linux-user/syscall.c

   1 /*
   2  *  Linux syscalls
   3  *
   4  *  Copyright (c) 2003 Fabrice Bellard
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #define _ATFILE_SOURCE
  20 #include "qemu/osdep.h"
  21 #include "qemu/cutils.h"
  22 #include "qemu/path.h"
  23 #include <elf.h>
  24 #include <endian.h>
  25 #include <grp.h>
  26 #include <sys/ipc.h>
  27 #include <sys/msg.h>
  28 #include <sys/wait.h>
  29 #include <sys/mount.h>
  30 #include <sys/file.h>
  31 #include <sys/fsuid.h>
  32 #include <sys/personality.h>
  33 #include <sys/prctl.h>
  34 #include <sys/resource.h>
  35 #include <sys/swap.h>
  36 #include <linux/capability.h>
  37 #include <sched.h>
  38 #include <sys/timex.h>
  39 #include <sys/socket.h>
  40 #include <sys/un.h>
  41 #include <sys/uio.h>
  42 #include <poll.h>
  43 #include <sys/times.h>
  44 #include <sys/shm.h>
  45 #include <sys/sem.h>
  46 #include <sys/statfs.h>
  47 #include <utime.h>
  48 #include <sys/sysinfo.h>
  49 #include <sys/signalfd.h>
  50 //#include <sys/user.h>
  51 #include <netinet/ip.h>
  52 #include <netinet/tcp.h>
  53 #include <linux/wireless.h>
  54 #include <linux/icmp.h>
  55 #include <linux/icmpv6.h>
  56 #include <linux/errqueue.h>
  57 #include <linux/random.h>
  58 #include "qemu-common.h"
  59 #ifdef CONFIG_TIMERFD
  60 #include <sys/timerfd.h>
  61 #endif
  62 #ifdef TARGET_GPROF
  63 #include <sys/gmon.h>
  64 #endif
  65 #ifdef CONFIG_EVENTFD
  66 #include <sys/eventfd.h>
  67 #endif
  68 #ifdef CONFIG_EPOLL
  69 #include <sys/epoll.h>
  70 #endif
  71 #ifdef CONFIG_ATTR
  72 #include "qemu/xattr.h"
  73 #endif
  74 #ifdef CONFIG_SENDFILE
  75 #include <sys/sendfile.h>
  76 #endif
  77
  78 #define termios host_termios
  79 #define winsize host_winsize
  80 #define termio host_termio
  81 #define sgttyb host_sgttyb /* same as target */
  82 #define tchars host_tchars /* same as target */
  83 #define ltchars host_ltchars /* same as target */
  84
  85 #include <linux/termios.h>
  86 #include <linux/unistd.h>
  87 #include <linux/cdrom.h>
  88 #include <linux/hdreg.h>
  89 #include <linux/soundcard.h>
  90 #include <linux/kd.h>
  91 #include <linux/mtio.h>
  92 #include <linux/fs.h>
  93 #if defined(CONFIG_FIEMAP)
  94 #include <linux/fiemap.h>
  95 #endif
  96 #include <linux/fb.h>
  97 #include <linux/vt.h>
  98 #include <linux/dm-ioctl.h>
  99 #include <linux/reboot.h>
 100 #include <linux/route.h>
 101 #include <linux/filter.h>
 102 #include <linux/blkpg.h>
 103 #include <netpacket/packet.h>
 104 #include <linux/netlink.h>
 105 #ifdef CONFIG_RTNETLINK
 106 #include <linux/rtnetlink.h>
 107 #include <linux/if_bridge.h>
 108 #endif
 109 #include <linux/audit.h>
 110 #include "linux_loop.h"
 111 #include "uname.h"
 112
 113 #include "qemu.h"
 114
 115 #ifndef CLONE_IO
 116 #define CLONE_IO                0x80000000      /* Clone io context */
 117 #endif
 118
 119 /* We can't directly call the host clone syscall, because this will
 120  * badly confuse libc (breaking mutexes, for example). So we must
 121  * divide clone flags into:
 122  *  * flag combinations that look like pthread_create()
 123  *  * flag combinations that look like fork()
 124  *  * flags we can implement within QEMU itself
 125  *  * flags we can't support and will return an error for
 126  */
 127 /* For thread creation, all these flags must be present; for
 128  * fork, none must be present.
 129  */
 130 #define CLONE_THREAD_FLAGS                              \
 131     (CLONE_VM | CLONE_FS | CLONE_FILES |                \
 132      CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM)
 133
 134 /* These flags are ignored:
 135  * CLONE_DETACHED is now ignored by the kernel;
 136  * CLONE_IO is just an optimisation hint to the I/O scheduler
 137  */
 138 #define CLONE_IGNORED_FLAGS                     \
 139     (CLONE_DETACHED | CLONE_IO)
 140
 141 /* Flags for fork which we can implement within QEMU itself */
 142 #define CLONE_OPTIONAL_FORK_FLAGS               \
 143     (CLONE_SETTLS | CLONE_PARENT_SETTID |       \
 144      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID)
 145
 146 /* Flags for thread creation which we can implement within QEMU itself */
 147 #define CLONE_OPTIONAL_THREAD_FLAGS                             \
 148     (CLONE_SETTLS | CLONE_PARENT_SETTID |                       \
 149      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID | CLONE_PARENT)
 150
 151 #define CLONE_INVALID_FORK_FLAGS                                        \
 152     (~(CSIGNAL | CLONE_OPTIONAL_FORK_FLAGS | CLONE_IGNORED_FLAGS))
 153
 154 #define CLONE_INVALID_THREAD_FLAGS                                      \
 155     (~(CSIGNAL | CLONE_THREAD_FLAGS | CLONE_OPTIONAL_THREAD_FLAGS |     \
 156        CLONE_IGNORED_FLAGS))
 157
 158 /* CLONE_VFORK is special cased early in do_fork(). The other flag bits
 159  * have almost all been allocated. We cannot support any of
 160  * CLONE_NEWNS, CLONE_NEWCGROUP, CLONE_NEWUTS, CLONE_NEWIPC,
 161  * CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET, CLONE_PTRACE, CLONE_UNTRACED.
 162  * The checks against the invalid thread masks above will catch these.
 163  * (The one remaining unallocated bit is 0x1000 which used to be CLONE_PID.)
 164  */
 165
 166 //#define DEBUG
 167 /* Define DEBUG_ERESTARTSYS to force every syscall to be restarted
 168  * once. This exercises the codepaths for restart.
 169  */
 170 //#define DEBUG_ERESTARTSYS
 171
 172 //#include <linux/msdos_fs.h>
 173 #define VFAT_IOCTL_READDIR_BOTH         _IOR('r', 1, struct linux_dirent [2])
 174 #define VFAT_IOCTL_READDIR_SHORT        _IOR('r', 2, struct linux_dirent [2])
 175
 176 #undef _syscall0
 177 #undef _syscall1
 178 #undef _syscall2
 179 #undef _syscall3
 180 #undef _syscall4
 181 #undef _syscall5
 182 #undef _syscall6
 183
 184 #define _syscall0(type,name)            \
 185 static type name (void)                 \
 186 {                                       \
 187         return syscall(__NR_##name);    \
 188 }
 189
 190 #define _syscall1(type,name,type1,arg1)         \
 191 static type name (type1 arg1)                   \
 192 {                                               \
 193         return syscall(__NR_##name, arg1);      \
 194 }
 195
 196 #define _syscall2(type,name,type1,arg1,type2,arg2)      \
 197 static type name (type1 arg1,type2 arg2)                \
 198 {                                                       \
 199         return syscall(__NR_##name, arg1, arg2);        \
 200 }
 201
 202 #define _syscall3(type,name,type1,arg1,type2,arg2,type3,arg3)   \
 203 static type name (type1 arg1,type2 arg2,type3 arg3)             \
 204 {                                                               \
 205         return syscall(__NR_##name, arg1, arg2, arg3);          \
 206 }
 207
 208 #define _syscall4(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4)        \
 209 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4)                  \
 210 {                                                                               \
 211         return syscall(__NR_##name, arg1, arg2, arg3, arg4);                    \
 212 }
 213
 214 #define _syscall5(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,        \
 215                   type5,arg5)                                                   \
 216 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5)       \
 217 {                                                                               \
 218         return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5);              \
 219 }
 220
 221
 222 #define _syscall6(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,        \
 223                   type5,arg5,type6,arg6)                                        \
 224 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5,       \
 225                   type6 arg6)                                                   \
 226 {                                                                               \
 227         return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6);        \
 228 }
 229
 230
 231 #define __NR_sys_uname __NR_uname
 232 #define __NR_sys_getcwd1 __NR_getcwd
 233 #define __NR_sys_getdents __NR_getdents
 234 #define __NR_sys_getdents64 __NR_getdents64
 235 #define __NR_sys_getpriority __NR_getpriority
 236 #define __NR_sys_rt_sigqueueinfo __NR_rt_sigqueueinfo
 237 #define __NR_sys_rt_tgsigqueueinfo __NR_rt_tgsigqueueinfo
 238 #define __NR_sys_syslog __NR_syslog
 239 #define __NR_sys_futex __NR_futex
 240 #define __NR_sys_inotify_init __NR_inotify_init
 241 #define __NR_sys_inotify_add_watch __NR_inotify_add_watch
 242 #define __NR_sys_inotify_rm_watch __NR_inotify_rm_watch
 243
 244 #if defined(__alpha__) || defined(__x86_64__) || defined(__s390x__)
 245 #define __NR__llseek __NR_lseek
 246 #endif
 247
 248 /* Newer kernel ports have llseek() instead of _llseek() */
 249 #if defined(TARGET_NR_llseek) && !defined(TARGET_NR__llseek)
 250 #define TARGET_NR__llseek TARGET_NR_llseek
 251 #endif
 252
 253 #ifdef __NR_gettid
 254 _syscall0(int, gettid)
 255 #else
 256 /* This is a replacement for the host gettid() and must return a host
 257    errno. */
 258 static int gettid(void) {
 259     return -ENOSYS;
 260 }
 261 #endif
 262 #if defined(TARGET_NR_getdents) && defined(__NR_getdents)
 263 _syscall3(int, sys_getdents, uint, fd, struct linux_dirent *, dirp, uint, count);
 264 #endif
 265 #if !defined(__NR_getdents) || \
 266     (defined(TARGET_NR_getdents64) && defined(__NR_getdents64))
 267 _syscall3(int, sys_getdents64, uint, fd, struct linux_dirent64 *, dirp, uint, count);
 268 #endif
 269 #if defined(TARGET_NR__llseek) && defined(__NR_llseek)
 270 _syscall5(int, _llseek,  uint,  fd, ulong, hi, ulong, lo,
 271           loff_t *, res, uint, wh);
 272 #endif
 273 _syscall3(int, sys_rt_sigqueueinfo, pid_t, pid, int, sig, siginfo_t *, uinfo)
 274 _syscall4(int, sys_rt_tgsigqueueinfo, pid_t, pid, pid_t, tid, int, sig,
 275           siginfo_t *, uinfo)
 276 _syscall3(int,sys_syslog,int,type,char*,bufp,int,len)
 277 #ifdef __NR_exit_group
 278 _syscall1(int,exit_group,int,error_code)
 279 #endif
 280 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
 281 _syscall1(int,set_tid_address,int *,tidptr)
 282 #endif
 283 #if defined(TARGET_NR_futex) && defined(__NR_futex)
 284 _syscall6(int,sys_futex,int *,uaddr,int,op,int,val,
 285           const struct timespec *,timeout,int *,uaddr2,int,val3)
 286 #endif
 287 #define __NR_sys_sched_getaffinity __NR_sched_getaffinity
 288 _syscall3(int, sys_sched_getaffinity, pid_t, pid, unsigned int, len,
 289           unsigned long *, user_mask_ptr);
 290 #define __NR_sys_sched_setaffinity __NR_sched_setaffinity
 291 _syscall3(int, sys_sched_setaffinity, pid_t, pid, unsigned int, len,
 292           unsigned long *, user_mask_ptr);
 293 #define __NR_sys_getcpu __NR_getcpu
 294 _syscall3(int, sys_getcpu, unsigned *, cpu, unsigned *, node, void *, tcache);
 295 _syscall4(int, reboot, int, magic1, int, magic2, unsigned int, cmd,
 296           void *, arg);
 297 _syscall2(int, capget, struct __user_cap_header_struct *, header,
 298           struct __user_cap_data_struct *, data);
 299 _syscall2(int, capset, struct __user_cap_header_struct *, header,
 300           struct __user_cap_data_struct *, data);
 301 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
 302 _syscall2(int, ioprio_get, int, which, int, who)
 303 #endif
 304 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
 305 _syscall3(int, ioprio_set, int, which, int, who, int, ioprio)
 306 #endif
 307 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
 308 _syscall3(int, getrandom, void *, buf, size_t, buflen, unsigned int, flags)
 309 #endif
 310
 311 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
 312 _syscall5(int, kcmp, pid_t, pid1, pid_t, pid2, int, type,
 313           unsigned long, idx1, unsigned long, idx2)
 314 #endif
 315
 316 static bitmask_transtbl fcntl_flags_tbl[] = {
 317   { TARGET_O_ACCMODE,   TARGET_O_WRONLY,    O_ACCMODE,   O_WRONLY,    },
 318   { TARGET_O_ACCMODE,   TARGET_O_RDWR,      O_ACCMODE,   O_RDWR,      },
 319   { TARGET_O_CREAT,     TARGET_O_CREAT,     O_CREAT,     O_CREAT,     },
 320   { TARGET_O_EXCL,      TARGET_O_EXCL,      O_EXCL,      O_EXCL,      },
 321   { TARGET_O_NOCTTY,    TARGET_O_NOCTTY,    O_NOCTTY,    O_NOCTTY,    },
 322   { TARGET_O_TRUNC,     TARGET_O_TRUNC,     O_TRUNC,     O_TRUNC,     },
 323   { TARGET_O_APPEND,    TARGET_O_APPEND,    O_APPEND,    O_APPEND,    },
 324   { TARGET_O_NONBLOCK,  TARGET_O_NONBLOCK,  O_NONBLOCK,  O_NONBLOCK,  },
 325   { TARGET_O_SYNC,      TARGET_O_DSYNC,     O_SYNC,      O_DSYNC,     },
 326   { TARGET_O_SYNC,      TARGET_O_SYNC,      O_SYNC,      O_SYNC,      },
 327   { TARGET_FASYNC,      TARGET_FASYNC,      FASYNC,      FASYNC,      },
 328   { TARGET_O_DIRECTORY, TARGET_O_DIRECTORY, O_DIRECTORY, O_DIRECTORY, },
 329   { TARGET_O_NOFOLLOW,  TARGET_O_NOFOLLOW,  O_NOFOLLOW,  O_NOFOLLOW,  },
 330 #if defined(O_DIRECT)
 331   { TARGET_O_DIRECT,    TARGET_O_DIRECT,    O_DIRECT,    O_DIRECT,    },
 332 #endif
 333 #if defined(O_NOATIME)
 334   { TARGET_O_NOATIME,   TARGET_O_NOATIME,   O_NOATIME,   O_NOATIME    },
 335 #endif
 336 #if defined(O_CLOEXEC)
 337   { TARGET_O_CLOEXEC,   TARGET_O_CLOEXEC,   O_CLOEXEC,   O_CLOEXEC    },
 338 #endif
 339 #if defined(O_PATH)
 340   { TARGET_O_PATH,      TARGET_O_PATH,      O_PATH,      O_PATH       },
 341 #endif
 342 #if defined(O_TMPFILE)
 343   { TARGET_O_TMPFILE,   TARGET_O_TMPFILE,   O_TMPFILE,   O_TMPFILE    },
 344 #endif
 345   /* Don't terminate the list prematurely on 64-bit host+guest.  */
 346 #if TARGET_O_LARGEFILE != 0 || O_LARGEFILE != 0
 347   { TARGET_O_LARGEFILE, TARGET_O_LARGEFILE, O_LARGEFILE, O_LARGEFILE, },
 348 #endif
 349   { 0, 0, 0, 0 }
 350 };
 351
 352 enum {
 353     QEMU_IFLA_BR_UNSPEC,
 354     QEMU_IFLA_BR_FORWARD_DELAY,
 355     QEMU_IFLA_BR_HELLO_TIME,
 356     QEMU_IFLA_BR_MAX_AGE,
 357     QEMU_IFLA_BR_AGEING_TIME,
 358     QEMU_IFLA_BR_STP_STATE,
 359     QEMU_IFLA_BR_PRIORITY,
 360     QEMU_IFLA_BR_VLAN_FILTERING,
 361     QEMU_IFLA_BR_VLAN_PROTOCOL,
 362     QEMU_IFLA_BR_GROUP_FWD_MASK,
 363     QEMU_IFLA_BR_ROOT_ID,
 364     QEMU_IFLA_BR_BRIDGE_ID,
 365     QEMU_IFLA_BR_ROOT_PORT,
 366     QEMU_IFLA_BR_ROOT_PATH_COST,
 367     QEMU_IFLA_BR_TOPOLOGY_CHANGE,
 368     QEMU_IFLA_BR_TOPOLOGY_CHANGE_DETECTED,
 369     QEMU_IFLA_BR_HELLO_TIMER,
 370     QEMU_IFLA_BR_TCN_TIMER,
 371     QEMU_IFLA_BR_TOPOLOGY_CHANGE_TIMER,
 372     QEMU_IFLA_BR_GC_TIMER,
 373     QEMU_IFLA_BR_GROUP_ADDR,
 374     QEMU_IFLA_BR_FDB_FLUSH,
 375     QEMU_IFLA_BR_MCAST_ROUTER,
 376     QEMU_IFLA_BR_MCAST_SNOOPING,
 377     QEMU_IFLA_BR_MCAST_QUERY_USE_IFADDR,
 378     QEMU_IFLA_BR_MCAST_QUERIER,
 379     QEMU_IFLA_BR_MCAST_HASH_ELASTICITY,
 380     QEMU_IFLA_BR_MCAST_HASH_MAX,
 381     QEMU_IFLA_BR_MCAST_LAST_MEMBER_CNT,
 382     QEMU_IFLA_BR_MCAST_STARTUP_QUERY_CNT,
 383     QEMU_IFLA_BR_MCAST_LAST_MEMBER_INTVL,
 384     QEMU_IFLA_BR_MCAST_MEMBERSHIP_INTVL,
 385     QEMU_IFLA_BR_MCAST_QUERIER_INTVL,
 386     QEMU_IFLA_BR_MCAST_QUERY_INTVL,
 387     QEMU_IFLA_BR_MCAST_QUERY_RESPONSE_INTVL,
 388     QEMU_IFLA_BR_MCAST_STARTUP_QUERY_INTVL,
 389     QEMU_IFLA_BR_NF_CALL_IPTABLES,
 390     QEMU_IFLA_BR_NF_CALL_IP6TABLES,
 391     QEMU_IFLA_BR_NF_CALL_ARPTABLES,
 392     QEMU_IFLA_BR_VLAN_DEFAULT_PVID,
 393     QEMU_IFLA_BR_PAD,
 394     QEMU_IFLA_BR_VLAN_STATS_ENABLED,
 395     QEMU_IFLA_BR_MCAST_STATS_ENABLED,
 396     QEMU___IFLA_BR_MAX,
 397 };
 398
 399 enum {
 400     QEMU_IFLA_UNSPEC,
 401     QEMU_IFLA_ADDRESS,
 402     QEMU_IFLA_BROADCAST,
 403     QEMU_IFLA_IFNAME,
 404     QEMU_IFLA_MTU,
 405     QEMU_IFLA_LINK,
 406     QEMU_IFLA_QDISC,
 407     QEMU_IFLA_STATS,
 408     QEMU_IFLA_COST,
 409     QEMU_IFLA_PRIORITY,
 410     QEMU_IFLA_MASTER,
 411     QEMU_IFLA_WIRELESS,
 412     QEMU_IFLA_PROTINFO,
 413     QEMU_IFLA_TXQLEN,
 414     QEMU_IFLA_MAP,
 415     QEMU_IFLA_WEIGHT,
 416     QEMU_IFLA_OPERSTATE,
 417     QEMU_IFLA_LINKMODE,
 418     QEMU_IFLA_LINKINFO,
 419     QEMU_IFLA_NET_NS_PID,
 420     QEMU_IFLA_IFALIAS,
 421     QEMU_IFLA_NUM_VF,
 422     QEMU_IFLA_VFINFO_LIST,
 423     QEMU_IFLA_STATS64,
 424     QEMU_IFLA_VF_PORTS,
 425     QEMU_IFLA_PORT_SELF,
 426     QEMU_IFLA_AF_SPEC,
 427     QEMU_IFLA_GROUP,
 428     QEMU_IFLA_NET_NS_FD,
 429     QEMU_IFLA_EXT_MASK,
 430     QEMU_IFLA_PROMISCUITY,
 431     QEMU_IFLA_NUM_TX_QUEUES,
 432     QEMU_IFLA_NUM_RX_QUEUES,
 433     QEMU_IFLA_CARRIER,
 434     QEMU_IFLA_PHYS_PORT_ID,
 435     QEMU_IFLA_CARRIER_CHANGES,
 436     QEMU_IFLA_PHYS_SWITCH_ID,
 437     QEMU_IFLA_LINK_NETNSID,
 438     QEMU_IFLA_PHYS_PORT_NAME,
 439     QEMU_IFLA_PROTO_DOWN,
 440     QEMU_IFLA_GSO_MAX_SEGS,
 441     QEMU_IFLA_GSO_MAX_SIZE,
 442     QEMU_IFLA_PAD,
 443     QEMU_IFLA_XDP,
 444     QEMU___IFLA_MAX
 445 };
 446
 447 enum {
 448     QEMU_IFLA_BRPORT_UNSPEC,
 449     QEMU_IFLA_BRPORT_STATE,
 450     QEMU_IFLA_BRPORT_PRIORITY,
 451     QEMU_IFLA_BRPORT_COST,
 452     QEMU_IFLA_BRPORT_MODE,
 453     QEMU_IFLA_BRPORT_GUARD,
 454     QEMU_IFLA_BRPORT_PROTECT,
 455     QEMU_IFLA_BRPORT_FAST_LEAVE,
 456     QEMU_IFLA_BRPORT_LEARNING,
 457     QEMU_IFLA_BRPORT_UNICAST_FLOOD,
 458     QEMU_IFLA_BRPORT_PROXYARP,
 459     QEMU_IFLA_BRPORT_LEARNING_SYNC,
 460     QEMU_IFLA_BRPORT_PROXYARP_WIFI,
 461     QEMU_IFLA_BRPORT_ROOT_ID,
 462     QEMU_IFLA_BRPORT_BRIDGE_ID,
 463     QEMU_IFLA_BRPORT_DESIGNATED_PORT,
 464     QEMU_IFLA_BRPORT_DESIGNATED_COST,
 465     QEMU_IFLA_BRPORT_ID,
 466     QEMU_IFLA_BRPORT_NO,
 467     QEMU_IFLA_BRPORT_TOPOLOGY_CHANGE_ACK,
 468     QEMU_IFLA_BRPORT_CONFIG_PENDING,
 469     QEMU_IFLA_BRPORT_MESSAGE_AGE_TIMER,
 470     QEMU_IFLA_BRPORT_FORWARD_DELAY_TIMER,
 471     QEMU_IFLA_BRPORT_HOLD_TIMER,
 472     QEMU_IFLA_BRPORT_FLUSH,
 473     QEMU_IFLA_BRPORT_MULTICAST_ROUTER,
 474     QEMU_IFLA_BRPORT_PAD,
 475     QEMU___IFLA_BRPORT_MAX
 476 };
 477
 478 enum {
 479     QEMU_IFLA_INFO_UNSPEC,
 480     QEMU_IFLA_INFO_KIND,
 481     QEMU_IFLA_INFO_DATA,
 482     QEMU_IFLA_INFO_XSTATS,
 483     QEMU_IFLA_INFO_SLAVE_KIND,
 484     QEMU_IFLA_INFO_SLAVE_DATA,
 485     QEMU___IFLA_INFO_MAX,
 486 };
 487
 488 enum {
 489     QEMU_IFLA_INET_UNSPEC,
 490     QEMU_IFLA_INET_CONF,
 491     QEMU___IFLA_INET_MAX,
 492 };
 493
 494 enum {
 495     QEMU_IFLA_INET6_UNSPEC,
 496     QEMU_IFLA_INET6_FLAGS,
 497     QEMU_IFLA_INET6_CONF,
 498     QEMU_IFLA_INET6_STATS,
 499     QEMU_IFLA_INET6_MCAST,
 500     QEMU_IFLA_INET6_CACHEINFO,
 501     QEMU_IFLA_INET6_ICMP6STATS,
 502     QEMU_IFLA_INET6_TOKEN,
 503     QEMU_IFLA_INET6_ADDR_GEN_MODE,
 504     QEMU___IFLA_INET6_MAX
 505 };
 506
 507 typedef abi_long (*TargetFdDataFunc)(void *, size_t);
 508 typedef abi_long (*TargetFdAddrFunc)(void *, abi_ulong, socklen_t);
 509 typedef struct TargetFdTrans {
 510     TargetFdDataFunc host_to_target_data;
 511     TargetFdDataFunc target_to_host_data;
 512     TargetFdAddrFunc target_to_host_addr;
 513 } TargetFdTrans;
 514
 515 static TargetFdTrans **target_fd_trans;
 516
 517 static unsigned int target_fd_max;
 518
 519 static TargetFdDataFunc fd_trans_target_to_host_data(int fd)
 520 {
 521     if (fd >= 0 && fd < target_fd_max && target_fd_trans[fd]) {
 522         return target_fd_trans[fd]->target_to_host_data;
 523     }
 524     return NULL;
 525 }
 526
 527 static TargetFdDataFunc fd_trans_host_to_target_data(int fd)
 528 {
 529     if (fd >= 0 && fd < target_fd_max && target_fd_trans[fd]) {
 530         return target_fd_trans[fd]->host_to_target_data;
 531     }
 532     return NULL;
 533 }
 534
 535 static TargetFdAddrFunc fd_trans_target_to_host_addr(int fd)
 536 {
 537     if (fd >= 0 && fd < target_fd_max && target_fd_trans[fd]) {
 538         return target_fd_trans[fd]->target_to_host_addr;
 539     }
 540     return NULL;
 541 }
 542
 543 static void fd_trans_register(int fd, TargetFdTrans *trans)
 544 {
 545     unsigned int oldmax;
 546
 547     if (fd >= target_fd_max) {
 548         oldmax = target_fd_max;
 549         target_fd_max = ((fd >> 6) + 1) << 6; /* by slice of 64 entries */
 550         target_fd_trans = g_renew(TargetFdTrans *,
 551                                   target_fd_trans, target_fd_max);
 552         memset((void *)(target_fd_trans + oldmax), 0,
 553                (target_fd_max - oldmax) * sizeof(TargetFdTrans *));
 554     }
 555     target_fd_trans[fd] = trans;
 556 }
 557
 558 static void fd_trans_unregister(int fd)
 559 {
 560     if (fd >= 0 && fd < target_fd_max) {
 561         target_fd_trans[fd] = NULL;
 562     }
 563 }
 564
 565 static void fd_trans_dup(int oldfd, int newfd)
 566 {
 567     fd_trans_unregister(newfd);
 568     if (oldfd < target_fd_max && target_fd_trans[oldfd]) {
 569         fd_trans_register(newfd, target_fd_trans[oldfd]);
 570     }
 571 }
 572
 573 static int sys_getcwd1(char *buf, size_t size)
 574 {
 575   if (getcwd(buf, size) == NULL) {
 576       /* getcwd() sets errno */
 577       return (-1);
 578   }
 579   return strlen(buf)+1;
 580 }
 581
 582 #ifdef TARGET_NR_utimensat
 583 #if defined(__NR_utimensat)
 584 #define __NR_sys_utimensat __NR_utimensat
 585 _syscall4(int,sys_utimensat,int,dirfd,const char *,pathname,
 586           const struct timespec *,tsp,int,flags)
 587 #else
 588 static int sys_utimensat(int dirfd, const char *pathname,
 589                          const struct timespec times[2], int flags)
 590 {
 591     errno = ENOSYS;
 592     return -1;
 593 }
 594 #endif
 595 #endif /* TARGET_NR_utimensat */
 596
 597 #ifdef TARGET_NR_renameat2
 598 #if defined(__NR_renameat2)
 599 #define __NR_sys_renameat2 __NR_renameat2
 600 _syscall5(int, sys_renameat2, int, oldfd, const char *, old, int, newfd,
 601           const char *, new, unsigned int, flags)
 602 #else
 603 static int sys_renameat2(int oldfd, const char *old,
 604                          int newfd, const char *new, int flags)
 605 {
 606     if (flags == 0) {
 607         return renameat(oldfd, old, newfd, new);
 608     }
 609     errno = ENOSYS;
 610     return -1;
 611 }
 612 #endif
 613 #endif /* TARGET_NR_renameat2 */
 614
 615 #ifdef CONFIG_INOTIFY
 616 #include <sys/inotify.h>
 617
 618 #if defined(TARGET_NR_inotify_init) && defined(__NR_inotify_init)
 619 static int sys_inotify_init(void)
 620 {
 621   return (inotify_init());
 622 }
 623 #endif
 624 #if defined(TARGET_NR_inotify_add_watch) && defined(__NR_inotify_add_watch)
 625 static int sys_inotify_add_watch(int fd,const char *pathname, int32_t mask)
 626 {
 627   return (inotify_add_watch(fd, pathname, mask));
 628 }
 629 #endif
 630 #if defined(TARGET_NR_inotify_rm_watch) && defined(__NR_inotify_rm_watch)
 631 static int sys_inotify_rm_watch(int fd, int32_t wd)
 632 {
 633   return (inotify_rm_watch(fd, wd));
 634 }
 635 #endif
 636 #ifdef CONFIG_INOTIFY1
 637 #if defined(TARGET_NR_inotify_init1) && defined(__NR_inotify_init1)
 638 static int sys_inotify_init1(int flags)
 639 {
 640   return (inotify_init1(flags));
 641 }
 642 #endif
 643 #endif
 644 #else
 645 /* Userspace can usually survive runtime without inotify */
 646 #undef TARGET_NR_inotify_init
 647 #undef TARGET_NR_inotify_init1
 648 #undef TARGET_NR_inotify_add_watch
 649 #undef TARGET_NR_inotify_rm_watch
 650 #endif /* CONFIG_INOTIFY  */
 651
 652 #if defined(TARGET_NR_prlimit64)
 653 #ifndef __NR_prlimit64
 654 # define __NR_prlimit64 -1
 655 #endif
 656 #define __NR_sys_prlimit64 __NR_prlimit64
 657 /* The glibc rlimit structure may not be that used by the underlying syscall */
 658 struct host_rlimit64 {
 659     uint64_t rlim_cur;
 660     uint64_t rlim_max;
 661 };
 662 _syscall4(int, sys_prlimit64, pid_t, pid, int, resource,
 663           const struct host_rlimit64 *, new_limit,
 664           struct host_rlimit64 *, old_limit)
 665 #endif
 666
 667
 668 #if defined(TARGET_NR_timer_create)
 669 /* Maxiumum of 32 active POSIX timers allowed at any one time. */
 670 static timer_t g_posix_timers[32] = { 0, } ;
 671
 672 static inline int next_free_host_timer(void)
 673 {
 674     int k ;
 675     /* FIXME: Does finding the next free slot require a lock? */
 676     for (k = 0; k < ARRAY_SIZE(g_posix_timers); k++) {
 677         if (g_posix_timers[k] == 0) {
 678             g_posix_timers[k] = (timer_t) 1;
 679             return k;
 680         }
 681     }
 682     return -1;
 683 }
 684 #endif
 685
 686 /* ARM EABI and MIPS expect 64bit types aligned even on pairs or registers */
 687 #ifdef TARGET_ARM
 688 static inline int regpairs_aligned(void *cpu_env, int num)
 689 {
 690     return ((((CPUARMState *)cpu_env)->eabi) == 1) ;
 691 }
 692 #elif defined(TARGET_MIPS) && (TARGET_ABI_BITS == 32)
 693 static inline int regpairs_aligned(void *cpu_env, int num) { return 1; }
 694 #elif defined(TARGET_PPC) && !defined(TARGET_PPC64)
 695 /* SysV AVI for PPC32 expects 64bit parameters to be passed on odd/even pairs
 696  * of registers which translates to the same as ARM/MIPS, because we start with
 697  * r3 as arg1 */
 698 static inline int regpairs_aligned(void *cpu_env, int num) { return 1; }
 699 #elif defined(TARGET_SH4)
 700 /* SH4 doesn't align register pairs, except for p{read,write}64 */
 701 static inline int regpairs_aligned(void *cpu_env, int num)
 702 {
 703     switch (num) {
 704     case TARGET_NR_pread64:
 705     case TARGET_NR_pwrite64:
 706         return 1;
 707
 708     default:
 709         return 0;
 710     }
 711 }
 712 #else
 713 static inline int regpairs_aligned(void *cpu_env, int num) { return 0; }
 714 #endif
 715
 716 #define ERRNO_TABLE_SIZE 1200
 717
 718 /* target_to_host_errno_table[] is initialized from
 719  * host_to_target_errno_table[] in syscall_init(). */
 720 static uint16_t target_to_host_errno_table[ERRNO_TABLE_SIZE] = {
 721 };
 722
 723 /*
 724  * This list is the union of errno values overridden in asm-<arch>/errno.h
 725  * minus the errnos that are not actually generic to all archs.
 726  */
 727 static uint16_t host_to_target_errno_table[ERRNO_TABLE_SIZE] = {
 728     [EAGAIN]            = TARGET_EAGAIN,
 729     [EIDRM]             = TARGET_EIDRM,
 730     [ECHRNG]            = TARGET_ECHRNG,
 731     [EL2NSYNC]          = TARGET_EL2NSYNC,
 732     [EL3HLT]            = TARGET_EL3HLT,
 733     [EL3RST]            = TARGET_EL3RST,
 734     [ELNRNG]            = TARGET_ELNRNG,
 735     [EUNATCH]           = TARGET_EUNATCH,
 736     [ENOCSI]            = TARGET_ENOCSI,
 737     [EL2HLT]            = TARGET_EL2HLT,
 738     [EDEADLK]           = TARGET_EDEADLK,
 739     [ENOLCK]            = TARGET_ENOLCK,
 740     [EBADE]             = TARGET_EBADE,
 741     [EBADR]             = TARGET_EBADR,
 742     [EXFULL]            = TARGET_EXFULL,
 743     [ENOANO]            = TARGET_ENOANO,
 744     [EBADRQC]           = TARGET_EBADRQC,
 745     [EBADSLT]           = TARGET_EBADSLT,
 746     [EBFONT]            = TARGET_EBFONT,
 747     [ENOSTR]            = TARGET_ENOSTR,
 748     [ENODATA]           = TARGET_ENODATA,
 749     [ETIME]             = TARGET_ETIME,
 750     [ENOSR]             = TARGET_ENOSR,
 751     [ENONET]            = TARGET_ENONET,
 752     [ENOPKG]            = TARGET_ENOPKG,
 753     [EREMOTE]           = TARGET_EREMOTE,
 754     [ENOLINK]           = TARGET_ENOLINK,
 755     [EADV]              = TARGET_EADV,
 756     [ESRMNT]            = TARGET_ESRMNT,
 757     [ECOMM]             = TARGET_ECOMM,
 758     [EPROTO]            = TARGET_EPROTO,
 759     [EDOTDOT]           = TARGET_EDOTDOT,
 760     [EMULTIHOP]         = TARGET_EMULTIHOP,
 761     [EBADMSG]           = TARGET_EBADMSG,
 762     [ENAMETOOLONG]      = TARGET_ENAMETOOLONG,
 763     [EOVERFLOW]         = TARGET_EOVERFLOW,
 764     [ENOTUNIQ]          = TARGET_ENOTUNIQ,
 765     [EBADFD]            = TARGET_EBADFD,
 766     [EREMCHG]           = TARGET_EREMCHG,
 767     [ELIBACC]           = TARGET_ELIBACC,
 768     [ELIBBAD]           = TARGET_ELIBBAD,
 769     [ELIBSCN]           = TARGET_ELIBSCN,
 770     [ELIBMAX]           = TARGET_ELIBMAX,
 771     [ELIBEXEC]          = TARGET_ELIBEXEC,
 772     [EILSEQ]            = TARGET_EILSEQ,
 773     [ENOSYS]            = TARGET_ENOSYS,
 774     [ELOOP]             = TARGET_ELOOP,
 775     [ERESTART]          = TARGET_ERESTART,
 776     [ESTRPIPE]          = TARGET_ESTRPIPE,
 777     [ENOTEMPTY]         = TARGET_ENOTEMPTY,
 778     [EUSERS]            = TARGET_EUSERS,
 779     [ENOTSOCK]          = TARGET_ENOTSOCK,
 780     [EDESTADDRREQ]      = TARGET_EDESTADDRREQ,
 781     [EMSGSIZE]          = TARGET_EMSGSIZE,
 782     [EPROTOTYPE]        = TARGET_EPROTOTYPE,
 783     [ENOPROTOOPT]       = TARGET_ENOPROTOOPT,
 784     [EPROTONOSUPPORT]   = TARGET_EPROTONOSUPPORT,
 785     [ESOCKTNOSUPPORT]   = TARGET_ESOCKTNOSUPPORT,
 786     [EOPNOTSUPP]        = TARGET_EOPNOTSUPP,
 787     [EPFNOSUPPORT]      = TARGET_EPFNOSUPPORT,
 788     [EAFNOSUPPORT]      = TARGET_EAFNOSUPPORT,
 789     [EADDRINUSE]        = TARGET_EADDRINUSE,
 790     [EADDRNOTAVAIL]     = TARGET_EADDRNOTAVAIL,
 791     [ENETDOWN]          = TARGET_ENETDOWN,
 792     [ENETUNREACH]       = TARGET_ENETUNREACH,
 793     [ENETRESET]         = TARGET_ENETRESET,
 794     [ECONNABORTED]      = TARGET_ECONNABORTED,
 795     [ECONNRESET]        = TARGET_ECONNRESET,
 796     [ENOBUFS]           = TARGET_ENOBUFS,
 797     [EISCONN]           = TARGET_EISCONN,
 798     [ENOTCONN]          = TARGET_ENOTCONN,
 799     [EUCLEAN]           = TARGET_EUCLEAN,
 800     [ENOTNAM]           = TARGET_ENOTNAM,
 801     [ENAVAIL]           = TARGET_ENAVAIL,
 802     [EISNAM]            = TARGET_EISNAM,
 803     [EREMOTEIO]         = TARGET_EREMOTEIO,
 804     [EDQUOT]            = TARGET_EDQUOT,
 805     [ESHUTDOWN]         = TARGET_ESHUTDOWN,
 806     [ETOOMANYREFS]      = TARGET_ETOOMANYREFS,
 807     [ETIMEDOUT]         = TARGET_ETIMEDOUT,
 808     [ECONNREFUSED]      = TARGET_ECONNREFUSED,
 809     [EHOSTDOWN]         = TARGET_EHOSTDOWN,
 810     [EHOSTUNREACH]      = TARGET_EHOSTUNREACH,
 811     [EALREADY]          = TARGET_EALREADY,
 812     [EINPROGRESS]       = TARGET_EINPROGRESS,
 813     [ESTALE]            = TARGET_ESTALE,
 814     [ECANCELED]         = TARGET_ECANCELED,
 815     [ENOMEDIUM]         = TARGET_ENOMEDIUM,
 816     [EMEDIUMTYPE]       = TARGET_EMEDIUMTYPE,
 817 #ifdef ENOKEY
 818     [ENOKEY]            = TARGET_ENOKEY,
 819 #endif
 820 #ifdef EKEYEXPIRED
 821     [EKEYEXPIRED]       = TARGET_EKEYEXPIRED,
 822 #endif
 823 #ifdef EKEYREVOKED
 824     [EKEYREVOKED]       = TARGET_EKEYREVOKED,
 825 #endif
 826 #ifdef EKEYREJECTED
 827     [EKEYREJECTED]      = TARGET_EKEYREJECTED,
 828 #endif
 829 #ifdef EOWNERDEAD
 830     [EOWNERDEAD]        = TARGET_EOWNERDEAD,
 831 #endif
 832 #ifdef ENOTRECOVERABLE
 833     [ENOTRECOVERABLE]   = TARGET_ENOTRECOVERABLE,
 834 #endif
 835 #ifdef ENOMSG
 836     [ENOMSG]            = TARGET_ENOMSG,
 837 #endif
 838 #ifdef ERKFILL
 839     [ERFKILL]           = TARGET_ERFKILL,
 840 #endif
 841 #ifdef EHWPOISON
 842     [EHWPOISON]         = TARGET_EHWPOISON,
 843 #endif
 844 };
 845
 846 static inline int host_to_target_errno(int err)
 847 {
 848     if (err >= 0 && err < ERRNO_TABLE_SIZE &&
 849         host_to_target_errno_table[err]) {
 850         return host_to_target_errno_table[err];
 851     }
 852     return err;
 853 }
 854
 855 static inline int target_to_host_errno(int err)
 856 {
 857     if (err >= 0 && err < ERRNO_TABLE_SIZE &&
 858         target_to_host_errno_table[err]) {
 859         return target_to_host_errno_table[err];
 860     }
 861     return err;
 862 }
 863
 864 static inline abi_long get_errno(abi_long ret)
 865 {
 866     if (ret == -1)
 867         return -host_to_target_errno(errno);
 868     else
 869         return ret;
 870 }
 871
 872 static inline int is_error(abi_long ret)
 873 {
 874     return (abi_ulong)ret >= (abi_ulong)(-4096);
 875 }
 876
 877 const char *target_strerror(int err)
 878 {
 879     if (err == TARGET_ERESTARTSYS) {
 880         return "To be restarted";
 881     }
 882     if (err == TARGET_QEMU_ESIGRETURN) {
 883         return "Successful exit from sigreturn";
 884     }
 885
 886     if ((err >= ERRNO_TABLE_SIZE) || (err < 0)) {
 887         return NULL;
 888     }
 889     return strerror(target_to_host_errno(err));
 890 }
 891
 892 #define safe_syscall0(type, name) \
 893 static type safe_##name(void) \
 894 { \
 895     return safe_syscall(__NR_##name); \
 896 }
 897
 898 #define safe_syscall1(type, name, type1, arg1) \
 899 static type safe_##name(type1 arg1) \
 900 { \
 901     return safe_syscall(__NR_##name, arg1); \
 902 }
 903
 904 #define safe_syscall2(type, name, type1, arg1, type2, arg2) \
 905 static type safe_##name(type1 arg1, type2 arg2) \
 906 { \
 907     return safe_syscall(__NR_##name, arg1, arg2); \
 908 }
 909
 910 #define safe_syscall3(type, name, type1, arg1, type2, arg2, type3, arg3) \
 911 static type safe_##name(type1 arg1, type2 arg2, type3 arg3) \
 912 { \
 913     return safe_syscall(__NR_##name, arg1, arg2, arg3); \
 914 }
 915
 916 #define safe_syscall4(type, name, type1, arg1, type2, arg2, type3, arg3, \
 917     type4, arg4) \
 918 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4) \
 919 { \
 920     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4); \
 921 }
 922
 923 #define safe_syscall5(type, name, type1, arg1, type2, arg2, type3, arg3, \
 924     type4, arg4, type5, arg5) \
 925 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
 926     type5 arg5) \
 927 { \
 928     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5); \
 929 }
 930
 931 #define safe_syscall6(type, name, type1, arg1, type2, arg2, type3, arg3, \
 932     type4, arg4, type5, arg5, type6, arg6) \
 933 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
 934     type5 arg5, type6 arg6) \
 935 { \
 936     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6); \
 937 }
 938
 939 safe_syscall3(ssize_t, read, int, fd, void *, buff, size_t, count)
 940 safe_syscall3(ssize_t, write, int, fd, const void *, buff, size_t, count)
 941 safe_syscall4(int, openat, int, dirfd, const char *, pathname, \
 942               int, flags, mode_t, mode)
 943 safe_syscall4(pid_t, wait4, pid_t, pid, int *, status, int, options, \
 944               struct rusage *, rusage)
 945 safe_syscall5(int, waitid, idtype_t, idtype, id_t, id, siginfo_t *, infop, \
 946               int, options, struct rusage *, rusage)
 947 safe_syscall3(int, execve, const char *, filename, char **, argv, char **, envp)
 948 safe_syscall6(int, pselect6, int, nfds, fd_set *, readfds, fd_set *, writefds, \
 949               fd_set *, exceptfds, struct timespec *, timeout, void *, sig)
 950 safe_syscall5(int, ppoll, struct pollfd *, ufds, unsigned int, nfds,
 951               struct timespec *, tsp, const sigset_t *, sigmask,
 952               size_t, sigsetsize)
 953 safe_syscall6(int, epoll_pwait, int, epfd, struct epoll_event *, events,
 954               int, maxevents, int, timeout, const sigset_t *, sigmask,
 955               size_t, sigsetsize)
 956 safe_syscall6(int,futex,int *,uaddr,int,op,int,val, \
 957               const struct timespec *,timeout,int *,uaddr2,int,val3)
 958 safe_syscall2(int, rt_sigsuspend, sigset_t *, newset, size_t, sigsetsize)
 959 safe_syscall2(int, kill, pid_t, pid, int, sig)
 960 safe_syscall2(int, tkill, int, tid, int, sig)
 961 safe_syscall3(int, tgkill, int, tgid, int, pid, int, sig)
 962 safe_syscall3(ssize_t, readv, int, fd, const struct iovec *, iov, int, iovcnt)
 963 safe_syscall3(ssize_t, writev, int, fd, const struct iovec *, iov, int, iovcnt)
 964 safe_syscall5(ssize_t, preadv, int, fd, const struct iovec *, iov, int, iovcnt,
 965               unsigned long, pos_l, unsigned long, pos_h)
 966 safe_syscall5(ssize_t, pwritev, int, fd, const struct iovec *, iov, int, iovcnt,
 967               unsigned long, pos_l, unsigned long, pos_h)
 968 safe_syscall3(int, connect, int, fd, const struct sockaddr *, addr,
 969               socklen_t, addrlen)
 970 safe_syscall6(ssize_t, sendto, int, fd, const void *, buf, size_t, len,
 971               int, flags, const struct sockaddr *, addr, socklen_t, addrlen)
 972 safe_syscall6(ssize_t, recvfrom, int, fd, void *, buf, size_t, len,
 973               int, flags, struct sockaddr *, addr, socklen_t *, addrlen)
 974 safe_syscall3(ssize_t, sendmsg, int, fd, const struct msghdr *, msg, int, flags)
 975 safe_syscall3(ssize_t, recvmsg, int, fd, struct msghdr *, msg, int, flags)
 976 safe_syscall2(int, flock, int, fd, int, operation)
 977 safe_syscall4(int, rt_sigtimedwait, const sigset_t *, these, siginfo_t *, uinfo,
 978               const struct timespec *, uts, size_t, sigsetsize)
 979 safe_syscall4(int, accept4, int, fd, struct sockaddr *, addr, socklen_t *, len,
 980               int, flags)
 981 safe_syscall2(int, nanosleep, const struct timespec *, req,
 982               struct timespec *, rem)
 983 #ifdef TARGET_NR_clock_nanosleep
 984 safe_syscall4(int, clock_nanosleep, const clockid_t, clock, int, flags,
 985               const struct timespec *, req, struct timespec *, rem)
 986 #endif
 987 #ifdef __NR_msgsnd
 988 safe_syscall4(int, msgsnd, int, msgid, const void *, msgp, size_t, sz,
 989               int, flags)
 990 safe_syscall5(int, msgrcv, int, msgid, void *, msgp, size_t, sz,
 991               long, msgtype, int, flags)
 992 safe_syscall4(int, semtimedop, int, semid, struct sembuf *, tsops,
 993               unsigned, nsops, const struct timespec *, timeout)
 994 #else
 995 /* This host kernel architecture uses a single ipc syscall; fake up
 996  * wrappers for the sub-operations to hide this implementation detail.
 997  * Annoyingly we can't include linux/ipc.h to get the constant definitions
 998  * for the call parameter because some structs in there conflict with the
 999  * sys/ipc.h ones. So we just define them here, and rely on them being
1000  * the same for all host architectures.
1001  */
1002 #define Q_SEMTIMEDOP 4
1003 #define Q_MSGSND 11
1004 #define Q_MSGRCV 12
1005 #define Q_IPCCALL(VERSION, OP) ((VERSION) << 16 | (OP))
1006
1007 safe_syscall6(int, ipc, int, call, long, first, long, second, long, third,
1008               void *, ptr, long, fifth)
1009 static int safe_msgsnd(int msgid, const void *msgp, size_t sz, int flags)
1010 {
1011     return safe_ipc(Q_IPCCALL(0, Q_MSGSND), msgid, sz, flags, (void *)msgp, 0);
1012 }
1013 static int safe_msgrcv(int msgid, void *msgp, size_t sz, long type, int flags)
1014 {
1015     return safe_ipc(Q_IPCCALL(1, Q_MSGRCV), msgid, sz, flags, msgp, type);
1016 }
1017 static int safe_semtimedop(int semid, struct sembuf *tsops, unsigned nsops,
1018                            const struct timespec *timeout)
1019 {
1020     return safe_ipc(Q_IPCCALL(0, Q_SEMTIMEDOP), semid, nsops, 0, tsops,
1021                     (long)timeout);
1022 }
1023 #endif
1024 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
1025 safe_syscall5(int, mq_timedsend, int, mqdes, const char *, msg_ptr,
1026               size_t, len, unsigned, prio, const struct timespec *, timeout)
1027 safe_syscall5(int, mq_timedreceive, int, mqdes, char *, msg_ptr,
1028               size_t, len, unsigned *, prio, const struct timespec *, timeout)
1029 #endif
1030 /* We do ioctl like this rather than via safe_syscall3 to preserve the
1031  * "third argument might be integer or pointer or not present" behaviour of
1032  * the libc function.
1033  */
1034 #define safe_ioctl(...) safe_syscall(__NR_ioctl, __VA_ARGS__)
1035 /* Similarly for fcntl. Note that callers must always:
1036  *  pass the F_GETLK64 etc constants rather than the unsuffixed F_GETLK
1037  *  use the flock64 struct rather than unsuffixed flock
1038  * This will then work and use a 64-bit offset for both 32-bit and 64-bit hosts.
1039  */
1040 #ifdef __NR_fcntl64
1041 #define safe_fcntl(...) safe_syscall(__NR_fcntl64, __VA_ARGS__)
1042 #else
1043 #define safe_fcntl(...) safe_syscall(__NR_fcntl, __VA_ARGS__)
1044 #endif
1045
1046 static inline int host_to_target_sock_type(int host_type)
1047 {
1048     int target_type;
1049
1050     switch (host_type & 0xf /* SOCK_TYPE_MASK */) {
1051     case SOCK_DGRAM:
1052         target_type = TARGET_SOCK_DGRAM;
1053         break;
1054     case SOCK_STREAM:
1055         target_type = TARGET_SOCK_STREAM;
1056         break;
1057     default:
1058         target_type = host_type & 0xf /* SOCK_TYPE_MASK */;
1059         break;
1060     }
1061
1062 #if defined(SOCK_CLOEXEC)
1063     if (host_type & SOCK_CLOEXEC) {
1064         target_type |= TARGET_SOCK_CLOEXEC;
1065     }
1066 #endif
1067
1068 #if defined(SOCK_NONBLOCK)
1069     if (host_type & SOCK_NONBLOCK) {
1070         target_type |= TARGET_SOCK_NONBLOCK;
1071     }
1072 #endif
1073
1074     return target_type;
1075 }
1076
1077 static abi_ulong target_brk;
1078 static abi_ulong target_original_brk;
1079 static abi_ulong brk_page;
1080
1081 void target_set_brk(abi_ulong new_brk)
1082 {
1083     target_original_brk = target_brk = HOST_PAGE_ALIGN(new_brk);
1084     brk_page = HOST_PAGE_ALIGN(target_brk);
1085 }
1086
1087 //#define DEBUGF_BRK(message, args...) do { fprintf(stderr, (message), ## args); } while (0)
1088 #define DEBUGF_BRK(message, args...)
1089
1090 /* do_brk() must return target values and target errnos. */
1091 abi_long do_brk(abi_ulong new_brk)
1092 {
1093     abi_long mapped_addr;
1094     abi_ulong new_alloc_size;
1095
1096     DEBUGF_BRK("do_brk(" TARGET_ABI_FMT_lx ") -> ", new_brk);
1097
1098     if (!new_brk) {
1099         DEBUGF_BRK(TARGET_ABI_FMT_lx " (!new_brk)\n", target_brk);
1100         return target_brk;
1101     }
1102     if (new_brk < target_original_brk) {
1103         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk < target_original_brk)\n",
1104                    target_brk);
1105         return target_brk;
1106     }
1107
1108     /* If the new brk is less than the highest page reserved to the
1109      * target heap allocation, set it and we're almost done...  */
1110     if (new_brk <= brk_page) {
1111         /* Heap contents are initialized to zero, as for anonymous
1112          * mapped pages.  */
1113         if (new_brk > target_brk) {
1114             memset(g2h(target_brk), 0, new_brk - target_brk);
1115         }
1116         target_brk = new_brk;
1117         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk <= brk_page)\n", target_brk);
1118         return target_brk;
1119     }
1120
1121     /* We need to allocate more memory after the brk... Note that
1122      * we don't use MAP_FIXED because that will map over the top of
1123      * any existing mapping (like the one with the host libc or qemu
1124      * itself); instead we treat "mapped but at wrong address" as
1125      * a failure and unmap again.
1126      */
1127     new_alloc_size = HOST_PAGE_ALIGN(new_brk - brk_page);
1128     mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size,
1129                                         PROT_READ|PROT_WRITE,
1130                                         MAP_ANON|MAP_PRIVATE, 0, 0));
1131
1132     if (mapped_addr == brk_page) {
1133         /* Heap contents are initialized to zero, as for anonymous
1134          * mapped pages.  Technically the new pages are already
1135          * initialized to zero since they *are* anonymous mapped
1136          * pages, however we have to take care with the contents that
1137          * come from the remaining part of the previous page: it may
1138          * contains garbage data due to a previous heap usage (grown
1139          * then shrunken).  */
1140         memset(g2h(target_brk), 0, brk_page - target_brk);
1141
1142         target_brk = new_brk;
1143         brk_page = HOST_PAGE_ALIGN(target_brk);
1144         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr == brk_page)\n",
1145             target_brk);
1146         return target_brk;
1147     } else if (mapped_addr != -1) {
1148         /* Mapped but at wrong address, meaning there wasn't actually
1149          * enough space for this brk.
1150          */
1151         target_munmap(mapped_addr, new_alloc_size);
1152         mapped_addr = -1;
1153         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr != -1)\n", target_brk);
1154     }
1155     else {
1156         DEBUGF_BRK(TARGET_ABI_FMT_lx " (otherwise)\n", target_brk);
1157     }
1158
1159 #if defined(TARGET_ALPHA)
1160     /* We (partially) emulate OSF/1 on Alpha, which requires we
1161        return a proper errno, not an unchanged brk value.  */
1162     return -TARGET_ENOMEM;
1163 #endif
1164     /* For everything else, return the previous break. */
1165     return target_brk;
1166 }
1167
1168 static inline abi_long copy_from_user_fdset(fd_set *fds,
1169                                             abi_ulong target_fds_addr,
1170                                             int n)
1171 {
1172     int i, nw, j, k;
1173     abi_ulong b, *target_fds;
1174
1175     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
1176     if (!(target_fds = lock_user(VERIFY_READ,
1177                                  target_fds_addr,
1178                                  sizeof(abi_ulong) * nw,
1179                                  1)))
1180         return -TARGET_EFAULT;
1181
1182     FD_ZERO(fds);
1183     k = 0;
1184     for (i = 0; i < nw; i++) {
1185         /* grab the abi_ulong */
1186         __get_user(b, &target_fds[i]);
1187         for (j = 0; j < TARGET_ABI_BITS; j++) {
1188             /* check the bit inside the abi_ulong */
1189             if ((b >> j) & 1)
1190                 FD_SET(k, fds);
1191             k++;
1192         }
1193     }
1194
1195     unlock_user(target_fds, target_fds_addr, 0);
1196
1197     return 0;
1198 }
1199
1200 static inline abi_ulong copy_from_user_fdset_ptr(fd_set *fds, fd_set **fds_ptr,
1201                                                  abi_ulong target_fds_addr,
1202                                                  int n)
1203 {
1204     if (target_fds_addr) {
1205         if (copy_from_user_fdset(fds, target_fds_addr, n))
1206             return -TARGET_EFAULT;
1207         *fds_ptr = fds;
1208     } else {
1209         *fds_ptr = NULL;
1210     }
1211     return 0;
1212 }
1213
1214 static inline abi_long copy_to_user_fdset(abi_ulong target_fds_addr,
1215                                           const fd_set *fds,
1216                                           int n)
1217 {
1218     int i, nw, j, k;
1219     abi_long v;
1220     abi_ulong *target_fds;
1221
1222     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
1223     if (!(target_fds = lock_user(VERIFY_WRITE,
1224                                  target_fds_addr,
1225                                  sizeof(abi_ulong) * nw,
1226                                  0)))
1227         return -TARGET_EFAULT;
1228
1229     k = 0;
1230     for (i = 0; i < nw; i++) {
1231         v = 0;
1232         for (j = 0; j < TARGET_ABI_BITS; j++) {
1233             v |= ((abi_ulong)(FD_ISSET(k, fds) != 0) << j);
1234             k++;
1235         }
1236         __put_user(v, &target_fds[i]);
1237     }
1238
1239     unlock_user(target_fds, target_fds_addr, sizeof(abi_ulong) * nw);
1240
1241     return 0;
1242 }
1243
1244 #if defined(__alpha__)
1245 #define HOST_HZ 1024
1246 #else
1247 #define HOST_HZ 100
1248 #endif
1249
1250 static inline abi_long host_to_target_clock_t(long ticks)
1251 {
1252 #if HOST_HZ == TARGET_HZ
1253     return ticks;
1254 #else
1255     return ((int64_t)ticks * TARGET_HZ) / HOST_HZ;
1256 #endif
1257 }
1258
1259 static inline abi_long host_to_target_rusage(abi_ulong target_addr,
1260                                              const struct rusage *rusage)
1261 {
1262     struct target_rusage *target_rusage;
1263
1264     if (!lock_user_struct(VERIFY_WRITE, target_rusage, target_addr, 0))
1265         return -TARGET_EFAULT;
1266     target_rusage->ru_utime.tv_sec = tswapal(rusage->ru_utime.tv_sec);
1267     target_rusage->ru_utime.tv_usec = tswapal(rusage->ru_utime.tv_usec);
1268     target_rusage->ru_stime.tv_sec = tswapal(rusage->ru_stime.tv_sec);
1269     target_rusage->ru_stime.tv_usec = tswapal(rusage->ru_stime.tv_usec);
1270     target_rusage->ru_maxrss = tswapal(rusage->ru_maxrss);
1271     target_rusage->ru_ixrss = tswapal(rusage->ru_ixrss);
1272     target_rusage->ru_idrss = tswapal(rusage->ru_idrss);
1273     target_rusage->ru_isrss = tswapal(rusage->ru_isrss);
1274     target_rusage->ru_minflt = tswapal(rusage->ru_minflt);
1275     target_rusage->ru_majflt = tswapal(rusage->ru_majflt);
1276     target_rusage->ru_nswap = tswapal(rusage->ru_nswap);
1277     target_rusage->ru_inblock = tswapal(rusage->ru_inblock);
1278     target_rusage->ru_oublock = tswapal(rusage->ru_oublock);
1279     target_rusage->ru_msgsnd = tswapal(rusage->ru_msgsnd);
1280     target_rusage->ru_msgrcv = tswapal(rusage->ru_msgrcv);
1281     target_rusage->ru_nsignals = tswapal(rusage->ru_nsignals);
1282     target_rusage->ru_nvcsw = tswapal(rusage->ru_nvcsw);
1283     target_rusage->ru_nivcsw = tswapal(rusage->ru_nivcsw);
1284     unlock_user_struct(target_rusage, target_addr, 1);
1285
1286     return 0;
1287 }
1288
1289 static inline rlim_t target_to_host_rlim(abi_ulong target_rlim)
1290 {
1291     abi_ulong target_rlim_swap;
1292     rlim_t result;
1293
1294     target_rlim_swap = tswapal(target_rlim);
1295     if (target_rlim_swap == TARGET_RLIM_INFINITY)
1296         return RLIM_INFINITY;
1297
1298     result = target_rlim_swap;
1299     if (target_rlim_swap != (rlim_t)result)
1300         return RLIM_INFINITY;
1301
1302     return result;
1303 }
1304
1305 static inline abi_ulong host_to_target_rlim(rlim_t rlim)
1306 {
1307     abi_ulong target_rlim_swap;
1308     abi_ulong result;
1309
1310     if (rlim == RLIM_INFINITY || rlim != (abi_long)rlim)
1311         target_rlim_swap = TARGET_RLIM_INFINITY;
1312     else
1313         target_rlim_swap = rlim;
1314     result = tswapal(target_rlim_swap);
1315
1316     return result;
1317 }
1318
1319 static inline int target_to_host_resource(int code)
1320 {
1321     switch (code) {
1322     case TARGET_RLIMIT_AS:
1323         return RLIMIT_AS;
1324     case TARGET_RLIMIT_CORE:
1325         return RLIMIT_CORE;
1326     case TARGET_RLIMIT_CPU:
1327         return RLIMIT_CPU;
1328     case TARGET_RLIMIT_DATA:
1329         return RLIMIT_DATA;
1330     case TARGET_RLIMIT_FSIZE:
1331         return RLIMIT_FSIZE;
1332     case TARGET_RLIMIT_LOCKS:
1333         return RLIMIT_LOCKS;
1334     case TARGET_RLIMIT_MEMLOCK:
1335         return RLIMIT_MEMLOCK;
1336     case TARGET_RLIMIT_MSGQUEUE:
1337         return RLIMIT_MSGQUEUE;
1338     case TARGET_RLIMIT_NICE:
1339         return RLIMIT_NICE;
1340     case TARGET_RLIMIT_NOFILE:
1341         return RLIMIT_NOFILE;
1342     case TARGET_RLIMIT_NPROC:
1343         return RLIMIT_NPROC;
1344     case TARGET_RLIMIT_RSS:
1345         return RLIMIT_RSS;
1346     case TARGET_RLIMIT_RTPRIO:
1347         return RLIMIT_RTPRIO;
1348     case TARGET_RLIMIT_SIGPENDING:
1349         return RLIMIT_SIGPENDING;
1350     case TARGET_RLIMIT_STACK:
1351         return RLIMIT_STACK;
1352     default:
1353         return code;
1354     }
1355 }
1356
1357 static inline abi_long copy_from_user_timeval(struct timeval *tv,
1358                                               abi_ulong target_tv_addr)
1359 {
1360     struct target_timeval *target_tv;
1361
1362     if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1))
1363         return -TARGET_EFAULT;
1364
1365     __get_user(tv->tv_sec, &target_tv->tv_sec);
1366     __get_user(tv->tv_usec, &target_tv->tv_usec);
1367
1368     unlock_user_struct(target_tv, target_tv_addr, 0);
1369
1370     return 0;
1371 }
1372
1373 static inline abi_long copy_to_user_timeval(abi_ulong target_tv_addr,
1374                                             const struct timeval *tv)
1375 {
1376     struct target_timeval *target_tv;
1377
1378     if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0))
1379         return -TARGET_EFAULT;
1380
1381     __put_user(tv->tv_sec, &target_tv->tv_sec);
1382     __put_user(tv->tv_usec, &target_tv->tv_usec);
1383
1384     unlock_user_struct(target_tv, target_tv_addr, 1);
1385
1386     return 0;
1387 }
1388
1389 static inline abi_long copy_from_user_timezone(struct timezone *tz,
1390                                                abi_ulong target_tz_addr)
1391 {
1392     struct target_timezone *target_tz;
1393
1394     if (!lock_user_struct(VERIFY_READ, target_tz, target_tz_addr, 1)) {
1395         return -TARGET_EFAULT;
1396     }
1397
1398     __get_user(tz->tz_minuteswest, &target_tz->tz_minuteswest);
1399     __get_user(tz->tz_dsttime, &target_tz->tz_dsttime);
1400
1401     unlock_user_struct(target_tz, target_tz_addr, 0);
1402
1403     return 0;
1404 }
1405
1406 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
1407 #include <mqueue.h>
1408
1409 static inline abi_long copy_from_user_mq_attr(struct mq_attr *attr,
1410                                               abi_ulong target_mq_attr_addr)
1411 {
1412     struct target_mq_attr *target_mq_attr;
1413
1414     if (!lock_user_struct(VERIFY_READ, target_mq_attr,
1415                           target_mq_attr_addr, 1))
1416         return -TARGET_EFAULT;
1417
1418     __get_user(attr->mq_flags, &target_mq_attr->mq_flags);
1419     __get_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1420     __get_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1421     __get_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1422
1423     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 0);
1424
1425     return 0;
1426 }
1427
1428 static inline abi_long copy_to_user_mq_attr(abi_ulong target_mq_attr_addr,
1429                                             const struct mq_attr *attr)
1430 {
1431     struct target_mq_attr *target_mq_attr;
1432
1433     if (!lock_user_struct(VERIFY_WRITE, target_mq_attr,
1434                           target_mq_attr_addr, 0))
1435         return -TARGET_EFAULT;
1436
1437     __put_user(attr->mq_flags, &target_mq_attr->mq_flags);
1438     __put_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1439     __put_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1440     __put_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1441
1442     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 1);
1443
1444     return 0;
1445 }
1446 #endif
1447
1448 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect)
1449 /* do_select() must return target values and target errnos. */
1450 static abi_long do_select(int n,
1451                           abi_ulong rfd_addr, abi_ulong wfd_addr,
1452                           abi_ulong efd_addr, abi_ulong target_tv_addr)
1453 {
1454     fd_set rfds, wfds, efds;
1455     fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
1456     struct timeval tv;
1457     struct timespec ts, *ts_ptr;
1458     abi_long ret;
1459
1460     ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
1461     if (ret) {
1462         return ret;
1463     }
1464     ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
1465     if (ret) {
1466         return ret;
1467     }
1468     ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
1469     if (ret) {
1470         return ret;
1471     }
1472
1473     if (target_tv_addr) {
1474         if (copy_from_user_timeval(&tv, target_tv_addr))
1475             return -TARGET_EFAULT;
1476         ts.tv_sec = tv.tv_sec;
1477         ts.tv_nsec = tv.tv_usec * 1000;
1478         ts_ptr = &ts;
1479     } else {
1480         ts_ptr = NULL;
1481     }
1482
1483     ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
1484                                   ts_ptr, NULL));
1485
1486     if (!is_error(ret)) {
1487         if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n))
1488             return -TARGET_EFAULT;
1489         if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n))
1490             return -TARGET_EFAULT;
1491         if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n))
1492             return -TARGET_EFAULT;
1493
1494         if (target_tv_addr) {
1495             tv.tv_sec = ts.tv_sec;
1496             tv.tv_usec = ts.tv_nsec / 1000;
1497             if (copy_to_user_timeval(target_tv_addr, &tv)) {
1498                 return -TARGET_EFAULT;
1499             }
1500         }
1501     }
1502
1503     return ret;
1504 }
1505
1506 #if defined(TARGET_WANT_OLD_SYS_SELECT)
1507 static abi_long do_old_select(abi_ulong arg1)
1508 {
1509     struct target_sel_arg_struct *sel;
1510     abi_ulong inp, outp, exp, tvp;
1511     long nsel;
1512
1513     if (!lock_user_struct(VERIFY_READ, sel, arg1, 1)) {
1514         return -TARGET_EFAULT;
1515     }
1516
1517     nsel = tswapal(sel->n);
1518     inp = tswapal(sel->inp);
1519     outp = tswapal(sel->outp);
1520     exp = tswapal(sel->exp);
1521     tvp = tswapal(sel->tvp);
1522
1523     unlock_user_struct(sel, arg1, 0);
1524
1525     return do_select(nsel, inp, outp, exp, tvp);
1526 }
1527 #endif
1528 #endif
1529
1530 static abi_long do_pipe2(int host_pipe[], int flags)
1531 {
1532 #ifdef CONFIG_PIPE2
1533     return pipe2(host_pipe, flags);
1534 #else
1535     return -ENOSYS;
1536 #endif
1537 }
1538
1539 static abi_long do_pipe(void *cpu_env, abi_ulong pipedes,
1540                         int flags, int is_pipe2)
1541 {
1542     int host_pipe[2];
1543     abi_long ret;
1544     ret = flags ? do_pipe2(host_pipe, flags) : pipe(host_pipe);
1545
1546     if (is_error(ret))
1547         return get_errno(ret);
1548
1549     /* Several targets have special calling conventions for the original
1550        pipe syscall, but didn't replicate this into the pipe2 syscall.  */
1551     if (!is_pipe2) {
1552 #if defined(TARGET_ALPHA)
1553         ((CPUAlphaState *)cpu_env)->ir[IR_A4] = host_pipe[1];
1554         return host_pipe[0];
1555 #elif defined(TARGET_MIPS)
1556         ((CPUMIPSState*)cpu_env)->active_tc.gpr[3] = host_pipe[1];
1557         return host_pipe[0];
1558 #elif defined(TARGET_SH4)
1559         ((CPUSH4State*)cpu_env)->gregs[1] = host_pipe[1];
1560         return host_pipe[0];
1561 #elif defined(TARGET_SPARC)
1562         ((CPUSPARCState*)cpu_env)->regwptr[1] = host_pipe[1];
1563         return host_pipe[0];
1564 #endif
1565     }
1566
1567     if (put_user_s32(host_pipe[0], pipedes)
1568         || put_user_s32(host_pipe[1], pipedes + sizeof(host_pipe[0])))
1569         return -TARGET_EFAULT;
1570     return get_errno(ret);
1571 }
1572
1573 static inline abi_long target_to_host_ip_mreq(struct ip_mreqn *mreqn,
1574                                               abi_ulong target_addr,
1575                                               socklen_t len)
1576 {
1577     struct target_ip_mreqn *target_smreqn;
1578
1579     target_smreqn = lock_user(VERIFY_READ, target_addr, len, 1);
1580     if (!target_smreqn)
1581         return -TARGET_EFAULT;
1582     mreqn->imr_multiaddr.s_addr = target_smreqn->imr_multiaddr.s_addr;
1583     mreqn->imr_address.s_addr = target_smreqn->imr_address.s_addr;
1584     if (len == sizeof(struct target_ip_mreqn))
1585         mreqn->imr_ifindex = tswapal(target_smreqn->imr_ifindex);
1586     unlock_user(target_smreqn, target_addr, 0);
1587
1588     return 0;
1589 }
1590
1591 static inline abi_long target_to_host_sockaddr(int fd, struct sockaddr *addr,
1592                                                abi_ulong target_addr,
1593                                                socklen_t len)
1594 {
1595     const socklen_t unix_maxlen = sizeof (struct sockaddr_un);
1596     sa_family_t sa_family;
1597     struct target_sockaddr *target_saddr;
1598
1599     if (fd_trans_target_to_host_addr(fd)) {
1600         return fd_trans_target_to_host_addr(fd)(addr, target_addr, len);
1601     }
1602
1603     target_saddr = lock_user(VERIFY_READ, target_addr, len, 1);
1604     if (!target_saddr)
1605         return -TARGET_EFAULT;
1606
1607     sa_family = tswap16(target_saddr->sa_family);
1608
1609     /* Oops. The caller might send a incomplete sun_path; sun_path
1610      * must be terminated by \0 (see the manual page), but
1611      * unfortunately it is quite common to specify sockaddr_un
1612      * length as "strlen(x->sun_path)" while it should be
1613      * "strlen(...) + 1". We'll fix that here if needed.
1614      * Linux kernel has a similar feature.
1615      */
1616
1617     if (sa_family == AF_UNIX) {
1618         if (len < unix_maxlen && len > 0) {
1619             char *cp = (char*)target_saddr;
1620
1621             if ( cp[len-1] && !cp[len] )
1622                 len++;
1623         }
1624         if (len > unix_maxlen)
1625             len = unix_maxlen;
1626     }
1627
1628     memcpy(addr, target_saddr, len);
1629     addr->sa_family = sa_family;
1630     if (sa_family == AF_NETLINK) {
1631         struct sockaddr_nl *nladdr;
1632
1633         nladdr = (struct sockaddr_nl *)addr;
1634         nladdr->nl_pid = tswap32(nladdr->nl_pid);
1635         nladdr->nl_groups = tswap32(nladdr->nl_groups);
1636     } else if (sa_family == AF_PACKET) {
1637         struct target_sockaddr_ll *lladdr;
1638
1639         lladdr = (struct target_sockaddr_ll *)addr;
1640         lladdr->sll_ifindex = tswap32(lladdr->sll_ifindex);
1641         lladdr->sll_hatype = tswap16(lladdr->sll_hatype);
1642     }
1643     unlock_user(target_saddr, target_addr, 0);
1644
1645     return 0;
1646 }
1647
1648 static inline abi_long host_to_target_sockaddr(abi_ulong target_addr,
1649                                                struct sockaddr *addr,
1650                                                socklen_t len)
1651 {
1652     struct target_sockaddr *target_saddr;
1653
1654     if (len == 0) {
1655         return 0;
1656     }
1657     assert(addr);
1658
1659     target_saddr = lock_user(VERIFY_WRITE, target_addr, len, 0);
1660     if (!target_saddr)
1661         return -TARGET_EFAULT;
1662     memcpy(target_saddr, addr, len);
1663     if (len >= offsetof(struct target_sockaddr, sa_family) +
1664         sizeof(target_saddr->sa_family)) {
1665         target_saddr->sa_family = tswap16(addr->sa_family);
1666     }
1667     if (addr->sa_family == AF_NETLINK && len >= sizeof(struct sockaddr_nl)) {
1668         struct sockaddr_nl *target_nl = (struct sockaddr_nl *)target_saddr;
1669         target_nl->nl_pid = tswap32(target_nl->nl_pid);
1670         target_nl->nl_groups = tswap32(target_nl->nl_groups);
1671     } else if (addr->sa_family == AF_PACKET) {
1672         struct sockaddr_ll *target_ll = (struct sockaddr_ll *)target_saddr;
1673         target_ll->sll_ifindex = tswap32(target_ll->sll_ifindex);
1674         target_ll->sll_hatype = tswap16(target_ll->sll_hatype);
1675     } else if (addr->sa_family == AF_INET6 &&
1676                len >= sizeof(struct target_sockaddr_in6)) {
1677         struct target_sockaddr_in6 *target_in6 =
1678                (struct target_sockaddr_in6 *)target_saddr;
1679         target_in6->sin6_scope_id = tswap16(target_in6->sin6_scope_id);
1680     }
1681     unlock_user(target_saddr, target_addr, len);
1682
1683     return 0;
1684 }
1685
1686 static inline abi_long target_to_host_cmsg(struct msghdr *msgh,
1687                                            struct target_msghdr *target_msgh)
1688 {
1689     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1690     abi_long msg_controllen;
1691     abi_ulong target_cmsg_addr;
1692     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1693     socklen_t space = 0;
1694
1695     msg_controllen = tswapal(target_msgh->msg_controllen);
1696     if (msg_controllen < sizeof (struct target_cmsghdr))
1697         goto the_end;
1698     target_cmsg_addr = tswapal(target_msgh->msg_control);
1699     target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, 1);
1700     target_cmsg_start = target_cmsg;
1701     if (!target_cmsg)
1702         return -TARGET_EFAULT;
1703
1704     while (cmsg && target_cmsg) {
1705         void *data = CMSG_DATA(cmsg);
1706         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1707
1708         int len = tswapal(target_cmsg->cmsg_len)
1709             - sizeof(struct target_cmsghdr);
1710
1711         space += CMSG_SPACE(len);
1712         if (space > msgh->msg_controllen) {
1713             space -= CMSG_SPACE(len);
1714             /* This is a QEMU bug, since we allocated the payload
1715              * area ourselves (unlike overflow in host-to-target
1716              * conversion, which is just the guest giving us a buffer
1717              * that's too small). It can't happen for the payload types
1718              * we currently support; if it becomes an issue in future
1719              * we would need to improve our allocation strategy to
1720              * something more intelligent than "twice the size of the
1721              * target buffer we're reading from".
1722              */
1723             gemu_log("Host cmsg overflow\n");
1724             break;
1725         }
1726
1727         if (tswap32(target_cmsg->cmsg_level) == TARGET_SOL_SOCKET) {
1728             cmsg->cmsg_level = SOL_SOCKET;
1729         } else {
1730             cmsg->cmsg_level = tswap32(target_cmsg->cmsg_level);
1731         }
1732         cmsg->cmsg_type = tswap32(target_cmsg->cmsg_type);
1733         cmsg->cmsg_len = CMSG_LEN(len);
1734
1735         if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
1736             int *fd = (int *)data;
1737             int *target_fd = (int *)target_data;
1738             int i, numfds = len / sizeof(int);
1739
1740             for (i = 0; i < numfds; i++) {
1741                 __get_user(fd[i], target_fd + i);
1742             }
1743         } else if (cmsg->cmsg_level == SOL_SOCKET
1744                &&  cmsg->cmsg_type == SCM_CREDENTIALS) {
1745             struct ucred *cred = (struct ucred *)data;
1746             struct target_ucred *target_cred =
1747                 (struct target_ucred *)target_data;
1748
1749             __get_user(cred->pid, &target_cred->pid);
1750             __get_user(cred->uid, &target_cred->uid);
1751             __get_user(cred->gid, &target_cred->gid);
1752         } else {
1753             gemu_log("Unsupported ancillary data: %d/%d\n",
1754                                         cmsg->cmsg_level, cmsg->cmsg_type);
1755             memcpy(data, target_data, len);
1756         }
1757
1758         cmsg = CMSG_NXTHDR(msgh, cmsg);
1759         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
1760                                          target_cmsg_start);
1761     }
1762     unlock_user(target_cmsg, target_cmsg_addr, 0);
1763  the_end:
1764     msgh->msg_controllen = space;
1765     return 0;
1766 }
1767
1768 static inline abi_long host_to_target_cmsg(struct target_msghdr *target_msgh,
1769                                            struct msghdr *msgh)
1770 {
1771     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1772     abi_long msg_controllen;
1773     abi_ulong target_cmsg_addr;
1774     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1775     socklen_t space = 0;
1776
1777     msg_controllen = tswapal(target_msgh->msg_controllen);
1778     if (msg_controllen < sizeof (struct target_cmsghdr))
1779         goto the_end;
1780     target_cmsg_addr = tswapal(target_msgh->msg_control);
1781     target_cmsg = lock_user(VERIFY_WRITE, target_cmsg_addr, msg_controllen, 0);
1782     target_cmsg_start = target_cmsg;
1783     if (!target_cmsg)
1784         return -TARGET_EFAULT;
1785
1786     while (cmsg && target_cmsg) {
1787         void *data = CMSG_DATA(cmsg);
1788         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1789
1790         int len = cmsg->cmsg_len - sizeof(struct cmsghdr);
1791         int tgt_len, tgt_space;
1792
1793         /* We never copy a half-header but may copy half-data;
1794          * this is Linux's behaviour in put_cmsg(). Note that
1795          * truncation here is a guest problem (which we report
1796          * to the guest via the CTRUNC bit), unlike truncation
1797          * in target_to_host_cmsg, which is a QEMU bug.
1798          */
1799         if (msg_controllen < sizeof(struct target_cmsghdr)) {
1800             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1801             break;
1802         }
1803
1804         if (cmsg->cmsg_level == SOL_SOCKET) {
1805             target_cmsg->cmsg_level = tswap32(TARGET_SOL_SOCKET);
1806         } else {
1807             target_cmsg->cmsg_level = tswap32(cmsg->cmsg_level);
1808         }
1809         target_cmsg->cmsg_type = tswap32(cmsg->cmsg_type);
1810
1811         /* Payload types which need a different size of payload on
1812          * the target must adjust tgt_len here.
1813          */
1814         switch (cmsg->cmsg_level) {
1815         case SOL_SOCKET:
1816             switch (cmsg->cmsg_type) {
1817             case SO_TIMESTAMP:
1818                 tgt_len = sizeof(struct target_timeval);
1819                 break;
1820             default:
1821                 break;
1822             }
1823         default:
1824             tgt_len = len;
1825             break;
1826         }
1827
1828         if (msg_controllen < TARGET_CMSG_LEN(tgt_len)) {
1829             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1830             tgt_len = msg_controllen - sizeof(struct target_cmsghdr);
1831         }
1832
1833         /* We must now copy-and-convert len bytes of payload
1834          * into tgt_len bytes of destination space. Bear in mind
1835          * that in both source and destination we may be dealing
1836          * with a truncated value!
1837          */
1838         switch (cmsg->cmsg_level) {
1839         case SOL_SOCKET:
1840             switch (cmsg->cmsg_type) {
1841             case SCM_RIGHTS:
1842             {
1843                 int *fd = (int *)data;
1844                 int *target_fd = (int *)target_data;
1845                 int i, numfds = tgt_len / sizeof(int);
1846
1847                 for (i = 0; i < numfds; i++) {
1848                     __put_user(fd[i], target_fd + i);
1849                 }
1850                 break;
1851             }
1852             case SO_TIMESTAMP:
1853             {
1854                 struct timeval *tv = (struct timeval *)data;
1855                 struct target_timeval *target_tv =
1856                     (struct target_timeval *)target_data;
1857
1858                 if (len != sizeof(struct timeval) ||
1859                     tgt_len != sizeof(struct target_timeval)) {
1860                     goto unimplemented;
1861                 }
1862
1863                 /* copy struct timeval to target */
1864                 __put_user(tv->tv_sec, &target_tv->tv_sec);
1865                 __put_user(tv->tv_usec, &target_tv->tv_usec);
1866                 break;
1867             }
1868             case SCM_CREDENTIALS:
1869             {
1870                 struct ucred *cred = (struct ucred *)data;
1871                 struct target_ucred *target_cred =
1872                     (struct target_ucred *)target_data;
1873
1874                 __put_user(cred->pid, &target_cred->pid);
1875                 __put_user(cred->uid, &target_cred->uid);
1876                 __put_user(cred->gid, &target_cred->gid);
1877                 break;
1878             }
1879             default:
1880                 goto unimplemented;
1881             }
1882             break;
1883
1884         case SOL_IP:
1885             switch (cmsg->cmsg_type) {
1886             case IP_TTL:
1887             {
1888                 uint32_t *v = (uint32_t *)data;
1889                 uint32_t *t_int = (uint32_t *)target_data;
1890
1891                 if (len != sizeof(uint32_t) ||
1892                     tgt_len != sizeof(uint32_t)) {
1893                     goto unimplemented;
1894                 }
1895                 __put_user(*v, t_int);
1896                 break;
1897             }
1898             case IP_RECVERR:
1899             {
1900                 struct errhdr_t {
1901                    struct sock_extended_err ee;
1902                    struct sockaddr_in offender;
1903                 };
1904                 struct errhdr_t *errh = (struct errhdr_t *)data;
1905                 struct errhdr_t *target_errh =
1906                     (struct errhdr_t *)target_data;
1907
1908                 if (len != sizeof(struct errhdr_t) ||
1909                     tgt_len != sizeof(struct errhdr_t)) {
1910                     goto unimplemented;
1911                 }
1912                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
1913                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
1914                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
1915                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
1916                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
1917                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
1918                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
1919                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
1920                     (void *) &errh->offender, sizeof(errh->offender));
1921                 break;
1922             }
1923             default:
1924                 goto unimplemented;
1925             }
1926             break;
1927
1928         case SOL_IPV6:
1929             switch (cmsg->cmsg_type) {
1930             case IPV6_HOPLIMIT:
1931             {
1932                 uint32_t *v = (uint32_t *)data;
1933                 uint32_t *t_int = (uint32_t *)target_data;
1934
1935                 if (len != sizeof(uint32_t) ||
1936                     tgt_len != sizeof(uint32_t)) {
1937                     goto unimplemented;
1938                 }
1939                 __put_user(*v, t_int);
1940                 break;
1941             }
1942             case IPV6_RECVERR:
1943             {
1944                 struct errhdr6_t {
1945                    struct sock_extended_err ee;
1946                    struct sockaddr_in6 offender;
1947                 };
1948                 struct errhdr6_t *errh = (struct errhdr6_t *)data;
1949                 struct errhdr6_t *target_errh =
1950                     (struct errhdr6_t *)target_data;
1951
1952                 if (len != sizeof(struct errhdr6_t) ||
1953                     tgt_len != sizeof(struct errhdr6_t)) {
1954                     goto unimplemented;
1955                 }
1956                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
1957                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
1958                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
1959                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
1960                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
1961                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
1962                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
1963                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
1964                     (void *) &errh->offender, sizeof(errh->offender));
1965                 break;
1966             }
1967             default:
1968                 goto unimplemented;
1969             }
1970             break;
1971
1972         default:
1973         unimplemented:
1974             gemu_log("Unsupported ancillary data: %d/%d\n",
1975                                         cmsg->cmsg_level, cmsg->cmsg_type);
1976             memcpy(target_data, data, MIN(len, tgt_len));
1977             if (tgt_len > len) {
1978                 memset(target_data + len, 0, tgt_len - len);
1979             }
1980         }
1981
1982         target_cmsg->cmsg_len = tswapal(TARGET_CMSG_LEN(tgt_len));
1983         tgt_space = TARGET_CMSG_SPACE(tgt_len);
1984         if (msg_controllen < tgt_space) {
1985             tgt_space = msg_controllen;
1986         }
1987         msg_controllen -= tgt_space;
1988         space += tgt_space;
1989         cmsg = CMSG_NXTHDR(msgh, cmsg);
1990         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
1991                                          target_cmsg_start);
1992     }
1993     unlock_user(target_cmsg, target_cmsg_addr, space);
1994  the_end:
1995     target_msgh->msg_controllen = tswapal(space);
1996     return 0;
1997 }
1998
1999 static void tswap_nlmsghdr(struct nlmsghdr *nlh)
2000 {
2001     nlh->nlmsg_len = tswap32(nlh->nlmsg_len);
2002     nlh->nlmsg_type = tswap16(nlh->nlmsg_type);
2003     nlh->nlmsg_flags = tswap16(nlh->nlmsg_flags);
2004     nlh->nlmsg_seq = tswap32(nlh->nlmsg_seq);
2005     nlh->nlmsg_pid = tswap32(nlh->nlmsg_pid);
2006 }
2007
2008 static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
2009                                               size_t len,
2010                                               abi_long (*host_to_target_nlmsg)
2011                                                        (struct nlmsghdr *))
2012 {
2013     uint32_t nlmsg_len;
2014     abi_long ret;
2015
2016     while (len > sizeof(struct nlmsghdr)) {
2017
2018         nlmsg_len = nlh->nlmsg_len;
2019         if (nlmsg_len < sizeof(struct nlmsghdr) ||
2020             nlmsg_len > len) {
2021             break;
2022         }
2023
2024         switch (nlh->nlmsg_type) {
2025         case NLMSG_DONE:
2026             tswap_nlmsghdr(nlh);
2027             return 0;
2028         case NLMSG_NOOP:
2029             break;
2030         case NLMSG_ERROR:
2031         {
2032             struct nlmsgerr *e = NLMSG_DATA(nlh);
2033             e->error = tswap32(e->error);
2034             tswap_nlmsghdr(&e->msg);
2035             tswap_nlmsghdr(nlh);
2036             return 0;
2037         }
2038         default:
2039             ret = host_to_target_nlmsg(nlh);
2040             if (ret < 0) {
2041                 tswap_nlmsghdr(nlh);
2042                 return ret;
2043             }
2044             break;
2045         }
2046         tswap_nlmsghdr(nlh);
2047         len -= NLMSG_ALIGN(nlmsg_len);
2048         nlh = (struct nlmsghdr *)(((char*)nlh) + NLMSG_ALIGN(nlmsg_len));
2049     }
2050     return 0;
2051 }
2052
2053 static abi_long target_to_host_for_each_nlmsg(struct nlmsghdr *nlh,
2054                                               size_t len,
2055                                               abi_long (*target_to_host_nlmsg)
2056                                                        (struct nlmsghdr *))
2057 {
2058     int ret;
2059
2060     while (len > sizeof(struct nlmsghdr)) {
2061         if (tswap32(nlh->nlmsg_len) < sizeof(struct nlmsghdr) ||
2062             tswap32(nlh->nlmsg_len) > len) {
2063             break;
2064         }
2065         tswap_nlmsghdr(nlh);
2066         switch (nlh->nlmsg_type) {
2067         case NLMSG_DONE:
2068             return 0;
2069         case NLMSG_NOOP:
2070             break;
2071         case NLMSG_ERROR:
2072         {
2073             struct nlmsgerr *e = NLMSG_DATA(nlh);
2074             e->error = tswap32(e->error);
2075             tswap_nlmsghdr(&e->msg);
2076             return 0;
2077         }
2078         default:
2079             ret = target_to_host_nlmsg(nlh);
2080             if (ret < 0) {
2081                 return ret;
2082             }
2083         }
2084         len -= NLMSG_ALIGN(nlh->nlmsg_len);
2085         nlh = (struct nlmsghdr *)(((char *)nlh) + NLMSG_ALIGN(nlh->nlmsg_len));
2086     }
2087     return 0;
2088 }
2089
2090 #ifdef CONFIG_RTNETLINK
2091 static abi_long host_to_target_for_each_nlattr(struct nlattr *nlattr,
2092                                                size_t len, void *context,
2093                                                abi_long (*host_to_target_nlattr)
2094                                                         (struct nlattr *,
2095                                                          void *context))
2096 {
2097     unsigned short nla_len;
2098     abi_long ret;
2099
2100     while (len > sizeof(struct nlattr)) {
2101         nla_len = nlattr->nla_len;
2102         if (nla_len < sizeof(struct nlattr) ||
2103             nla_len > len) {
2104             break;
2105         }
2106         ret = host_to_target_nlattr(nlattr, context);
2107         nlattr->nla_len = tswap16(nlattr->nla_len);
2108         nlattr->nla_type = tswap16(nlattr->nla_type);
2109         if (ret < 0) {
2110             return ret;
2111         }
2112         len -= NLA_ALIGN(nla_len);
2113         nlattr = (struct nlattr *)(((char *)nlattr) + NLA_ALIGN(nla_len));
2114     }
2115     return 0;
2116 }
2117
2118 static abi_long host_to_target_for_each_rtattr(struct rtattr *rtattr,
2119                                                size_t len,
2120                                                abi_long (*host_to_target_rtattr)
2121                                                         (struct rtattr *))
2122 {
2123     unsigned short rta_len;
2124     abi_long ret;
2125
2126     while (len > sizeof(struct rtattr)) {
2127         rta_len = rtattr->rta_len;
2128         if (rta_len < sizeof(struct rtattr) ||
2129             rta_len > len) {
2130             break;
2131         }
2132         ret = host_to_target_rtattr(rtattr);
2133         rtattr->rta_len = tswap16(rtattr->rta_len);
2134         rtattr->rta_type = tswap16(rtattr->rta_type);
2135         if (ret < 0) {
2136             return ret;
2137         }
2138         len -= RTA_ALIGN(rta_len);
2139         rtattr = (struct rtattr *)(((char *)rtattr) + RTA_ALIGN(rta_len));
2140     }
2141     return 0;
2142 }
2143
2144 #define NLA_DATA(nla) ((void *)((char *)(nla)) + NLA_HDRLEN)
2145
2146 static abi_long host_to_target_data_bridge_nlattr(struct nlattr *nlattr,
2147                                                   void *context)
2148 {
2149     uint16_t *u16;
2150     uint32_t *u32;
2151     uint64_t *u64;
2152
2153     switch (nlattr->nla_type) {
2154     /* no data */
2155     case QEMU_IFLA_BR_FDB_FLUSH:
2156         break;
2157     /* binary */
2158     case QEMU_IFLA_BR_GROUP_ADDR:
2159         break;
2160     /* uint8_t */
2161     case QEMU_IFLA_BR_VLAN_FILTERING:
2162     case QEMU_IFLA_BR_TOPOLOGY_CHANGE:
2163     case QEMU_IFLA_BR_TOPOLOGY_CHANGE_DETECTED:
2164     case QEMU_IFLA_BR_MCAST_ROUTER:
2165     case QEMU_IFLA_BR_MCAST_SNOOPING:
2166     case QEMU_IFLA_BR_MCAST_QUERY_USE_IFADDR:
2167     case QEMU_IFLA_BR_MCAST_QUERIER:
2168     case QEMU_IFLA_BR_NF_CALL_IPTABLES:
2169     case QEMU_IFLA_BR_NF_CALL_IP6TABLES:
2170     case QEMU_IFLA_BR_NF_CALL_ARPTABLES:
2171         break;
2172     /* uint16_t */
2173     case QEMU_IFLA_BR_PRIORITY:
2174     case QEMU_IFLA_BR_VLAN_PROTOCOL:
2175     case QEMU_IFLA_BR_GROUP_FWD_MASK:
2176     case QEMU_IFLA_BR_ROOT_PORT:
2177     case QEMU_IFLA_BR_VLAN_DEFAULT_PVID:
2178         u16 = NLA_DATA(nlattr);
2179         *u16 = tswap16(*u16);
2180         break;
2181     /* uint32_t */
2182     case QEMU_IFLA_BR_FORWARD_DELAY:
2183     case QEMU_IFLA_BR_HELLO_TIME:
2184     case QEMU_IFLA_BR_MAX_AGE:
2185     case QEMU_IFLA_BR_AGEING_TIME:
2186     case QEMU_IFLA_BR_STP_STATE:
2187     case QEMU_IFLA_BR_ROOT_PATH_COST:
2188     case QEMU_IFLA_BR_MCAST_HASH_ELASTICITY:
2189     case QEMU_IFLA_BR_MCAST_HASH_MAX:
2190     case QEMU_IFLA_BR_MCAST_LAST_MEMBER_CNT:
2191     case QEMU_IFLA_BR_MCAST_STARTUP_QUERY_CNT:
2192         u32 = NLA_DATA(nlattr);
2193         *u32 = tswap32(*u32);
2194         break;
2195     /* uint64_t */
2196     case QEMU_IFLA_BR_HELLO_TIMER:
2197     case QEMU_IFLA_BR_TCN_TIMER:
2198     case QEMU_IFLA_BR_GC_TIMER:
2199     case QEMU_IFLA_BR_TOPOLOGY_CHANGE_TIMER:
2200     case QEMU_IFLA_BR_MCAST_LAST_MEMBER_INTVL:
2201     case QEMU_IFLA_BR_MCAST_MEMBERSHIP_INTVL:
2202     case QEMU_IFLA_BR_MCAST_QUERIER_INTVL:
2203     case QEMU_IFLA_BR_MCAST_QUERY_INTVL:
2204     case QEMU_IFLA_BR_MCAST_QUERY_RESPONSE_INTVL:
2205     case QEMU_IFLA_BR_MCAST_STARTUP_QUERY_INTVL:
2206         u64 = NLA_DATA(nlattr);
2207         *u64 = tswap64(*u64);
2208         break;
2209     /* ifla_bridge_id: uin8_t[] */
2210     case QEMU_IFLA_BR_ROOT_ID:
2211     case QEMU_IFLA_BR_BRIDGE_ID:
2212         break;
2213     default:
2214         gemu_log("Unknown QEMU_IFLA_BR type %d\n", nlattr->nla_type);
2215         break;
2216     }
2217     return 0;
2218 }
2219
2220 static abi_long host_to_target_slave_data_bridge_nlattr(struct nlattr *nlattr,
2221                                                         void *context)
2222 {
2223     uint16_t *u16;
2224     uint32_t *u32;
2225     uint64_t *u64;
2226
2227     switch (nlattr->nla_type) {
2228     /* uint8_t */
2229     case QEMU_IFLA_BRPORT_STATE:
2230     case QEMU_IFLA_BRPORT_MODE:
2231     case QEMU_IFLA_BRPORT_GUARD:
2232     case QEMU_IFLA_BRPORT_PROTECT:
2233     case QEMU_IFLA_BRPORT_FAST_LEAVE:
2234     case QEMU_IFLA_BRPORT_LEARNING:
2235     case QEMU_IFLA_BRPORT_UNICAST_FLOOD:
2236     case QEMU_IFLA_BRPORT_PROXYARP:
2237     case QEMU_IFLA_BRPORT_LEARNING_SYNC:
2238     case QEMU_IFLA_BRPORT_PROXYARP_WIFI:
2239     case QEMU_IFLA_BRPORT_TOPOLOGY_CHANGE_ACK:
2240     case QEMU_IFLA_BRPORT_CONFIG_PENDING:
2241     case QEMU_IFLA_BRPORT_MULTICAST_ROUTER:
2242         break;
2243     /* uint16_t */
2244     case QEMU_IFLA_BRPORT_PRIORITY:
2245     case QEMU_IFLA_BRPORT_DESIGNATED_PORT:
2246     case QEMU_IFLA_BRPORT_DESIGNATED_COST:
2247     case QEMU_IFLA_BRPORT_ID:
2248     case QEMU_IFLA_BRPORT_NO:
2249         u16 = NLA_DATA(nlattr);
2250         *u16 = tswap16(*u16);
2251         break;
2252     /* uin32_t */
2253     case QEMU_IFLA_BRPORT_COST:
2254         u32 = NLA_DATA(nlattr);
2255         *u32 = tswap32(*u32);
2256         break;
2257     /* uint64_t */
2258     case QEMU_IFLA_BRPORT_MESSAGE_AGE_TIMER:
2259     case QEMU_IFLA_BRPORT_FORWARD_DELAY_TIMER:
2260     case QEMU_IFLA_BRPORT_HOLD_TIMER:
2261         u64 = NLA_DATA(nlattr);
2262         *u64 = tswap64(*u64);
2263         break;
2264     /* ifla_bridge_id: uint8_t[] */
2265     case QEMU_IFLA_BRPORT_ROOT_ID:
2266     case QEMU_IFLA_BRPORT_BRIDGE_ID:
2267         break;
2268     default:
2269         gemu_log("Unknown QEMU_IFLA_BRPORT type %d\n", nlattr->nla_type);
2270         break;
2271     }
2272     return 0;
2273 }
2274
2275 struct linkinfo_context {
2276     int len;
2277     char *name;
2278     int slave_len;
2279     char *slave_name;
2280 };
2281
2282 static abi_long host_to_target_data_linkinfo_nlattr(struct nlattr *nlattr,
2283                                                     void *context)
2284 {
2285     struct linkinfo_context *li_context = context;
2286
2287     switch (nlattr->nla_type) {
2288     /* string */
2289     case QEMU_IFLA_INFO_KIND:
2290         li_context->name = NLA_DATA(nlattr);
2291         li_context->len = nlattr->nla_len - NLA_HDRLEN;
2292         break;
2293     case QEMU_IFLA_INFO_SLAVE_KIND:
2294         li_context->slave_name = NLA_DATA(nlattr);
2295         li_context->slave_len = nlattr->nla_len - NLA_HDRLEN;
2296         break;
2297     /* stats */
2298     case QEMU_IFLA_INFO_XSTATS:
2299         /* FIXME: only used by CAN */
2300         break;
2301     /* nested */
2302     case QEMU_IFLA_INFO_DATA:
2303         if (strncmp(li_context->name, "bridge",
2304                     li_context->len) == 0) {
2305             return host_to_target_for_each_nlattr(NLA_DATA(nlattr),
2306                                                   nlattr->nla_len,
2307                                                   NULL,
2308                                              host_to_target_data_bridge_nlattr);
2309         } else {
2310             gemu_log("Unknown QEMU_IFLA_INFO_KIND %s\n", li_context->name);
2311         }
2312         break;
2313     case QEMU_IFLA_INFO_SLAVE_DATA:
2314         if (strncmp(li_context->slave_name, "bridge",
2315                     li_context->slave_len) == 0) {
2316             return host_to_target_for_each_nlattr(NLA_DATA(nlattr),
2317                                                   nlattr->nla_len,
2318                                                   NULL,
2319                                        host_to_target_slave_data_bridge_nlattr);
2320         } else {
2321             gemu_log("Unknown QEMU_IFLA_INFO_SLAVE_KIND %s\n",
2322                      li_context->slave_name);
2323         }
2324         break;
2325     default:
2326         gemu_log("Unknown host QEMU_IFLA_INFO type: %d\n", nlattr->nla_type);
2327         break;
2328     }
2329
2330     return 0;
2331 }
2332
2333 static abi_long host_to_target_data_inet_nlattr(struct nlattr *nlattr,
2334                                                 void *context)
2335 {
2336     uint32_t *u32;
2337     int i;
2338
2339     switch (nlattr->nla_type) {
2340     case QEMU_IFLA_INET_CONF:
2341         u32 = NLA_DATA(nlattr);
2342         for (i = 0; i < (nlattr->nla_len - NLA_HDRLEN) / sizeof(*u32);
2343              i++) {
2344             u32[i] = tswap32(u32[i]);
2345         }
2346         break;
2347     default:
2348         gemu_log("Unknown host AF_INET type: %d\n", nlattr->nla_type);
2349     }
2350     return 0;
2351 }
2352
2353 static abi_long host_to_target_data_inet6_nlattr(struct nlattr *nlattr,
2354                                                 void *context)
2355 {
2356     uint32_t *u32;
2357     uint64_t *u64;
2358     struct ifla_cacheinfo *ci;
2359     int i;
2360
2361     switch (nlattr->nla_type) {
2362     /* binaries */
2363     case QEMU_IFLA_INET6_TOKEN:
2364         break;
2365     /* uint8_t */
2366     case QEMU_IFLA_INET6_ADDR_GEN_MODE:
2367         break;
2368     /* uint32_t */
2369     case QEMU_IFLA_INET6_FLAGS:
2370         u32 = NLA_DATA(nlattr);
2371         *u32 = tswap32(*u32);
2372         break;
2373     /* uint32_t[] */
2374     case QEMU_IFLA_INET6_CONF:
2375         u32 = NLA_DATA(nlattr);
2376         for (i = 0; i < (nlattr->nla_len - NLA_HDRLEN) / sizeof(*u32);
2377              i++) {
2378             u32[i] = tswap32(u32[i]);
2379         }
2380         break;
2381     /* ifla_cacheinfo */
2382     case QEMU_IFLA_INET6_CACHEINFO:
2383         ci = NLA_DATA(nlattr);
2384         ci->max_reasm_len = tswap32(ci->max_reasm_len);
2385         ci->tstamp = tswap32(ci->tstamp);
2386         ci->reachable_time = tswap32(ci->reachable_time);
2387         ci->retrans_time = tswap32(ci->retrans_time);
2388         break;
2389     /* uint64_t[] */
2390     case QEMU_IFLA_INET6_STATS:
2391     case QEMU_IFLA_INET6_ICMP6STATS:
2392         u64 = NLA_DATA(nlattr);
2393         for (i = 0; i < (nlattr->nla_len - NLA_HDRLEN) / sizeof(*u64);
2394              i++) {
2395             u64[i] = tswap64(u64[i]);
2396         }
2397         break;
2398     default:
2399         gemu_log("Unknown host AF_INET6 type: %d\n", nlattr->nla_type);
2400     }
2401     return 0;
2402 }
2403
2404 static abi_long host_to_target_data_spec_nlattr(struct nlattr *nlattr,
2405                                                     void *context)
2406 {
2407     switch (nlattr->nla_type) {
2408     case AF_INET:
2409         return host_to_target_for_each_nlattr(NLA_DATA(nlattr), nlattr->nla_len,
2410                                               NULL,
2411                                              host_to_target_data_inet_nlattr);
2412     case AF_INET6:
2413         return host_to_target_for_each_nlattr(NLA_DATA(nlattr), nlattr->nla_len,
2414                                               NULL,
2415                                              host_to_target_data_inet6_nlattr);
2416     default:
2417         gemu_log("Unknown host AF_SPEC type: %d\n", nlattr->nla_type);
2418         break;
2419     }
2420     return 0;
2421 }
2422
2423 static abi_long host_to_target_data_link_rtattr(struct rtattr *rtattr)
2424 {
2425     uint32_t *u32;
2426     struct rtnl_link_stats *st;
2427     struct rtnl_link_stats64 *st64;
2428     struct rtnl_link_ifmap *map;
2429     struct linkinfo_context li_context;
2430
2431     switch (rtattr->rta_type) {
2432     /* binary stream */
2433     case QEMU_IFLA_ADDRESS:
2434     case QEMU_IFLA_BROADCAST:
2435     /* string */
2436     case QEMU_IFLA_IFNAME:
2437     case QEMU_IFLA_QDISC:
2438         break;
2439     /* uin8_t */
2440     case QEMU_IFLA_OPERSTATE:
2441     case QEMU_IFLA_LINKMODE:
2442     case QEMU_IFLA_CARRIER:
2443     case QEMU_IFLA_PROTO_DOWN:
2444         break;
2445     /* uint32_t */
2446     case QEMU_IFLA_MTU:
2447     case QEMU_IFLA_LINK:
2448     case QEMU_IFLA_WEIGHT:
2449     case QEMU_IFLA_TXQLEN:
2450     case QEMU_IFLA_CARRIER_CHANGES:
2451     case QEMU_IFLA_NUM_RX_QUEUES:
2452     case QEMU_IFLA_NUM_TX_QUEUES:
2453     case QEMU_IFLA_PROMISCUITY:
2454     case QEMU_IFLA_EXT_MASK:
2455     case QEMU_IFLA_LINK_NETNSID:
2456     case QEMU_IFLA_GROUP:
2457     case QEMU_IFLA_MASTER:
2458     case QEMU_IFLA_NUM_VF:
2459     case QEMU_IFLA_GSO_MAX_SEGS:
2460     case QEMU_IFLA_GSO_MAX_SIZE:
2461         u32 = RTA_DATA(rtattr);
2462         *u32 = tswap32(*u32);
2463         break;
2464     /* struct rtnl_link_stats */
2465     case QEMU_IFLA_STATS:
2466         st = RTA_DATA(rtattr);
2467         st->rx_packets = tswap32(st->rx_packets);
2468         st->tx_packets = tswap32(st->tx_packets);
2469         st->rx_bytes = tswap32(st->rx_bytes);
2470         st->tx_bytes = tswap32(st->tx_bytes);
2471         st->rx_errors = tswap32(st->rx_errors);
2472         st->tx_errors = tswap32(st->tx_errors);
2473         st->rx_dropped = tswap32(st->rx_dropped);
2474         st->tx_dropped = tswap32(st->tx_dropped);
2475         st->multicast = tswap32(st->multicast);
2476         st->collisions = tswap32(st->collisions);
2477
2478         /* detailed rx_errors: */
2479         st->rx_length_errors = tswap32(st->rx_length_errors);
2480         st->rx_over_errors = tswap32(st->rx_over_errors);
2481         st->rx_crc_errors = tswap32(st->rx_crc_errors);
2482         st->rx_frame_errors = tswap32(st->rx_frame_errors);
2483         st->rx_fifo_errors = tswap32(st->rx_fifo_errors);
2484         st->rx_missed_errors = tswap32(st->rx_missed_errors);
2485
2486         /* detailed tx_errors */
2487         st->tx_aborted_errors = tswap32(st->tx_aborted_errors);
2488         st->tx_carrier_errors = tswap32(st->tx_carrier_errors);
2489         st->tx_fifo_errors = tswap32(st->tx_fifo_errors);
2490         st->tx_heartbeat_errors = tswap32(st->tx_heartbeat_errors);
2491         st->tx_window_errors = tswap32(st->tx_window_errors);
2492
2493         /* for cslip etc */
2494         st->rx_compressed = tswap32(st->rx_compressed);
2495         st->tx_compressed = tswap32(st->tx_compressed);
2496         break;
2497     /* struct rtnl_link_stats64 */
2498     case QEMU_IFLA_STATS64:
2499         st64 = RTA_DATA(rtattr);
2500         st64->rx_packets = tswap64(st64->rx_packets);
2501         st64->tx_packets = tswap64(st64->tx_packets);
2502         st64->rx_bytes = tswap64(st64->rx_bytes);
2503         st64->tx_bytes = tswap64(st64->tx_bytes);
2504         st64->rx_errors = tswap64(st64->rx_errors);
2505         st64->tx_errors = tswap64(st64->tx_errors);
2506         st64->rx_dropped = tswap64(st64->rx_dropped);
2507         st64->tx_dropped = tswap64(st64->tx_dropped);
2508         st64->multicast = tswap64(st64->multicast);
2509         st64->collisions = tswap64(st64->collisions);
2510
2511         /* detailed rx_errors: */
2512         st64->rx_length_errors = tswap64(st64->rx_length_errors);
2513         st64->rx_over_errors = tswap64(st64->rx_over_errors);
2514         st64->rx_crc_errors = tswap64(st64->rx_crc_errors);
2515         st64->rx_frame_errors = tswap64(st64->rx_frame_errors);
2516         st64->rx_fifo_errors = tswap64(st64->rx_fifo_errors);
2517         st64->rx_missed_errors = tswap64(st64->rx_missed_errors);
2518
2519         /* detailed tx_errors */
2520         st64->tx_aborted_errors = tswap64(st64->tx_aborted_errors);
2521         st64->tx_carrier_errors = tswap64(st64->tx_carrier_errors);
2522         st64->tx_fifo_errors = tswap64(st64->tx_fifo_errors);
2523         st64->tx_heartbeat_errors = tswap64(st64->tx_heartbeat_errors);
2524         st64->tx_window_errors = tswap64(st64->tx_window_errors);
2525
2526         /* for cslip etc */
2527         st64->rx_compressed = tswap64(st64->rx_compressed);
2528         st64->tx_compressed = tswap64(st64->tx_compressed);
2529         break;
2530     /* struct rtnl_link_ifmap */
2531     case QEMU_IFLA_MAP:
2532         map = RTA_DATA(rtattr);
2533         map->mem_start = tswap64(map->mem_start);
2534         map->mem_end = tswap64(map->mem_end);
2535         map->base_addr = tswap64(map->base_addr);
2536         map->irq = tswap16(map->irq);
2537         break;
2538     /* nested */
2539     case QEMU_IFLA_LINKINFO:
2540         memset(&li_context, 0, sizeof(li_context));
2541         return host_to_target_for_each_nlattr(RTA_DATA(rtattr), rtattr->rta_len,
2542                                               &li_context,
2543                                            host_to_target_data_linkinfo_nlattr);
2544     case QEMU_IFLA_AF_SPEC:
2545         return host_to_target_for_each_nlattr(RTA_DATA(rtattr), rtattr->rta_len,
2546                                               NULL,
2547                                              host_to_target_data_spec_nlattr);
2548     default:
2549         gemu_log("Unknown host QEMU_IFLA type: %d\n", rtattr->rta_type);
2550         break;
2551     }
2552     return 0;
2553 }
2554
2555 static abi_long host_to_target_data_addr_rtattr(struct rtattr *rtattr)
2556 {
2557     uint32_t *u32;
2558     struct ifa_cacheinfo *ci;
2559
2560     switch (rtattr->rta_type) {
2561     /* binary: depends on family type */
2562     case IFA_ADDRESS:
2563     case IFA_LOCAL:
2564         break;
2565     /* string */
2566     case IFA_LABEL:
2567         break;
2568     /* u32 */
2569     case IFA_FLAGS:
2570     case IFA_BROADCAST:
2571         u32 = RTA_DATA(rtattr);
2572         *u32 = tswap32(*u32);
2573         break;
2574     /* struct ifa_cacheinfo */
2575     case IFA_CACHEINFO:
2576         ci = RTA_DATA(rtattr);
2577         ci->ifa_prefered = tswap32(ci->ifa_prefered);
2578         ci->ifa_valid = tswap32(ci->ifa_valid);
2579         ci->cstamp = tswap32(ci->cstamp);
2580         ci->tstamp = tswap32(ci->tstamp);
2581         break;
2582     default:
2583         gemu_log("Unknown host IFA type: %d\n", rtattr->rta_type);
2584         break;
2585     }
2586     return 0;
2587 }
2588
2589 static abi_long host_to_target_data_route_rtattr(struct rtattr *rtattr)
2590 {
2591     uint32_t *u32;
2592     switch (rtattr->rta_type) {
2593     /* binary: depends on family type */
2594     case RTA_GATEWAY:
2595     case RTA_DST:
2596     case RTA_PREFSRC:
2597         break;
2598     /* u32 */
2599     case RTA_PRIORITY:
2600     case RTA_TABLE:
2601     case RTA_OIF:
2602         u32 = RTA_DATA(rtattr);
2603         *u32 = tswap32(*u32);
2604         break;
2605     default:
2606         gemu_log("Unknown host RTA type: %d\n", rtattr->rta_type);
2607         break;
2608     }
2609     return 0;
2610 }
2611
2612 static abi_long host_to_target_link_rtattr(struct rtattr *rtattr,
2613                                          uint32_t rtattr_len)
2614 {
2615     return host_to_target_for_each_rtattr(rtattr, rtattr_len,
2616                                           host_to_target_data_link_rtattr);
2617 }
2618
2619 static abi_long host_to_target_addr_rtattr(struct rtattr *rtattr,
2620                                          uint32_t rtattr_len)
2621 {
2622     return host_to_target_for_each_rtattr(rtattr, rtattr_len,
2623                                           host_to_target_data_addr_rtattr);
2624 }
2625
2626 static abi_long host_to_target_route_rtattr(struct rtattr *rtattr,
2627                                          uint32_t rtattr_len)
2628 {
2629     return host_to_target_for_each_rtattr(rtattr, rtattr_len,
2630                                           host_to_target_data_route_rtattr);
2631 }
2632
2633 static abi_long host_to_target_data_route(struct nlmsghdr *nlh)
2634 {
2635     uint32_t nlmsg_len;
2636     struct ifinfomsg *ifi;
2637     struct ifaddrmsg *ifa;
2638     struct rtmsg *rtm;
2639
2640     nlmsg_len = nlh->nlmsg_len;
2641     switch (nlh->nlmsg_type) {
2642     case RTM_NEWLINK:
2643     case RTM_DELLINK:
2644     case RTM_GETLINK:
2645         if (nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(*ifi))) {
2646             ifi = NLMSG_DATA(nlh);
2647             ifi->ifi_type = tswap16(ifi->ifi_type);
2648             ifi->ifi_index = tswap32(ifi->ifi_index);
2649             ifi->ifi_flags = tswap32(ifi->ifi_flags);
2650             ifi->ifi_change = tswap32(ifi->ifi_change);
2651             host_to_target_link_rtattr(IFLA_RTA(ifi),
2652                                        nlmsg_len - NLMSG_LENGTH(sizeof(*ifi)));
2653         }
2654         break;
2655     case RTM_NEWADDR:
2656     case RTM_DELADDR:
2657     case RTM_GETADDR:
2658         if (nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(*ifa))) {
2659             ifa = NLMSG_DATA(nlh);
2660             ifa->ifa_index = tswap32(ifa->ifa_index);
2661             host_to_target_addr_rtattr(IFA_RTA(ifa),
2662                                        nlmsg_len - NLMSG_LENGTH(sizeof(*ifa)));
2663         }
2664         break;
2665     case RTM_NEWROUTE:
2666     case RTM_DELROUTE:
2667     case RTM_GETROUTE:
2668         if (nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(*rtm))) {
2669             rtm = NLMSG_DATA(nlh);
2670             rtm->rtm_flags = tswap32(rtm->rtm_flags);
2671             host_to_target_route_rtattr(RTM_RTA(rtm),
2672                                         nlmsg_len - NLMSG_LENGTH(sizeof(*rtm)));
2673         }
2674         break;
2675     default:
2676         return -TARGET_EINVAL;
2677     }
2678     return 0;
2679 }
2680
2681 static inline abi_long host_to_target_nlmsg_route(struct nlmsghdr *nlh,
2682                                                   size_t len)
2683 {
2684     return host_to_target_for_each_nlmsg(nlh, len, host_to_target_data_route);
2685 }
2686
2687 static abi_long target_to_host_for_each_rtattr(struct rtattr *rtattr,
2688                                                size_t len,
2689                                                abi_long (*target_to_host_rtattr)
2690                                                         (struct rtattr *))
2691 {
2692     abi_long ret;
2693
2694     while (len >= sizeof(struct rtattr)) {
2695         if (tswap16(rtattr->rta_len) < sizeof(struct rtattr) ||
2696             tswap16(rtattr->rta_len) > len) {
2697             break;
2698         }
2699         rtattr->rta_len = tswap16(rtattr->rta_len);
2700         rtattr->rta_type = tswap16(rtattr->rta_type);
2701         ret = target_to_host_rtattr(rtattr);
2702         if (ret < 0) {
2703             return ret;
2704         }
2705         len -= RTA_ALIGN(rtattr->rta_len);
2706         rtattr = (struct rtattr *)(((char *)rtattr) +
2707                  RTA_ALIGN(rtattr->rta_len));
2708     }
2709     return 0;
2710 }
2711
2712 static abi_long target_to_host_data_link_rtattr(struct rtattr *rtattr)
2713 {
2714     switch (rtattr->rta_type) {
2715     default:
2716         gemu_log("Unknown target QEMU_IFLA type: %d\n", rtattr->rta_type);
2717         break;
2718     }
2719     return 0;
2720 }
2721
2722 static abi_long target_to_host_data_addr_rtattr(struct rtattr *rtattr)
2723 {
2724     switch (rtattr->rta_type) {
2725     /* binary: depends on family type */
2726     case IFA_LOCAL:
2727     case IFA_ADDRESS:
2728         break;
2729     default:
2730         gemu_log("Unknown target IFA type: %d\n", rtattr->rta_type);
2731         break;
2732     }
2733     return 0;
2734 }
2735
2736 static abi_long target_to_host_data_route_rtattr(struct rtattr *rtattr)
2737 {
2738     uint32_t *u32;
2739     switch (rtattr->rta_type) {
2740     /* binary: depends on family type */
2741     case RTA_DST:
2742     case RTA_SRC:
2743     case RTA_GATEWAY:
2744         break;
2745     /* u32 */
2746     case RTA_PRIORITY:
2747     case RTA_OIF:
2748         u32 = RTA_DATA(rtattr);
2749         *u32 = tswap32(*u32);
2750         break;
2751     default:
2752         gemu_log("Unknown target RTA type: %d\n", rtattr->rta_type);
2753         break;
2754     }
2755     return 0;
2756 }
2757
2758 static void target_to_host_link_rtattr(struct rtattr *rtattr,
2759                                        uint32_t rtattr_len)
2760 {
2761     target_to_host_for_each_rtattr(rtattr, rtattr_len,
2762                                    target_to_host_data_link_rtattr);
2763 }
2764
2765 static void target_to_host_addr_rtattr(struct rtattr *rtattr,
2766                                      uint32_t rtattr_len)
2767 {
2768     target_to_host_for_each_rtattr(rtattr, rtattr_len,
2769                                    target_to_host_data_addr_rtattr);
2770 }
2771
2772 static void target_to_host_route_rtattr(struct rtattr *rtattr,
2773                                      uint32_t rtattr_len)
2774 {
2775     target_to_host_for_each_rtattr(rtattr, rtattr_len,
2776                                    target_to_host_data_route_rtattr);
2777 }
2778
2779 static abi_long target_to_host_data_route(struct nlmsghdr *nlh)
2780 {
2781     struct ifinfomsg *ifi;
2782     struct ifaddrmsg *ifa;
2783     struct rtmsg *rtm;
2784
2785     switch (nlh->nlmsg_type) {
2786     case RTM_GETLINK:
2787         break;
2788     case RTM_NEWLINK:
2789     case RTM_DELLINK:
2790         if (nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(*ifi))) {
2791             ifi = NLMSG_DATA(nlh);
2792             ifi->ifi_type = tswap16(ifi->ifi_type);
2793             ifi->ifi_index = tswap32(ifi->ifi_index);
2794             ifi->ifi_flags = tswap32(ifi->ifi_flags);
2795             ifi->ifi_change = tswap32(ifi->ifi_change);
2796             target_to_host_link_rtattr(IFLA_RTA(ifi), nlh->nlmsg_len -
2797                                        NLMSG_LENGTH(sizeof(*ifi)));
2798         }
2799         break;
2800     case RTM_GETADDR:
2801     case RTM_NEWADDR:
2802     case RTM_DELADDR:
2803         if (nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(*ifa))) {
2804             ifa = NLMSG_DATA(nlh);
2805             ifa->ifa_index = tswap32(ifa->ifa_index);
2806             target_to_host_addr_rtattr(IFA_RTA(ifa), nlh->nlmsg_len -
2807                                        NLMSG_LENGTH(sizeof(*ifa)));
2808         }
2809         break;
2810     case RTM_GETROUTE:
2811         break;
2812     case RTM_NEWROUTE:
2813     case RTM_DELROUTE:
2814         if (nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(*rtm))) {
2815             rtm = NLMSG_DATA(nlh);
2816             rtm->rtm_flags = tswap32(rtm->rtm_flags);
2817             target_to_host_route_rtattr(RTM_RTA(rtm), nlh->nlmsg_len -
2818                                         NLMSG_LENGTH(sizeof(*rtm)));
2819         }
2820         break;
2821     default:
2822         return -TARGET_EOPNOTSUPP;
2823     }
2824     return 0;
2825 }
2826
2827 static abi_long target_to_host_nlmsg_route(struct nlmsghdr *nlh, size_t len)
2828 {
2829     return target_to_host_for_each_nlmsg(nlh, len, target_to_host_data_route);
2830 }
2831 #endif /* CONFIG_RTNETLINK */
2832
2833 static abi_long host_to_target_data_audit(struct nlmsghdr *nlh)
2834 {
2835     switch (nlh->nlmsg_type) {
2836     default:
2837         gemu_log("Unknown host audit message type %d\n",
2838                  nlh->nlmsg_type);
2839         return -TARGET_EINVAL;
2840     }
2841     return 0;
2842 }
2843
2844 static inline abi_long host_to_target_nlmsg_audit(struct nlmsghdr *nlh,
2845                                                   size_t len)
2846 {
2847     return host_to_target_for_each_nlmsg(nlh, len, host_to_target_data_audit);
2848 }
2849
2850 static abi_long target_to_host_data_audit(struct nlmsghdr *nlh)
2851 {
2852     switch (nlh->nlmsg_type) {
2853     case AUDIT_USER:
2854     case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
2855     case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
2856         break;
2857     default:
2858         gemu_log("Unknown target audit message type %d\n",
2859                  nlh->nlmsg_type);
2860         return -TARGET_EINVAL;
2861     }
2862
2863     return 0;
2864 }
2865
2866 static abi_long target_to_host_nlmsg_audit(struct nlmsghdr *nlh, size_t len)
2867 {
2868     return target_to_host_for_each_nlmsg(nlh, len, target_to_host_data_audit);
2869 }
2870
2871 /* do_setsockopt() Must return target values and target errnos. */
2872 static abi_long do_setsockopt(int sockfd, int level, int optname,
2873                               abi_ulong optval_addr, socklen_t optlen)
2874 {
2875     abi_long ret;
2876     int val;
2877     struct ip_mreqn *ip_mreq;
2878     struct ip_mreq_source *ip_mreq_source;
2879
2880     switch(level) {
2881     case SOL_TCP:
2882         /* TCP options all take an 'int' value.  */
2883         if (optlen < sizeof(uint32_t))
2884             return -TARGET_EINVAL;
2885
2886         if (get_user_u32(val, optval_addr))
2887             return -TARGET_EFAULT;
2888         ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
2889         break;
2890     case SOL_IP:
2891         switch(optname) {
2892         case IP_TOS:
2893         case IP_TTL:
2894         case IP_HDRINCL:
2895         case IP_ROUTER_ALERT:
2896         case IP_RECVOPTS:
2897         case IP_RETOPTS:
2898         case IP_PKTINFO:
2899         case IP_MTU_DISCOVER:
2900         case IP_RECVERR:
2901         case IP_RECVTTL:
2902         case IP_RECVTOS:
2903 #ifdef IP_FREEBIND
2904         case IP_FREEBIND:
2905 #endif
2906         case IP_MULTICAST_TTL:
2907         case IP_MULTICAST_LOOP:
2908             val = 0;
2909             if (optlen >= sizeof(uint32_t)) {
2910                 if (get_user_u32(val, optval_addr))
2911                     return -TARGET_EFAULT;
2912             } else if (optlen >= 1) {
2913                 if (get_user_u8(val, optval_addr))
2914                     return -TARGET_EFAULT;
2915             }
2916             ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
2917             break;
2918         case IP_ADD_MEMBERSHIP:
2919         case IP_DROP_MEMBERSHIP:
2920             if (optlen < sizeof (struct target_ip_mreq) ||
2921                 optlen > sizeof (struct target_ip_mreqn))
2922                 return -TARGET_EINVAL;
2923
2924             ip_mreq = (struct ip_mreqn *) alloca(optlen);
2925             target_to_host_ip_mreq(ip_mreq, optval_addr, optlen);
2926             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq, optlen));
2927             break;
2928
2929         case IP_BLOCK_SOURCE:
2930         case IP_UNBLOCK_SOURCE:
2931         case IP_ADD_SOURCE_MEMBERSHIP:
2932         case IP_DROP_SOURCE_MEMBERSHIP:
2933             if (optlen != sizeof (struct target_ip_mreq_source))
2934                 return -TARGET_EINVAL;
2935
2936             ip_mreq_source = lock_user(VERIFY_READ, optval_addr, optlen, 1);
2937             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq_source, optlen));
2938             unlock_user (ip_mreq_source, optval_addr, 0);
2939             break;
2940
2941         default:
2942             goto unimplemented;
2943         }
2944         break;
2945     case SOL_IPV6:
2946         switch (optname) {
2947         case IPV6_MTU_DISCOVER:
2948         case IPV6_MTU:
2949         case IPV6_V6ONLY:
2950         case IPV6_RECVPKTINFO:
2951         case IPV6_UNICAST_HOPS:
2952         case IPV6_RECVERR:
2953         case IPV6_RECVHOPLIMIT:
2954         case IPV6_2292HOPLIMIT:
2955         case IPV6_CHECKSUM:
2956             val = 0;
2957             if (optlen < sizeof(uint32_t)) {
2958                 return -TARGET_EINVAL;
2959             }
2960             if (get_user_u32(val, optval_addr)) {
2961                 return -TARGET_EFAULT;
2962             }
2963             ret = get_errno(setsockopt(sockfd, level, optname,
2964                                        &val, sizeof(val)));
2965             break;
2966         case IPV6_PKTINFO:
2967         {
2968             struct in6_pktinfo pki;
2969
2970             if (optlen < sizeof(pki)) {
2971                 return -TARGET_EINVAL;
2972             }
2973
2974             if (copy_from_user(&pki, optval_addr, sizeof(pki))) {
2975                 return -TARGET_EFAULT;
2976             }
2977
2978             pki.ipi6_ifindex = tswap32(pki.ipi6_ifindex);
2979
2980             ret = get_errno(setsockopt(sockfd, level, optname,
2981                                        &pki, sizeof(pki)));
2982             break;
2983         }
2984         default:
2985             goto unimplemented;
2986         }
2987         break;
2988     case SOL_ICMPV6:
2989         switch (optname) {
2990         case ICMPV6_FILTER:
2991         {
2992             struct icmp6_filter icmp6f;
2993
2994             if (optlen > sizeof(icmp6f)) {
2995                 optlen = sizeof(icmp6f);
2996             }
2997
2998             if (copy_from_user(&icmp6f, optval_addr, optlen)) {
2999                 return -TARGET_EFAULT;
3000             }
3001
3002             for (val = 0; val < 8; val++) {
3003                 icmp6f.data[val] = tswap32(icmp6f.data[val]);
3004             }
3005
3006             ret = get_errno(setsockopt(sockfd, level, optname,
3007                                        &icmp6f, optlen));
3008             break;
3009         }
3010         default:
3011             goto unimplemented;
3012         }
3013         break;
3014     case SOL_RAW:
3015         switch (optname) {
3016         case ICMP_FILTER:
3017         case IPV6_CHECKSUM:
3018             /* those take an u32 value */
3019             if (optlen < sizeof(uint32_t)) {
3020                 return -TARGET_EINVAL;
3021             }
3022
3023             if (get_user_u32(val, optval_addr)) {
3024                 return -TARGET_EFAULT;
3025             }
3026             ret = get_errno(setsockopt(sockfd, level, optname,
3027                                        &val, sizeof(val)));
3028             break;
3029
3030         default:
3031             goto unimplemented;
3032         }
3033         break;
3034     case TARGET_SOL_SOCKET:
3035         switch (optname) {
3036         case TARGET_SO_RCVTIMEO:
3037         {
3038                 struct timeval tv;
3039
3040                 optname = SO_RCVTIMEO;
3041
3042 set_timeout:
3043                 if (optlen != sizeof(struct target_timeval)) {
3044                     return -TARGET_EINVAL;
3045                 }
3046
3047                 if (copy_from_user_timeval(&tv, optval_addr)) {
3048                     return -TARGET_EFAULT;
3049                 }
3050
3051                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
3052                                 &tv, sizeof(tv)));
3053                 return ret;
3054         }
3055         case TARGET_SO_SNDTIMEO:
3056                 optname = SO_SNDTIMEO;
3057                 goto set_timeout;
3058         case TARGET_SO_ATTACH_FILTER:
3059         {
3060                 struct target_sock_fprog *tfprog;
3061                 struct target_sock_filter *tfilter;
3062                 struct sock_fprog fprog;
3063                 struct sock_filter *filter;
3064                 int i;
3065
3066                 if (optlen != sizeof(*tfprog)) {
3067                     return -TARGET_EINVAL;
3068                 }
3069                 if (!lock_user_struct(VERIFY_READ, tfprog, optval_addr, 0)) {
3070                     return -TARGET_EFAULT;
3071                 }
3072                 if (!lock_user_struct(VERIFY_READ, tfilter,
3073                                       tswapal(tfprog->filter), 0)) {
3074                     unlock_user_struct(tfprog, optval_addr, 1);
3075                     return -TARGET_EFAULT;
3076                 }
3077
3078                 fprog.len = tswap16(tfprog->len);
3079                 filter = g_try_new(struct sock_filter, fprog.len);
3080                 if (filter == NULL) {
3081                     unlock_user_struct(tfilter, tfprog->filter, 1);
3082                     unlock_user_struct(tfprog, optval_addr, 1);
3083                     return -TARGET_ENOMEM;
3084                 }
3085                 for (i = 0; i < fprog.len; i++) {
3086                     filter[i].code = tswap16(tfilter[i].code);
3087                     filter[i].jt = tfilter[i].jt;
3088                     filter[i].jf = tfilter[i].jf;
3089                     filter[i].k = tswap32(tfilter[i].k);
3090                 }
3091                 fprog.filter = filter;
3092
3093                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET,
3094                                 SO_ATTACH_FILTER, &fprog, sizeof(fprog)));
3095                 g_free(filter);
3096
3097                 unlock_user_struct(tfilter, tfprog->filter, 1);
3098                 unlock_user_struct(tfprog, optval_addr, 1);
3099                 return ret;
3100         }
3101         case TARGET_SO_BINDTODEVICE:
3102         {
3103                 char *dev_ifname, *addr_ifname;
3104
3105                 if (optlen > IFNAMSIZ - 1) {
3106                     optlen = IFNAMSIZ - 1;
3107                 }
3108                 dev_ifname = lock_user(VERIFY_READ, optval_addr, optlen, 1);
3109                 if (!dev_ifname) {
3110                     return -TARGET_EFAULT;
3111                 }
3112                 optname = SO_BINDTODEVICE;
3113                 addr_ifname = alloca(IFNAMSIZ);
3114                 memcpy(addr_ifname, dev_ifname, optlen);
3115                 addr_ifname[optlen] = 0;
3116                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
3117                                            addr_ifname, optlen));
3118                 unlock_user (dev_ifname, optval_addr, 0);
3119                 return ret;
3120         }
3121             /* Options with 'int' argument.  */
3122         case TARGET_SO_DEBUG:
3123                 optname = SO_DEBUG;
3124                 break;
3125         case TARGET_SO_REUSEADDR:
3126                 optname = SO_REUSEADDR;
3127                 break;
3128         case TARGET_SO_TYPE:
3129                 optname = SO_TYPE;
3130                 break;
3131         case TARGET_SO_ERROR:
3132                 optname = SO_ERROR;
3133                 break;
3134         case TARGET_SO_DONTROUTE:
3135                 optname = SO_DONTROUTE;
3136                 break;
3137         case TARGET_SO_BROADCAST:
3138                 optname = SO_BROADCAST;
3139                 break;
3140         case TARGET_SO_SNDBUF:
3141                 optname = SO_SNDBUF;
3142                 break;
3143         case TARGET_SO_SNDBUFFORCE:
3144                 optname = SO_SNDBUFFORCE;
3145                 break;
3146         case TARGET_SO_RCVBUF:
3147                 optname = SO_RCVBUF;
3148                 break;
3149         case TARGET_SO_RCVBUFFORCE:
3150                 optname = SO_RCVBUFFORCE;
3151                 break;
3152         case TARGET_SO_KEEPALIVE:
3153                 optname = SO_KEEPALIVE;
3154                 break;
3155         case TARGET_SO_OOBINLINE:
3156                 optname = SO_OOBINLINE;
3157                 break;
3158         case TARGET_SO_NO_CHECK:
3159                 optname = SO_NO_CHECK;
3160                 break;
3161         case TARGET_SO_PRIORITY:
3162                 optname = SO_PRIORITY;
3163                 break;
3164 #ifdef SO_BSDCOMPAT
3165         case TARGET_SO_BSDCOMPAT:
3166                 optname = SO_BSDCOMPAT;
3167                 break;
3168 #endif
3169         case TARGET_SO_PASSCRED:
3170                 optname = SO_PASSCRED;
3171                 break;
3172         case TARGET_SO_PASSSEC:
3173                 optname = SO_PASSSEC;
3174                 break;
3175         case TARGET_SO_TIMESTAMP:
3176                 optname = SO_TIMESTAMP;
3177                 break;
3178         case TARGET_SO_RCVLOWAT:
3179                 optname = SO_RCVLOWAT;
3180                 break;
3181         default:
3182             goto unimplemented;
3183         }
3184         if (optlen < sizeof(uint32_t))
3185             return -TARGET_EINVAL;
3186
3187         if (get_user_u32(val, optval_addr))
3188             return -TARGET_EFAULT;
3189         ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname, &val, sizeof(val)));
3190         break;
3191     default:
3192     unimplemented:
3193         gemu_log("Unsupported setsockopt level=%d optname=%d\n", level, optname);
3194         ret = -TARGET_ENOPROTOOPT;
3195     }
3196     return ret;
3197 }
3198
3199 /* do_getsockopt() Must return target values and target errnos. */
3200 static abi_long do_getsockopt(int sockfd, int level, int optname,
3201                               abi_ulong optval_addr, abi_ulong optlen)
3202 {
3203     abi_long ret;
3204     int len, val;
3205     socklen_t lv;
3206
3207     switch(level) {
3208     case TARGET_SOL_SOCKET:
3209         level = SOL_SOCKET;
3210         switch (optname) {
3211         /* These don't just return a single integer */
3212         case TARGET_SO_LINGER:
3213         case TARGET_SO_RCVTIMEO:
3214         case TARGET_SO_SNDTIMEO:
3215         case TARGET_SO_PEERNAME:
3216             goto unimplemented;
3217         case TARGET_SO_PEERCRED: {
3218             struct ucred cr;
3219             socklen_t crlen;
3220             struct target_ucred *tcr;
3221
3222             if (get_user_u32(len, optlen)) {
3223                 return -TARGET_EFAULT;
3224             }
3225             if (len < 0) {
3226                 return -TARGET_EINVAL;
3227             }
3228
3229             crlen = sizeof(cr);
3230             ret = get_errno(getsockopt(sockfd, level, SO_PEERCRED,
3231                                        &cr, &crlen));
3232             if (ret < 0) {
3233                 return ret;
3234             }
3235             if (len > crlen) {
3236                 len = crlen;
3237             }
3238             if (!lock_user_struct(VERIFY_WRITE, tcr, optval_addr, 0)) {
3239                 return -TARGET_EFAULT;
3240             }
3241             __put_user(cr.pid, &tcr->pid);
3242             __put_user(cr.uid, &tcr->uid);
3243             __put_user(cr.gid, &tcr->gid);
3244             unlock_user_struct(tcr, optval_addr, 1);
3245             if (put_user_u32(len, optlen)) {
3246                 return -TARGET_EFAULT;
3247             }
3248             break;
3249         }
3250         /* Options with 'int' argument.  */
3251         case TARGET_SO_DEBUG:
3252             optname = SO_DEBUG;
3253             goto int_case;
3254         case TARGET_SO_REUSEADDR:
3255             optname = SO_REUSEADDR;
3256             goto int_case;
3257         case TARGET_SO_TYPE:
3258             optname = SO_TYPE;
3259             goto int_case;
3260         case TARGET_SO_ERROR:
3261             optname = SO_ERROR;
3262             goto int_case;
3263         case TARGET_SO_DONTROUTE:
3264             optname = SO_DONTROUTE;
3265             goto int_case;
3266         case TARGET_SO_BROADCAST:
3267             optname = SO_BROADCAST;
3268             goto int_case;
3269         case TARGET_SO_SNDBUF:
3270             optname = SO_SNDBUF;
3271             goto int_case;
3272         case TARGET_SO_RCVBUF:
3273             optname = SO_RCVBUF;
3274             goto int_case;
3275         case TARGET_SO_KEEPALIVE:
3276             optname = SO_KEEPALIVE;
3277             goto int_case;
3278         case TARGET_SO_OOBINLINE:
3279             optname = SO_OOBINLINE;
3280             goto int_case;
3281         case TARGET_SO_NO_CHECK:
3282             optname = SO_NO_CHECK;
3283             goto int_case;
3284         case TARGET_SO_PRIORITY:
3285             optname = SO_PRIORITY;
3286             goto int_case;
3287 #ifdef SO_BSDCOMPAT
3288         case TARGET_SO_BSDCOMPAT:
3289             optname = SO_BSDCOMPAT;
3290             goto int_case;
3291 #endif
3292         case TARGET_SO_PASSCRED:
3293             optname = SO_PASSCRED;
3294             goto int_case;
3295         case TARGET_SO_TIMESTAMP:
3296             optname = SO_TIMESTAMP;
3297             goto int_case;
3298         case TARGET_SO_RCVLOWAT:
3299             optname = SO_RCVLOWAT;
3300             goto int_case;
3301         case TARGET_SO_ACCEPTCONN:
3302             optname = SO_ACCEPTCONN;
3303             goto int_case;
3304         default:
3305             goto int_case;
3306         }
3307         break;
3308     case SOL_TCP:
3309         /* TCP options all take an 'int' value.  */
3310     int_case:
3311         if (get_user_u32(len, optlen))
3312             return -TARGET_EFAULT;
3313         if (len < 0)
3314             return -TARGET_EINVAL;
3315         lv = sizeof(lv);
3316         ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
3317         if (ret < 0)
3318             return ret;
3319         if (optname == SO_TYPE) {
3320             val = host_to_target_sock_type(val);
3321         }
3322         if (len > lv)
3323             len = lv;
3324         if (len == 4) {
3325             if (put_user_u32(val, optval_addr))
3326                 return -TARGET_EFAULT;
3327         } else {
3328             if (put_user_u8(val, optval_addr))
3329                 return -TARGET_EFAULT;
3330         }
3331         if (put_user_u32(len, optlen))
3332             return -TARGET_EFAULT;
3333         break;
3334     case SOL_IP:
3335         switch(optname) {
3336         case IP_TOS:
3337         case IP_TTL:
3338         case IP_HDRINCL:
3339         case IP_ROUTER_ALERT:
3340         case IP_RECVOPTS:
3341         case IP_RETOPTS:
3342         case IP_PKTINFO:
3343         case IP_MTU_DISCOVER:
3344         case IP_RECVERR:
3345         case IP_RECVTOS:
3346 #ifdef IP_FREEBIND
3347         case IP_FREEBIND:
3348 #endif
3349         case IP_MULTICAST_TTL:
3350         case IP_MULTICAST_LOOP:
3351             if (get_user_u32(len, optlen))
3352                 return -TARGET_EFAULT;
3353             if (len < 0)
3354                 return -TARGET_EINVAL;
3355             lv = sizeof(lv);
3356             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
3357             if (ret < 0)
3358                 return ret;
3359             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
3360                 len = 1;
3361                 if (put_user_u32(len, optlen)
3362                     || put_user_u8(val, optval_addr))
3363                     return -TARGET_EFAULT;
3364             } else {
3365                 if (len > sizeof(int))
3366                     len = sizeof(int);
3367                 if (put_user_u32(len, optlen)
3368                     || put_user_u32(val, optval_addr))
3369                     return -TARGET_EFAULT;
3370             }
3371             break;
3372         default:
3373             ret = -TARGET_ENOPROTOOPT;
3374             break;
3375         }
3376         break;
3377     default:
3378     unimplemented:
3379         gemu_log("getsockopt level=%d optname=%d not yet supported\n",
3380                  level, optname);
3381         ret = -TARGET_EOPNOTSUPP;
3382         break;
3383     }
3384     return ret;
3385 }
3386
3387 static struct iovec *lock_iovec(int type, abi_ulong target_addr,
3388                                 abi_ulong count, int copy)
3389 {
3390     struct target_iovec *target_vec;
3391     struct iovec *vec;
3392     abi_ulong total_len, max_len;
3393     int i;
3394     int err = 0;
3395     bool bad_address = false;
3396
3397     if (count == 0) {
3398         errno = 0;
3399         return NULL;
3400     }
3401     if (count > IOV_MAX) {
3402         errno = EINVAL;
3403         return NULL;
3404     }
3405
3406     vec = g_try_new0(struct iovec, count);
3407     if (vec == NULL) {
3408         errno = ENOMEM;
3409         return NULL;
3410     }
3411
3412     target_vec = lock_user(VERIFY_READ, target_addr,
3413                            count * sizeof(struct target_iovec), 1);
3414     if (target_vec == NULL) {
3415         err = EFAULT;
3416         goto fail2;
3417     }
3418
3419     /* ??? If host page size > target page size, this will result in a
3420        value larger than what we can actually support.  */
3421     max_len = 0x7fffffff & TARGET_PAGE_MASK;
3422     total_len = 0;
3423
3424     for (i = 0; i < count; i++) {
3425         abi_ulong base = tswapal(target_vec[i].iov_base);
3426         abi_long len = tswapal(target_vec[i].iov_len);
3427
3428         if (len < 0) {
3429             err = EINVAL;
3430             goto fail;
3431         } else if (len == 0) {
3432             /* Zero length pointer is ignored.  */
3433             vec[i].iov_base = 0;
3434         } else {
3435             vec[i].iov_base = lock_user(type, base, len, copy);
3436             /* If the first buffer pointer is bad, this is a fault.  But
3437              * subsequent bad buffers will result in a partial write; this
3438              * is realized by filling the vector with null pointers and
3439              * zero lengths. */
3440             if (!vec[i].iov_base) {
3441                 if (i == 0) {
3442                     err = EFAULT;
3443                     goto fail;
3444                 } else {
3445                     bad_address = true;
3446                 }
3447             }
3448             if (bad_address) {
3449                 len = 0;
3450             }
3451             if (len > max_len - total_len) {
3452                 len = max_len - total_len;
3453             }
3454         }
3455         vec[i].iov_len = len;
3456         total_len += len;
3457     }
3458
3459     unlock_user(target_vec, target_addr, 0);
3460     return vec;
3461
3462  fail:
3463     while (--i >= 0) {
3464         if (tswapal(target_vec[i].iov_len) > 0) {
3465             unlock_user(vec[i].iov_base, tswapal(target_vec[i].iov_base), 0);
3466         }
3467     }
3468     unlock_user(target_vec, target_addr, 0);
3469  fail2:
3470     g_free(vec);
3471     errno = err;
3472     return NULL;
3473 }
3474
3475 static void unlock_iovec(struct iovec *vec, abi_ulong target_addr,
3476                          abi_ulong count, int copy)
3477 {
3478     struct target_iovec *target_vec;
3479     int i;
3480
3481     target_vec = lock_user(VERIFY_READ, target_addr,
3482                            count * sizeof(struct target_iovec), 1);
3483     if (target_vec) {
3484         for (i = 0; i < count; i++) {
3485             abi_ulong base = tswapal(target_vec[i].iov_base);
3486             abi_long len = tswapal(target_vec[i].iov_len);
3487             if (len < 0) {
3488                 break;
3489             }
3490             unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0);
3491         }
3492         unlock_user(target_vec, target_addr, 0);
3493     }
3494
3495     g_free(vec);
3496 }
3497
3498 static inline int target_to_host_sock_type(int *type)
3499 {
3500     int host_type = 0;
3501     int target_type = *type;
3502
3503     switch (target_type & TARGET_SOCK_TYPE_MASK) {
3504     case TARGET_SOCK_DGRAM:
3505         host_type = SOCK_DGRAM;
3506         break;
3507     case TARGET_SOCK_STREAM:
3508         host_type = SOCK_STREAM;
3509         break;
3510     default:
3511         host_type = target_type & TARGET_SOCK_TYPE_MASK;
3512         break;
3513     }
3514     if (target_type & TARGET_SOCK_CLOEXEC) {
3515 #if defined(SOCK_CLOEXEC)
3516         host_type |= SOCK_CLOEXEC;
3517 #else
3518         return -TARGET_EINVAL;
3519 #endif
3520     }
3521     if (target_type & TARGET_SOCK_NONBLOCK) {
3522 #if defined(SOCK_NONBLOCK)
3523         host_type |= SOCK_NONBLOCK;
3524 #elif !defined(O_NONBLOCK)
3525         return -TARGET_EINVAL;
3526 #endif
3527     }
3528     *type = host_type;
3529     return 0;
3530 }
3531
3532 /* Try to emulate socket type flags after socket creation.  */
3533 static int sock_flags_fixup(int fd, int target_type)
3534 {
3535 #if !defined(SOCK_NONBLOCK) && defined(O_NONBLOCK)
3536     if (target_type & TARGET_SOCK_NONBLOCK) {
3537         int flags = fcntl(fd, F_GETFL);
3538         if (fcntl(fd, F_SETFL, O_NONBLOCK | flags) == -1) {
3539             close(fd);
3540             return -TARGET_EINVAL;
3541         }
3542     }
3543 #endif
3544     return fd;
3545 }
3546
3547 static abi_long packet_target_to_host_sockaddr(void *host_addr,
3548                                                abi_ulong target_addr,
3549                                                socklen_t len)
3550 {
3551     struct sockaddr *addr = host_addr;
3552     struct target_sockaddr *target_saddr;
3553
3554     target_saddr = lock_user(VERIFY_READ, target_addr, len, 1);
3555     if (!target_saddr) {
3556         return -TARGET_EFAULT;
3557     }
3558
3559     memcpy(addr, target_saddr, len);
3560     addr->sa_family = tswap16(target_saddr->sa_family);
3561     /* spkt_protocol is big-endian */
3562
3563     unlock_user(target_saddr, target_addr, 0);
3564     return 0;
3565 }
3566
3567 static TargetFdTrans target_packet_trans = {
3568     .target_to_host_addr = packet_target_to_host_sockaddr,
3569 };
3570
3571 #ifdef CONFIG_RTNETLINK
3572 static abi_long netlink_route_target_to_host(void *buf, size_t len)
3573 {
3574     abi_long ret;
3575
3576     ret = target_to_host_nlmsg_route(buf, len);
3577     if (ret < 0) {
3578         return ret;
3579     }
3580
3581     return len;
3582 }
3583
3584 static abi_long netlink_route_host_to_target(void *buf, size_t len)
3585 {
3586     abi_long ret;
3587
3588     ret = host_to_target_nlmsg_route(buf, len);
3589     if (ret < 0) {
3590         return ret;
3591     }
3592
3593     return len;
3594 }
3595
3596 static TargetFdTrans target_netlink_route_trans = {
3597     .target_to_host_data = netlink_route_target_to_host,
3598     .host_to_target_data = netlink_route_host_to_target,
3599 };
3600 #endif /* CONFIG_RTNETLINK */
3601
3602 static abi_long netlink_audit_target_to_host(void *buf, size_t len)
3603 {
3604     abi_long ret;
3605
3606     ret = target_to_host_nlmsg_audit(buf, len);
3607     if (ret < 0) {
3608         return ret;
3609     }
3610
3611     return len;
3612 }
3613
3614 static abi_long netlink_audit_host_to_target(void *buf, size_t len)
3615 {
3616     abi_long ret;
3617
3618     ret = host_to_target_nlmsg_audit(buf, len);
3619     if (ret < 0) {
3620         return ret;
3621     }
3622
3623     return len;
3624 }
3625
3626 static TargetFdTrans target_netlink_audit_trans = {
3627     .target_to_host_data = netlink_audit_target_to_host,
3628     .host_to_target_data = netlink_audit_host_to_target,
3629 };
3630
3631 /* do_socket() Must return target values and target errnos. */
3632 static abi_long do_socket(int domain, int type, int protocol)
3633 {
3634     int target_type = type;
3635     int ret;
3636
3637     ret = target_to_host_sock_type(&type);
3638     if (ret) {
3639         return ret;
3640     }
3641
3642     if (domain == PF_NETLINK && !(
3643 #ifdef CONFIG_RTNETLINK
3644          protocol == NETLINK_ROUTE ||
3645 #endif
3646          protocol == NETLINK_KOBJECT_UEVENT ||
3647          protocol == NETLINK_AUDIT)) {
3648         return -EPFNOSUPPORT;
3649     }
3650
3651     if (domain == AF_PACKET ||
3652         (domain == AF_INET && type == SOCK_PACKET)) {
3653         protocol = tswap16(protocol);
3654     }
3655
3656     ret = get_errno(socket(domain, type, protocol));
3657     if (ret >= 0) {
3658         ret = sock_flags_fixup(ret, target_type);
3659         if (type == SOCK_PACKET) {
3660             /* Manage an obsolete case :
3661              * if socket type is SOCK_PACKET, bind by name
3662              */
3663             fd_trans_register(ret, &target_packet_trans);
3664         } else if (domain == PF_NETLINK) {
3665             switch (protocol) {
3666 #ifdef CONFIG_RTNETLINK
3667             case NETLINK_ROUTE:
3668                 fd_trans_register(ret, &target_netlink_route_trans);
3669                 break;
3670 #endif
3671             case NETLINK_KOBJECT_UEVENT:
3672                 /* nothing to do: messages are strings */
3673                 break;
3674             case NETLINK_AUDIT:
3675                 fd_trans_register(ret, &target_netlink_audit_trans);
3676                 break;
3677             default:
3678                 g_assert_not_reached();
3679             }
3680         }
3681     }
3682     return ret;
3683 }
3684
3685 /* do_bind() Must return target values and target errnos. */
3686 static abi_long do_bind(int sockfd, abi_ulong target_addr,
3687                         socklen_t addrlen)
3688 {
3689     void *addr;
3690     abi_long ret;
3691
3692     if ((int)addrlen < 0) {
3693         return -TARGET_EINVAL;
3694     }
3695
3696     addr = alloca(addrlen+1);
3697
3698     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
3699     if (ret)
3700         return ret;
3701
3702     return get_errno(bind(sockfd, addr, addrlen));
3703 }
3704
3705 /* do_connect() Must return target values and target errnos. */
3706 static abi_long do_connect(int sockfd, abi_ulong target_addr,
3707                            socklen_t addrlen)
3708 {
3709     void *addr;
3710     abi_long ret;
3711
3712     if ((int)addrlen < 0) {
3713         return -TARGET_EINVAL;
3714     }
3715
3716     addr = alloca(addrlen+1);
3717
3718     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
3719     if (ret)
3720         return ret;
3721
3722     return get_errno(safe_connect(sockfd, addr, addrlen));
3723 }
3724
3725 /* do_sendrecvmsg_locked() Must return target values and target errnos. */
3726 static abi_long do_sendrecvmsg_locked(int fd, struct target_msghdr *msgp,
3727                                       int flags, int send)
3728 {
3729     abi_long ret, len;
3730     struct msghdr msg;
3731     abi_ulong count;
3732     struct iovec *vec;
3733     abi_ulong target_vec;
3734
3735     if (msgp->msg_name) {
3736         msg.msg_namelen = tswap32(msgp->msg_namelen);
3737         msg.msg_name = alloca(msg.msg_namelen+1);
3738         ret = target_to_host_sockaddr(fd, msg.msg_name,
3739                                       tswapal(msgp->msg_name),
3740                                       msg.msg_namelen);
3741         if (ret == -TARGET_EFAULT) {
3742             /* For connected sockets msg_name and msg_namelen must
3743              * be ignored, so returning EFAULT immediately is wrong.
3744              * Instead, pass a bad msg_name to the host kernel, and
3745              * let it decide whether to return EFAULT or not.
3746              */
3747             msg.msg_name = (void *)-1;
3748         } else if (ret) {
3749             goto out2;
3750         }
3751     } else {
3752         msg.msg_name = NULL;
3753         msg.msg_namelen = 0;
3754     }
3755     msg.msg_controllen = 2 * tswapal(msgp->msg_controllen);
3756     msg.msg_control = alloca(msg.msg_controllen);
3757     msg.msg_flags = tswap32(msgp->msg_flags);
3758
3759     count = tswapal(msgp->msg_iovlen);
3760     target_vec = tswapal(msgp->msg_iov);
3761
3762     if (count > IOV_MAX) {
3763         /* sendrcvmsg returns a different errno for this condition than
3764          * readv/writev, so we must catch it here before lock_iovec() does.
3765          */
3766         ret = -TARGET_EMSGSIZE;
3767         goto out2;
3768     }
3769
3770     vec = lock_iovec(send ? VERIFY_READ : VERIFY_WRITE,
3771                      target_vec, count, send);
3772     if (vec == NULL) {
3773         ret = -host_to_target_errno(errno);
3774         goto out2;
3775     }
3776     msg.msg_iovlen = count;
3777     msg.msg_iov = vec;
3778
3779     if (send) {
3780         if (fd_trans_target_to_host_data(fd)) {
3781             void *host_msg;
3782
3783             host_msg = g_malloc(msg.msg_iov->iov_len);
3784             memcpy(host_msg, msg.msg_iov->iov_base, msg.msg_iov->iov_len);
3785             ret = fd_trans_target_to_host_data(fd)(host_msg,
3786                                                    msg.msg_iov->iov_len);
3787             if (ret >= 0) {
3788                 msg.msg_iov->iov_base = host_msg;
3789                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
3790             }
3791             g_free(host_msg);
3792         } else {
3793             ret = target_to_host_cmsg(&msg, msgp);
3794             if (ret == 0) {
3795                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
3796             }
3797         }
3798     } else {
3799         ret = get_errno(safe_recvmsg(fd, &msg, flags));
3800         if (!is_error(ret)) {
3801             len = ret;
3802             if (fd_trans_host_to_target_data(fd)) {
3803                 ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base,
3804                                                        len);
3805             } else {
3806                 ret = host_to_target_cmsg(msgp, &msg);
3807             }
3808             if (!is_error(ret)) {
3809                 msgp->msg_namelen = tswap32(msg.msg_namelen);
3810                 if (msg.msg_name != NULL && msg.msg_name != (void *)-1) {
3811                     ret = host_to_target_sockaddr(tswapal(msgp->msg_name),
3812                                     msg.msg_name, msg.msg_namelen);
3813                     if (ret) {
3814                         goto out;
3815                     }
3816                 }
3817
3818                 ret = len;
3819             }
3820         }
3821     }
3822
3823 out:
3824     unlock_iovec(vec, target_vec, count, !send);
3825 out2:
3826     return ret;
3827 }
3828
3829 static abi_long do_sendrecvmsg(int fd, abi_ulong target_msg,
3830                                int flags, int send)
3831 {
3832     abi_long ret;
3833     struct target_msghdr *msgp;
3834
3835     if (!lock_user_struct(send ? VERIFY_READ : VERIFY_WRITE,
3836                           msgp,
3837                           target_msg,
3838                           send ? 1 : 0)) {
3839         return -TARGET_EFAULT;
3840     }
3841     ret = do_sendrecvmsg_locked(fd, msgp, flags, send);
3842     unlock_user_struct(msgp, target_msg, send ? 0 : 1);
3843     return ret;
3844 }
3845
3846 /* We don't rely on the C library to have sendmmsg/recvmmsg support,
3847  * so it might not have this *mmsg-specific flag either.
3848  */
3849 #ifndef MSG_WAITFORONE
3850 #define MSG_WAITFORONE 0x10000
3851 #endif
3852
3853 static abi_long do_sendrecvmmsg(int fd, abi_ulong target_msgvec,
3854                                 unsigned int vlen, unsigned int flags,
3855                                 int send)
3856 {
3857     struct target_mmsghdr *mmsgp;
3858     abi_long ret = 0;
3859     int i;
3860
3861     if (vlen > UIO_MAXIOV) {
3862         vlen = UIO_MAXIOV;
3863     }
3864
3865     mmsgp = lock_user(VERIFY_WRITE, target_msgvec, sizeof(*mmsgp) * vlen, 1);
3866     if (!mmsgp) {
3867         return -TARGET_EFAULT;
3868     }
3869
3870     for (i = 0; i < vlen; i++) {
3871         ret = do_sendrecvmsg_locked(fd, &mmsgp[i].msg_hdr, flags, send);
3872         if (is_error(ret)) {
3873             break;
3874         }
3875         mmsgp[i].msg_len = tswap32(ret);
3876         /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
3877         if (flags & MSG_WAITFORONE) {
3878             flags |= MSG_DONTWAIT;
3879         }
3880     }
3881
3882     unlock_user(mmsgp, target_msgvec, sizeof(*mmsgp) * i);
3883
3884     /* Return number of datagrams sent if we sent any at all;
3885      * otherwise return the error.
3886      */
3887     if (i) {
3888         return i;
3889     }
3890     return ret;
3891 }
3892
3893 /* do_accept4() Must return target values and target errnos. */
3894 static abi_long do_accept4(int fd, abi_ulong target_addr,
3895                            abi_ulong target_addrlen_addr, int flags)
3896 {
3897     socklen_t addrlen;
3898     void *addr;
3899     abi_long ret;
3900     int host_flags;
3901
3902     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
3903
3904     if (target_addr == 0) {
3905         return get_errno(safe_accept4(fd, NULL, NULL, host_flags));
3906     }
3907
3908     /* linux returns EINVAL if addrlen pointer is invalid */
3909     if (get_user_u32(addrlen, target_addrlen_addr))
3910         return -TARGET_EINVAL;
3911
3912     if ((int)addrlen < 0) {
3913         return -TARGET_EINVAL;
3914     }
3915
3916     if (!access_ok(VERIFY_WRITE, target_addr, addrlen))
3917         return -TARGET_EINVAL;
3918
3919     addr = alloca(addrlen);
3920
3921     ret = get_errno(safe_accept4(fd, addr, &addrlen, host_flags));
3922     if (!is_error(ret)) {
3923         host_to_target_sockaddr(target_addr, addr, addrlen);
3924         if (put_user_u32(addrlen, target_addrlen_addr))
3925             ret = -TARGET_EFAULT;
3926     }
3927     return ret;
3928 }
3929
3930 /* do_getpeername() Must return target values and target errnos. */
3931 static abi_long do_getpeername(int fd, abi_ulong target_addr,
3932                                abi_ulong target_addrlen_addr)
3933 {
3934     socklen_t addrlen;
3935     void *addr;
3936     abi_long ret;
3937
3938     if (get_user_u32(addrlen, target_addrlen_addr))
3939         return -TARGET_EFAULT;
3940
3941     if ((int)addrlen < 0) {
3942         return -TARGET_EINVAL;
3943     }
3944
3945     if (!access_ok(VERIFY_WRITE, target_addr, addrlen))
3946         return -TARGET_EFAULT;
3947
3948     addr = alloca(addrlen);
3949
3950     ret = get_errno(getpeername(fd, addr, &addrlen));
3951     if (!is_error(ret)) {
3952         host_to_target_sockaddr(target_addr, addr, addrlen);
3953         if (put_user_u32(addrlen, target_addrlen_addr))
3954             ret = -TARGET_EFAULT;
3955     }
3956     return ret;
3957 }
3958
3959 /* do_getsockname() Must return target values and target errnos. */
3960 static abi_long do_getsockname(int fd, abi_ulong target_addr,
3961                                abi_ulong target_addrlen_addr)
3962 {
3963     socklen_t addrlen;
3964     void *addr;
3965     abi_long ret;
3966
3967     if (get_user_u32(addrlen, target_addrlen_addr))
3968         return -TARGET_EFAULT;
3969
3970     if ((int)addrlen < 0) {
3971         return -TARGET_EINVAL;
3972     }
3973
3974     if (!access_ok(VERIFY_WRITE, target_addr, addrlen))
3975         return -TARGET_EFAULT;
3976
3977     addr = alloca(addrlen);
3978
3979     ret = get_errno(getsockname(fd, addr, &addrlen));
3980     if (!is_error(ret)) {
3981         host_to_target_sockaddr(target_addr, addr, addrlen);
3982         if (put_user_u32(addrlen, target_addrlen_addr))
3983             ret = -TARGET_EFAULT;
3984     }
3985     return ret;
3986 }
3987
3988 /* do_socketpair() Must return target values and target errnos. */
3989 static abi_long do_socketpair(int domain, int type, int protocol,
3990                               abi_ulong target_tab_addr)
3991 {
3992     int tab[2];
3993     abi_long ret;
3994
3995     target_to_host_sock_type(&type);
3996
3997     ret = get_errno(socketpair(domain, type, protocol, tab));
3998     if (!is_error(ret)) {
3999         if (put_user_s32(tab[0], target_tab_addr)
4000             || put_user_s32(tab[1], target_tab_addr + sizeof(tab[0])))
4001             ret = -TARGET_EFAULT;
4002     }
4003     return ret;
4004 }
4005
4006 /* do_sendto() Must return target values and target errnos. */
4007 static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
4008                           abi_ulong target_addr, socklen_t addrlen)
4009 {
4010     void *addr;
4011     void *host_msg;
4012     void *copy_msg = NULL;
4013     abi_long ret;
4014
4015     if ((int)addrlen < 0) {
4016         return -TARGET_EINVAL;
4017     }
4018
4019     host_msg = lock_user(VERIFY_READ, msg, len, 1);
4020     if (!host_msg)
4021         return -TARGET_EFAULT;
4022     if (fd_trans_target_to_host_data(fd)) {
4023         copy_msg = host_msg;
4024         host_msg = g_malloc(len);
4025         memcpy(host_msg, copy_msg, len);
4026         ret = fd_trans_target_to_host_data(fd)(host_msg, len);
4027         if (ret < 0) {
4028             goto fail;
4029         }
4030     }
4031     if (target_addr) {
4032         addr = alloca(addrlen+1);
4033         ret = target_to_host_sockaddr(fd, addr, target_addr, addrlen);
4034         if (ret) {
4035             goto fail;
4036         }
4037         ret = get_errno(safe_sendto(fd, host_msg, len, flags, addr, addrlen));
4038     } else {
4039         ret = get_errno(safe_sendto(fd, host_msg, len, flags, NULL, 0));
4040     }
4041 fail:
4042     if (copy_msg) {
4043         g_free(host_msg);
4044         host_msg = copy_msg;
4045     }
4046     unlock_user(host_msg, msg, 0);
4047     return ret;
4048 }
4049
4050 /* do_recvfrom() Must return target values and target errnos. */
4051 static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
4052                             abi_ulong target_addr,
4053                             abi_ulong target_addrlen)
4054 {
4055     socklen_t addrlen;
4056     void *addr;
4057     void *host_msg;
4058     abi_long ret;
4059
4060     host_msg = lock_user(VERIFY_WRITE, msg, len, 0);
4061     if (!host_msg)
4062         return -TARGET_EFAULT;
4063     if (target_addr) {
4064         if (get_user_u32(addrlen, target_addrlen)) {
4065             ret = -TARGET_EFAULT;
4066             goto fail;
4067         }
4068         if ((int)addrlen < 0) {
4069             ret = -TARGET_EINVAL;
4070             goto fail;
4071         }
4072         addr = alloca(addrlen);
4073         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags,
4074                                       addr, &addrlen));
4075     } else {
4076         addr = NULL; /* To keep compiler quiet.  */
4077         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags, NULL, 0));
4078     }
4079     if (!is_error(ret)) {
4080         if (fd_trans_host_to_target_data(fd)) {
4081             ret = fd_trans_host_to_target_data(fd)(host_msg, ret);
4082         }
4083         if (target_addr) {
4084             host_to_target_sockaddr(target_addr, addr, addrlen);
4085             if (put_user_u32(addrlen, target_addrlen)) {
4086                 ret = -TARGET_EFAULT;
4087                 goto fail;
4088             }
4089         }
4090         unlock_user(host_msg, msg, len);
4091     } else {
4092 fail:
4093         unlock_user(host_msg, msg, 0);
4094     }
4095     return ret;
4096 }
4097
4098 #ifdef TARGET_NR_socketcall
4099 /* do_socketcall() must return target values and target errnos. */
4100 static abi_long do_socketcall(int num, abi_ulong vptr)
4101 {
4102     static const unsigned nargs[] = { /* number of arguments per operation */
4103         [TARGET_SYS_SOCKET] = 3,      /* domain, type, protocol */
4104         [TARGET_SYS_BIND] = 3,        /* fd, addr, addrlen */
4105         [TARGET_SYS_CONNECT] = 3,     /* fd, addr, addrlen */
4106         [TARGET_SYS_LISTEN] = 2,      /* fd, backlog */
4107         [TARGET_SYS_ACCEPT] = 3,      /* fd, addr, addrlen */
4108         [TARGET_SYS_GETSOCKNAME] = 3, /* fd, addr, addrlen */
4109         [TARGET_SYS_GETPEERNAME] = 3, /* fd, addr, addrlen */
4110         [TARGET_SYS_SOCKETPAIR] = 4,  /* domain, type, protocol, tab */
4111         [TARGET_SYS_SEND] = 4,        /* fd, msg, len, flags */
4112         [TARGET_SYS_RECV] = 4,        /* fd, msg, len, flags */
4113         [TARGET_SYS_SENDTO] = 6,      /* fd, msg, len, flags, addr, addrlen */
4114         [TARGET_SYS_RECVFROM] = 6,    /* fd, msg, len, flags, addr, addrlen */
4115         [TARGET_SYS_SHUTDOWN] = 2,    /* fd, how */
4116         [TARGET_SYS_SETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
4117         [TARGET_SYS_GETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
4118         [TARGET_SYS_SENDMSG] = 3,     /* fd, msg, flags */
4119         [TARGET_SYS_RECVMSG] = 3,     /* fd, msg, flags */
4120         [TARGET_SYS_ACCEPT4] = 4,     /* fd, addr, addrlen, flags */
4121         [TARGET_SYS_RECVMMSG] = 4,    /* fd, msgvec, vlen, flags */
4122         [TARGET_SYS_SENDMMSG] = 4,    /* fd, msgvec, vlen, flags */
4123     };
4124     abi_long a[6]; /* max 6 args */
4125     unsigned i;
4126
4127     /* check the range of the first argument num */
4128     /* (TARGET_SYS_SENDMMSG is the highest among TARGET_SYS_xxx) */
4129     if (num < 1 || num > TARGET_SYS_SENDMMSG) {
4130         return -TARGET_EINVAL;
4131     }
4132     /* ensure we have space for args */
4133     if (nargs[num] > ARRAY_SIZE(a)) {
4134         return -TARGET_EINVAL;
4135     }
4136     /* collect the arguments in a[] according to nargs[] */
4137     for (i = 0; i < nargs[num]; ++i) {
4138         if (get_user_ual(a[i], vptr + i * sizeof(abi_long)) != 0) {
4139             return -TARGET_EFAULT;
4140         }
4141     }
4142     /* now when we have the args, invoke the appropriate underlying function */
4143     switch (num) {
4144     case TARGET_SYS_SOCKET: /* domain, type, protocol */
4145         return do_socket(a[0], a[1], a[2]);
4146     case TARGET_SYS_BIND: /* sockfd, addr, addrlen */
4147         return do_bind(a[0], a[1], a[2]);
4148     case TARGET_SYS_CONNECT: /* sockfd, addr, addrlen */
4149         return do_connect(a[0], a[1], a[2]);
4150     case TARGET_SYS_LISTEN: /* sockfd, backlog */
4151         return get_errno(listen(a[0], a[1]));
4152     case TARGET_SYS_ACCEPT: /* sockfd, addr, addrlen */
4153         return do_accept4(a[0], a[1], a[2], 0);
4154     case TARGET_SYS_GETSOCKNAME: /* sockfd, addr, addrlen */
4155         return do_getsockname(a[0], a[1], a[2]);
4156     case TARGET_SYS_GETPEERNAME: /* sockfd, addr, addrlen */
4157         return do_getpeername(a[0], a[1], a[2]);
4158     case TARGET_SYS_SOCKETPAIR: /* domain, type, protocol, tab */
4159         return do_socketpair(a[0], a[1], a[2], a[3]);
4160     case TARGET_SYS_SEND: /* sockfd, msg, len, flags */
4161         return do_sendto(a[0], a[1], a[2], a[3], 0, 0);
4162     case TARGET_SYS_RECV: /* sockfd, msg, len, flags */
4163         return do_recvfrom(a[0], a[1], a[2], a[3], 0, 0);
4164     case TARGET_SYS_SENDTO: /* sockfd, msg, len, flags, addr, addrlen */
4165         return do_sendto(a[0], a[1], a[2], a[3], a[4], a[5]);
4166     case TARGET_SYS_RECVFROM: /* sockfd, msg, len, flags, addr, addrlen */
4167         return do_recvfrom(a[0], a[1], a[2], a[3], a[4], a[5]);
4168     case TARGET_SYS_SHUTDOWN: /* sockfd, how */
4169         return get_errno(shutdown(a[0], a[1]));
4170     case TARGET_SYS_SETSOCKOPT: /* sockfd, level, optname, optval, optlen */
4171         return do_setsockopt(a[0], a[1], a[2], a[3], a[4]);
4172     case TARGET_SYS_GETSOCKOPT: /* sockfd, level, optname, optval, optlen */
4173         return do_getsockopt(a[0], a[1], a[2], a[3], a[4]);
4174     case TARGET_SYS_SENDMSG: /* sockfd, msg, flags */
4175         return do_sendrecvmsg(a[0], a[1], a[2], 1);
4176     case TARGET_SYS_RECVMSG: /* sockfd, msg, flags */
4177         return do_sendrecvmsg(a[0], a[1], a[2], 0);
4178     case TARGET_SYS_ACCEPT4: /* sockfd, addr, addrlen, flags */
4179         return do_accept4(a[0], a[1], a[2], a[3]);
4180     case TARGET_SYS_RECVMMSG: /* sockfd, msgvec, vlen, flags */
4181         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 0);
4182     case TARGET_SYS_SENDMMSG: /* sockfd, msgvec, vlen, flags */
4183         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 1);
4184     default:
4185         gemu_log("Unsupported socketcall: %d\n", num);
4186         return -TARGET_EINVAL;
4187     }
4188 }
4189 #endif
4190
4191 #define N_SHM_REGIONS   32
4192
4193 static struct shm_region {
4194     abi_ulong start;
4195     abi_ulong size;
4196     bool in_use;
4197 } shm_regions[N_SHM_REGIONS];
4198
4199 #ifndef TARGET_SEMID64_DS
4200 /* asm-generic version of this struct */
4201 struct target_semid64_ds
4202 {
4203   struct target_ipc_perm sem_perm;
4204   abi_ulong sem_otime;
4205 #if TARGET_ABI_BITS == 32
4206   abi_ulong __unused1;
4207 #endif
4208   abi_ulong sem_ctime;
4209 #if TARGET_ABI_BITS == 32
4210   abi_ulong __unused2;
4211 #endif
4212   abi_ulong sem_nsems;
4213   abi_ulong __unused3;
4214   abi_ulong __unused4;
4215 };
4216 #endif
4217
4218 static inline abi_long target_to_host_ipc_perm(struct ipc_perm *host_ip,
4219                                                abi_ulong target_addr)
4220 {
4221     struct target_ipc_perm *target_ip;
4222     struct target_semid64_ds *target_sd;
4223
4224     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
4225         return -TARGET_EFAULT;
4226     target_ip = &(target_sd->sem_perm);
4227     host_ip->__key = tswap32(target_ip->__key);
4228     host_ip->uid = tswap32(target_ip->uid);
4229     host_ip->gid = tswap32(target_ip->gid);
4230     host_ip->cuid = tswap32(target_ip->cuid);
4231     host_ip->cgid = tswap32(target_ip->cgid);
4232 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
4233     host_ip->mode = tswap32(target_ip->mode);
4234 #else
4235     host_ip->mode = tswap16(target_ip->mode);
4236 #endif
4237 #if defined(TARGET_PPC)
4238     host_ip->__seq = tswap32(target_ip->__seq);
4239 #else
4240     host_ip->__seq = tswap16(target_ip->__seq);
4241 #endif
4242     unlock_user_struct(target_sd, target_addr, 0);
4243     return 0;
4244 }
4245
4246 static inline abi_long host_to_target_ipc_perm(abi_ulong target_addr,
4247                                                struct ipc_perm *host_ip)
4248 {
4249     struct target_ipc_perm *target_ip;
4250     struct target_semid64_ds *target_sd;
4251
4252     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
4253         return -TARGET_EFAULT;
4254     target_ip = &(target_sd->sem_perm);
4255     target_ip->__key = tswap32(host_ip->__key);
4256     target_ip->uid = tswap32(host_ip->uid);
4257     target_ip->gid = tswap32(host_ip->gid);
4258     target_ip->cuid = tswap32(host_ip->cuid);
4259     target_ip->cgid = tswap32(host_ip->cgid);
4260 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
4261     target_ip->mode = tswap32(host_ip->mode);
4262 #else
4263     target_ip->mode = tswap16(host_ip->mode);
4264 #endif
4265 #if defined(TARGET_PPC)
4266     target_ip->__seq = tswap32(host_ip->__seq);
4267 #else
4268     target_ip->__seq = tswap16(host_ip->__seq);
4269 #endif
4270     unlock_user_struct(target_sd, target_addr, 1);
4271     return 0;
4272 }
4273
4274 static inline abi_long target_to_host_semid_ds(struct semid_ds *host_sd,
4275                                                abi_ulong target_addr)
4276 {
4277     struct target_semid64_ds *target_sd;
4278
4279     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
4280         return -TARGET_EFAULT;
4281     if (target_to_host_ipc_perm(&(host_sd->sem_perm),target_addr))
4282         return -TARGET_EFAULT;
4283     host_sd->sem_nsems = tswapal(target_sd->sem_nsems);
4284     host_sd->sem_otime = tswapal(target_sd->sem_otime);
4285     host_sd->sem_ctime = tswapal(target_sd->sem_ctime);
4286     unlock_user_struct(target_sd, target_addr, 0);
4287     return 0;
4288 }
4289
4290 static inline abi_long host_to_target_semid_ds(abi_ulong target_addr,
4291                                                struct semid_ds *host_sd)
4292 {
4293     struct target_semid64_ds *target_sd;
4294
4295     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
4296         return -TARGET_EFAULT;
4297     if (host_to_target_ipc_perm(target_addr,&(host_sd->sem_perm)))
4298         return -TARGET_EFAULT;
4299     target_sd->sem_nsems = tswapal(host_sd->sem_nsems);
4300     target_sd->sem_otime = tswapal(host_sd->sem_otime);
4301     target_sd->sem_ctime = tswapal(host_sd->sem_ctime);
4302     unlock_user_struct(target_sd, target_addr, 1);
4303     return 0;
4304 }
4305
4306 struct target_seminfo {
4307     int semmap;
4308     int semmni;
4309     int semmns;
4310     int semmnu;
4311     int semmsl;
4312     int semopm;
4313     int semume;
4314     int semusz;
4315     int semvmx;
4316     int semaem;
4317 };
4318
4319 static inline abi_long host_to_target_seminfo(abi_ulong target_addr,
4320                                               struct seminfo *host_seminfo)
4321 {
4322     struct target_seminfo *target_seminfo;
4323     if (!lock_user_struct(VERIFY_WRITE, target_seminfo, target_addr, 0))
4324         return -TARGET_EFAULT;
4325     __put_user(host_seminfo->semmap, &target_seminfo->semmap);
4326     __put_user(host_seminfo->semmni, &target_seminfo->semmni);
4327     __put_user(host_seminfo->semmns, &target_seminfo->semmns);
4328     __put_user(host_seminfo->semmnu, &target_seminfo->semmnu);
4329     __put_user(host_seminfo->semmsl, &target_seminfo->semmsl);
4330     __put_user(host_seminfo->semopm, &target_seminfo->semopm);
4331     __put_user(host_seminfo->semume, &target_seminfo->semume);
4332     __put_user(host_seminfo->semusz, &target_seminfo->semusz);
4333     __put_user(host_seminfo->semvmx, &target_seminfo->semvmx);
4334     __put_user(host_seminfo->semaem, &target_seminfo->semaem);
4335     unlock_user_struct(target_seminfo, target_addr, 1);
4336     return 0;
4337 }
4338
4339 union semun {
4340         int val;
4341         struct semid_ds *buf;
4342         unsigned short *array;
4343         struct seminfo *__buf;
4344 };
4345
4346 union target_semun {
4347         int val;
4348         abi_ulong buf;
4349         abi_ulong array;
4350         abi_ulong __buf;
4351 };
4352
4353 static inline abi_long target_to_host_semarray(int semid, unsigned short **host_array,
4354                                                abi_ulong target_addr)
4355 {
4356     int nsems;
4357     unsigned short *array;
4358     union semun semun;
4359     struct semid_ds semid_ds;
4360     int i, ret;
4361
4362     semun.buf = &semid_ds;
4363
4364     ret = semctl(semid, 0, IPC_STAT, semun);
4365     if (ret == -1)
4366         return get_errno(ret);
4367
4368     nsems = semid_ds.sem_nsems;
4369
4370     *host_array = g_try_new(unsigned short, nsems);
4371     if (!*host_array) {
4372         return -TARGET_ENOMEM;
4373     }
4374     array = lock_user(VERIFY_READ, target_addr,
4375                       nsems*sizeof(unsigned short), 1);
4376     if (!array) {
4377         g_free(*host_array);
4378         return -TARGET_EFAULT;
4379     }
4380
4381     for(i=0; i<nsems; i++) {
4382         __get_user((*host_array)[i], &array[i]);
4383     }
4384     unlock_user(array, target_addr, 0);
4385
4386     return 0;
4387 }
4388
4389 static inline abi_long host_to_target_semarray(int semid, abi_ulong target_addr,
4390                                                unsigned short **host_array)
4391 {
4392     int nsems;
4393     unsigned short *array;
4394     union semun semun;
4395     struct semid_ds semid_ds;
4396     int i, ret;
4397
4398     semun.buf = &semid_ds;
4399
4400     ret = semctl(semid, 0, IPC_STAT, semun);
4401     if (ret == -1)
4402         return get_errno(ret);
4403
4404     nsems = semid_ds.sem_nsems;
4405
4406     array = lock_user(VERIFY_WRITE, target_addr,
4407                       nsems*sizeof(unsigned short), 0);
4408     if (!array)
4409         return -TARGET_EFAULT;
4410
4411     for(i=0; i<nsems; i++) {
4412         __put_user((*host_array)[i], &array[i]);
4413     }
4414     g_free(*host_array);
4415     unlock_user(array, target_addr, 1);
4416
4417     return 0;
4418 }
4419
4420 static inline abi_long do_semctl(int semid, int semnum, int cmd,
4421                                  abi_ulong target_arg)
4422 {
4423     union target_semun target_su = { .buf = target_arg };
4424     union semun arg;
4425     struct semid_ds dsarg;
4426     unsigned short *array = NULL;
4427     struct seminfo seminfo;
4428     abi_long ret = -TARGET_EINVAL;
4429     abi_long err;
4430     cmd &= 0xff;
4431
4432     switch( cmd ) {
4433         case GETVAL:
4434         case SETVAL:
4435             /* In 64 bit cross-endian situations, we will erroneously pick up
4436              * the wrong half of the union for the "val" element.  To rectify
4437              * this, the entire 8-byte structure is byteswapped, followed by
4438              * a swap of the 4 byte val field. In other cases, the data is
4439              * already in proper host byte order. */
4440             if (sizeof(target_su.val) != (sizeof(target_su.buf))) {
4441                 target_su.buf = tswapal(target_su.buf);
4442                 arg.val = tswap32(target_su.val);
4443             } else {
4444                 arg.val = target_su.val;
4445             }
4446             ret = get_errno(semctl(semid, semnum, cmd, arg));
4447             break;
4448         case GETALL:
4449         case SETALL:
4450             err = target_to_host_semarray(semid, &array, target_su.array);
4451             if (err)
4452                 return err;
4453             arg.array = array;
4454             ret = get_errno(semctl(semid, semnum, cmd, arg));
4455             err = host_to_target_semarray(semid, target_su.array, &array);
4456             if (err)
4457                 return err;
4458             break;
4459         case IPC_STAT:
4460         case IPC_SET:
4461         case SEM_STAT:
4462             err = target_to_host_semid_ds(&dsarg, target_su.buf);
4463             if (err)
4464                 return err;
4465             arg.buf = &dsarg;
4466             ret = get_errno(semctl(semid, semnum, cmd, arg));
4467             err = host_to_target_semid_ds(target_su.buf, &dsarg);
4468             if (err)
4469                 return err;
4470             break;
4471         case IPC_INFO:
4472         case SEM_INFO:
4473             arg.__buf = &seminfo;
4474             ret = get_errno(semctl(semid, semnum, cmd, arg));
4475             err = host_to_target_seminfo(target_su.__buf, &seminfo);
4476             if (err)
4477                 return err;
4478             break;
4479         case IPC_RMID:
4480         case GETPID:
4481         case GETNCNT:
4482         case GETZCNT:
4483             ret = get_errno(semctl(semid, semnum, cmd, NULL));
4484             break;
4485     }
4486
4487     return ret;
4488 }
4489
4490 struct target_sembuf {
4491     unsigned short sem_num;
4492     short sem_op;
4493     short sem_flg;
4494 };
4495
4496 static inline abi_long target_to_host_sembuf(struct sembuf *host_sembuf,
4497                                              abi_ulong target_addr,
4498                                              unsigned nsops)
4499 {
4500     struct target_sembuf *target_sembuf;
4501     int i;
4502
4503     target_sembuf = lock_user(VERIFY_READ, target_addr,
4504                               nsops*sizeof(struct target_sembuf), 1);
4505     if (!target_sembuf)
4506         return -TARGET_EFAULT;
4507
4508     for(i=0; i<nsops; i++) {
4509         __get_user(host_sembuf[i].sem_num, &target_sembuf[i].sem_num);
4510         __get_user(host_sembuf[i].sem_op, &target_sembuf[i].sem_op);
4511         __get_user(host_sembuf[i].sem_flg, &target_sembuf[i].sem_flg);
4512     }
4513
4514     unlock_user(target_sembuf, target_addr, 0);
4515
4516     return 0;
4517 }
4518
4519 static inline abi_long do_semop(int semid, abi_long ptr, unsigned nsops)
4520 {
4521     struct sembuf sops[nsops];
4522
4523     if (target_to_host_sembuf(sops, ptr, nsops))
4524         return -TARGET_EFAULT;
4525
4526     return get_errno(safe_semtimedop(semid, sops, nsops, NULL));
4527 }
4528
4529 struct target_msqid_ds
4530 {
4531     struct target_ipc_perm msg_perm;
4532     abi_ulong msg_stime;
4533 #if TARGET_ABI_BITS == 32
4534     abi_ulong __unused1;
4535 #endif
4536     abi_ulong msg_rtime;
4537 #if TARGET_ABI_BITS == 32
4538     abi_ulong __unused2;
4539 #endif
4540     abi_ulong msg_ctime;
4541 #if TARGET_ABI_BITS == 32
4542     abi_ulong __unused3;
4543 #endif
4544     abi_ulong __msg_cbytes;
4545     abi_ulong msg_qnum;
4546     abi_ulong msg_qbytes;
4547     abi_ulong msg_lspid;
4548     abi_ulong msg_lrpid;
4549     abi_ulong __unused4;
4550     abi_ulong __unused5;
4551 };
4552
4553 static inline abi_long target_to_host_msqid_ds(struct msqid_ds *host_md,
4554                                                abi_ulong target_addr)
4555 {
4556     struct target_msqid_ds *target_md;
4557
4558     if (!lock_user_struct(VERIFY_READ, target_md, target_addr, 1))
4559         return -TARGET_EFAULT;
4560     if (target_to_host_ipc_perm(&(host_md->msg_perm),target_addr))
4561         return -TARGET_EFAULT;
4562     host_md->msg_stime = tswapal(target_md->msg_stime);
4563     host_md->msg_rtime = tswapal(target_md->msg_rtime);
4564     host_md->msg_ctime = tswapal(target_md->msg_ctime);
4565     host_md->__msg_cbytes = tswapal(target_md->__msg_cbytes);
4566     host_md->msg_qnum = tswapal(target_md->msg_qnum);
4567     host_md->msg_qbytes = tswapal(target_md->msg_qbytes);
4568     host_md->msg_lspid = tswapal(target_md->msg_lspid);
4569     host_md->msg_lrpid = tswapal(target_md->msg_lrpid);
4570     unlock_user_struct(target_md, target_addr, 0);
4571     return 0;
4572 }
4573
4574 static inline abi_long host_to_target_msqid_ds(abi_ulong target_addr,
4575                                                struct msqid_ds *host_md)
4576 {
4577     struct target_msqid_ds *target_md;
4578
4579     if (!lock_user_struct(VERIFY_WRITE, target_md, target_addr, 0))
4580         return -TARGET_EFAULT;
4581     if (host_to_target_ipc_perm(target_addr,&(host_md->msg_perm)))
4582         return -TARGET_EFAULT;
4583     target_md->msg_stime = tswapal(host_md->msg_stime);
4584     target_md->msg_rtime = tswapal(host_md->msg_rtime);
4585     target_md->msg_ctime = tswapal(host_md->msg_ctime);
4586     target_md->__msg_cbytes = tswapal(host_md->__msg_cbytes);
4587     target_md->msg_qnum = tswapal(host_md->msg_qnum);
4588     target_md->msg_qbytes = tswapal(host_md->msg_qbytes);
4589     target_md->msg_lspid = tswapal(host_md->msg_lspid);
4590     target_md->msg_lrpid = tswapal(host_md->msg_lrpid);
4591     unlock_user_struct(target_md, target_addr, 1);
4592     return 0;
4593 }
4594
4595 struct target_msginfo {
4596     int msgpool;
4597     int msgmap;
4598     int msgmax;
4599     int msgmnb;
4600     int msgmni;
4601     int msgssz;
4602     int msgtql;
4603     unsigned short int msgseg;
4604 };
4605
4606 static inline abi_long host_to_target_msginfo(abi_ulong target_addr,
4607                                               struct msginfo *host_msginfo)
4608 {
4609     struct target_msginfo *target_msginfo;
4610     if (!lock_user_struct(VERIFY_WRITE, target_msginfo, target_addr, 0))
4611         return -TARGET_EFAULT;
4612     __put_user(host_msginfo->msgpool, &target_msginfo->msgpool);
4613     __put_user(host_msginfo->msgmap, &target_msginfo->msgmap);
4614     __put_user(host_msginfo->msgmax, &target_msginfo->msgmax);
4615     __put_user(host_msginfo->msgmnb, &target_msginfo->msgmnb);
4616     __put_user(host_msginfo->msgmni, &target_msginfo->msgmni);
4617     __put_user(host_msginfo->msgssz, &target_msginfo->msgssz);
4618     __put_user(host_msginfo->msgtql, &target_msginfo->msgtql);
4619     __put_user(host_msginfo->msgseg, &target_msginfo->msgseg);
4620     unlock_user_struct(target_msginfo, target_addr, 1);
4621     return 0;
4622 }
4623
4624 static inline abi_long do_msgctl(int msgid, int cmd, abi_long ptr)
4625 {
4626     struct msqid_ds dsarg;
4627     struct msginfo msginfo;
4628     abi_long ret = -TARGET_EINVAL;
4629
4630     cmd &= 0xff;
4631
4632     switch (cmd) {
4633     case IPC_STAT:
4634     case IPC_SET:
4635     case MSG_STAT:
4636         if (target_to_host_msqid_ds(&dsarg,ptr))
4637             return -TARGET_EFAULT;
4638         ret = get_errno(msgctl(msgid, cmd, &dsarg));
4639         if (host_to_target_msqid_ds(ptr,&dsarg))
4640             return -TARGET_EFAULT;
4641         break;
4642     case IPC_RMID:
4643         ret = get_errno(msgctl(msgid, cmd, NULL));
4644         break;
4645     case IPC_INFO:
4646     case MSG_INFO:
4647         ret = get_errno(msgctl(msgid, cmd, (struct msqid_ds *)&msginfo));
4648         if (host_to_target_msginfo(ptr, &msginfo))
4649             return -TARGET_EFAULT;
4650         break;
4651     }
4652
4653     return ret;
4654 }
4655
4656 struct target_msgbuf {
4657     abi_long mtype;
4658     char        mtext[1];
4659 };
4660
4661 static inline abi_long do_msgsnd(int msqid, abi_long msgp,
4662                                  ssize_t msgsz, int msgflg)
4663 {
4664     struct target_msgbuf *target_mb;
4665     struct msgbuf *host_mb;
4666     abi_long ret = 0;
4667
4668     if (msgsz < 0) {
4669         return -TARGET_EINVAL;
4670     }
4671
4672     if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0))
4673         return -TARGET_EFAULT;
4674     host_mb = g_try_malloc(msgsz + sizeof(long));
4675     if (!host_mb) {
4676         unlock_user_struct(target_mb, msgp, 0);
4677         return -TARGET_ENOMEM;
4678     }
4679     host_mb->mtype = (abi_long) tswapal(target_mb->mtype);
4680     memcpy(host_mb->mtext, target_mb->mtext, msgsz);
4681     ret = get_errno(safe_msgsnd(msqid, host_mb, msgsz, msgflg));
4682     g_free(host_mb);
4683     unlock_user_struct(target_mb, msgp, 0);
4684
4685     return ret;
4686 }
4687
4688 static inline abi_long do_msgrcv(int msqid, abi_long msgp,
4689                                  ssize_t msgsz, abi_long msgtyp,
4690                                  int msgflg)
4691 {
4692     struct target_msgbuf *target_mb;
4693     char *target_mtext;
4694     struct msgbuf *host_mb;
4695     abi_long ret = 0;
4696
4697     if (msgsz < 0) {
4698         return -TARGET_EINVAL;
4699     }
4700
4701     if (!lock_user_struct(VERIFY_WRITE, target_mb, msgp, 0))
4702         return -TARGET_EFAULT;
4703
4704     host_mb = g_try_malloc(msgsz + sizeof(long));
4705     if (!host_mb) {
4706         ret = -TARGET_ENOMEM;
4707         goto end;
4708     }
4709     ret = get_errno(safe_msgrcv(msqid, host_mb, msgsz, msgtyp, msgflg));
4710
4711     if (ret > 0) {
4712         abi_ulong target_mtext_addr = msgp + sizeof(abi_ulong);
4713         target_mtext = lock_user(VERIFY_WRITE, target_mtext_addr, ret, 0);
4714         if (!target_mtext) {
4715             ret = -TARGET_EFAULT;
4716             goto end;
4717         }
4718         memcpy(target_mb->mtext, host_mb->mtext, ret);
4719         unlock_user(target_mtext, target_mtext_addr, ret);
4720     }
4721
4722     target_mb->mtype = tswapal(host_mb->mtype);
4723
4724 end:
4725     if (target_mb)
4726         unlock_user_struct(target_mb, msgp, 1);
4727     g_free(host_mb);
4728     return ret;
4729 }
4730
4731 static inline abi_long target_to_host_shmid_ds(struct shmid_ds *host_sd,
4732                                                abi_ulong target_addr)
4733 {
4734     struct target_shmid_ds *target_sd;
4735
4736     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
4737         return -TARGET_EFAULT;
4738     if (target_to_host_ipc_perm(&(host_sd->shm_perm), target_addr))
4739         return -TARGET_EFAULT;
4740     __get_user(host_sd->shm_segsz, &target_sd->shm_segsz);
4741     __get_user(host_sd->shm_atime, &target_sd->shm_atime);
4742     __get_user(host_sd->shm_dtime, &target_sd->shm_dtime);
4743     __get_user(host_sd->shm_ctime, &target_sd->shm_ctime);
4744     __get_user(host_sd->shm_cpid, &target_sd->shm_cpid);
4745     __get_user(host_sd->shm_lpid, &target_sd->shm_lpid);
4746     __get_user(host_sd->shm_nattch, &target_sd->shm_nattch);
4747     unlock_user_struct(target_sd, target_addr, 0);
4748     return 0;
4749 }
4750
4751 static inline abi_long host_to_target_shmid_ds(abi_ulong target_addr,
4752                                                struct shmid_ds *host_sd)
4753 {
4754     struct target_shmid_ds *target_sd;
4755
4756     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
4757         return -TARGET_EFAULT;
4758     if (host_to_target_ipc_perm(target_addr, &(host_sd->shm_perm)))
4759         return -TARGET_EFAULT;
4760     __put_user(host_sd->shm_segsz, &target_sd->shm_segsz);
4761     __put_user(host_sd->shm_atime, &target_sd->shm_atime);
4762     __put_user(host_sd->shm_dtime, &target_sd->shm_dtime);
4763     __put_user(host_sd->shm_ctime, &target_sd->shm_ctime);
4764     __put_user(host_sd->shm_cpid, &target_sd->shm_cpid);
4765     __put_user(host_sd->shm_lpid, &target_sd->shm_lpid);
4766     __put_user(host_sd->shm_nattch, &target_sd->shm_nattch);
4767     unlock_user_struct(target_sd, target_addr, 1);
4768     return 0;
4769 }
4770
4771 struct  target_shminfo {
4772     abi_ulong shmmax;
4773     abi_ulong shmmin;
4774     abi_ulong shmmni;
4775     abi_ulong shmseg;
4776     abi_ulong shmall;
4777 };
4778
4779 static inline abi_long host_to_target_shminfo(abi_ulong target_addr,
4780                                               struct shminfo *host_shminfo)
4781 {
4782     struct target_shminfo *target_shminfo;
4783     if (!lock_user_struct(VERIFY_WRITE, target_shminfo, target_addr, 0))
4784         return -TARGET_EFAULT;
4785     __put_user(host_shminfo->shmmax, &target_shminfo->shmmax);
4786     __put_user(host_shminfo->shmmin, &target_shminfo->shmmin);
4787     __put_user(host_shminfo->shmmni, &target_shminfo->shmmni);
4788     __put_user(host_shminfo->shmseg, &target_shminfo->shmseg);
4789     __put_user(host_shminfo->shmall, &target_shminfo->shmall);
4790     unlock_user_struct(target_shminfo, target_addr, 1);
4791     return 0;
4792 }
4793
4794 struct target_shm_info {
4795     int used_ids;
4796     abi_ulong shm_tot;
4797     abi_ulong shm_rss;
4798     abi_ulong shm_swp;
4799     abi_ulong swap_attempts;
4800     abi_ulong swap_successes;
4801 };
4802
4803 static inline abi_long host_to_target_shm_info(abi_ulong target_addr,
4804                                                struct shm_info *host_shm_info)
4805 {
4806     struct target_shm_info *target_shm_info;
4807     if (!lock_user_struct(VERIFY_WRITE, target_shm_info, target_addr, 0))
4808         return -TARGET_EFAULT;
4809     __put_user(host_shm_info->used_ids, &target_shm_info->used_ids);
4810     __put_user(host_shm_info->shm_tot, &target_shm_info->shm_tot);
4811     __put_user(host_shm_info->shm_rss, &target_shm_info->shm_rss);
4812     __put_user(host_shm_info->shm_swp, &target_shm_info->shm_swp);
4813     __put_user(host_shm_info->swap_attempts, &target_shm_info->swap_attempts);
4814     __put_user(host_shm_info->swap_successes, &target_shm_info->swap_successes);
4815     unlock_user_struct(target_shm_info, target_addr, 1);
4816     return 0;
4817 }
4818
4819 static inline abi_long do_shmctl(int shmid, int cmd, abi_long buf)
4820 {
4821     struct shmid_ds dsarg;
4822     struct shminfo shminfo;
4823     struct shm_info shm_info;
4824     abi_long ret = -TARGET_EINVAL;
4825
4826     cmd &= 0xff;
4827
4828     switch(cmd) {
4829     case IPC_STAT:
4830     case IPC_SET:
4831     case SHM_STAT:
4832         if (target_to_host_shmid_ds(&dsarg, buf))
4833             return -TARGET_EFAULT;
4834         ret = get_errno(shmctl(shmid, cmd, &dsarg));
4835         if (host_to_target_shmid_ds(buf, &dsarg))
4836             return -TARGET_EFAULT;
4837         break;
4838     case IPC_INFO:
4839         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shminfo));
4840         if (host_to_target_shminfo(buf, &shminfo))
4841             return -TARGET_EFAULT;
4842         break;
4843     case SHM_INFO:
4844         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shm_info));
4845         if (host_to_target_shm_info(buf, &shm_info))
4846             return -TARGET_EFAULT;
4847         break;
4848     case IPC_RMID:
4849     case SHM_LOCK:
4850     case SHM_UNLOCK:
4851         ret = get_errno(shmctl(shmid, cmd, NULL));
4852         break;
4853     }
4854
4855     return ret;
4856 }
4857
4858 #ifndef TARGET_FORCE_SHMLBA
4859 /* For most architectures, SHMLBA is the same as the page size;
4860  * some architectures have larger values, in which case they should
4861  * define TARGET_FORCE_SHMLBA and provide a target_shmlba() function.
4862  * This corresponds to the kernel arch code defining __ARCH_FORCE_SHMLBA
4863  * and defining its own value for SHMLBA.
4864  *
4865  * The kernel also permits SHMLBA to be set by the architecture to a
4866  * value larger than the page size without setting __ARCH_FORCE_SHMLBA;
4867  * this means that addresses are rounded to the large size if
4868  * SHM_RND is set but addresses not aligned to that size are not rejected
4869  * as long as they are at least page-aligned. Since the only architecture
4870  * which uses this is ia64 this code doesn't provide for that oddity.
4871  */
4872 static inline abi_ulong target_shmlba(CPUArchState *cpu_env)
4873 {
4874     return TARGET_PAGE_SIZE;
4875 }
4876 #endif
4877
4878 static inline abi_ulong do_shmat(CPUArchState *cpu_env,
4879                                  int shmid, abi_ulong shmaddr, int shmflg)
4880 {
4881     abi_long raddr;
4882     void *host_raddr;
4883     struct shmid_ds shm_info;
4884     int i,ret;
4885     abi_ulong shmlba;
4886
4887     /* find out the length of the shared memory segment */
4888     ret = get_errno(shmctl(shmid, IPC_STAT, &shm_info));
4889     if (is_error(ret)) {
4890         /* can't get length, bail out */
4891         return ret;
4892     }
4893
4894     shmlba = target_shmlba(cpu_env);
4895
4896     if (shmaddr & (shmlba - 1)) {
4897         if (shmflg & SHM_RND) {
4898             shmaddr &= ~(shmlba - 1);
4899         } else {
4900             return -TARGET_EINVAL;
4901         }
4902     }
4903
4904     mmap_lock();
4905
4906     if (shmaddr)
4907         host_raddr = shmat(shmid, (void *)g2h(shmaddr), shmflg);
4908     else {
4909         abi_ulong mmap_start;
4910
4911         mmap_start = mmap_find_vma(0, shm_info.shm_segsz);
4912
4913         if (mmap_start == -1) {
4914             errno = ENOMEM;
4915             host_raddr = (void *)-1;
4916         } else
4917             host_raddr = shmat(shmid, g2h(mmap_start), shmflg | SHM_REMAP);
4918     }
4919
4920     if (host_raddr == (void *)-1) {
4921         mmap_unlock();
4922         return get_errno((long)host_raddr);
4923     }
4924     raddr=h2g((unsigned long)host_raddr);
4925
4926     page_set_flags(raddr, raddr + shm_info.shm_segsz,
4927                    PAGE_VALID | PAGE_READ |
4928                    ((shmflg & SHM_RDONLY)? 0 : PAGE_WRITE));
4929
4930     for (i = 0; i < N_SHM_REGIONS; i++) {
4931         if (!shm_regions[i].in_use) {
4932             shm_regions[i].in_use = true;
4933             shm_regions[i].start = raddr;
4934             shm_regions[i].size = shm_info.shm_segsz;
4935             break;
4936         }
4937     }
4938
4939     mmap_unlock();
4940     return raddr;
4941
4942 }
4943
4944 static inline abi_long do_shmdt(abi_ulong shmaddr)
4945 {
4946     int i;
4947
4948     for (i = 0; i < N_SHM_REGIONS; ++i) {
4949         if (shm_regions[i].in_use && shm_regions[i].start == shmaddr) {
4950             shm_regions[i].in_use = false;
4951             page_set_flags(shmaddr, shmaddr + shm_regions[i].size, 0);
4952             break;
4953         }
4954     }
4955
4956     return get_errno(shmdt(g2h(shmaddr)));
4957 }
4958
4959 #ifdef TARGET_NR_ipc
4960 /* ??? This only works with linear mappings.  */
4961 /* do_ipc() must return target values and target errnos. */
4962 static abi_long do_ipc(CPUArchState *cpu_env,
4963                        unsigned int call, abi_long first,
4964                        abi_long second, abi_long third,
4965                        abi_long ptr, abi_long fifth)
4966 {
4967     int version;
4968     abi_long ret = 0;
4969
4970     version = call >> 16;
4971     call &= 0xffff;
4972
4973     switch (call) {
4974     case IPCOP_semop:
4975         ret = do_semop(first, ptr, second);
4976         break;
4977
4978     case IPCOP_semget:
4979         ret = get_errno(semget(first, second, third));
4980         break;
4981
4982     case IPCOP_semctl: {
4983         /* The semun argument to semctl is passed by value, so dereference the
4984          * ptr argument. */
4985         abi_ulong atptr;
4986         get_user_ual(atptr, ptr);
4987         ret = do_semctl(first, second, third, atptr);
4988         break;
4989     }
4990
4991     case IPCOP_msgget:
4992         ret = get_errno(msgget(first, second));
4993         break;
4994
4995     case IPCOP_msgsnd:
4996         ret = do_msgsnd(first, ptr, second, third);
4997         break;
4998
4999     case IPCOP_msgctl:
5000         ret = do_msgctl(first, second, ptr);
5001         break;
5002
5003     case IPCOP_msgrcv:
5004         switch (version) {
5005         case 0:
5006             {
5007                 struct target_ipc_kludge {
5008                     abi_long msgp;
5009                     abi_long msgtyp;
5010                 } *tmp;
5011
5012                 if (!lock_user_struct(VERIFY_READ, tmp, ptr, 1)) {
5013                     ret = -TARGET_EFAULT;
5014                     break;
5015                 }
5016
5017                 ret = do_msgrcv(first, tswapal(tmp->msgp), second, tswapal(tmp->msgtyp), third);
5018
5019                 unlock_user_struct(tmp, ptr, 0);
5020                 break;
5021             }
5022         default:
5023             ret = do_msgrcv(first, ptr, second, fifth, third);
5024         }
5025         break;
5026
5027     case IPCOP_shmat:
5028         switch (version) {
5029         default:
5030         {
5031             abi_ulong raddr;
5032             raddr = do_shmat(cpu_env, first, ptr, second);
5033             if (is_error(raddr))
5034                 return get_errno(raddr);
5035             if (put_user_ual(raddr, third))
5036                 return -TARGET_EFAULT;
5037             break;
5038         }
5039         case 1:
5040             ret = -TARGET_EINVAL;
5041             break;
5042         }
5043         break;
5044     case IPCOP_shmdt:
5045         ret = do_shmdt(ptr);
5046         break;
5047
5048     case IPCOP_shmget:
5049         /* IPC_* flag values are the same on all linux platforms */
5050         ret = get_errno(shmget(first, second, third));
5051         break;
5052
5053         /* IPC_* and SHM_* command values are the same on all linux platforms */
5054     case IPCOP_shmctl:
5055         ret = do_shmctl(first, second, ptr);
5056         break;
5057     default:
5058         gemu_log("Unsupported ipc call: %d (version %d)\n", call, version);
5059         ret = -TARGET_ENOSYS;
5060         break;
5061     }
5062     return ret;
5063 }
5064 #endif
5065
5066 /* kernel structure types definitions */
5067
5068 #define STRUCT(name, ...) STRUCT_ ## name,
5069 #define STRUCT_SPECIAL(name) STRUCT_ ## name,
5070 enum {
5071 #include "syscall_types.h"
5072 STRUCT_MAX
5073 };
5074 #undef STRUCT
5075 #undef STRUCT_SPECIAL
5076
5077 #define STRUCT(name, ...) static const argtype struct_ ## name ## _def[] = {  __VA_ARGS__, TYPE_NULL };
5078 #define STRUCT_SPECIAL(name)
5079 #include "syscall_types.h"
5080 #undef STRUCT
5081 #undef STRUCT_SPECIAL
5082
5083 typedef struct IOCTLEntry IOCTLEntry;
5084
5085 typedef abi_long do_ioctl_fn(const IOCTLEntry *ie, uint8_t *buf_temp,
5086                              int fd, int cmd, abi_long arg);
5087
5088 struct IOCTLEntry {
5089     int target_cmd;
5090     unsigned int host_cmd;
5091     const char *name;
5092     int access;
5093     do_ioctl_fn *do_ioctl;
5094     const argtype arg_type[5];
5095 };
5096
5097 #define IOC_R 0x0001
5098 #define IOC_W 0x0002
5099 #define IOC_RW (IOC_R | IOC_W)
5100
5101 #define MAX_STRUCT_SIZE 4096
5102
5103 #ifdef CONFIG_FIEMAP
5104 /* So fiemap access checks don't overflow on 32 bit systems.
5105  * This is very slightly smaller than the limit imposed by
5106  * the underlying kernel.
5107  */
5108 #define FIEMAP_MAX_EXTENTS ((UINT_MAX - sizeof(struct fiemap))  \
5109                             / sizeof(struct fiemap_extent))
5110
5111 static abi_long do_ioctl_fs_ioc_fiemap(const IOCTLEntry *ie, uint8_t *buf_temp,
5112                                        int fd, int cmd, abi_long arg)
5113 {
5114     /* The parameter for this ioctl is a struct fiemap followed
5115      * by an array of struct fiemap_extent whose size is set
5116      * in fiemap->fm_extent_count. The array is filled in by the
5117      * ioctl.
5118      */
5119     int target_size_in, target_size_out;
5120     struct fiemap *fm;
5121     const argtype *arg_type = ie->arg_type;
5122     const argtype extent_arg_type[] = { MK_STRUCT(STRUCT_fiemap_extent) };
5123     void *argptr, *p;
5124     abi_long ret;
5125     int i, extent_size = thunk_type_size(extent_arg_type, 0);
5126     uint32_t outbufsz;
5127     int free_fm = 0;
5128
5129     assert(arg_type[0] == TYPE_PTR);
5130     assert(ie->access == IOC_RW);
5131     arg_type++;
5132     target_size_in = thunk_type_size(arg_type, 0);
5133     argptr = lock_user(VERIFY_READ, arg, target_size_in, 1);
5134     if (!argptr) {
5135         return -TARGET_EFAULT;
5136     }
5137     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5138     unlock_user(argptr, arg, 0);
5139     fm = (struct fiemap *)buf_temp;
5140     if (fm->fm_extent_count > FIEMAP_MAX_EXTENTS) {
5141         return -TARGET_EINVAL;
5142     }
5143
5144     outbufsz = sizeof (*fm) +
5145         (sizeof(struct fiemap_extent) * fm->fm_extent_count);
5146
5147     if (outbufsz > MAX_STRUCT_SIZE) {
5148         /* We can't fit all the extents into the fixed size buffer.
5149          * Allocate one that is large enough and use it instead.
5150          */
5151         fm = g_try_malloc(outbufsz);
5152         if (!fm) {
5153             return -TARGET_ENOMEM;
5154         }
5155         memcpy(fm, buf_temp, sizeof(struct fiemap));
5156         free_fm = 1;
5157     }
5158     ret = get_errno(safe_ioctl(fd, ie->host_cmd, fm));
5159     if (!is_error(ret)) {
5160         target_size_out = target_size_in;
5161         /* An extent_count of 0 means we were only counting the extents
5162          * so there are no structs to copy
5163          */
5164         if (fm->fm_extent_count != 0) {
5165             target_size_out += fm->fm_mapped_extents * extent_size;
5166         }
5167         argptr = lock_user(VERIFY_WRITE, arg, target_size_out, 0);
5168         if (!argptr) {
5169             ret = -TARGET_EFAULT;
5170         } else {
5171             /* Convert the struct fiemap */
5172             thunk_convert(argptr, fm, arg_type, THUNK_TARGET);
5173             if (fm->fm_extent_count != 0) {
5174                 p = argptr + target_size_in;
5175                 /* ...and then all the struct fiemap_extents */
5176                 for (i = 0; i < fm->fm_mapped_extents; i++) {
5177                     thunk_convert(p, &fm->fm_extents[i], extent_arg_type,
5178                                   THUNK_TARGET);
5179                     p += extent_size;
5180                 }
5181             }
5182             unlock_user(argptr, arg, target_size_out);
5183         }
5184     }
5185     if (free_fm) {
5186         g_free(fm);
5187     }
5188     return ret;
5189 }
5190 #endif
5191
5192 static abi_long do_ioctl_ifconf(const IOCTLEntry *ie, uint8_t *buf_temp,
5193                                 int fd, int cmd, abi_long arg)
5194 {
5195     const argtype *arg_type = ie->arg_type;
5196     int target_size;
5197     void *argptr;
5198     int ret;
5199     struct ifconf *host_ifconf;
5200     uint32_t outbufsz;
5201     const argtype ifreq_arg_type[] = { MK_STRUCT(STRUCT_sockaddr_ifreq) };
5202     int target_ifreq_size;
5203     int nb_ifreq;
5204     int free_buf = 0;
5205     int i;
5206     int target_ifc_len;
5207     abi_long target_ifc_buf;
5208     int host_ifc_len;
5209     char *host_ifc_buf;
5210
5211     assert(arg_type[0] == TYPE_PTR);
5212     assert(ie->access == IOC_RW);
5213
5214     arg_type++;
5215     target_size = thunk_type_size(arg_type, 0);
5216
5217     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5218     if (!argptr)
5219         return -TARGET_EFAULT;
5220     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5221     unlock_user(argptr, arg, 0);
5222
5223     host_ifconf = (struct ifconf *)(unsigned long)buf_temp;
5224     target_ifc_len = host_ifconf->ifc_len;
5225     target_ifc_buf = (abi_long)(unsigned long)host_ifconf->ifc_buf;
5226
5227     target_ifreq_size = thunk_type_size(ifreq_arg_type, 0);
5228     nb_ifreq = target_ifc_len / target_ifreq_size;
5229     host_ifc_len = nb_ifreq * sizeof(struct ifreq);
5230
5231     outbufsz = sizeof(*host_ifconf) + host_ifc_len;
5232     if (outbufsz > MAX_STRUCT_SIZE) {
5233         /* We can't fit all the extents into the fixed size buffer.
5234          * Allocate one that is large enough and use it instead.
5235          */
5236         host_ifconf = malloc(outbufsz);
5237         if (!host_ifconf) {
5238             return -TARGET_ENOMEM;
5239         }
5240         memcpy(host_ifconf, buf_temp, sizeof(*host_ifconf));
5241         free_buf = 1;
5242     }
5243     host_ifc_buf = (char*)host_ifconf + sizeof(*host_ifconf);
5244
5245     host_ifconf->ifc_len = host_ifc_len;
5246     host_ifconf->ifc_buf = host_ifc_buf;
5247
5248     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_ifconf));
5249     if (!is_error(ret)) {
5250         /* convert host ifc_len to target ifc_len */
5251
5252         nb_ifreq = host_ifconf->ifc_len / sizeof(struct ifreq);
5253         target_ifc_len = nb_ifreq * target_ifreq_size;
5254         host_ifconf->ifc_len = target_ifc_len;
5255
5256         /* restore target ifc_buf */
5257
5258         host_ifconf->ifc_buf = (char *)(unsigned long)target_ifc_buf;
5259
5260         /* copy struct ifconf to target user */
5261
5262         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5263         if (!argptr)
5264             return -TARGET_EFAULT;
5265         thunk_convert(argptr, host_ifconf, arg_type, THUNK_TARGET);
5266         unlock_user(argptr, arg, target_size);
5267
5268         /* copy ifreq[] to target user */
5269
5270         argptr = lock_user(VERIFY_WRITE, target_ifc_buf, target_ifc_len, 0);
5271         for (i = 0; i < nb_ifreq ; i++) {
5272             thunk_convert(argptr + i * target_ifreq_size,
5273                           host_ifc_buf + i * sizeof(struct ifreq),
5274                           ifreq_arg_type, THUNK_TARGET);
5275         }
5276         unlock_user(argptr, target_ifc_buf, target_ifc_len);
5277     }
5278
5279     if (free_buf) {
5280         free(host_ifconf);
5281     }
5282
5283     return ret;
5284 }
5285
5286 static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
5287                             int cmd, abi_long arg)
5288 {
5289     void *argptr;
5290     struct dm_ioctl *host_dm;
5291     abi_long guest_data;
5292     uint32_t guest_data_size;
5293     int target_size;
5294     const argtype *arg_type = ie->arg_type;
5295     abi_long ret;
5296     void *big_buf = NULL;
5297     char *host_data;
5298
5299     arg_type++;
5300     target_size = thunk_type_size(arg_type, 0);
5301     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5302     if (!argptr) {
5303         ret = -TARGET_EFAULT;
5304         goto out;
5305     }
5306     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5307     unlock_user(argptr, arg, 0);
5308
5309     /* buf_temp is too small, so fetch things into a bigger buffer */
5310     big_buf = g_malloc0(((struct dm_ioctl*)buf_temp)->data_size * 2);
5311     memcpy(big_buf, buf_temp, target_size);
5312     buf_temp = big_buf;
5313     host_dm = big_buf;
5314
5315     guest_data = arg + host_dm->data_start;
5316     if ((guest_data - arg) < 0) {
5317         ret = -TARGET_EINVAL;
5318         goto out;
5319     }
5320     guest_data_size = host_dm->data_size - host_dm->data_start;
5321     host_data = (char*)host_dm + host_dm->data_start;
5322
5323     argptr = lock_user(VERIFY_READ, guest_data, guest_data_size, 1);
5324     if (!argptr) {
5325         ret = -TARGET_EFAULT;
5326         goto out;
5327     }
5328
5329     switch (ie->host_cmd) {
5330     case DM_REMOVE_ALL:
5331     case DM_LIST_DEVICES:
5332     case DM_DEV_CREATE:
5333     case DM_DEV_REMOVE:
5334     case DM_DEV_SUSPEND:
5335     case DM_DEV_STATUS:
5336     case DM_DEV_WAIT:
5337     case DM_TABLE_STATUS:
5338     case DM_TABLE_CLEAR:
5339     case DM_TABLE_DEPS:
5340     case DM_LIST_VERSIONS:
5341         /* no input data */
5342         break;
5343     case DM_DEV_RENAME:
5344     case DM_DEV_SET_GEOMETRY:
5345         /* data contains only strings */
5346         memcpy(host_data, argptr, guest_data_size);
5347         break;
5348     case DM_TARGET_MSG:
5349         memcpy(host_data, argptr, guest_data_size);
5350         *(uint64_t*)host_data = tswap64(*(uint64_t*)argptr);
5351         break;
5352     case DM_TABLE_LOAD:
5353     {
5354         void *gspec = argptr;
5355         void *cur_data = host_data;
5356         const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
5357         int spec_size = thunk_type_size(arg_type, 0);
5358         int i;
5359
5360         for (i = 0; i < host_dm->target_count; i++) {
5361             struct dm_target_spec *spec = cur_data;
5362             uint32_t next;
5363             int slen;
5364
5365             thunk_convert(spec, gspec, arg_type, THUNK_HOST);
5366             slen = strlen((char*)gspec + spec_size) + 1;
5367             next = spec->next;
5368             spec->next = sizeof(*spec) + slen;
5369             strcpy((char*)&spec[1], gspec + spec_size);
5370             gspec += next;
5371             cur_data += spec->next;
5372         }
5373         break;
5374     }
5375     default:
5376         ret = -TARGET_EINVAL;
5377         unlock_user(argptr, guest_data, 0);
5378         goto out;
5379     }
5380     unlock_user(argptr, guest_data, 0);
5381
5382     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5383     if (!is_error(ret)) {
5384         guest_data = arg + host_dm->data_start;
5385         guest_data_size = host_dm->data_size - host_dm->data_start;
5386         argptr = lock_user(VERIFY_WRITE, guest_data, guest_data_size, 0);
5387         switch (ie->host_cmd) {
5388         case DM_REMOVE_ALL:
5389         case DM_DEV_CREATE:
5390         case DM_DEV_REMOVE:
5391         case DM_DEV_RENAME:
5392         case DM_DEV_SUSPEND:
5393         case DM_DEV_STATUS:
5394         case DM_TABLE_LOAD:
5395         case DM_TABLE_CLEAR:
5396         case DM_TARGET_MSG:
5397         case DM_DEV_SET_GEOMETRY:
5398             /* no return data */
5399             break;
5400         case DM_LIST_DEVICES:
5401         {
5402             struct dm_name_list *nl = (void*)host_dm + host_dm->data_start;
5403             uint32_t remaining_data = guest_data_size;
5404             void *cur_data = argptr;
5405             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_name_list) };
5406             int nl_size = 12; /* can't use thunk_size due to alignment */
5407
5408             while (1) {
5409                 uint32_t next = nl->next;
5410                 if (next) {
5411                     nl->next = nl_size + (strlen(nl->name) + 1);
5412                 }
5413                 if (remaining_data < nl->next) {
5414                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5415                     break;
5416                 }
5417                 thunk_convert(cur_data, nl, arg_type, THUNK_TARGET);
5418                 strcpy(cur_data + nl_size, nl->name);
5419                 cur_data += nl->next;
5420                 remaining_data -= nl->next;
5421                 if (!next) {
5422                     break;
5423                 }
5424                 nl = (void*)nl + next;
5425             }
5426             break;
5427         }
5428         case DM_DEV_WAIT:
5429         case DM_TABLE_STATUS:
5430         {
5431             struct dm_target_spec *spec = (void*)host_dm + host_dm->data_start;
5432             void *cur_data = argptr;
5433             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
5434             int spec_size = thunk_type_size(arg_type, 0);
5435             int i;
5436
5437             for (i = 0; i < host_dm->target_count; i++) {
5438                 uint32_t next = spec->next;
5439                 int slen = strlen((char*)&spec[1]) + 1;
5440                 spec->next = (cur_data - argptr) + spec_size + slen;
5441                 if (guest_data_size < spec->next) {
5442                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5443                     break;
5444                 }
5445                 thunk_convert(cur_data, spec, arg_type, THUNK_TARGET);
5446                 strcpy(cur_data + spec_size, (char*)&spec[1]);
5447                 cur_data = argptr + spec->next;
5448                 spec = (void*)host_dm + host_dm->data_start + next;
5449             }
5450             break;
5451         }
5452         case DM_TABLE_DEPS:
5453         {
5454             void *hdata = (void*)host_dm + host_dm->data_start;
5455             int count = *(uint32_t*)hdata;
5456             uint64_t *hdev = hdata + 8;
5457             uint64_t *gdev = argptr + 8;
5458             int i;
5459
5460             *(uint32_t*)argptr = tswap32(count);
5461             for (i = 0; i < count; i++) {
5462                 *gdev = tswap64(*hdev);
5463                 gdev++;
5464                 hdev++;
5465             }
5466             break;
5467         }
5468         case DM_LIST_VERSIONS:
5469         {
5470             struct dm_target_versions *vers = (void*)host_dm + host_dm->data_start;
5471             uint32_t remaining_data = guest_data_size;
5472             void *cur_data = argptr;
5473             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_versions) };
5474             int vers_size = thunk_type_size(arg_type, 0);
5475
5476             while (1) {
5477                 uint32_t next = vers->next;
5478                 if (next) {
5479                     vers->next = vers_size + (strlen(vers->name) + 1);
5480                 }
5481                 if (remaining_data < vers->next) {
5482                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5483                     break;
5484                 }
5485                 thunk_convert(cur_data, vers, arg_type, THUNK_TARGET);
5486                 strcpy(cur_data + vers_size, vers->name);
5487                 cur_data += vers->next;
5488                 remaining_data -= vers->next;
5489                 if (!next) {
5490                     break;
5491                 }
5492                 vers = (void*)vers + next;
5493             }
5494             break;
5495         }
5496         default:
5497             unlock_user(argptr, guest_data, 0);
5498             ret = -TARGET_EINVAL;
5499             goto out;
5500         }
5501         unlock_user(argptr, guest_data, guest_data_size);
5502
5503         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5504         if (!argptr) {
5505             ret = -TARGET_EFAULT;
5506             goto out;
5507         }
5508         thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5509         unlock_user(argptr, arg, target_size);
5510     }
5511 out:
5512     g_free(big_buf);
5513     return ret;
5514 }
5515
5516 static abi_long do_ioctl_blkpg(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
5517                                int cmd, abi_long arg)
5518 {
5519     void *argptr;
5520     int target_size;
5521     const argtype *arg_type = ie->arg_type;
5522     const argtype part_arg_type[] = { MK_STRUCT(STRUCT_blkpg_partition) };
5523     abi_long ret;
5524
5525     struct blkpg_ioctl_arg *host_blkpg = (void*)buf_temp;
5526     struct blkpg_partition host_part;
5527
5528     /* Read and convert blkpg */
5529     arg_type++;
5530     target_size = thunk_type_size(arg_type, 0);
5531     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5532     if (!argptr) {
5533         ret = -TARGET_EFAULT;
5534         goto out;
5535     }
5536     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5537     unlock_user(argptr, arg, 0);
5538
5539     switch (host_blkpg->op) {
5540     case BLKPG_ADD_PARTITION:
5541     case BLKPG_DEL_PARTITION:
5542         /* payload is struct blkpg_partition */
5543         break;
5544     default:
5545         /* Unknown opcode */
5546         ret = -TARGET_EINVAL;
5547         goto out;
5548     }
5549
5550     /* Read and convert blkpg->data */
5551     arg = (abi_long)(uintptr_t)host_blkpg->data;
5552     target_size = thunk_type_size(part_arg_type, 0);
5553     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5554     if (!argptr) {
5555         ret = -TARGET_EFAULT;
5556         goto out;
5557     }
5558     thunk_convert(&host_part, argptr, part_arg_type, THUNK_HOST);
5559     unlock_user(argptr, arg, 0);
5560
5561     /* Swizzle the data pointer to our local copy and call! */
5562     host_blkpg->data = &host_part;
5563     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_blkpg));
5564
5565 out:
5566     return ret;
5567 }
5568
5569 static abi_long do_ioctl_rt(const IOCTLEntry *ie, uint8_t *buf_temp,
5570                                 int fd, int cmd, abi_long arg)
5571 {
5572     const argtype *arg_type = ie->arg_type;
5573     const StructEntry *se;
5574     const argtype *field_types;
5575     const int *dst_offsets, *src_offsets;
5576     int target_size;
5577     void *argptr;
5578     abi_ulong *target_rt_dev_ptr;
5579     unsigned long *host_rt_dev_ptr;
5580     abi_long ret;
5581     int i;
5582
5583     assert(ie->access == IOC_W);
5584     assert(*arg_type == TYPE_PTR);
5585     arg_type++;
5586     assert(*arg_type == TYPE_STRUCT);
5587     target_size = thunk_type_size(arg_type, 0);
5588     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5589     if (!argptr) {
5590         return -TARGET_EFAULT;
5591     }
5592     arg_type++;
5593     assert(*arg_type == (int)STRUCT_rtentry);
5594     se = struct_entries + *arg_type++;
5595     assert(se->convert[0] == NULL);
5596     /* convert struct here to be able to catch rt_dev string */
5597     field_types = se->field_types;
5598     dst_offsets = se->field_offsets[THUNK_HOST];
5599     src_offsets = se->field_offsets[THUNK_TARGET];
5600     for (i = 0; i < se->nb_fields; i++) {
5601         if (dst_offsets[i] == offsetof(struct rtentry, rt_dev)) {
5602             assert(*field_types == TYPE_PTRVOID);
5603             target_rt_dev_ptr = (abi_ulong *)(argptr + src_offsets[i]);
5604             host_rt_dev_ptr = (unsigned long *)(buf_temp + dst_offsets[i]);
5605             if (*target_rt_dev_ptr != 0) {
5606                 *host_rt_dev_ptr = (unsigned long)lock_user_string(
5607                                                   tswapal(*target_rt_dev_ptr));
5608                 if (!*host_rt_dev_ptr) {
5609                     unlock_user(argptr, arg, 0);
5610                     return -TARGET_EFAULT;
5611                 }
5612             } else {
5613                 *host_rt_dev_ptr = 0;
5614             }
5615             field_types++;
5616             continue;
5617         }
5618         field_types = thunk_convert(buf_temp + dst_offsets[i],
5619                                     argptr + src_offsets[i],
5620                                     field_types, THUNK_HOST);
5621     }
5622     unlock_user(argptr, arg, 0);
5623
5624     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5625     if (*host_rt_dev_ptr != 0) {
5626         unlock_user((void *)*host_rt_dev_ptr,
5627                     *target_rt_dev_ptr, 0);
5628     }
5629     return ret;
5630 }
5631
5632 static abi_long do_ioctl_kdsigaccept(const IOCTLEntry *ie, uint8_t *buf_temp,
5633                                      int fd, int cmd, abi_long arg)
5634 {
5635     int sig = target_to_host_signal(arg);
5636     return get_errno(safe_ioctl(fd, ie->host_cmd, sig));
5637 }
5638
5639 static IOCTLEntry ioctl_entries[] = {
5640 #define IOCTL(cmd, access, ...) \
5641     { TARGET_ ## cmd, cmd, #cmd, access, 0, {  __VA_ARGS__ } },
5642 #define IOCTL_SPECIAL(cmd, access, dofn, ...)                      \
5643     { TARGET_ ## cmd, cmd, #cmd, access, dofn, {  __VA_ARGS__ } },
5644 #define IOCTL_IGNORE(cmd) \
5645     { TARGET_ ## cmd, 0, #cmd },
5646 #include "ioctls.h"
5647     { 0, 0, },
5648 };
5649
5650 /* ??? Implement proper locking for ioctls.  */
5651 /* do_ioctl() Must return target values and target errnos. */
5652 static abi_long do_ioctl(int fd, int cmd, abi_long arg)
5653 {
5654     const IOCTLEntry *ie;
5655     const argtype *arg_type;
5656     abi_long ret;
5657     uint8_t buf_temp[MAX_STRUCT_SIZE];
5658     int target_size;
5659     void *argptr;
5660
5661     ie = ioctl_entries;
5662     for(;;) {
5663         if (ie->target_cmd == 0) {
5664             gemu_log("Unsupported ioctl: cmd=0x%04lx\n", (long)cmd);
5665             return -TARGET_ENOSYS;
5666         }
5667         if (ie->target_cmd == cmd)
5668             break;
5669         ie++;
5670     }
5671     arg_type = ie->arg_type;
5672 #if defined(DEBUG)
5673     gemu_log("ioctl: cmd=0x%04lx (%s)\n", (long)cmd, ie->name);
5674 #endif
5675     if (ie->do_ioctl) {
5676         return ie->do_ioctl(ie, buf_temp, fd, cmd, arg);
5677     } else if (!ie->host_cmd) {
5678         /* Some architectures define BSD ioctls in their headers
5679            that are not implemented in Linux.  */
5680         return -TARGET_ENOSYS;
5681     }
5682
5683     switch(arg_type[0]) {
5684     case TYPE_NULL:
5685         /* no argument */
5686         ret = get_errno(safe_ioctl(fd, ie->host_cmd));
5687         break;
5688     case TYPE_PTRVOID:
5689     case TYPE_INT:
5690         ret = get_errno(safe_ioctl(fd, ie->host_cmd, arg));
5691         break;
5692     case TYPE_PTR:
5693         arg_type++;
5694         target_size = thunk_type_size(arg_type, 0);
5695         switch(ie->access) {
5696         case IOC_R:
5697             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5698             if (!is_error(ret)) {
5699                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5700                 if (!argptr)
5701                     return -TARGET_EFAULT;
5702                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5703                 unlock_user(argptr, arg, target_size);
5704             }
5705             break;
5706         case IOC_W:
5707             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5708             if (!argptr)
5709                 return -TARGET_EFAULT;
5710             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5711             unlock_user(argptr, arg, 0);
5712             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5713             break;
5714         default:
5715         case IOC_RW:
5716             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5717             if (!argptr)
5718                 return -TARGET_EFAULT;
5719             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5720             unlock_user(argptr, arg, 0);
5721             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5722             if (!is_error(ret)) {
5723                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5724                 if (!argptr)
5725                     return -TARGET_EFAULT;
5726                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5727                 unlock_user(argptr, arg, target_size);
5728             }
5729             break;
5730         }
5731         break;
5732     default:
5733         gemu_log("Unsupported ioctl type: cmd=0x%04lx type=%d\n",
5734                  (long)cmd, arg_type[0]);
5735         ret = -TARGET_ENOSYS;
5736         break;
5737     }
5738     return ret;
5739 }
5740
5741 static const bitmask_transtbl iflag_tbl[] = {
5742         { TARGET_IGNBRK, TARGET_IGNBRK, IGNBRK, IGNBRK },
5743         { TARGET_BRKINT, TARGET_BRKINT, BRKINT, BRKINT },
5744         { TARGET_IGNPAR, TARGET_IGNPAR, IGNPAR, IGNPAR },
5745         { TARGET_PARMRK, TARGET_PARMRK, PARMRK, PARMRK },
5746         { TARGET_INPCK, TARGET_INPCK, INPCK, INPCK },
5747         { TARGET_ISTRIP, TARGET_ISTRIP, ISTRIP, ISTRIP },
5748         { TARGET_INLCR, TARGET_INLCR, INLCR, INLCR },
5749         { TARGET_IGNCR, TARGET_IGNCR, IGNCR, IGNCR },
5750         { TARGET_ICRNL, TARGET_ICRNL, ICRNL, ICRNL },
5751         { TARGET_IUCLC, TARGET_IUCLC, IUCLC, IUCLC },
5752         { TARGET_IXON, TARGET_IXON, IXON, IXON },
5753         { TARGET_IXANY, TARGET_IXANY, IXANY, IXANY },
5754         { TARGET_IXOFF, TARGET_IXOFF, IXOFF, IXOFF },
5755         { TARGET_IMAXBEL, TARGET_IMAXBEL, IMAXBEL, IMAXBEL },
5756         { 0, 0, 0, 0 }
5757 };
5758
5759 static const bitmask_transtbl oflag_tbl[] = {
5760         { TARGET_OPOST, TARGET_OPOST, OPOST, OPOST },
5761         { TARGET_OLCUC, TARGET_OLCUC, OLCUC, OLCUC },
5762         { TARGET_ONLCR, TARGET_ONLCR, ONLCR, ONLCR },
5763         { TARGET_OCRNL, TARGET_OCRNL, OCRNL, OCRNL },
5764         { TARGET_ONOCR, TARGET_ONOCR, ONOCR, ONOCR },
5765         { TARGET_ONLRET, TARGET_ONLRET, ONLRET, ONLRET },
5766         { TARGET_OFILL, TARGET_OFILL, OFILL, OFILL },
5767         { TARGET_OFDEL, TARGET_OFDEL, OFDEL, OFDEL },
5768         { TARGET_NLDLY, TARGET_NL0, NLDLY, NL0 },
5769         { TARGET_NLDLY, TARGET_NL1, NLDLY, NL1 },
5770         { TARGET_CRDLY, TARGET_CR0, CRDLY, CR0 },
5771         { TARGET_CRDLY, TARGET_CR1, CRDLY, CR1 },
5772         { TARGET_CRDLY, TARGET_CR2, CRDLY, CR2 },
5773         { TARGET_CRDLY, TARGET_CR3, CRDLY, CR3 },
5774         { TARGET_TABDLY, TARGET_TAB0, TABDLY, TAB0 },
5775         { TARGET_TABDLY, TARGET_TAB1, TABDLY, TAB1 },
5776         { TARGET_TABDLY, TARGET_TAB2, TABDLY, TAB2 },
5777         { TARGET_TABDLY, TARGET_TAB3, TABDLY, TAB3 },
5778         { TARGET_BSDLY, TARGET_BS0, BSDLY, BS0 },
5779         { TARGET_BSDLY, TARGET_BS1, BSDLY, BS1 },
5780         { TARGET_VTDLY, TARGET_VT0, VTDLY, VT0 },
5781         { TARGET_VTDLY, TARGET_VT1, VTDLY, VT1 },
5782         { TARGET_FFDLY, TARGET_FF0, FFDLY, FF0 },
5783         { TARGET_FFDLY, TARGET_FF1, FFDLY, FF1 },
5784         { 0, 0, 0, 0 }
5785 };
5786
5787 static const bitmask_transtbl cflag_tbl[] = {
5788         { TARGET_CBAUD, TARGET_B0, CBAUD, B0 },
5789         { TARGET_CBAUD, TARGET_B50, CBAUD, B50 },
5790         { TARGET_CBAUD, TARGET_B75, CBAUD, B75 },
5791         { TARGET_CBAUD, TARGET_B110, CBAUD, B110 },
5792         { TARGET_CBAUD, TARGET_B134, CBAUD, B134 },
5793         { TARGET_CBAUD, TARGET_B150, CBAUD, B150 },
5794         { TARGET_CBAUD, TARGET_B200, CBAUD, B200 },
5795         { TARGET_CBAUD, TARGET_B300, CBAUD, B300 },
5796         { TARGET_CBAUD, TARGET_B600, CBAUD, B600 },
5797         { TARGET_CBAUD, TARGET_B1200, CBAUD, B1200 },
5798         { TARGET_CBAUD, TARGET_B1800, CBAUD, B1800 },
5799         { TARGET_CBAUD, TARGET_B2400, CBAUD, B2400 },
5800         { TARGET_CBAUD, TARGET_B4800, CBAUD, B4800 },
5801         { TARGET_CBAUD, TARGET_B9600, CBAUD, B9600 },
5802         { TARGET_CBAUD, TARGET_B19200, CBAUD, B19200 },
5803         { TARGET_CBAUD, TARGET_B38400, CBAUD, B38400 },
5804         { TARGET_CBAUD, TARGET_B57600, CBAUD, B57600 },
5805         { TARGET_CBAUD, TARGET_B115200, CBAUD, B115200 },
5806         { TARGET_CBAUD, TARGET_B230400, CBAUD, B230400 },
5807         { TARGET_CBAUD, TARGET_B460800, CBAUD, B460800 },
5808         { TARGET_CSIZE, TARGET_CS5, CSIZE, CS5 },
5809         { TARGET_CSIZE, TARGET_CS6, CSIZE, CS6 },
5810         { TARGET_CSIZE, TARGET_CS7, CSIZE, CS7 },
5811         { TARGET_CSIZE, TARGET_CS8, CSIZE, CS8 },
5812         { TARGET_CSTOPB, TARGET_CSTOPB, CSTOPB, CSTOPB },
5813         { TARGET_CREAD, TARGET_CREAD, CREAD, CREAD },
5814         { TARGET_PARENB, TARGET_PARENB, PARENB, PARENB },
5815         { TARGET_PARODD, TARGET_PARODD, PARODD, PARODD },
5816         { TARGET_HUPCL, TARGET_HUPCL, HUPCL, HUPCL },
5817         { TARGET_CLOCAL, TARGET_CLOCAL, CLOCAL, CLOCAL },
5818         { TARGET_CRTSCTS, TARGET_CRTSCTS, CRTSCTS, CRTSCTS },
5819         { 0, 0, 0, 0 }
5820 };
5821
5822 static const bitmask_transtbl lflag_tbl[] = {
5823         { TARGET_ISIG, TARGET_ISIG, ISIG, ISIG },
5824         { TARGET_ICANON, TARGET_ICANON, ICANON, ICANON },
5825         { TARGET_XCASE, TARGET_XCASE, XCASE, XCASE },
5826         { TARGET_ECHO, TARGET_ECHO, ECHO, ECHO },
5827         { TARGET_ECHOE, TARGET_ECHOE, ECHOE, ECHOE },
5828         { TARGET_ECHOK, TARGET_ECHOK, ECHOK, ECHOK },
5829         { TARGET_ECHONL, TARGET_ECHONL, ECHONL, ECHONL },
5830         { TARGET_NOFLSH, TARGET_NOFLSH, NOFLSH, NOFLSH },
5831         { TARGET_TOSTOP, TARGET_TOSTOP, TOSTOP, TOSTOP },
5832         { TARGET_ECHOCTL, TARGET_ECHOCTL, ECHOCTL, ECHOCTL },
5833         { TARGET_ECHOPRT, TARGET_ECHOPRT, ECHOPRT, ECHOPRT },
5834         { TARGET_ECHOKE, TARGET_ECHOKE, ECHOKE, ECHOKE },
5835         { TARGET_FLUSHO, TARGET_FLUSHO, FLUSHO, FLUSHO },
5836         { TARGET_PENDIN, TARGET_PENDIN, PENDIN, PENDIN },
5837         { TARGET_IEXTEN, TARGET_IEXTEN, IEXTEN, IEXTEN },
5838         { 0, 0, 0, 0 }
5839 };
5840
5841 static void target_to_host_termios (void *dst, const void *src)
5842 {
5843     struct host_termios *host = dst;
5844     const struct target_termios *target = src;
5845
5846     host->c_iflag =
5847         target_to_host_bitmask(tswap32(target->c_iflag), iflag_tbl);
5848     host->c_oflag =
5849         target_to_host_bitmask(tswap32(target->c_oflag), oflag_tbl);
5850     host->c_cflag =
5851         target_to_host_bitmask(tswap32(target->c_cflag), cflag_tbl);
5852     host->c_lflag =
5853         target_to_host_bitmask(tswap32(target->c_lflag), lflag_tbl);
5854     host->c_line = target->c_line;
5855
5856     memset(host->c_cc, 0, sizeof(host->c_cc));
5857     host->c_cc[VINTR] = target->c_cc[TARGET_VINTR];
5858     host->c_cc[VQUIT] = target->c_cc[TARGET_VQUIT];
5859     host->c_cc[VERASE] = target->c_cc[TARGET_VERASE];
5860     host->c_cc[VKILL] = target->c_cc[TARGET_VKILL];
5861     host->c_cc[VEOF] = target->c_cc[TARGET_VEOF];
5862     host->c_cc[VTIME] = target->c_cc[TARGET_VTIME];
5863     host->c_cc[VMIN] = target->c_cc[TARGET_VMIN];
5864     host->c_cc[VSWTC] = target->c_cc[TARGET_VSWTC];
5865     host->c_cc[VSTART] = target->c_cc[TARGET_VSTART];
5866     host->c_cc[VSTOP] = target->c_cc[TARGET_VSTOP];
5867     host->c_cc[VSUSP] = target->c_cc[TARGET_VSUSP];
5868     host->c_cc[VEOL] = target->c_cc[TARGET_VEOL];
5869     host->c_cc[VREPRINT] = target->c_cc[TARGET_VREPRINT];
5870     host->c_cc[VDISCARD] = target->c_cc[TARGET_VDISCARD];
5871     host->c_cc[VWERASE] = target->c_cc[TARGET_VWERASE];
5872     host->c_cc[VLNEXT] = target->c_cc[TARGET_VLNEXT];
5873     host->c_cc[VEOL2] = target->c_cc[TARGET_VEOL2];
5874 }
5875
5876 static void host_to_target_termios (void *dst, const void *src)
5877 {
5878     struct target_termios *target = dst;
5879     const struct host_termios *host = src;
5880
5881     target->c_iflag =
5882         tswap32(host_to_target_bitmask(host->c_iflag, iflag_tbl));
5883     target->c_oflag =
5884         tswap32(host_to_target_bitmask(host->c_oflag, oflag_tbl));
5885     target->c_cflag =
5886         tswap32(host_to_target_bitmask(host->c_cflag, cflag_tbl));
5887     target->c_lflag =
5888         tswap32(host_to_target_bitmask(host->c_lflag, lflag_tbl));
5889     target->c_line = host->c_line;
5890
5891     memset(target->c_cc, 0, sizeof(target->c_cc));
5892     target->c_cc[TARGET_VINTR] = host->c_cc[VINTR];
5893     target->c_cc[TARGET_VQUIT] = host->c_cc[VQUIT];
5894     target->c_cc[TARGET_VERASE] = host->c_cc[VERASE];
5895     target->c_cc[TARGET_VKILL] = host->c_cc[VKILL];
5896     target->c_cc[TARGET_VEOF] = host->c_cc[VEOF];
5897     target->c_cc[TARGET_VTIME] = host->c_cc[VTIME];
5898     target->c_cc[TARGET_VMIN] = host->c_cc[VMIN];
5899     target->c_cc[TARGET_VSWTC] = host->c_cc[VSWTC];
5900     target->c_cc[TARGET_VSTART] = host->c_cc[VSTART];
5901     target->c_cc[TARGET_VSTOP] = host->c_cc[VSTOP];
5902     target->c_cc[TARGET_VSUSP] = host->c_cc[VSUSP];
5903     target->c_cc[TARGET_VEOL] = host->c_cc[VEOL];
5904     target->c_cc[TARGET_VREPRINT] = host->c_cc[VREPRINT];
5905     target->c_cc[TARGET_VDISCARD] = host->c_cc[VDISCARD];
5906     target->c_cc[TARGET_VWERASE] = host->c_cc[VWERASE];
5907     target->c_cc[TARGET_VLNEXT] = host->c_cc[VLNEXT];
5908     target->c_cc[TARGET_VEOL2] = host->c_cc[VEOL2];
5909 }
5910
5911 static const StructEntry struct_termios_def = {
5912     .convert = { host_to_target_termios, target_to_host_termios },
5913     .size = { sizeof(struct target_termios), sizeof(struct host_termios) },
5914     .align = { __alignof__(struct target_termios), __alignof__(struct host_termios) },
5915 };
5916
5917 static bitmask_transtbl mmap_flags_tbl[] = {
5918     { TARGET_MAP_SHARED, TARGET_MAP_SHARED, MAP_SHARED, MAP_SHARED },
5919     { TARGET_MAP_PRIVATE, TARGET_MAP_PRIVATE, MAP_PRIVATE, MAP_PRIVATE },
5920     { TARGET_MAP_FIXED, TARGET_MAP_FIXED, MAP_FIXED, MAP_FIXED },
5921     { TARGET_MAP_ANONYMOUS, TARGET_MAP_ANONYMOUS,
5922       MAP_ANONYMOUS, MAP_ANONYMOUS },
5923     { TARGET_MAP_GROWSDOWN, TARGET_MAP_GROWSDOWN,
5924       MAP_GROWSDOWN, MAP_GROWSDOWN },
5925     { TARGET_MAP_DENYWRITE, TARGET_MAP_DENYWRITE,
5926       MAP_DENYWRITE, MAP_DENYWRITE },
5927     { TARGET_MAP_EXECUTABLE, TARGET_MAP_EXECUTABLE,
5928       MAP_EXECUTABLE, MAP_EXECUTABLE },
5929     { TARGET_MAP_LOCKED, TARGET_MAP_LOCKED, MAP_LOCKED, MAP_LOCKED },
5930     { TARGET_MAP_NORESERVE, TARGET_MAP_NORESERVE,
5931       MAP_NORESERVE, MAP_NORESERVE },
5932     { TARGET_MAP_HUGETLB, TARGET_MAP_HUGETLB, MAP_HUGETLB, MAP_HUGETLB },
5933     /* MAP_STACK had been ignored by the kernel for quite some time.
5934        Recognize it for the target insofar as we do not want to pass
5935        it through to the host.  */
5936     { TARGET_MAP_STACK, TARGET_MAP_STACK, 0, 0 },
5937     { 0, 0, 0, 0 }
5938 };
5939
5940 #if defined(TARGET_I386)
5941
5942 /* NOTE: there is really one LDT for all the threads */
5943 static uint8_t *ldt_table;
5944
5945 static abi_long read_ldt(abi_ulong ptr, unsigned long bytecount)
5946 {
5947     int size;
5948     void *p;
5949
5950     if (!ldt_table)
5951         return 0;
5952     size = TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE;
5953     if (size > bytecount)
5954         size = bytecount;
5955     p = lock_user(VERIFY_WRITE, ptr, size, 0);
5956     if (!p)
5957         return -TARGET_EFAULT;
5958     /* ??? Should this by byteswapped?  */
5959     memcpy(p, ldt_table, size);
5960     unlock_user(p, ptr, size);
5961     return size;
5962 }
5963
5964 /* XXX: add locking support */
5965 static abi_long write_ldt(CPUX86State *env,
5966                           abi_ulong ptr, unsigned long bytecount, int oldmode)
5967 {
5968     struct target_modify_ldt_ldt_s ldt_info;
5969     struct target_modify_ldt_ldt_s *target_ldt_info;
5970     int seg_32bit, contents, read_exec_only, limit_in_pages;
5971     int seg_not_present, useable, lm;
5972     uint32_t *lp, entry_1, entry_2;
5973
5974     if (bytecount != sizeof(ldt_info))
5975         return -TARGET_EINVAL;
5976     if (!lock_user_struct(VERIFY_READ, target_ldt_info, ptr, 1))
5977         return -TARGET_EFAULT;
5978     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
5979     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
5980     ldt_info.limit = tswap32(target_ldt_info->limit);
5981     ldt_info.flags = tswap32(target_ldt_info->flags);
5982     unlock_user_struct(target_ldt_info, ptr, 0);
5983
5984     if (ldt_info.entry_number >= TARGET_LDT_ENTRIES)
5985         return -TARGET_EINVAL;
5986     seg_32bit = ldt_info.flags & 1;
5987     contents = (ldt_info.flags >> 1) & 3;
5988     read_exec_only = (ldt_info.flags >> 3) & 1;
5989     limit_in_pages = (ldt_info.flags >> 4) & 1;
5990     seg_not_present = (ldt_info.flags >> 5) & 1;
5991     useable = (ldt_info.flags >> 6) & 1;
5992 #ifdef TARGET_ABI32
5993     lm = 0;
5994 #else
5995     lm = (ldt_info.flags >> 7) & 1;
5996 #endif
5997     if (contents == 3) {
5998         if (oldmode)
5999             return -TARGET_EINVAL;
6000         if (seg_not_present == 0)
6001             return -TARGET_EINVAL;
6002     }
6003     /* allocate the LDT */
6004     if (!ldt_table) {
6005         env->ldt.base = target_mmap(0,
6006                                     TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE,
6007                                     PROT_READ|PROT_WRITE,
6008                                     MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
6009         if (env->ldt.base == -1)
6010             return -TARGET_ENOMEM;
6011         memset(g2h(env->ldt.base), 0,
6012                TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE);
6013         env->ldt.limit = 0xffff;
6014         ldt_table = g2h(env->ldt.base);
6015     }
6016
6017     /* NOTE: same code as Linux kernel */
6018     /* Allow LDTs to be cleared by the user. */
6019     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
6020         if (oldmode ||
6021             (contents == 0              &&
6022              read_exec_only == 1        &&
6023              seg_32bit == 0             &&
6024              limit_in_pages == 0        &&
6025              seg_not_present == 1       &&
6026              useable == 0 )) {
6027             entry_1 = 0;
6028             entry_2 = 0;
6029             goto install;
6030         }
6031     }
6032
6033     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
6034         (ldt_info.limit & 0x0ffff);
6035     entry_2 = (ldt_info.base_addr & 0xff000000) |
6036         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
6037         (ldt_info.limit & 0xf0000) |
6038         ((read_exec_only ^ 1) << 9) |
6039         (contents << 10) |
6040         ((seg_not_present ^ 1) << 15) |
6041         (seg_32bit << 22) |
6042         (limit_in_pages << 23) |
6043         (lm << 21) |
6044         0x7000;
6045     if (!oldmode)
6046         entry_2 |= (useable << 20);
6047
6048     /* Install the new entry ...  */
6049 install:
6050     lp = (uint32_t *)(ldt_table + (ldt_info.entry_number << 3));
6051     lp[0] = tswap32(entry_1);
6052     lp[1] = tswap32(entry_2);
6053     return 0;
6054 }
6055
6056 /* specific and weird i386 syscalls */
6057 static abi_long do_modify_ldt(CPUX86State *env, int func, abi_ulong ptr,
6058                               unsigned long bytecount)
6059 {
6060     abi_long ret;
6061
6062     switch (func) {
6063     case 0:
6064         ret = read_ldt(ptr, bytecount);
6065         break;
6066     case 1:
6067         ret = write_ldt(env, ptr, bytecount, 1);
6068         break;
6069     case 0x11:
6070         ret = write_ldt(env, ptr, bytecount, 0);
6071         break;
6072     default:
6073         ret = -TARGET_ENOSYS;
6074         break;
6075     }
6076     return ret;
6077 }
6078
6079 #if defined(TARGET_I386) && defined(TARGET_ABI32)
6080 abi_long do_set_thread_area(CPUX86State *env, abi_ulong ptr)
6081 {
6082     uint64_t *gdt_table = g2h(env->gdt.base);
6083     struct target_modify_ldt_ldt_s ldt_info;
6084     struct target_modify_ldt_ldt_s *target_ldt_info;
6085     int seg_32bit, contents, read_exec_only, limit_in_pages;
6086     int seg_not_present, useable, lm;
6087     uint32_t *lp, entry_1, entry_2;
6088     int i;
6089
6090     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
6091     if (!target_ldt_info)
6092         return -TARGET_EFAULT;
6093     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
6094     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
6095     ldt_info.limit = tswap32(target_ldt_info->limit);
6096     ldt_info.flags = tswap32(target_ldt_info->flags);
6097     if (ldt_info.entry_number == -1) {
6098         for (i=TARGET_GDT_ENTRY_TLS_MIN; i<=TARGET_GDT_ENTRY_TLS_MAX; i++) {
6099             if (gdt_table[i] == 0) {
6100                 ldt_info.entry_number = i;
6101                 target_ldt_info->entry_number = tswap32(i);
6102                 break;
6103             }
6104         }
6105     }
6106     unlock_user_struct(target_ldt_info, ptr, 1);
6107
6108     if (ldt_info.entry_number < TARGET_GDT_ENTRY_TLS_MIN ||
6109         ldt_info.entry_number > TARGET_GDT_ENTRY_TLS_MAX)
6110            return -TARGET_EINVAL;
6111     seg_32bit = ldt_info.flags & 1;
6112     contents = (ldt_info.flags >> 1) & 3;
6113     read_exec_only = (ldt_info.flags >> 3) & 1;
6114     limit_in_pages = (ldt_info.flags >> 4) & 1;
6115     seg_not_present = (ldt_info.flags >> 5) & 1;
6116     useable = (ldt_info.flags >> 6) & 1;
6117 #ifdef TARGET_ABI32
6118     lm = 0;
6119 #else
6120     lm = (ldt_info.flags >> 7) & 1;
6121 #endif
6122
6123     if (contents == 3) {
6124         if (seg_not_present == 0)
6125             return -TARGET_EINVAL;
6126     }
6127
6128     /* NOTE: same code as Linux kernel */
6129     /* Allow LDTs to be cleared by the user. */
6130     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
6131         if ((contents == 0             &&
6132              read_exec_only == 1       &&
6133              seg_32bit == 0            &&
6134              limit_in_pages == 0       &&
6135              seg_not_present == 1      &&
6136              useable == 0 )) {
6137             entry_1 = 0;
6138             entry_2 = 0;
6139             goto install;
6140         }
6141     }
6142
6143     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
6144         (ldt_info.limit & 0x0ffff);
6145     entry_2 = (ldt_info.base_addr & 0xff000000) |
6146         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
6147         (ldt_info.limit & 0xf0000) |
6148         ((read_exec_only ^ 1) << 9) |
6149         (contents << 10) |
6150         ((seg_not_present ^ 1) << 15) |
6151         (seg_32bit << 22) |
6152         (limit_in_pages << 23) |
6153         (useable << 20) |
6154         (lm << 21) |
6155         0x7000;
6156
6157     /* Install the new entry ...  */
6158 install:
6159     lp = (uint32_t *)(gdt_table + ldt_info.entry_number);
6160     lp[0] = tswap32(entry_1);
6161     lp[1] = tswap32(entry_2);
6162     return 0;
6163 }
6164
6165 static abi_long do_get_thread_area(CPUX86State *env, abi_ulong ptr)
6166 {
6167     struct target_modify_ldt_ldt_s *target_ldt_info;
6168     uint64_t *gdt_table = g2h(env->gdt.base);
6169     uint32_t base_addr, limit, flags;
6170     int seg_32bit, contents, read_exec_only, limit_in_pages, idx;
6171     int seg_not_present, useable, lm;
6172     uint32_t *lp, entry_1, entry_2;
6173
6174     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
6175     if (!target_ldt_info)
6176         return -TARGET_EFAULT;
6177     idx = tswap32(target_ldt_info->entry_number);
6178     if (idx < TARGET_GDT_ENTRY_TLS_MIN ||
6179         idx > TARGET_GDT_ENTRY_TLS_MAX) {
6180         unlock_user_struct(target_ldt_info, ptr, 1);
6181         return -TARGET_EINVAL;
6182     }
6183     lp = (uint32_t *)(gdt_table + idx);
6184     entry_1 = tswap32(lp[0]);
6185     entry_2 = tswap32(lp[1]);
6186
6187     read_exec_only = ((entry_2 >> 9) & 1) ^ 1;
6188     contents = (entry_2 >> 10) & 3;
6189     seg_not_present = ((entry_2 >> 15) & 1) ^ 1;
6190     seg_32bit = (entry_2 >> 22) & 1;
6191     limit_in_pages = (entry_2 >> 23) & 1;
6192     useable = (entry_2 >> 20) & 1;
6193 #ifdef TARGET_ABI32
6194     lm = 0;
6195 #else
6196     lm = (entry_2 >> 21) & 1;
6197 #endif
6198     flags = (seg_32bit << 0) | (contents << 1) |
6199         (read_exec_only << 3) | (limit_in_pages << 4) |
6200         (seg_not_present << 5) | (useable << 6) | (lm << 7);
6201     limit = (entry_1 & 0xffff) | (entry_2  & 0xf0000);
6202     base_addr = (entry_1 >> 16) |
6203         (entry_2 & 0xff000000) |
6204         ((entry_2 & 0xff) << 16);
6205     target_ldt_info->base_addr = tswapal(base_addr);
6206     target_ldt_info->limit = tswap32(limit);
6207     target_ldt_info->flags = tswap32(flags);
6208     unlock_user_struct(target_ldt_info, ptr, 1);
6209     return 0;
6210 }
6211 #endif /* TARGET_I386 && TARGET_ABI32 */
6212
6213 #ifndef TARGET_ABI32
6214 abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
6215 {
6216     abi_long ret = 0;
6217     abi_ulong val;
6218     int idx;
6219
6220     switch(code) {
6221     case TARGET_ARCH_SET_GS:
6222     case TARGET_ARCH_SET_FS:
6223         if (code == TARGET_ARCH_SET_GS)
6224             idx = R_GS;
6225         else
6226             idx = R_FS;
6227         cpu_x86_load_seg(env, idx, 0);
6228         env->segs[idx].base = addr;
6229         break;
6230     case TARGET_ARCH_GET_GS:
6231     case TARGET_ARCH_GET_FS:
6232         if (code == TARGET_ARCH_GET_GS)
6233             idx = R_GS;
6234         else
6235             idx = R_FS;
6236         val = env->segs[idx].base;
6237         if (put_user(val, addr, abi_ulong))
6238             ret = -TARGET_EFAULT;
6239         break;
6240     default:
6241         ret = -TARGET_EINVAL;
6242         break;
6243     }
6244     return ret;
6245 }
6246 #endif
6247
6248 #endif /* defined(TARGET_I386) */
6249
6250 #define NEW_STACK_SIZE 0x40000
6251
6252
6253 static pthread_mutex_t clone_lock = PTHREAD_MUTEX_INITIALIZER;
6254 typedef struct {
6255     CPUArchState *env;
6256     pthread_mutex_t mutex;
6257     pthread_cond_t cond;
6258     pthread_t thread;
6259     uint32_t tid;
6260     abi_ulong child_tidptr;
6261     abi_ulong parent_tidptr;
6262     sigset_t sigmask;
6263 } new_thread_info;
6264
6265 static void *clone_func(void *arg)
6266 {
6267     new_thread_info *info = arg;
6268     CPUArchState *env;
6269     CPUState *cpu;
6270     TaskState *ts;
6271
6272     rcu_register_thread();
6273     tcg_register_thread();
6274     env = info->env;
6275     cpu = ENV_GET_CPU(env);
6276     thread_cpu = cpu;
6277     ts = (TaskState *)cpu->opaque;
6278     info->tid = gettid();
6279     task_settid(ts);
6280     if (info->child_tidptr)
6281         put_user_u32(info->tid, info->child_tidptr);
6282     if (info->parent_tidptr)
6283         put_user_u32(info->tid, info->parent_tidptr);
6284     /* Enable signals.  */
6285     sigprocmask(SIG_SETMASK, &info->sigmask, NULL);
6286     /* Signal to the parent that we're ready.  */
6287     pthread_mutex_lock(&info->mutex);
6288     pthread_cond_broadcast(&info->cond);
6289     pthread_mutex_unlock(&info->mutex);
6290     /* Wait until the parent has finished initializing the tls state.  */
6291     pthread_mutex_lock(&clone_lock);
6292     pthread_mutex_unlock(&clone_lock);
6293     cpu_loop(env);
6294     /* never exits */
6295     return NULL;
6296 }
6297
6298 /* do_fork() Must return host values and target errnos (unlike most
6299    do_*() functions). */
6300 static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
6301                    abi_ulong parent_tidptr, target_ulong newtls,
6302                    abi_ulong child_tidptr)
6303 {
6304     CPUState *cpu = ENV_GET_CPU(env);
6305     int ret;
6306     TaskState *ts;
6307     CPUState *new_cpu;
6308     CPUArchState *new_env;
6309     sigset_t sigmask;
6310
6311     flags &= ~CLONE_IGNORED_FLAGS;
6312
6313     /* Emulate vfork() with fork() */
6314     if (flags & CLONE_VFORK)
6315         flags &= ~(CLONE_VFORK | CLONE_VM);
6316
6317     if (flags & CLONE_VM) {
6318         TaskState *parent_ts = (TaskState *)cpu->opaque;
6319         new_thread_info info;
6320         pthread_attr_t attr;
6321
6322         if (((flags & CLONE_THREAD_FLAGS) != CLONE_THREAD_FLAGS) ||
6323             (flags & CLONE_INVALID_THREAD_FLAGS)) {
6324             return -TARGET_EINVAL;
6325         }
6326
6327         ts = g_new0(TaskState, 1);
6328         init_task_state(ts);
6329         /* we create a new CPU instance. */
6330         new_env = cpu_copy(env);
6331         /* Init regs that differ from the parent.  */
6332         cpu_clone_regs(new_env, newsp);
6333         new_cpu = ENV_GET_CPU(new_env);
6334         new_cpu->opaque = ts;
6335         ts->bprm = parent_ts->bprm;
6336         ts->info = parent_ts->info;
6337         ts->signal_mask = parent_ts->signal_mask;
6338
6339         if (flags & CLONE_CHILD_CLEARTID) {
6340             ts->child_tidptr = child_tidptr;
6341         }
6342
6343         if (flags & CLONE_SETTLS) {
6344             cpu_set_tls (new_env, newtls);
6345         }
6346
6347         /* Grab a mutex so that thread setup appears atomic.  */
6348         pthread_mutex_lock(&clone_lock);
6349
6350         memset(&info, 0, sizeof(info));
6351         pthread_mutex_init(&info.mutex, NULL);
6352         pthread_mutex_lock(&info.mutex);
6353         pthread_cond_init(&info.cond, NULL);
6354         info.env = new_env;
6355         if (flags & CLONE_CHILD_SETTID) {
6356             info.child_tidptr = child_tidptr;
6357         }
6358         if (flags & CLONE_PARENT_SETTID) {
6359             info.parent_tidptr = parent_tidptr;
6360         }
6361
6362         ret = pthread_attr_init(&attr);
6363         ret = pthread_attr_setstacksize(&attr, NEW_STACK_SIZE);
6364         ret = pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
6365         /* It is not safe to deliver signals until the child has finished
6366            initializing, so temporarily block all signals.  */
6367         sigfillset(&sigmask);
6368         sigprocmask(SIG_BLOCK, &sigmask, &info.sigmask);
6369
6370         /* If this is our first additional thread, we need to ensure we
6371          * generate code for parallel execution and flush old translations.
6372          */
6373         if (!parallel_cpus) {
6374             parallel_cpus = true;
6375             tb_flush(cpu);
6376         }
6377
6378         ret = pthread_create(&info.thread, &attr, clone_func, &info);
6379         /* TODO: Free new CPU state if thread creation failed.  */
6380
6381         sigprocmask(SIG_SETMASK, &info.sigmask, NULL);
6382         pthread_attr_destroy(&attr);
6383         if (ret == 0) {
6384             /* Wait for the child to initialize.  */
6385             pthread_cond_wait(&info.cond, &info.mutex);
6386             ret = info.tid;
6387         } else {
6388             ret = -1;
6389         }
6390         pthread_mutex_unlock(&info.mutex);
6391         pthread_cond_destroy(&info.cond);
6392         pthread_mutex_destroy(&info.mutex);
6393         pthread_mutex_unlock(&clone_lock);
6394     } else {
6395         /* if no CLONE_VM, we consider it is a fork */
6396         if (flags & CLONE_INVALID_FORK_FLAGS) {
6397             return -TARGET_EINVAL;
6398         }
6399
6400         /* We can't support custom termination signals */
6401         if ((flags & CSIGNAL) != TARGET_SIGCHLD) {
6402             return -TARGET_EINVAL;
6403         }
6404
6405         if (block_signals()) {
6406             return -TARGET_ERESTARTSYS;
6407         }
6408
6409         fork_start();
6410         ret = fork();
6411         if (ret == 0) {
6412             /* Child Process.  */
6413             cpu_clone_regs(env, newsp);
6414             fork_end(1);
6415             /* There is a race condition here.  The parent process could
6416                theoretically read the TID in the child process before the child
6417                tid is set.  This would require using either ptrace
6418                (not implemented) or having *_tidptr to point at a shared memory
6419                mapping.  We can't repeat the spinlock hack used above because
6420                the child process gets its own copy of the lock.  */
6421             if (flags & CLONE_CHILD_SETTID)
6422                 put_user_u32(gettid(), child_tidptr);
6423             if (flags & CLONE_PARENT_SETTID)
6424                 put_user_u32(gettid(), parent_tidptr);
6425             ts = (TaskState *)cpu->opaque;
6426             if (flags & CLONE_SETTLS)
6427                 cpu_set_tls (env, newtls);
6428             if (flags & CLONE_CHILD_CLEARTID)
6429                 ts->child_tidptr = child_tidptr;
6430         } else {
6431             fork_end(0);
6432         }
6433     }
6434     return ret;
6435 }
6436
6437 /* warning : doesn't handle linux specific flags... */
6438 static int target_to_host_fcntl_cmd(int cmd)
6439 {
6440     switch(cmd) {
6441         case TARGET_F_DUPFD:
6442         case TARGET_F_GETFD:
6443         case TARGET_F_SETFD:
6444         case TARGET_F_GETFL:
6445         case TARGET_F_SETFL:
6446             return cmd;
6447         case TARGET_F_GETLK:
6448             return F_GETLK64;
6449         case TARGET_F_SETLK:
6450             return F_SETLK64;
6451         case TARGET_F_SETLKW:
6452             return F_SETLKW64;
6453         case TARGET_F_GETOWN:
6454             return F_GETOWN;
6455         case TARGET_F_SETOWN:
6456             return F_SETOWN;
6457         case TARGET_F_GETSIG:
6458             return F_GETSIG;
6459         case TARGET_F_SETSIG:
6460             return F_SETSIG;
6461 #if TARGET_ABI_BITS == 32
6462         case TARGET_F_GETLK64:
6463             return F_GETLK64;
6464         case TARGET_F_SETLK64:
6465             return F_SETLK64;
6466         case TARGET_F_SETLKW64:
6467             return F_SETLKW64;
6468 #endif
6469         case TARGET_F_SETLEASE:
6470             return F_SETLEASE;
6471         case TARGET_F_GETLEASE:
6472             return F_GETLEASE;
6473 #ifdef F_DUPFD_CLOEXEC
6474         case TARGET_F_DUPFD_CLOEXEC:
6475             return F_DUPFD_CLOEXEC;
6476 #endif
6477         case TARGET_F_NOTIFY:
6478             return F_NOTIFY;
6479 #ifdef F_GETOWN_EX
6480         case TARGET_F_GETOWN_EX:
6481             return F_GETOWN_EX;
6482 #endif
6483 #ifdef F_SETOWN_EX
6484         case TARGET_F_SETOWN_EX:
6485             return F_SETOWN_EX;
6486 #endif
6487 #ifdef F_SETPIPE_SZ
6488         case TARGET_F_SETPIPE_SZ:
6489             return F_SETPIPE_SZ;
6490         case TARGET_F_GETPIPE_SZ:
6491             return F_GETPIPE_SZ;
6492 #endif
6493         default:
6494             return -TARGET_EINVAL;
6495     }
6496     return -TARGET_EINVAL;
6497 }
6498
6499 #define TRANSTBL_CONVERT(a) { -1, TARGET_##a, -1, a }
6500 static const bitmask_transtbl flock_tbl[] = {
6501     TRANSTBL_CONVERT(F_RDLCK),
6502     TRANSTBL_CONVERT(F_WRLCK),
6503     TRANSTBL_CONVERT(F_UNLCK),
6504     TRANSTBL_CONVERT(F_EXLCK),
6505     TRANSTBL_CONVERT(F_SHLCK),
6506     { 0, 0, 0, 0 }
6507 };
6508
6509 static inline abi_long copy_from_user_flock(struct flock64 *fl,
6510                                             abi_ulong target_flock_addr)
6511 {
6512     struct target_flock *target_fl;
6513     short l_type;
6514
6515     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6516         return -TARGET_EFAULT;
6517     }
6518
6519     __get_user(l_type, &target_fl->l_type);
6520     fl->l_type = target_to_host_bitmask(l_type, flock_tbl);
6521     __get_user(fl->l_whence, &target_fl->l_whence);
6522     __get_user(fl->l_start, &target_fl->l_start);
6523     __get_user(fl->l_len, &target_fl->l_len);
6524     __get_user(fl->l_pid, &target_fl->l_pid);
6525     unlock_user_struct(target_fl, target_flock_addr, 0);
6526     return 0;
6527 }
6528
6529 static inline abi_long copy_to_user_flock(abi_ulong target_flock_addr,
6530                                           const struct flock64 *fl)
6531 {
6532     struct target_flock *target_fl;
6533     short l_type;
6534
6535     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6536         return -TARGET_EFAULT;
6537     }
6538
6539     l_type = host_to_target_bitmask(fl->l_type, flock_tbl);
6540     __put_user(l_type, &target_fl->l_type);
6541     __put_user(fl->l_whence, &target_fl->l_whence);
6542     __put_user(fl->l_start, &target_fl->l_start);
6543     __put_user(fl->l_len, &target_fl->l_len);
6544     __put_user(fl->l_pid, &target_fl->l_pid);
6545     unlock_user_struct(target_fl, target_flock_addr, 1);
6546     return 0;
6547 }
6548
6549 typedef abi_long from_flock64_fn(struct flock64 *fl, abi_ulong target_addr);
6550 typedef abi_long to_flock64_fn(abi_ulong target_addr, const struct flock64 *fl);
6551
6552 #if defined(TARGET_ARM) && TARGET_ABI_BITS == 32
6553 static inline abi_long copy_from_user_eabi_flock64(struct flock64 *fl,
6554                                                    abi_ulong target_flock_addr)
6555 {
6556     struct target_eabi_flock64 *target_fl;
6557     short l_type;
6558
6559     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6560         return -TARGET_EFAULT;
6561     }
6562
6563     __get_user(l_type, &target_fl->l_type);
6564     fl->l_type = target_to_host_bitmask(l_type, flock_tbl);
6565     __get_user(fl->l_whence, &target_fl->l_whence);
6566     __get_user(fl->l_start, &target_fl->l_start);
6567     __get_user(fl->l_len, &target_fl->l_len);
6568     __get_user(fl->l_pid, &target_fl->l_pid);
6569     unlock_user_struct(target_fl, target_flock_addr, 0);
6570     return 0;
6571 }
6572
6573 static inline abi_long copy_to_user_eabi_flock64(abi_ulong target_flock_addr,
6574                                                  const struct flock64 *fl)
6575 {
6576     struct target_eabi_flock64 *target_fl;
6577     short l_type;
6578
6579     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6580         return -TARGET_EFAULT;
6581     }
6582
6583     l_type = host_to_target_bitmask(fl->l_type, flock_tbl);
6584     __put_user(l_type, &target_fl->l_type);
6585     __put_user(fl->l_whence, &target_fl->l_whence);
6586     __put_user(fl->l_start, &target_fl->l_start);
6587     __put_user(fl->l_len, &target_fl->l_len);
6588     __put_user(fl->l_pid, &target_fl->l_pid);
6589     unlock_user_struct(target_fl, target_flock_addr, 1);
6590     return 0;
6591 }
6592 #endif
6593
6594 static inline abi_long copy_from_user_flock64(struct flock64 *fl,
6595                                               abi_ulong target_flock_addr)
6596 {
6597     struct target_flock64 *target_fl;
6598     short l_type;
6599
6600     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6601         return -TARGET_EFAULT;
6602     }
6603
6604     __get_user(l_type, &target_fl->l_type);
6605     fl->l_type = target_to_host_bitmask(l_type, flock_tbl);
6606     __get_user(fl->l_whence, &target_fl->l_whence);
6607     __get_user(fl->l_start, &target_fl->l_start);
6608     __get_user(fl->l_len, &target_fl->l_len);
6609     __get_user(fl->l_pid, &target_fl->l_pid);
6610     unlock_user_struct(target_fl, target_flock_addr, 0);
6611     return 0;
6612 }
6613
6614 static inline abi_long copy_to_user_flock64(abi_ulong target_flock_addr,
6615                                             const struct flock64 *fl)
6616 {
6617     struct target_flock64 *target_fl;
6618     short l_type;
6619
6620     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6621         return -TARGET_EFAULT;
6622     }
6623
6624     l_type = host_to_target_bitmask(fl->l_type, flock_tbl);
6625     __put_user(l_type, &target_fl->l_type);
6626     __put_user(fl->l_whence, &target_fl->l_whence);
6627     __put_user(fl->l_start, &target_fl->l_start);
6628     __put_user(fl->l_len, &target_fl->l_len);
6629     __put_user(fl->l_pid, &target_fl->l_pid);
6630     unlock_user_struct(target_fl, target_flock_addr, 1);
6631     return 0;
6632 }
6633
6634 static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
6635 {
6636     struct flock64 fl64;
6637 #ifdef F_GETOWN_EX
6638     struct f_owner_ex fox;
6639     struct target_f_owner_ex *target_fox;
6640 #endif
6641     abi_long ret;
6642     int host_cmd = target_to_host_fcntl_cmd(cmd);
6643
6644     if (host_cmd == -TARGET_EINVAL)
6645             return host_cmd;
6646
6647     switch(cmd) {
6648     case TARGET_F_GETLK:
6649         ret = copy_from_user_flock(&fl64, arg);
6650         if (ret) {
6651             return ret;
6652         }
6653         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6654         if (ret == 0) {
6655             ret = copy_to_user_flock(arg, &fl64);
6656         }
6657         break;
6658
6659     case TARGET_F_SETLK:
6660     case TARGET_F_SETLKW:
6661         ret = copy_from_user_flock(&fl64, arg);
6662         if (ret) {
6663             return ret;
6664         }
6665         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6666         break;
6667
6668     case TARGET_F_GETLK64:
6669         ret = copy_from_user_flock64(&fl64, arg);
6670         if (ret) {
6671             return ret;
6672         }
6673         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6674         if (ret == 0) {
6675             ret = copy_to_user_flock64(arg, &fl64);
6676         }
6677         break;
6678     case TARGET_F_SETLK64:
6679     case TARGET_F_SETLKW64:
6680         ret = copy_from_user_flock64(&fl64, arg);
6681         if (ret) {
6682             return ret;
6683         }
6684         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6685         break;
6686
6687     case TARGET_F_GETFL:
6688         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
6689         if (ret >= 0) {
6690             ret = host_to_target_bitmask(ret, fcntl_flags_tbl);
6691         }
6692         break;
6693
6694     case TARGET_F_SETFL:
6695         ret = get_errno(safe_fcntl(fd, host_cmd,
6696                                    target_to_host_bitmask(arg,
6697                                                           fcntl_flags_tbl)));
6698         break;
6699
6700 #ifdef F_GETOWN_EX
6701     case TARGET_F_GETOWN_EX:
6702         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
6703         if (ret >= 0) {
6704             if (!lock_user_struct(VERIFY_WRITE, target_fox, arg, 0))
6705                 return -TARGET_EFAULT;
6706             target_fox->type = tswap32(fox.type);
6707             target_fox->pid = tswap32(fox.pid);
6708             unlock_user_struct(target_fox, arg, 1);
6709         }
6710         break;
6711 #endif
6712
6713 #ifdef F_SETOWN_EX
6714     case TARGET_F_SETOWN_EX:
6715         if (!lock_user_struct(VERIFY_READ, target_fox, arg, 1))
6716             return -TARGET_EFAULT;
6717         fox.type = tswap32(target_fox->type);
6718         fox.pid = tswap32(target_fox->pid);
6719         unlock_user_struct(target_fox, arg, 0);
6720         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
6721         break;
6722 #endif
6723
6724     case TARGET_F_SETOWN:
6725     case TARGET_F_GETOWN:
6726     case TARGET_F_SETSIG:
6727     case TARGET_F_GETSIG:
6728     case TARGET_F_SETLEASE:
6729     case TARGET_F_GETLEASE:
6730     case TARGET_F_SETPIPE_SZ:
6731     case TARGET_F_GETPIPE_SZ:
6732         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
6733         break;
6734
6735     default:
6736         ret = get_errno(safe_fcntl(fd, cmd, arg));
6737         break;
6738     }
6739     return ret;
6740 }
6741
6742 #ifdef USE_UID16
6743
6744 static inline int high2lowuid(int uid)
6745 {
6746     if (uid > 65535)
6747         return 65534;
6748     else
6749         return uid;
6750 }
6751
6752 static inline int high2lowgid(int gid)
6753 {
6754     if (gid > 65535)
6755         return 65534;
6756     else
6757         return gid;
6758 }
6759
6760 static inline int low2highuid(int uid)
6761 {
6762     if ((int16_t)uid == -1)
6763         return -1;
6764     else
6765         return uid;
6766 }
6767
6768 static inline int low2highgid(int gid)
6769 {
6770     if ((int16_t)gid == -1)
6771         return -1;
6772     else
6773         return gid;
6774 }
6775 static inline int tswapid(int id)
6776 {
6777     return tswap16(id);
6778 }
6779
6780 #define put_user_id(x, gaddr) put_user_u16(x, gaddr)
6781
6782 #else /* !USE_UID16 */
6783 static inline int high2lowuid(int uid)
6784 {
6785     return uid;
6786 }
6787 static inline int high2lowgid(int gid)
6788 {
6789     return gid;
6790 }
6791 static inline int low2highuid(int uid)
6792 {
6793     return uid;
6794 }
6795 static inline int low2highgid(int gid)
6796 {
6797     return gid;
6798 }
6799 static inline int tswapid(int id)
6800 {
6801     return tswap32(id);
6802 }
6803
6804 #define put_user_id(x, gaddr) put_user_u32(x, gaddr)
6805
6806 #endif /* USE_UID16 */
6807
6808 /* We must do direct syscalls for setting UID/GID, because we want to
6809  * implement the Linux system call semantics of "change only for this thread",
6810  * not the libc/POSIX semantics of "change for all threads in process".
6811  * (See http://ewontfix.com/17/ for more details.)
6812  * We use the 32-bit version of the syscalls if present; if it is not
6813  * then either the host architecture supports 32-bit UIDs natively with
6814  * the standard syscall, or the 16-bit UID is the best we can do.
6815  */
6816 #ifdef __NR_setuid32
6817 #define __NR_sys_setuid __NR_setuid32
6818 #else
6819 #define __NR_sys_setuid __NR_setuid
6820 #endif
6821 #ifdef __NR_setgid32
6822 #define __NR_sys_setgid __NR_setgid32
6823 #else
6824 #define __NR_sys_setgid __NR_setgid
6825 #endif
6826 #ifdef __NR_setresuid32
6827 #define __NR_sys_setresuid __NR_setresuid32
6828 #else
6829 #define __NR_sys_setresuid __NR_setresuid
6830 #endif
6831 #ifdef __NR_setresgid32
6832 #define __NR_sys_setresgid __NR_setresgid32
6833 #else
6834 #define __NR_sys_setresgid __NR_setresgid
6835 #endif
6836
6837 _syscall1(int, sys_setuid, uid_t, uid)
6838 _syscall1(int, sys_setgid, gid_t, gid)
6839 _syscall3(int, sys_setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
6840 _syscall3(int, sys_setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
6841
6842 void syscall_init(void)
6843 {
6844     IOCTLEntry *ie;
6845     const argtype *arg_type;
6846     int size;
6847     int i;
6848
6849     thunk_init(STRUCT_MAX);
6850
6851 #define STRUCT(name, ...) thunk_register_struct(STRUCT_ ## name, #name, struct_ ## name ## _def);
6852 #define STRUCT_SPECIAL(name) thunk_register_struct_direct(STRUCT_ ## name, #name, &struct_ ## name ## _def);
6853 #include "syscall_types.h"
6854 #undef STRUCT
6855 #undef STRUCT_SPECIAL
6856
6857     /* Build target_to_host_errno_table[] table from
6858      * host_to_target_errno_table[]. */
6859     for (i = 0; i < ERRNO_TABLE_SIZE; i++) {
6860         target_to_host_errno_table[host_to_target_errno_table[i]] = i;
6861     }
6862
6863     /* we patch the ioctl size if necessary. We rely on the fact that
6864        no ioctl has all the bits at '1' in the size field */
6865     ie = ioctl_entries;
6866     while (ie->target_cmd != 0) {
6867         if (((ie->target_cmd >> TARGET_IOC_SIZESHIFT) & TARGET_IOC_SIZEMASK) ==
6868             TARGET_IOC_SIZEMASK) {
6869             arg_type = ie->arg_type;
6870             if (arg_type[0] != TYPE_PTR) {
6871                 fprintf(stderr, "cannot patch size for ioctl 0x%x\n",
6872                         ie->target_cmd);
6873                 exit(1);
6874             }
6875             arg_type++;
6876             size = thunk_type_size(arg_type, 0);
6877             ie->target_cmd = (ie->target_cmd &
6878                               ~(TARGET_IOC_SIZEMASK << TARGET_IOC_SIZESHIFT)) |
6879                 (size << TARGET_IOC_SIZESHIFT);
6880         }
6881
6882         /* automatic consistency check if same arch */
6883 #if (defined(__i386__) && defined(TARGET_I386) && defined(TARGET_ABI32)) || \
6884     (defined(__x86_64__) && defined(TARGET_X86_64))
6885         if (unlikely(ie->target_cmd != ie->host_cmd)) {
6886             fprintf(stderr, "ERROR: ioctl(%s): target=0x%x host=0x%x\n",
6887                     ie->name, ie->target_cmd, ie->host_cmd);
6888         }
6889 #endif
6890         ie++;
6891     }
6892 }
6893
6894 #if TARGET_ABI_BITS == 32
6895 static inline uint64_t target_offset64(uint32_t word0, uint32_t word1)
6896 {
6897 #ifdef TARGET_WORDS_BIGENDIAN
6898     return ((uint64_t)word0 << 32) | word1;
6899 #else
6900     return ((uint64_t)word1 << 32) | word0;
6901 #endif
6902 }
6903 #else /* TARGET_ABI_BITS == 32 */
6904 static inline uint64_t target_offset64(uint64_t word0, uint64_t word1)
6905 {
6906     return word0;
6907 }
6908 #endif /* TARGET_ABI_BITS != 32 */
6909
6910 #ifdef TARGET_NR_truncate64
6911 static inline abi_long target_truncate64(void *cpu_env, const char *arg1,
6912                                          abi_long arg2,
6913                                          abi_long arg3,
6914                                          abi_long arg4)
6915 {
6916     if (regpairs_aligned(cpu_env, TARGET_NR_truncate64)) {
6917         arg2 = arg3;
6918         arg3 = arg4;
6919     }
6920     return get_errno(truncate64(arg1, target_offset64(arg2, arg3)));
6921 }
6922 #endif
6923
6924 #ifdef TARGET_NR_ftruncate64
6925 static inline abi_long target_ftruncate64(void *cpu_env, abi_long arg1,
6926                                           abi_long arg2,
6927                                           abi_long arg3,
6928                                           abi_long arg4)
6929 {
6930     if (regpairs_aligned(cpu_env, TARGET_NR_ftruncate64)) {
6931         arg2 = arg3;
6932         arg3 = arg4;
6933     }
6934     return get_errno(ftruncate64(arg1, target_offset64(arg2, arg3)));
6935 }
6936 #endif
6937
6938 static inline abi_long target_to_host_timespec(struct timespec *host_ts,
6939                                                abi_ulong target_addr)
6940 {
6941     struct target_timespec *target_ts;
6942
6943     if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1))
6944         return -TARGET_EFAULT;
6945     __get_user(host_ts->tv_sec, &target_ts->tv_sec);
6946     __get_user(host_ts->tv_nsec, &target_ts->tv_nsec);
6947     unlock_user_struct(target_ts, target_addr, 0);
6948     return 0;
6949 }
6950
6951 static inline abi_long host_to_target_timespec(abi_ulong target_addr,
6952                                                struct timespec *host_ts)
6953 {
6954     struct target_timespec *target_ts;
6955
6956     if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0))
6957         return -TARGET_EFAULT;
6958     __put_user(host_ts->tv_sec, &target_ts->tv_sec);
6959     __put_user(host_ts->tv_nsec, &target_ts->tv_nsec);
6960     unlock_user_struct(target_ts, target_addr, 1);
6961     return 0;
6962 }
6963
6964 static inline abi_long target_to_host_itimerspec(struct itimerspec *host_itspec,
6965                                                  abi_ulong target_addr)
6966 {
6967     struct target_itimerspec *target_itspec;
6968
6969     if (!lock_user_struct(VERIFY_READ, target_itspec, target_addr, 1)) {
6970         return -TARGET_EFAULT;
6971     }
6972
6973     host_itspec->it_interval.tv_sec =
6974                             tswapal(target_itspec->it_interval.tv_sec);
6975     host_itspec->it_interval.tv_nsec =
6976                             tswapal(target_itspec->it_interval.tv_nsec);
6977     host_itspec->it_value.tv_sec = tswapal(target_itspec->it_value.tv_sec);
6978     host_itspec->it_value.tv_nsec = tswapal(target_itspec->it_value.tv_nsec);
6979
6980     unlock_user_struct(target_itspec, target_addr, 1);
6981     return 0;
6982 }
6983
6984 static inline abi_long host_to_target_itimerspec(abi_ulong target_addr,
6985                                                struct itimerspec *host_its)
6986 {
6987     struct target_itimerspec *target_itspec;
6988
6989     if (!lock_user_struct(VERIFY_WRITE, target_itspec, target_addr, 0)) {
6990         return -TARGET_EFAULT;
6991     }
6992
6993     target_itspec->it_interval.tv_sec = tswapal(host_its->it_interval.tv_sec);
6994     target_itspec->it_interval.tv_nsec = tswapal(host_its->it_interval.tv_nsec);
6995
6996     target_itspec->it_value.tv_sec = tswapal(host_its->it_value.tv_sec);
6997     target_itspec->it_value.tv_nsec = tswapal(host_its->it_value.tv_nsec);
6998
6999     unlock_user_struct(target_itspec, target_addr, 0);
7000     return 0;
7001 }
7002
7003 static inline abi_long target_to_host_timex(struct timex *host_tx,
7004                                             abi_long target_addr)
7005 {
7006     struct target_timex *target_tx;
7007
7008     if (!lock_user_struct(VERIFY_READ, target_tx, target_addr, 1)) {
7009         return -TARGET_EFAULT;
7010     }
7011
7012     __get_user(host_tx->modes, &target_tx->modes);
7013     __get_user(host_tx->offset, &target_tx->offset);
7014     __get_user(host_tx->freq, &target_tx->freq);
7015     __get_user(host_tx->maxerror, &target_tx->maxerror);
7016     __get_user(host_tx->esterror, &target_tx->esterror);
7017     __get_user(host_tx->status, &target_tx->status);
7018     __get_user(host_tx->constant, &target_tx->constant);
7019     __get_user(host_tx->precision, &target_tx->precision);
7020     __get_user(host_tx->tolerance, &target_tx->tolerance);
7021     __get_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
7022     __get_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
7023     __get_user(host_tx->tick, &target_tx->tick);
7024     __get_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7025     __get_user(host_tx->jitter, &target_tx->jitter);
7026     __get_user(host_tx->shift, &target_tx->shift);
7027     __get_user(host_tx->stabil, &target_tx->stabil);
7028     __get_user(host_tx->jitcnt, &target_tx->jitcnt);
7029     __get_user(host_tx->calcnt, &target_tx->calcnt);
7030     __get_user(host_tx->errcnt, &target_tx->errcnt);
7031     __get_user(host_tx->stbcnt, &target_tx->stbcnt);
7032     __get_user(host_tx->tai, &target_tx->tai);
7033
7034     unlock_user_struct(target_tx, target_addr, 0);
7035     return 0;
7036 }
7037
7038 static inline abi_long host_to_target_timex(abi_long target_addr,
7039                                             struct timex *host_tx)
7040 {
7041     struct target_timex *target_tx;
7042
7043     if (!lock_user_struct(VERIFY_WRITE, target_tx, target_addr, 0)) {
7044         return -TARGET_EFAULT;
7045     }
7046
7047     __put_user(host_tx->modes, &target_tx->modes);
7048     __put_user(host_tx->offset, &target_tx->offset);
7049     __put_user(host_tx->freq, &target_tx->freq);
7050     __put_user(host_tx->maxerror, &target_tx->maxerror);
7051     __put_user(host_tx->esterror, &target_tx->esterror);
7052     __put_user(host_tx->status, &target_tx->status);
7053     __put_user(host_tx->constant, &target_tx->constant);
7054     __put_user(host_tx->precision, &target_tx->precision);
7055     __put_user(host_tx->tolerance, &target_tx->tolerance);
7056     __put_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
7057     __put_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
7058     __put_user(host_tx->tick, &target_tx->tick);
7059     __put_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7060     __put_user(host_tx->jitter, &target_tx->jitter);
7061     __put_user(host_tx->shift, &target_tx->shift);
7062     __put_user(host_tx->stabil, &target_tx->stabil);
7063     __put_user(host_tx->jitcnt, &target_tx->jitcnt);
7064     __put_user(host_tx->calcnt, &target_tx->calcnt);
7065     __put_user(host_tx->errcnt, &target_tx->errcnt);
7066     __put_user(host_tx->stbcnt, &target_tx->stbcnt);
7067     __put_user(host_tx->tai, &target_tx->tai);
7068
7069     unlock_user_struct(target_tx, target_addr, 1);
7070     return 0;
7071 }
7072
7073
7074 static inline abi_long target_to_host_sigevent(struct sigevent *host_sevp,
7075                                                abi_ulong target_addr)
7076 {
7077     struct target_sigevent *target_sevp;
7078
7079     if (!lock_user_struct(VERIFY_READ, target_sevp, target_addr, 1)) {
7080         return -TARGET_EFAULT;
7081     }
7082
7083     /* This union is awkward on 64 bit systems because it has a 32 bit
7084      * integer and a pointer in it; we follow the conversion approach
7085      * used for handling sigval types in signal.c so the guest should get
7086      * the correct value back even if we did a 64 bit byteswap and it's
7087      * using the 32 bit integer.
7088      */
7089     host_sevp->sigev_value.sival_ptr =
7090         (void *)(uintptr_t)tswapal(target_sevp->sigev_value.sival_ptr);
7091     host_sevp->sigev_signo =
7092         target_to_host_signal(tswap32(target_sevp->sigev_signo));
7093     host_sevp->sigev_notify = tswap32(target_sevp->sigev_notify);
7094     host_sevp->_sigev_un._tid = tswap32(target_sevp->_sigev_un._tid);
7095
7096     unlock_user_struct(target_sevp, target_addr, 1);
7097     return 0;
7098 }
7099
7100 #if defined(TARGET_NR_mlockall)
7101 static inline int target_to_host_mlockall_arg(int arg)
7102 {
7103     int result = 0;
7104
7105     if (arg & TARGET_MLOCKALL_MCL_CURRENT) {
7106         result |= MCL_CURRENT;
7107     }
7108     if (arg & TARGET_MLOCKALL_MCL_FUTURE) {
7109         result |= MCL_FUTURE;
7110     }
7111     return result;
7112 }
7113 #endif
7114
7115 static inline abi_long host_to_target_stat64(void *cpu_env,
7116                                              abi_ulong target_addr,
7117                                              struct stat *host_st)
7118 {
7119 #if defined(TARGET_ARM) && defined(TARGET_ABI32)
7120     if (((CPUARMState *)cpu_env)->eabi) {
7121         struct target_eabi_stat64 *target_st;
7122
7123         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
7124             return -TARGET_EFAULT;
7125         memset(target_st, 0, sizeof(struct target_eabi_stat64));
7126         __put_user(host_st->st_dev, &target_st->st_dev);
7127         __put_user(host_st->st_ino, &target_st->st_ino);
7128 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
7129         __put_user(host_st->st_ino, &target_st->__st_ino);
7130 #endif
7131         __put_user(host_st->st_mode, &target_st->st_mode);
7132         __put_user(host_st->st_nlink, &target_st->st_nlink);
7133         __put_user(host_st->st_uid, &target_st->st_uid);
7134         __put_user(host_st->st_gid, &target_st->st_gid);
7135         __put_user(host_st->st_rdev, &target_st->st_rdev);
7136         __put_user(host_st->st_size, &target_st->st_size);
7137         __put_user(host_st->st_blksize, &target_st->st_blksize);
7138         __put_user(host_st->st_blocks, &target_st->st_blocks);
7139         __put_user(host_st->st_atime, &target_st->target_st_atime);
7140         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
7141         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
7142         unlock_user_struct(target_st, target_addr, 1);
7143     } else
7144 #endif
7145     {
7146 #if defined(TARGET_HAS_STRUCT_STAT64)
7147         struct target_stat64 *target_st;
7148 #else
7149         struct target_stat *target_st;
7150 #endif
7151
7152         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
7153             return -TARGET_EFAULT;
7154         memset(target_st, 0, sizeof(*target_st));
7155         __put_user(host_st->st_dev, &target_st->st_dev);
7156         __put_user(host_st->st_ino, &target_st->st_ino);
7157 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
7158         __put_user(host_st->st_ino, &target_st->__st_ino);
7159 #endif
7160         __put_user(host_st->st_mode, &target_st->st_mode);
7161         __put_user(host_st->st_nlink, &target_st->st_nlink);
7162         __put_user(host_st->st_uid, &target_st->st_uid);
7163         __put_user(host_st->st_gid, &target_st->st_gid);
7164         __put_user(host_st->st_rdev, &target_st->st_rdev);
7165         /* XXX: better use of kernel struct */
7166         __put_user(host_st->st_size, &target_st->st_size);
7167         __put_user(host_st->st_blksize, &target_st->st_blksize);
7168         __put_user(host_st->st_blocks, &target_st->st_blocks);
7169         __put_user(host_st->st_atime, &target_st->target_st_atime);
7170         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
7171         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
7172         unlock_user_struct(target_st, target_addr, 1);
7173     }
7174
7175     return 0;
7176 }
7177
7178 /* ??? Using host futex calls even when target atomic operations
7179    are not really atomic probably breaks things.  However implementing
7180    futexes locally would make futexes shared between multiple processes
7181    tricky.  However they're probably useless because guest atomic
7182    operations won't work either.  */
7183 static int do_futex(target_ulong uaddr, int op, int val, target_ulong timeout,
7184                     target_ulong uaddr2, int val3)
7185 {
7186     struct timespec ts, *pts;
7187     int base_op;
7188
7189     /* ??? We assume FUTEX_* constants are the same on both host
7190        and target.  */
7191 #ifdef FUTEX_CMD_MASK
7192     base_op = op & FUTEX_CMD_MASK;
7193 #else
7194     base_op = op;
7195 #endif
7196     switch (base_op) {
7197     case FUTEX_WAIT:
7198     case FUTEX_WAIT_BITSET:
7199         if (timeout) {
7200             pts = &ts;
7201             target_to_host_timespec(pts, timeout);
7202         } else {
7203             pts = NULL;
7204         }
7205         return get_errno(safe_futex(g2h(uaddr), op, tswap32(val),
7206                          pts, NULL, val3));
7207     case FUTEX_WAKE:
7208         return get_errno(safe_futex(g2h(uaddr), op, val, NULL, NULL, 0));
7209     case FUTEX_FD:
7210         return get_errno(safe_futex(g2h(uaddr), op, val, NULL, NULL, 0));
7211     case FUTEX_REQUEUE:
7212     case FUTEX_CMP_REQUEUE:
7213     case FUTEX_WAKE_OP:
7214         /* For FUTEX_REQUEUE, FUTEX_CMP_REQUEUE, and FUTEX_WAKE_OP, the
7215            TIMEOUT parameter is interpreted as a uint32_t by the kernel.
7216            But the prototype takes a `struct timespec *'; insert casts
7217            to satisfy the compiler.  We do not need to tswap TIMEOUT
7218            since it's not compared to guest memory.  */
7219         pts = (struct timespec *)(uintptr_t) timeout;
7220         return get_errno(safe_futex(g2h(uaddr), op, val, pts,
7221                                     g2h(uaddr2),
7222                                     (base_op == FUTEX_CMP_REQUEUE
7223                                      ? tswap32(val3)
7224                                      : val3)));
7225     default:
7226         return -TARGET_ENOSYS;
7227     }
7228 }
7229 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7230 static abi_long do_name_to_handle_at(abi_long dirfd, abi_long pathname,
7231                                      abi_long handle, abi_long mount_id,
7232                                      abi_long flags)
7233 {
7234     struct file_handle *target_fh;
7235     struct file_handle *fh;
7236     int mid = 0;
7237     abi_long ret;
7238     char *name;
7239     unsigned int size, total_size;
7240
7241     if (get_user_s32(size, handle)) {
7242         return -TARGET_EFAULT;
7243     }
7244
7245     name = lock_user_string(pathname);
7246     if (!name) {
7247         return -TARGET_EFAULT;
7248     }
7249
7250     total_size = sizeof(struct file_handle) + size;
7251     target_fh = lock_user(VERIFY_WRITE, handle, total_size, 0);
7252     if (!target_fh) {
7253         unlock_user(name, pathname, 0);
7254         return -TARGET_EFAULT;
7255     }
7256
7257     fh = g_malloc0(total_size);
7258     fh->handle_bytes = size;
7259
7260     ret = get_errno(name_to_handle_at(dirfd, path(name), fh, &mid, flags));
7261     unlock_user(name, pathname, 0);
7262
7263     /* man name_to_handle_at(2):
7264      * Other than the use of the handle_bytes field, the caller should treat
7265      * the file_handle structure as an opaque data type
7266      */
7267
7268     memcpy(target_fh, fh, total_size);
7269     target_fh->handle_bytes = tswap32(fh->handle_bytes);
7270     target_fh->handle_type = tswap32(fh->handle_type);
7271     g_free(fh);
7272     unlock_user(target_fh, handle, total_size);
7273
7274     if (put_user_s32(mid, mount_id)) {
7275         return -TARGET_EFAULT;
7276     }
7277
7278     return ret;
7279
7280 }
7281 #endif
7282
7283 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7284 static abi_long do_open_by_handle_at(abi_long mount_fd, abi_long handle,
7285                                      abi_long flags)
7286 {
7287     struct file_handle *target_fh;
7288     struct file_handle *fh;
7289     unsigned int size, total_size;
7290     abi_long ret;
7291
7292     if (get_user_s32(size, handle)) {
7293         return -TARGET_EFAULT;
7294     }
7295
7296     total_size = sizeof(struct file_handle) + size;
7297     target_fh = lock_user(VERIFY_READ, handle, total_size, 1);
7298     if (!target_fh) {
7299         return -TARGET_EFAULT;
7300     }
7301
7302     fh = g_memdup(target_fh, total_size);
7303     fh->handle_bytes = size;
7304     fh->handle_type = tswap32(target_fh->handle_type);
7305
7306     ret = get_errno(open_by_handle_at(mount_fd, fh,
7307                     target_to_host_bitmask(flags, fcntl_flags_tbl)));
7308
7309     g_free(fh);
7310
7311     unlock_user(target_fh, handle, total_size);
7312
7313     return ret;
7314 }
7315 #endif
7316
7317 #if defined(TARGET_NR_signalfd) || defined(TARGET_NR_signalfd4)
7318
7319 /* signalfd siginfo conversion */
7320
7321 static void
7322 host_to_target_signalfd_siginfo(struct signalfd_siginfo *tinfo,
7323                                 const struct signalfd_siginfo *info)
7324 {
7325     int sig = host_to_target_signal(info->ssi_signo);
7326
7327     /* linux/signalfd.h defines a ssi_addr_lsb
7328      * not defined in sys/signalfd.h but used by some kernels
7329      */
7330
7331 #ifdef BUS_MCEERR_AO
7332     if (tinfo->ssi_signo == SIGBUS &&
7333         (tinfo->ssi_code == BUS_MCEERR_AR ||
7334          tinfo->ssi_code == BUS_MCEERR_AO)) {
7335         uint16_t *ssi_addr_lsb = (uint16_t *)(&info->ssi_addr + 1);
7336         uint16_t *tssi_addr_lsb = (uint16_t *)(&tinfo->ssi_addr + 1);
7337         *tssi_addr_lsb = tswap16(*ssi_addr_lsb);
7338     }
7339 #endif
7340
7341     tinfo->ssi_signo = tswap32(sig);
7342     tinfo->ssi_errno = tswap32(tinfo->ssi_errno);
7343     tinfo->ssi_code = tswap32(info->ssi_code);
7344     tinfo->ssi_pid = tswap32(info->ssi_pid);
7345     tinfo->ssi_uid = tswap32(info->ssi_uid);
7346     tinfo->ssi_fd = tswap32(info->ssi_fd);
7347     tinfo->ssi_tid = tswap32(info->ssi_tid);
7348     tinfo->ssi_band = tswap32(info->ssi_band);
7349     tinfo->ssi_overrun = tswap32(info->ssi_overrun);
7350     tinfo->ssi_trapno = tswap32(info->ssi_trapno);
7351     tinfo->ssi_status = tswap32(info->ssi_status);
7352     tinfo->ssi_int = tswap32(info->ssi_int);
7353     tinfo->ssi_ptr = tswap64(info->ssi_ptr);
7354     tinfo->ssi_utime = tswap64(info->ssi_utime);
7355     tinfo->ssi_stime = tswap64(info->ssi_stime);
7356     tinfo->ssi_addr = tswap64(info->ssi_addr);
7357 }
7358
7359 static abi_long host_to_target_data_signalfd(void *buf, size_t len)
7360 {
7361     int i;
7362
7363     for (i = 0; i < len; i += sizeof(struct signalfd_siginfo)) {
7364         host_to_target_signalfd_siginfo(buf + i, buf + i);
7365     }
7366
7367     return len;
7368 }
7369
7370 static TargetFdTrans target_signalfd_trans = {
7371     .host_to_target_data = host_to_target_data_signalfd,
7372 };
7373
7374 static abi_long do_signalfd4(int fd, abi_long mask, int flags)
7375 {
7376     int host_flags;
7377     target_sigset_t *target_mask;
7378     sigset_t host_mask;
7379     abi_long ret;
7380
7381     if (flags & ~(TARGET_O_NONBLOCK | TARGET_O_CLOEXEC)) {
7382         return -TARGET_EINVAL;
7383     }
7384     if (!lock_user_struct(VERIFY_READ, target_mask, mask, 1)) {
7385         return -TARGET_EFAULT;
7386     }
7387
7388     target_to_host_sigset(&host_mask, target_mask);
7389
7390     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
7391
7392     ret = get_errno(signalfd(fd, &host_mask, host_flags));
7393     if (ret >= 0) {
7394         fd_trans_register(ret, &target_signalfd_trans);
7395     }
7396
7397     unlock_user_struct(target_mask, mask, 0);
7398
7399     return ret;
7400 }
7401 #endif
7402
7403 /* Map host to target signal numbers for the wait family of syscalls.
7404    Assume all other status bits are the same.  */
7405 int host_to_target_waitstatus(int status)
7406 {
7407     if (WIFSIGNALED(status)) {
7408         return host_to_target_signal(WTERMSIG(status)) | (status & ~0x7f);
7409     }
7410     if (WIFSTOPPED(status)) {
7411         return (host_to_target_signal(WSTOPSIG(status)) << 8)
7412                | (status & 0xff);
7413     }
7414     return status;
7415 }
7416
7417 static int open_self_cmdline(void *cpu_env, int fd)
7418 {
7419     CPUState *cpu = ENV_GET_CPU((CPUArchState *)cpu_env);
7420     struct linux_binprm *bprm = ((TaskState *)cpu->opaque)->bprm;
7421     int i;
7422
7423     for (i = 0; i < bprm->argc; i++) {
7424         size_t len = strlen(bprm->argv[i]) + 1;
7425
7426         if (write(fd, bprm->argv[i], len) != len) {
7427             return -1;
7428         }
7429     }
7430
7431     return 0;
7432 }
7433
7434 static int open_self_maps(void *cpu_env, int fd)
7435 {
7436     CPUState *cpu = ENV_GET_CPU((CPUArchState *)cpu_env);
7437     TaskState *ts = cpu->opaque;
7438     FILE *fp;
7439     char *line = NULL;
7440     size_t len = 0;
7441     ssize_t read;
7442
7443     fp = fopen("/proc/self/maps", "r");
7444     if (fp == NULL) {
7445         return -1;
7446     }
7447
7448     while ((read = getline(&line, &len, fp)) != -1) {
7449         int fields, dev_maj, dev_min, inode;
7450         uint64_t min, max, offset;
7451         char flag_r, flag_w, flag_x, flag_p;
7452         char path[512] = "";
7453         fields = sscanf(line, "%"PRIx64"-%"PRIx64" %c%c%c%c %"PRIx64" %x:%x %d"
7454                         " %512s", &min, &max, &flag_r, &flag_w, &flag_x,
7455                         &flag_p, &offset, &dev_maj, &dev_min, &inode, path);
7456
7457         if ((fields < 10) || (fields > 11)) {
7458             continue;
7459         }
7460         if (h2g_valid(min)) {
7461             int flags = page_get_flags(h2g(min));
7462             max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX);
7463             if (page_check_range(h2g(min), max - min, flags) == -1) {
7464                 continue;
7465             }
7466             if (h2g(min) == ts->info->stack_limit) {
7467                 pstrcpy(path, sizeof(path), "      [stack]");
7468             }
7469             dprintf(fd, TARGET_ABI_FMT_lx "-" TARGET_ABI_FMT_lx
7470                     " %c%c%c%c %08" PRIx64 " %02x:%02x %d %s%s\n",
7471                     h2g(min), h2g(max - 1) + 1, flag_r, flag_w,
7472                     flag_x, flag_p, offset, dev_maj, dev_min, inode,
7473                     path[0] ? "         " : "", path);
7474         }
7475     }
7476
7477     free(line);
7478     fclose(fp);
7479
7480     return 0;
7481 }
7482
7483 static int open_self_stat(void *cpu_env, int fd)
7484 {
7485     CPUState *cpu = ENV_GET_CPU((CPUArchState *)cpu_env);
7486     TaskState *ts = cpu->opaque;
7487     abi_ulong start_stack = ts->info->start_stack;
7488     int i;
7489
7490     for (i = 0; i < 44; i++) {
7491       char buf[128];
7492       int len;
7493       uint64_t val = 0;
7494
7495       if (i == 0) {
7496         /* pid */
7497         val = getpid();
7498         snprintf(buf, sizeof(buf), "%"PRId64 " ", val);
7499       } else if (i == 1) {
7500         /* app name */
7501         snprintf(buf, sizeof(buf), "(%s) ", ts->bprm->argv[0]);
7502       } else if (i == 27) {
7503         /* stack bottom */
7504         val = start_stack;
7505         snprintf(buf, sizeof(buf), "%"PRId64 " ", val);
7506       } else {
7507         /* for the rest, there is MasterCard */
7508         snprintf(buf, sizeof(buf), "0%c", i == 43 ? '\n' : ' ');
7509       }
7510
7511       len = strlen(buf);
7512       if (write(fd, buf, len) != len) {
7513           return -1;
7514       }
7515     }
7516
7517     return 0;
7518 }
7519
7520 static int open_self_auxv(void *cpu_env, int fd)
7521 {
7522     CPUState *cpu = ENV_GET_CPU((CPUArchState *)cpu_env);
7523     TaskState *ts = cpu->opaque;
7524     abi_ulong auxv = ts->info->saved_auxv;
7525     abi_ulong len = ts->info->auxv_len;
7526     char *ptr;
7527
7528     /*
7529      * Auxiliary vector is stored in target process stack.
7530      * read in whole auxv vector and copy it to file
7531      */
7532     ptr = lock_user(VERIFY_READ, auxv, len, 0);
7533     if (ptr != NULL) {
7534         while (len > 0) {
7535             ssize_t r;
7536             r = write(fd, ptr, len);
7537             if (r <= 0) {
7538                 break;
7539             }
7540             len -= r;
7541             ptr += r;
7542         }
7543         lseek(fd, 0, SEEK_SET);
7544         unlock_user(ptr, auxv, len);
7545     }
7546
7547     return 0;
7548 }
7549
7550 static int is_proc_myself(const char *filename, const char *entry)
7551 {
7552     if (!strncmp(filename, "/proc/", strlen("/proc/"))) {
7553         filename += strlen("/proc/");
7554         if (!strncmp(filename, "self/", strlen("self/"))) {
7555             filename += strlen("self/");
7556         } else if (*filename >= '1' && *filename <= '9') {
7557             char myself[80];
7558             snprintf(myself, sizeof(myself), "%d/", getpid());
7559             if (!strncmp(filename, myself, strlen(myself))) {
7560                 filename += strlen(myself);
7561             } else {
7562                 return 0;
7563             }
7564         } else {
7565             return 0;
7566         }
7567         if (!strcmp(filename, entry)) {
7568             return 1;
7569         }
7570     }
7571     return 0;
7572 }
7573
7574 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
7575 static int is_proc(const char *filename, const char *entry)
7576 {
7577     return strcmp(filename, entry) == 0;
7578 }
7579
7580 static int open_net_route(void *cpu_env, int fd)
7581 {
7582     FILE *fp;
7583     char *line = NULL;
7584     size_t len = 0;
7585     ssize_t read;
7586
7587     fp = fopen("/proc/net/route", "r");
7588     if (fp == NULL) {
7589         return -1;
7590     }
7591
7592     /* read header */
7593
7594     read = getline(&line, &len, fp);
7595     dprintf(fd, "%s", line);
7596
7597     /* read routes */
7598
7599     while ((read = getline(&line, &len, fp)) != -1) {
7600         char iface[16];
7601         uint32_t dest, gw, mask;
7602         unsigned int flags, refcnt, use, metric, mtu, window, irtt;
7603         sscanf(line, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
7604                      iface, &dest, &gw, &flags, &refcnt, &use, &metric,
7605                      &mask, &mtu, &window, &irtt);
7606         dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
7607                 iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
7608                 metric, tswap32(mask), mtu, window, irtt);
7609     }
7610
7611     free(line);
7612     fclose(fp);
7613
7614     return 0;
7615 }
7616 #endif
7617
7618 static int do_openat(void *cpu_env, int dirfd, const char *pathname, int flags, mode_t mode)
7619 {
7620     struct fake_open {
7621         const char *filename;
7622         int (*fill)(void *cpu_env, int fd);
7623         int (*cmp)(const char *s1, const char *s2);
7624     };
7625     const struct fake_open *fake_open;
7626     static const struct fake_open fakes[] = {
7627         { "maps", open_self_maps, is_proc_myself },
7628         { "stat", open_self_stat, is_proc_myself },
7629         { "auxv", open_self_auxv, is_proc_myself },
7630         { "cmdline", open_self_cmdline, is_proc_myself },
7631 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
7632         { "/proc/net/route", open_net_route, is_proc },
7633 #endif
7634         { NULL, NULL, NULL }
7635     };
7636
7637     if (is_proc_myself(pathname, "exe")) {
7638         int execfd = qemu_getauxval(AT_EXECFD);
7639         return execfd ? execfd : safe_openat(dirfd, exec_path, flags, mode);
7640     }
7641
7642     for (fake_open = fakes; fake_open->filename; fake_open++) {
7643         if (fake_open->cmp(pathname, fake_open->filename)) {
7644             break;
7645         }
7646     }
7647
7648     if (fake_open->filename) {
7649         const char *tmpdir;
7650         char filename[PATH_MAX];
7651         int fd, r;
7652
7653         /* create temporary file to map stat to */
7654         tmpdir = getenv("TMPDIR");
7655         if (!tmpdir)
7656             tmpdir = "/tmp";
7657         snprintf(filename, sizeof(filename), "%s/qemu-open.XXXXXX", tmpdir);
7658         fd = mkstemp(filename);
7659         if (fd < 0) {
7660             return fd;
7661         }
7662         unlink(filename);
7663
7664         if ((r = fake_open->fill(cpu_env, fd))) {
7665             int e = errno;
7666             close(fd);
7667             errno = e;
7668             return r;
7669         }
7670         lseek(fd, 0, SEEK_SET);
7671
7672         return fd;
7673     }
7674
7675     return safe_openat(dirfd, path(pathname), flags, mode);
7676 }
7677
7678 #define TIMER_MAGIC 0x0caf0000
7679 #define TIMER_MAGIC_MASK 0xffff0000
7680
7681 /* Convert QEMU provided timer ID back to internal 16bit index format */
7682 static target_timer_t get_timer_id(abi_long arg)
7683 {
7684     target_timer_t timerid = arg;
7685
7686     if ((timerid & TIMER_MAGIC_MASK) != TIMER_MAGIC) {
7687         return -TARGET_EINVAL;
7688     }
7689
7690     timerid &= 0xffff;
7691
7692     if (timerid >= ARRAY_SIZE(g_posix_timers)) {
7693         return -TARGET_EINVAL;
7694     }
7695
7696     return timerid;
7697 }
7698
7699 static abi_long swap_data_eventfd(void *buf, size_t len)
7700 {
7701     uint64_t *counter = buf;
7702     int i;
7703
7704     if (len < sizeof(uint64_t)) {
7705         return -EINVAL;
7706     }
7707
7708     for (i = 0; i < len; i += sizeof(uint64_t)) {
7709         *counter = tswap64(*counter);
7710         counter++;
7711     }
7712
7713     return len;
7714 }
7715
7716 static TargetFdTrans target_eventfd_trans = {
7717     .host_to_target_data = swap_data_eventfd,
7718     .target_to_host_data = swap_data_eventfd,
7719 };
7720
7721 #if (defined(TARGET_NR_inotify_init) && defined(__NR_inotify_init)) || \
7722     (defined(CONFIG_INOTIFY1) && defined(TARGET_NR_inotify_init1) && \
7723      defined(__NR_inotify_init1))
7724 static abi_long host_to_target_data_inotify(void *buf, size_t len)
7725 {
7726     struct inotify_event *ev;
7727     int i;
7728     uint32_t name_len;
7729
7730     for (i = 0; i < len; i += sizeof(struct inotify_event) + name_len) {
7731         ev = (struct inotify_event *)((char *)buf + i);
7732         name_len = ev->len;
7733
7734         ev->wd = tswap32(ev->wd);
7735         ev->mask = tswap32(ev->mask);
7736         ev->cookie = tswap32(ev->cookie);
7737         ev->len = tswap32(name_len);
7738     }
7739
7740     return len;
7741 }
7742
7743 static TargetFdTrans target_inotify_trans = {
7744     .host_to_target_data = host_to_target_data_inotify,
7745 };
7746 #endif
7747
7748 static int target_to_host_cpu_mask(unsigned long *host_mask,
7749                                    size_t host_size,
7750                                    abi_ulong target_addr,
7751                                    size_t target_size)
7752 {
7753     unsigned target_bits = sizeof(abi_ulong) * 8;
7754     unsigned host_bits = sizeof(*host_mask) * 8;
7755     abi_ulong *target_mask;
7756     unsigned i, j;
7757
7758     assert(host_size >= target_size);
7759
7760     target_mask = lock_user(VERIFY_READ, target_addr, target_size, 1);
7761     if (!target_mask) {
7762         return -TARGET_EFAULT;
7763     }
7764     memset(host_mask, 0, host_size);
7765
7766     for (i = 0 ; i < target_size / sizeof(abi_ulong); i++) {
7767         unsigned bit = i * target_bits;
7768         abi_ulong val;
7769
7770         __get_user(val, &target_mask[i]);
7771         for (j = 0; j < target_bits; j++, bit++) {
7772             if (val & (1UL << j)) {
7773                 host_mask[bit / host_bits] |= 1UL << (bit % host_bits);
7774             }
7775         }
7776     }
7777
7778     unlock_user(target_mask, target_addr, 0);
7779     return 0;
7780 }
7781
7782 static int host_to_target_cpu_mask(const unsigned long *host_mask,
7783                                    size_t host_size,
7784                                    abi_ulong target_addr,
7785                                    size_t target_size)
7786 {
7787     unsigned target_bits = sizeof(abi_ulong) * 8;
7788     unsigned host_bits = sizeof(*host_mask) * 8;
7789     abi_ulong *target_mask;
7790     unsigned i, j;
7791
7792     assert(host_size >= target_size);
7793
7794     target_mask = lock_user(VERIFY_WRITE, target_addr, target_size, 0);
7795     if (!target_mask) {
7796         return -TARGET_EFAULT;
7797     }
7798
7799     for (i = 0 ; i < target_size / sizeof(abi_ulong); i++) {
7800         unsigned bit = i * target_bits;
7801         abi_ulong val = 0;
7802
7803         for (j = 0; j < target_bits; j++, bit++) {
7804             if (host_mask[bit / host_bits] & (1UL << (bit % host_bits))) {
7805                 val |= 1UL << j;
7806             }
7807         }
7808         __put_user(val, &target_mask[i]);
7809     }
7810
7811     unlock_user(target_mask, target_addr, target_size);
7812     return 0;
7813 }
7814
7815 /* do_syscall() should always have a single exit point at the end so
7816    that actions, such as logging of syscall results, can be performed.
7817    All errnos that do_syscall() returns must be -TARGET_<errcode>. */
7818 abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
7819                     abi_long arg2, abi_long arg3, abi_long arg4,
7820                     abi_long arg5, abi_long arg6, abi_long arg7,
7821                     abi_long arg8)
7822 {
7823     CPUState *cpu = ENV_GET_CPU(cpu_env);
7824     abi_long ret;
7825     struct stat st;
7826     struct statfs stfs;
7827     void *p;
7828
7829 #if defined(DEBUG_ERESTARTSYS)
7830     /* Debug-only code for exercising the syscall-restart code paths
7831      * in the per-architecture cpu main loops: restart every syscall
7832      * the guest makes once before letting it through.
7833      */
7834     {
7835         static int flag;
7836
7837         flag = !flag;
7838         if (flag) {
7839             return -TARGET_ERESTARTSYS;
7840         }
7841     }
7842 #endif
7843
7844 #ifdef DEBUG
7845     gemu_log("syscall %d", num);
7846 #endif
7847     trace_guest_user_syscall(cpu, num, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8);
7848     if(do_strace)
7849         print_syscall(num, arg1, arg2, arg3, arg4, arg5, arg6);
7850
7851     switch(num) {
7852     case TARGET_NR_exit:
7853         /* In old applications this may be used to implement _exit(2).
7854            However in threaded applictions it is used for thread termination,
7855            and _exit_group is used for application termination.
7856            Do thread termination if we have more then one thread.  */
7857
7858         if (block_signals()) {
7859             ret = -TARGET_ERESTARTSYS;
7860             break;
7861         }
7862
7863         cpu_list_lock();
7864
7865         if (CPU_NEXT(first_cpu)) {
7866             TaskState *ts;
7867
7868             /* Remove the CPU from the list.  */
7869             QTAILQ_REMOVE(&cpus, cpu, node);
7870
7871             cpu_list_unlock();
7872
7873             ts = cpu->opaque;
7874             if (ts->child_tidptr) {
7875                 put_user_u32(0, ts->child_tidptr);
7876                 sys_futex(g2h(ts->child_tidptr), FUTEX_WAKE, INT_MAX,
7877                           NULL, NULL, 0);
7878             }
7879             thread_cpu = NULL;
7880             object_unref(OBJECT(cpu));
7881             g_free(ts);
7882             rcu_unregister_thread();
7883             pthread_exit(NULL);
7884         }
7885
7886         cpu_list_unlock();
7887 #ifdef TARGET_GPROF
7888         _mcleanup();
7889 #endif
7890         gdb_exit(cpu_env, arg1);
7891         _exit(arg1);
7892         ret = 0; /* avoid warning */
7893         break;
7894     case TARGET_NR_read:
7895         if (arg3 == 0)
7896             ret = 0;
7897         else {
7898             if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
7899                 goto efault;
7900             ret = get_errno(safe_read(arg1, p, arg3));
7901             if (ret >= 0 &&
7902                 fd_trans_host_to_target_data(arg1)) {
7903                 ret = fd_trans_host_to_target_data(arg1)(p, ret);
7904             }
7905             unlock_user(p, arg2, ret);
7906         }
7907         break;
7908     case TARGET_NR_write:
7909         if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
7910             goto efault;
7911         if (fd_trans_target_to_host_data(arg1)) {
7912             void *copy = g_malloc(arg3);
7913             memcpy(copy, p, arg3);
7914             ret = fd_trans_target_to_host_data(arg1)(copy, arg3);
7915             if (ret >= 0) {
7916                 ret = get_errno(safe_write(arg1, copy, ret));
7917             }
7918             g_free(copy);
7919         } else {
7920             ret = get_errno(safe_write(arg1, p, arg3));
7921         }
7922         unlock_user(p, arg2, 0);
7923         break;
7924 #ifdef TARGET_NR_open
7925     case TARGET_NR_open:
7926         if (!(p = lock_user_string(arg1)))
7927             goto efault;
7928         ret = get_errno(do_openat(cpu_env, AT_FDCWD, p,
7929                                   target_to_host_bitmask(arg2, fcntl_flags_tbl),
7930                                   arg3));
7931         fd_trans_unregister(ret);
7932         unlock_user(p, arg1, 0);
7933         break;
7934 #endif
7935     case TARGET_NR_openat:
7936         if (!(p = lock_user_string(arg2)))
7937             goto efault;
7938         ret = get_errno(do_openat(cpu_env, arg1, p,
7939                                   target_to_host_bitmask(arg3, fcntl_flags_tbl),
7940                                   arg4));
7941         fd_trans_unregister(ret);
7942         unlock_user(p, arg2, 0);
7943         break;
7944 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7945     case TARGET_NR_name_to_handle_at:
7946         ret = do_name_to_handle_at(arg1, arg2, arg3, arg4, arg5);
7947         break;
7948 #endif
7949 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7950     case TARGET_NR_open_by_handle_at:
7951         ret = do_open_by_handle_at(arg1, arg2, arg3);
7952         fd_trans_unregister(ret);
7953         break;
7954 #endif
7955     case TARGET_NR_close:
7956         fd_trans_unregister(arg1);
7957         ret = get_errno(close(arg1));
7958         break;
7959     case TARGET_NR_brk:
7960         ret = do_brk(arg1);
7961         break;
7962 #ifdef TARGET_NR_fork
7963     case TARGET_NR_fork:
7964         ret = get_errno(do_fork(cpu_env, TARGET_SIGCHLD, 0, 0, 0, 0));
7965         break;
7966 #endif
7967 #ifdef TARGET_NR_waitpid
7968     case TARGET_NR_waitpid:
7969         {
7970             int status;
7971             ret = get_errno(safe_wait4(arg1, &status, arg3, 0));
7972             if (!is_error(ret) && arg2 && ret
7973                 && put_user_s32(host_to_target_waitstatus(status), arg2))
7974                 goto efault;
7975         }
7976         break;
7977 #endif
7978 #ifdef TARGET_NR_waitid
7979     case TARGET_NR_waitid:
7980         {
7981             siginfo_t info;
7982             info.si_pid = 0;
7983             ret = get_errno(safe_waitid(arg1, arg2, &info, arg4, NULL));
7984             if (!is_error(ret) && arg3 && info.si_pid != 0) {
7985                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_siginfo_t), 0)))
7986                     goto efault;
7987                 host_to_target_siginfo(p, &info);
7988                 unlock_user(p, arg3, sizeof(target_siginfo_t));
7989             }
7990         }
7991         break;
7992 #endif
7993 #ifdef TARGET_NR_creat /* not on alpha */
7994     case TARGET_NR_creat:
7995         if (!(p = lock_user_string(arg1)))
7996             goto efault;
7997         ret = get_errno(creat(p, arg2));
7998         fd_trans_unregister(ret);
7999         unlock_user(p, arg1, 0);
8000         break;
8001 #endif
8002 #ifdef TARGET_NR_link
8003     case TARGET_NR_link:
8004         {
8005             void * p2;
8006             p = lock_user_string(arg1);
8007             p2 = lock_user_string(arg2);
8008             if (!p || !p2)
8009                 ret = -TARGET_EFAULT;
8010             else
8011                 ret = get_errno(link(p, p2));
8012             unlock_user(p2, arg2, 0);
8013             unlock_user(p, arg1, 0);
8014         }
8015         break;
8016 #endif
8017 #if defined(TARGET_NR_linkat)
8018     case TARGET_NR_linkat:
8019         {
8020             void * p2 = NULL;
8021             if (!arg2 || !arg4)
8022                 goto efault;
8023             p  = lock_user_string(arg2);
8024             p2 = lock_user_string(arg4);
8025             if (!p || !p2)
8026                 ret = -TARGET_EFAULT;
8027             else
8028                 ret = get_errno(linkat(arg1, p, arg3, p2, arg5));
8029             unlock_user(p, arg2, 0);
8030             unlock_user(p2, arg4, 0);
8031         }
8032         break;
8033 #endif
8034 #ifdef TARGET_NR_unlink
8035     case TARGET_NR_unlink:
8036         if (!(p = lock_user_string(arg1)))
8037             goto efault;
8038         ret = get_errno(unlink(p));
8039         unlock_user(p, arg1, 0);
8040         break;
8041 #endif
8042 #if defined(TARGET_NR_unlinkat)
8043     case TARGET_NR_unlinkat:
8044         if (!(p = lock_user_string(arg2)))
8045             goto efault;
8046         ret = get_errno(unlinkat(arg1, p, arg3));
8047         unlock_user(p, arg2, 0);
8048         break;
8049 #endif
8050     case TARGET_NR_execve:
8051         {
8052             char **argp, **envp;
8053             int argc, envc;
8054             abi_ulong gp;
8055             abi_ulong guest_argp;
8056             abi_ulong guest_envp;
8057             abi_ulong addr;
8058             char **q;
8059             int total_size = 0;
8060
8061             argc = 0;
8062             guest_argp = arg2;
8063             for (gp = guest_argp; gp; gp += sizeof(abi_ulong)) {
8064                 if (get_user_ual(addr, gp))
8065                     goto efault;
8066                 if (!addr)
8067                     break;
8068                 argc++;
8069             }
8070             envc = 0;
8071             guest_envp = arg3;
8072             for (gp = guest_envp; gp; gp += sizeof(abi_ulong)) {
8073                 if (get_user_ual(addr, gp))
8074                     goto efault;
8075                 if (!addr)
8076                     break;
8077                 envc++;
8078             }
8079
8080             argp = g_new0(char *, argc + 1);
8081             envp = g_new0(char *, envc + 1);
8082
8083             for (gp = guest_argp, q = argp; gp;
8084                   gp += sizeof(abi_ulong), q++) {
8085                 if (get_user_ual(addr, gp))
8086                     goto execve_efault;
8087                 if (!addr)
8088                     break;
8089                 if (!(*q = lock_user_string(addr)))
8090                     goto execve_efault;
8091                 total_size += strlen(*q) + 1;
8092             }
8093             *q = NULL;
8094
8095             for (gp = guest_envp, q = envp; gp;
8096                   gp += sizeof(abi_ulong), q++) {
8097                 if (get_user_ual(addr, gp))
8098                     goto execve_efault;
8099                 if (!addr)
8100                     break;
8101                 if (!(*q = lock_user_string(addr)))
8102                     goto execve_efault;
8103                 total_size += strlen(*q) + 1;
8104             }
8105             *q = NULL;
8106
8107             if (!(p = lock_user_string(arg1)))
8108                 goto execve_efault;
8109             /* Although execve() is not an interruptible syscall it is
8110              * a special case where we must use the safe_syscall wrapper:
8111              * if we allow a signal to happen before we make the host
8112              * syscall then we will 'lose' it, because at the point of
8113              * execve the process leaves QEMU's control. So we use the
8114              * safe syscall wrapper to ensure that we either take the
8115              * signal as a guest signal, or else it does not happen
8116              * before the execve completes and makes it the other
8117              * program's problem.
8118              */
8119             ret = get_errno(safe_execve(p, argp, envp));
8120             unlock_user(p, arg1, 0);
8121
8122             goto execve_end;
8123
8124         execve_efault:
8125             ret = -TARGET_EFAULT;
8126
8127         execve_end:
8128             for (gp = guest_argp, q = argp; *q;
8129                   gp += sizeof(abi_ulong), q++) {
8130                 if (get_user_ual(addr, gp)
8131                     || !addr)
8132                     break;
8133                 unlock_user(*q, addr, 0);
8134             }
8135             for (gp = guest_envp, q = envp; *q;
8136                   gp += sizeof(abi_ulong), q++) {
8137                 if (get_user_ual(addr, gp)
8138                     || !addr)
8139                     break;
8140                 unlock_user(*q, addr, 0);
8141             }
8142
8143             g_free(argp);
8144             g_free(envp);
8145         }
8146         break;
8147     case TARGET_NR_chdir:
8148         if (!(p = lock_user_string(arg1)))
8149             goto efault;
8150         ret = get_errno(chdir(p));
8151         unlock_user(p, arg1, 0);
8152         break;
8153 #ifdef TARGET_NR_time
8154     case TARGET_NR_time:
8155         {
8156             time_t host_time;
8157             ret = get_errno(time(&host_time));
8158             if (!is_error(ret)
8159                 && arg1
8160                 && put_user_sal(host_time, arg1))
8161                 goto efault;
8162         }
8163         break;
8164 #endif
8165 #ifdef TARGET_NR_mknod
8166     case TARGET_NR_mknod:
8167         if (!(p = lock_user_string(arg1)))
8168             goto efault;
8169         ret = get_errno(mknod(p, arg2, arg3));
8170         unlock_user(p, arg1, 0);
8171         break;
8172 #endif
8173 #if defined(TARGET_NR_mknodat)
8174     case TARGET_NR_mknodat:
8175         if (!(p = lock_user_string(arg2)))
8176             goto efault;
8177         ret = get_errno(mknodat(arg1, p, arg3, arg4));
8178         unlock_user(p, arg2, 0);
8179         break;
8180 #endif
8181 #ifdef TARGET_NR_chmod
8182     case TARGET_NR_chmod:
8183         if (!(p = lock_user_string(arg1)))
8184             goto efault;
8185         ret = get_errno(chmod(p, arg2));
8186         unlock_user(p, arg1, 0);
8187         break;
8188 #endif
8189 #ifdef TARGET_NR_break
8190     case TARGET_NR_break:
8191         goto unimplemented;
8192 #endif
8193 #ifdef TARGET_NR_oldstat
8194     case TARGET_NR_oldstat:
8195         goto unimplemented;
8196 #endif
8197     case TARGET_NR_lseek:
8198         ret = get_errno(lseek(arg1, arg2, arg3));
8199         break;
8200 #if defined(TARGET_NR_getxpid) && defined(TARGET_ALPHA)
8201     /* Alpha specific */
8202     case TARGET_NR_getxpid:
8203         ((CPUAlphaState *)cpu_env)->ir[IR_A4] = getppid();
8204         ret = get_errno(getpid());
8205         break;
8206 #endif
8207 #ifdef TARGET_NR_getpid
8208     case TARGET_NR_getpid:
8209         ret = get_errno(getpid());
8210         break;
8211 #endif
8212     case TARGET_NR_mount:
8213         {
8214             /* need to look at the data field */
8215             void *p2, *p3;
8216
8217             if (arg1) {
8218                 p = lock_user_string(arg1);
8219                 if (!p) {
8220                     goto efault;
8221                 }
8222             } else {
8223                 p = NULL;
8224             }
8225
8226             p2 = lock_user_string(arg2);
8227             if (!p2) {
8228                 if (arg1) {
8229                     unlock_user(p, arg1, 0);
8230                 }
8231                 goto efault;
8232             }
8233
8234             if (arg3) {
8235                 p3 = lock_user_string(arg3);
8236                 if (!p3) {
8237                     if (arg1) {
8238                         unlock_user(p, arg1, 0);
8239                     }
8240                     unlock_user(p2, arg2, 0);
8241                     goto efault;
8242                 }
8243             } else {
8244                 p3 = NULL;
8245             }
8246
8247             /* FIXME - arg5 should be locked, but it isn't clear how to
8248              * do that since it's not guaranteed to be a NULL-terminated
8249              * string.
8250              */
8251             if (!arg5) {
8252                 ret = mount(p, p2, p3, (unsigned long)arg4, NULL);
8253             } else {
8254                 ret = mount(p, p2, p3, (unsigned long)arg4, g2h(arg5));
8255             }
8256             ret = get_errno(ret);
8257
8258             if (arg1) {
8259                 unlock_user(p, arg1, 0);
8260             }
8261             unlock_user(p2, arg2, 0);
8262             if (arg3) {
8263                 unlock_user(p3, arg3, 0);
8264             }
8265         }
8266         break;
8267 #ifdef TARGET_NR_umount
8268     case TARGET_NR_umount:
8269         if (!(p = lock_user_string(arg1)))
8270             goto efault;
8271         ret = get_errno(umount(p));
8272         unlock_user(p, arg1, 0);
8273         break;
8274 #endif
8275 #ifdef TARGET_NR_stime /* not on alpha */
8276     case TARGET_NR_stime:
8277         {
8278             time_t host_time;
8279             if (get_user_sal(host_time, arg1))
8280                 goto efault;
8281             ret = get_errno(stime(&host_time));
8282         }
8283         break;
8284 #endif
8285     case TARGET_NR_ptrace:
8286         goto unimplemented;
8287 #ifdef TARGET_NR_alarm /* not on alpha */
8288     case TARGET_NR_alarm:
8289         ret = alarm(arg1);
8290         break;
8291 #endif
8292 #ifdef TARGET_NR_oldfstat
8293     case TARGET_NR_oldfstat:
8294         goto unimplemented;
8295 #endif
8296 #ifdef TARGET_NR_pause /* not on alpha */
8297     case TARGET_NR_pause:
8298         if (!block_signals()) {
8299             sigsuspend(&((TaskState *)cpu->opaque)->signal_mask);
8300         }
8301         ret = -TARGET_EINTR;
8302         break;
8303 #endif
8304 #ifdef TARGET_NR_utime
8305     case TARGET_NR_utime:
8306         {
8307             struct utimbuf tbuf, *host_tbuf;
8308             struct target_utimbuf *target_tbuf;
8309             if (arg2) {
8310                 if (!lock_user_struct(VERIFY_READ, target_tbuf, arg2, 1))
8311                     goto efault;
8312                 tbuf.actime = tswapal(target_tbuf->actime);
8313                 tbuf.modtime = tswapal(target_tbuf->modtime);
8314                 unlock_user_struct(target_tbuf, arg2, 0);
8315                 host_tbuf = &tbuf;
8316             } else {
8317                 host_tbuf = NULL;
8318             }
8319             if (!(p = lock_user_string(arg1)))
8320                 goto efault;
8321             ret = get_errno(utime(p, host_tbuf));
8322             unlock_user(p, arg1, 0);
8323         }
8324         break;
8325 #endif
8326 #ifdef TARGET_NR_utimes
8327     case TARGET_NR_utimes:
8328         {
8329             struct timeval *tvp, tv[2];
8330             if (arg2) {
8331                 if (copy_from_user_timeval(&tv[0], arg2)
8332                     || copy_from_user_timeval(&tv[1],
8333                                               arg2 + sizeof(struct target_timeval)))
8334                     goto efault;
8335                 tvp = tv;
8336             } else {
8337                 tvp = NULL;
8338             }
8339             if (!(p = lock_user_string(arg1)))
8340                 goto efault;
8341             ret = get_errno(utimes(p, tvp));
8342             unlock_user(p, arg1, 0);
8343         }
8344         break;
8345 #endif
8346 #if defined(TARGET_NR_futimesat)
8347     case TARGET_NR_futimesat:
8348         {
8349             struct timeval *tvp, tv[2];
8350             if (arg3) {
8351                 if (copy_from_user_timeval(&tv[0], arg3)
8352                     || copy_from_user_timeval(&tv[1],
8353                                               arg3 + sizeof(struct target_timeval)))
8354                     goto efault;
8355                 tvp = tv;
8356             } else {
8357                 tvp = NULL;
8358             }
8359             if (!(p = lock_user_string(arg2)))
8360                 goto efault;
8361             ret = get_errno(futimesat(arg1, path(p), tvp));
8362             unlock_user(p, arg2, 0);
8363         }
8364         break;
8365 #endif
8366 #ifdef TARGET_NR_stty
8367     case TARGET_NR_stty:
8368         goto unimplemented;
8369 #endif
8370 #ifdef TARGET_NR_gtty
8371     case TARGET_NR_gtty:
8372         goto unimplemented;
8373 #endif
8374 #ifdef TARGET_NR_access
8375     case TARGET_NR_access:
8376         if (!(p = lock_user_string(arg1)))
8377             goto efault;
8378         ret = get_errno(access(path(p), arg2));
8379         unlock_user(p, arg1, 0);
8380         break;
8381 #endif
8382 #if defined(TARGET_NR_faccessat) && defined(__NR_faccessat)
8383     case TARGET_NR_faccessat:
8384         if (!(p = lock_user_string(arg2)))
8385             goto efault;
8386         ret = get_errno(faccessat(arg1, p, arg3, 0));
8387         unlock_user(p, arg2, 0);
8388         break;
8389 #endif
8390 #ifdef TARGET_NR_nice /* not on alpha */
8391     case TARGET_NR_nice:
8392         ret = get_errno(nice(arg1));
8393         break;
8394 #endif
8395 #ifdef TARGET_NR_ftime
8396     case TARGET_NR_ftime:
8397         goto unimplemented;
8398 #endif
8399     case TARGET_NR_sync:
8400         sync();
8401         ret = 0;
8402         break;
8403 #if defined(TARGET_NR_syncfs) && defined(CONFIG_SYNCFS)
8404     case TARGET_NR_syncfs:
8405         ret = get_errno(syncfs(arg1));
8406         break;
8407 #endif
8408     case TARGET_NR_kill:
8409         ret = get_errno(safe_kill(arg1, target_to_host_signal(arg2)));
8410         break;
8411 #ifdef TARGET_NR_rename
8412     case TARGET_NR_rename:
8413         {
8414             void *p2;
8415             p = lock_user_string(arg1);
8416             p2 = lock_user_string(arg2);
8417             if (!p || !p2)
8418                 ret = -TARGET_EFAULT;
8419             else
8420                 ret = get_errno(rename(p, p2));
8421             unlock_user(p2, arg2, 0);
8422             unlock_user(p, arg1, 0);
8423         }
8424         break;
8425 #endif
8426 #if defined(TARGET_NR_renameat)
8427     case TARGET_NR_renameat:
8428         {
8429             void *p2;
8430             p  = lock_user_string(arg2);
8431             p2 = lock_user_string(arg4);
8432             if (!p || !p2)
8433                 ret = -TARGET_EFAULT;
8434             else
8435                 ret = get_errno(renameat(arg1, p, arg3, p2));
8436             unlock_user(p2, arg4, 0);
8437             unlock_user(p, arg2, 0);
8438         }
8439         break;
8440 #endif
8441 #if defined(TARGET_NR_renameat2)
8442     case TARGET_NR_renameat2:
8443         {
8444             void *p2;
8445             p  = lock_user_string(arg2);
8446             p2 = lock_user_string(arg4);
8447             if (!p || !p2) {
8448                 ret = -TARGET_EFAULT;
8449             } else {
8450                 ret = get_errno(sys_renameat2(arg1, p, arg3, p2, arg5));
8451             }
8452             unlock_user(p2, arg4, 0);
8453             unlock_user(p, arg2, 0);
8454         }
8455         break;
8456 #endif
8457 #ifdef TARGET_NR_mkdir
8458     case TARGET_NR_mkdir:
8459         if (!(p = lock_user_string(arg1)))
8460             goto efault;
8461         ret = get_errno(mkdir(p, arg2));
8462         unlock_user(p, arg1, 0);
8463         break;
8464 #endif
8465 #if defined(TARGET_NR_mkdirat)
8466     case TARGET_NR_mkdirat:
8467         if (!(p = lock_user_string(arg2)))
8468             goto efault;
8469         ret = get_errno(mkdirat(arg1, p, arg3));
8470         unlock_user(p, arg2, 0);
8471         break;
8472 #endif
8473 #ifdef TARGET_NR_rmdir
8474     case TARGET_NR_rmdir:
8475         if (!(p = lock_user_string(arg1)))
8476             goto efault;
8477         ret = get_errno(rmdir(p));
8478         unlock_user(p, arg1, 0);
8479         break;
8480 #endif
8481     case TARGET_NR_dup:
8482         ret = get_errno(dup(arg1));
8483         if (ret >= 0) {
8484             fd_trans_dup(arg1, ret);
8485         }
8486         break;
8487 #ifdef TARGET_NR_pipe
8488     case TARGET_NR_pipe:
8489         ret = do_pipe(cpu_env, arg1, 0, 0);
8490         break;
8491 #endif
8492 #ifdef TARGET_NR_pipe2
8493     case TARGET_NR_pipe2:
8494         ret = do_pipe(cpu_env, arg1,
8495                       target_to_host_bitmask(arg2, fcntl_flags_tbl), 1);
8496         break;
8497 #endif
8498     case TARGET_NR_times:
8499         {
8500             struct target_tms *tmsp;
8501             struct tms tms;
8502             ret = get_errno(times(&tms));
8503             if (arg1) {
8504                 tmsp = lock_user(VERIFY_WRITE, arg1, sizeof(struct target_tms), 0);
8505                 if (!tmsp)
8506                     goto efault;
8507                 tmsp->tms_utime = tswapal(host_to_target_clock_t(tms.tms_utime));
8508                 tmsp->tms_stime = tswapal(host_to_target_clock_t(tms.tms_stime));
8509                 tmsp->tms_cutime = tswapal(host_to_target_clock_t(tms.tms_cutime));
8510                 tmsp->tms_cstime = tswapal(host_to_target_clock_t(tms.tms_cstime));
8511             }
8512             if (!is_error(ret))
8513                 ret = host_to_target_clock_t(ret);
8514         }
8515         break;
8516 #ifdef TARGET_NR_prof
8517     case TARGET_NR_prof:
8518         goto unimplemented;
8519 #endif
8520 #ifdef TARGET_NR_signal
8521     case TARGET_NR_signal:
8522         goto unimplemented;
8523 #endif
8524     case TARGET_NR_acct:
8525         if (arg1 == 0) {
8526             ret = get_errno(acct(NULL));
8527         } else {
8528             if (!(p = lock_user_string(arg1)))
8529                 goto efault;
8530             ret = get_errno(acct(path(p)));
8531             unlock_user(p, arg1, 0);
8532         }
8533         break;
8534 #ifdef TARGET_NR_umount2
8535     case TARGET_NR_umount2:
8536         if (!(p = lock_user_string(arg1)))
8537             goto efault;
8538         ret = get_errno(umount2(p, arg2));
8539         unlock_user(p, arg1, 0);
8540         break;
8541 #endif
8542 #ifdef TARGET_NR_lock
8543     case TARGET_NR_lock:
8544         goto unimplemented;
8545 #endif
8546     case TARGET_NR_ioctl:
8547         ret = do_ioctl(arg1, arg2, arg3);
8548         break;
8549     case TARGET_NR_fcntl:
8550         ret = do_fcntl(arg1, arg2, arg3);
8551         break;
8552 #ifdef TARGET_NR_mpx
8553     case TARGET_NR_mpx:
8554         goto unimplemented;
8555 #endif
8556     case TARGET_NR_setpgid:
8557         ret = get_errno(setpgid(arg1, arg2));
8558         break;
8559 #ifdef TARGET_NR_ulimit
8560     case TARGET_NR_ulimit:
8561         goto unimplemented;
8562 #endif
8563 #ifdef TARGET_NR_oldolduname
8564     case TARGET_NR_oldolduname:
8565         goto unimplemented;
8566 #endif
8567     case TARGET_NR_umask:
8568         ret = get_errno(umask(arg1));
8569         break;
8570     case TARGET_NR_chroot:
8571         if (!(p = lock_user_string(arg1)))
8572             goto efault;
8573         ret = get_errno(chroot(p));
8574         unlock_user(p, arg1, 0);
8575         break;
8576 #ifdef TARGET_NR_ustat
8577     case TARGET_NR_ustat:
8578         goto unimplemented;
8579 #endif
8580 #ifdef TARGET_NR_dup2
8581     case TARGET_NR_dup2:
8582         ret = get_errno(dup2(arg1, arg2));
8583         if (ret >= 0) {
8584             fd_trans_dup(arg1, arg2);
8585         }
8586         break;
8587 #endif
8588 #if defined(CONFIG_DUP3) && defined(TARGET_NR_dup3)
8589     case TARGET_NR_dup3:
8590     {
8591         int host_flags;
8592
8593         if ((arg3 & ~TARGET_O_CLOEXEC) != 0) {
8594             return -EINVAL;
8595         }
8596         host_flags = target_to_host_bitmask(arg3, fcntl_flags_tbl);
8597         ret = get_errno(dup3(arg1, arg2, host_flags));
8598         if (ret >= 0) {
8599             fd_trans_dup(arg1, arg2);
8600         }
8601         break;
8602     }
8603 #endif
8604 #ifdef TARGET_NR_getppid /* not on alpha */
8605     case TARGET_NR_getppid:
8606         ret = get_errno(getppid());
8607         break;
8608 #endif
8609 #ifdef TARGET_NR_getpgrp
8610     case TARGET_NR_getpgrp:
8611         ret = get_errno(getpgrp());
8612         break;
8613 #endif
8614     case TARGET_NR_setsid:
8615         ret = get_errno(setsid());
8616         break;
8617 #ifdef TARGET_NR_sigaction
8618     case TARGET_NR_sigaction:
8619         {
8620 #if defined(TARGET_ALPHA)
8621             struct target_sigaction act, oact, *pact = 0;
8622             struct target_old_sigaction *old_act;
8623             if (arg2) {
8624                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
8625                     goto efault;
8626                 act._sa_handler = old_act->_sa_handler;
8627                 target_siginitset(&act.sa_mask, old_act->sa_mask);
8628                 act.sa_flags = old_act->sa_flags;
8629                 act.sa_restorer = 0;
8630                 unlock_user_struct(old_act, arg2, 0);
8631                 pact = &act;
8632             }
8633             ret = get_errno(do_sigaction(arg1, pact, &oact));
8634             if (!is_error(ret) && arg3) {
8635                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
8636                     goto efault;
8637                 old_act->_sa_handler = oact._sa_handler;
8638                 old_act->sa_mask = oact.sa_mask.sig[0];
8639                 old_act->sa_flags = oact.sa_flags;
8640                 unlock_user_struct(old_act, arg3, 1);
8641             }
8642 #elif defined(TARGET_MIPS)
8643             struct target_sigaction act, oact, *pact, *old_act;
8644
8645             if (arg2) {
8646                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
8647                     goto efault;
8648                 act._sa_handler = old_act->_sa_handler;
8649                 target_siginitset(&act.sa_mask, old_act->sa_mask.sig[0]);
8650                 act.sa_flags = old_act->sa_flags;
8651                 unlock_user_struct(old_act, arg2, 0);
8652                 pact = &act;
8653             } else {
8654                 pact = NULL;
8655             }
8656
8657             ret = get_errno(do_sigaction(arg1, pact, &oact));
8658
8659             if (!is_error(ret) && arg3) {
8660                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
8661                     goto efault;
8662                 old_act->_sa_handler = oact._sa_handler;
8663                 old_act->sa_flags = oact.sa_flags;
8664                 old_act->sa_mask.sig[0] = oact.sa_mask.sig[0];
8665                 old_act->sa_mask.sig[1] = 0;
8666                 old_act->sa_mask.sig[2] = 0;
8667                 old_act->sa_mask.sig[3] = 0;
8668                 unlock_user_struct(old_act, arg3, 1);
8669             }
8670 #else
8671             struct target_old_sigaction *old_act;
8672             struct target_sigaction act, oact, *pact;
8673             if (arg2) {
8674                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
8675                     goto efault;
8676                 act._sa_handler = old_act->_sa_handler;
8677                 target_siginitset(&act.sa_mask, old_act->sa_mask);
8678                 act.sa_flags = old_act->sa_flags;
8679                 act.sa_restorer = old_act->sa_restorer;
8680                 unlock_user_struct(old_act, arg2, 0);
8681                 pact = &act;
8682             } else {
8683                 pact = NULL;
8684             }
8685             ret = get_errno(do_sigaction(arg1, pact, &oact));
8686             if (!is_error(ret) && arg3) {
8687                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
8688                     goto efault;
8689                 old_act->_sa_handler = oact._sa_handler;
8690                 old_act->sa_mask = oact.sa_mask.sig[0];
8691                 old_act->sa_flags = oact.sa_flags;
8692                 old_act->sa_restorer = oact.sa_restorer;
8693                 unlock_user_struct(old_act, arg3, 1);
8694             }
8695 #endif
8696         }
8697         break;
8698 #endif
8699     case TARGET_NR_rt_sigaction:
8700         {
8701 #if defined(TARGET_ALPHA)
8702             /* For Alpha and SPARC this is a 5 argument syscall, with
8703              * a 'restorer' parameter which must be copied into the
8704              * sa_restorer field of the sigaction struct.
8705              * For Alpha that 'restorer' is arg5; for SPARC it is arg4,
8706              * and arg5 is the sigsetsize.
8707              * Alpha also has a separate rt_sigaction struct that it uses
8708              * here; SPARC uses the usual sigaction struct.
8709              */
8710             struct target_rt_sigaction *rt_act;
8711             struct target_sigaction act, oact, *pact = 0;
8712
8713             if (arg4 != sizeof(target_sigset_t)) {
8714                 ret = -TARGET_EINVAL;
8715                 break;
8716             }
8717             if (arg2) {
8718                 if (!lock_user_struct(VERIFY_READ, rt_act, arg2, 1))
8719                     goto efault;
8720                 act._sa_handler = rt_act->_sa_handler;
8721                 act.sa_mask = rt_act->sa_mask;
8722                 act.sa_flags = rt_act->sa_flags;
8723                 act.sa_restorer = arg5;
8724                 unlock_user_struct(rt_act, arg2, 0);
8725                 pact = &act;
8726             }
8727             ret = get_errno(do_sigaction(arg1, pact, &oact));
8728             if (!is_error(ret) && arg3) {
8729                 if (!lock_user_struct(VERIFY_WRITE, rt_act, arg3, 0))
8730                     goto efault;
8731                 rt_act->_sa_handler = oact._sa_handler;
8732                 rt_act->sa_mask = oact.sa_mask;
8733                 rt_act->sa_flags = oact.sa_flags;
8734                 unlock_user_struct(rt_act, arg3, 1);
8735             }
8736 #else
8737 #ifdef TARGET_SPARC
8738             target_ulong restorer = arg4;
8739             target_ulong sigsetsize = arg5;
8740 #else
8741             target_ulong sigsetsize = arg4;
8742 #endif
8743             struct target_sigaction *act;
8744             struct target_sigaction *oact;
8745
8746             if (sigsetsize != sizeof(target_sigset_t)) {
8747                 ret = -TARGET_EINVAL;
8748                 break;
8749             }
8750             if (arg2) {
8751                 if (!lock_user_struct(VERIFY_READ, act, arg2, 1)) {
8752                     goto efault;
8753                 }
8754 #ifdef TARGET_SPARC
8755                 act->sa_restorer = restorer;
8756 #endif
8757             } else {
8758                 act = NULL;
8759             }
8760             if (arg3) {
8761                 if (!lock_user_struct(VERIFY_WRITE, oact, arg3, 0)) {
8762                     ret = -TARGET_EFAULT;
8763                     goto rt_sigaction_fail;
8764                 }
8765             } else
8766                 oact = NULL;
8767             ret = get_errno(do_sigaction(arg1, act, oact));
8768         rt_sigaction_fail:
8769             if (act)
8770                 unlock_user_struct(act, arg2, 0);
8771             if (oact)
8772                 unlock_user_struct(oact, arg3, 1);
8773 #endif
8774         }
8775         break;
8776 #ifdef TARGET_NR_sgetmask /* not on alpha */
8777     case TARGET_NR_sgetmask:
8778         {
8779             sigset_t cur_set;
8780             abi_ulong target_set;
8781             ret = do_sigprocmask(0, NULL, &cur_set);
8782             if (!ret) {
8783                 host_to_target_old_sigset(&target_set, &cur_set);
8784                 ret = target_set;
8785             }
8786         }
8787         break;
8788 #endif
8789 #ifdef TARGET_NR_ssetmask /* not on alpha */
8790     case TARGET_NR_ssetmask:
8791         {
8792             sigset_t set, oset;
8793             abi_ulong target_set = arg1;
8794             target_to_host_old_sigset(&set, &target_set);
8795             ret = do_sigprocmask(SIG_SETMASK, &set, &oset);
8796             if (!ret) {
8797                 host_to_target_old_sigset(&target_set, &oset);
8798                 ret = target_set;
8799             }
8800         }
8801         break;
8802 #endif
8803 #ifdef TARGET_NR_sigprocmask
8804     case TARGET_NR_sigprocmask:
8805         {
8806 #if defined(TARGET_ALPHA)
8807             sigset_t set, oldset;
8808             abi_ulong mask;
8809             int how;
8810
8811             switch (arg1) {
8812             case TARGET_SIG_BLOCK:
8813                 how = SIG_BLOCK;
8814                 break;
8815             case TARGET_SIG_UNBLOCK:
8816                 how = SIG_UNBLOCK;
8817                 break;
8818             case TARGET_SIG_SETMASK:
8819                 how = SIG_SETMASK;
8820                 break;
8821             default:
8822                 ret = -TARGET_EINVAL;
8823                 goto fail;
8824             }
8825             mask = arg2;
8826             target_to_host_old_sigset(&set, &mask);
8827
8828             ret = do_sigprocmask(how, &set, &oldset);
8829             if (!is_error(ret)) {
8830                 host_to_target_old_sigset(&mask, &oldset);
8831                 ret = mask;
8832                 ((CPUAlphaState *)cpu_env)->ir[IR_V0] = 0; /* force no error */
8833             }
8834 #else
8835             sigset_t set, oldset, *set_ptr;
8836             int how;
8837
8838             if (arg2) {
8839                 switch (arg1) {
8840                 case TARGET_SIG_BLOCK:
8841                     how = SIG_BLOCK;
8842                     break;
8843                 case TARGET_SIG_UNBLOCK:
8844                     how = SIG_UNBLOCK;
8845                     break;
8846                 case TARGET_SIG_SETMASK:
8847                     how = SIG_SETMASK;
8848                     break;
8849                 default:
8850                     ret = -TARGET_EINVAL;
8851                     goto fail;
8852                 }
8853                 if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
8854                     goto efault;
8855                 target_to_host_old_sigset(&set, p);
8856                 unlock_user(p, arg2, 0);
8857                 set_ptr = &set;
8858             } else {
8859                 how = 0;
8860                 set_ptr = NULL;
8861             }
8862             ret = do_sigprocmask(how, set_ptr, &oldset);
8863             if (!is_error(ret) && arg3) {
8864                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
8865                     goto efault;
8866                 host_to_target_old_sigset(p, &oldset);
8867                 unlock_user(p, arg3, sizeof(target_sigset_t));
8868             }
8869 #endif
8870         }
8871         break;
8872 #endif
8873     case TARGET_NR_rt_sigprocmask:
8874         {
8875             int how = arg1;
8876             sigset_t set, oldset, *set_ptr;
8877
8878             if (arg4 != sizeof(target_sigset_t)) {
8879                 ret = -TARGET_EINVAL;
8880                 break;
8881             }
8882
8883             if (arg2) {
8884                 switch(how) {
8885                 case TARGET_SIG_BLOCK:
8886                     how = SIG_BLOCK;
8887                     break;
8888                 case TARGET_SIG_UNBLOCK:
8889                     how = SIG_UNBLOCK;
8890                     break;
8891                 case TARGET_SIG_SETMASK:
8892                     how = SIG_SETMASK;
8893                     break;
8894                 default:
8895                     ret = -TARGET_EINVAL;
8896                     goto fail;
8897                 }
8898                 if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
8899                     goto efault;
8900                 target_to_host_sigset(&set, p);
8901                 unlock_user(p, arg2, 0);
8902                 set_ptr = &set;
8903             } else {
8904                 how = 0;
8905                 set_ptr = NULL;
8906             }
8907             ret = do_sigprocmask(how, set_ptr, &oldset);
8908             if (!is_error(ret) && arg3) {
8909                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
8910                     goto efault;
8911                 host_to_target_sigset(p, &oldset);
8912                 unlock_user(p, arg3, sizeof(target_sigset_t));
8913             }
8914         }
8915         break;
8916 #ifdef TARGET_NR_sigpending
8917     case TARGET_NR_sigpending:
8918         {
8919             sigset_t set;
8920             ret = get_errno(sigpending(&set));
8921             if (!is_error(ret)) {
8922                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
8923                     goto efault;
8924                 host_to_target_old_sigset(p, &set);
8925                 unlock_user(p, arg1, sizeof(target_sigset_t));
8926             }
8927         }
8928         break;
8929 #endif
8930     case TARGET_NR_rt_sigpending:
8931         {
8932             sigset_t set;
8933
8934             /* Yes, this check is >, not != like most. We follow the kernel's
8935              * logic and it does it like this because it implements
8936              * NR_sigpending through the same code path, and in that case
8937              * the old_sigset_t is smaller in size.
8938              */
8939             if (arg2 > sizeof(target_sigset_t)) {
8940                 ret = -TARGET_EINVAL;
8941                 break;
8942             }
8943
8944             ret = get_errno(sigpending(&set));
8945             if (!is_error(ret)) {
8946                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
8947                     goto efault;
8948                 host_to_target_sigset(p, &set);
8949                 unlock_user(p, arg1, sizeof(target_sigset_t));
8950             }
8951         }
8952         break;
8953 #ifdef TARGET_NR_sigsuspend
8954     case TARGET_NR_sigsuspend:
8955         {
8956             TaskState *ts = cpu->opaque;
8957 #if defined(TARGET_ALPHA)
8958             abi_ulong mask = arg1;
8959             target_to_host_old_sigset(&ts->sigsuspend_mask, &mask);
8960 #else
8961             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
8962                 goto efault;
8963             target_to_host_old_sigset(&ts->sigsuspend_mask, p);
8964             unlock_user(p, arg1, 0);
8965 #endif
8966             ret = get_errno(safe_rt_sigsuspend(&ts->sigsuspend_mask,
8967                                                SIGSET_T_SIZE));
8968             if (ret != -TARGET_ERESTARTSYS) {
8969                 ts->in_sigsuspend = 1;
8970             }
8971         }
8972         break;
8973 #endif
8974     case TARGET_NR_rt_sigsuspend:
8975         {
8976             TaskState *ts = cpu->opaque;
8977
8978             if (arg2 != sizeof(target_sigset_t)) {
8979                 ret = -TARGET_EINVAL;
8980                 break;
8981             }
8982             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
8983                 goto efault;
8984             target_to_host_sigset(&ts->sigsuspend_mask, p);
8985             unlock_user(p, arg1, 0);
8986             ret = get_errno(safe_rt_sigsuspend(&ts->sigsuspend_mask,
8987                                                SIGSET_T_SIZE));
8988             if (ret != -TARGET_ERESTARTSYS) {
8989                 ts->in_sigsuspend = 1;
8990             }
8991         }
8992         break;
8993     case TARGET_NR_rt_sigtimedwait:
8994         {
8995             sigset_t set;
8996             struct timespec uts, *puts;
8997             siginfo_t uinfo;
8998
8999             if (arg4 != sizeof(target_sigset_t)) {
9000                 ret = -TARGET_EINVAL;
9001                 break;
9002             }
9003
9004             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
9005                 goto efault;
9006             target_to_host_sigset(&set, p);
9007             unlock_user(p, arg1, 0);
9008             if (arg3) {
9009                 puts = &uts;
9010                 target_to_host_timespec(puts, arg3);
9011             } else {
9012                 puts = NULL;
9013             }
9014             ret = get_errno(safe_rt_sigtimedwait(&set, &uinfo, puts,
9015                                                  SIGSET_T_SIZE));
9016             if (!is_error(ret)) {
9017                 if (arg2) {
9018                     p = lock_user(VERIFY_WRITE, arg2, sizeof(target_siginfo_t),
9019                                   0);
9020                     if (!p) {
9021                         goto efault;
9022                     }
9023                     host_to_target_siginfo(p, &uinfo);
9024                     unlock_user(p, arg2, sizeof(target_siginfo_t));
9025                 }
9026                 ret = host_to_target_signal(ret);
9027             }
9028         }
9029         break;
9030     case TARGET_NR_rt_sigqueueinfo:
9031         {
9032             siginfo_t uinfo;
9033
9034             p = lock_user(VERIFY_READ, arg3, sizeof(target_siginfo_t), 1);
9035             if (!p) {
9036                 goto efault;
9037             }
9038             target_to_host_siginfo(&uinfo, p);
9039             unlock_user(p, arg3, 0);
9040             ret = get_errno(sys_rt_sigqueueinfo(arg1, arg2, &uinfo));
9041         }
9042         break;
9043     case TARGET_NR_rt_tgsigqueueinfo:
9044         {
9045             siginfo_t uinfo;
9046
9047             p = lock_user(VERIFY_READ, arg4, sizeof(target_siginfo_t), 1);
9048             if (!p) {
9049                 goto efault;
9050             }
9051             target_to_host_siginfo(&uinfo, p);
9052             unlock_user(p, arg4, 0);
9053             ret = get_errno(sys_rt_tgsigqueueinfo(arg1, arg2, arg3, &uinfo));
9054         }
9055         break;
9056 #ifdef TARGET_NR_sigreturn
9057     case TARGET_NR_sigreturn:
9058         if (block_signals()) {
9059             ret = -TARGET_ERESTARTSYS;
9060         } else {
9061             ret = do_sigreturn(cpu_env);
9062         }
9063         break;
9064 #endif
9065     case TARGET_NR_rt_sigreturn:
9066         if (block_signals()) {
9067             ret = -TARGET_ERESTARTSYS;
9068         } else {
9069             ret = do_rt_sigreturn(cpu_env);
9070         }
9071         break;
9072     case TARGET_NR_sethostname:
9073         if (!(p = lock_user_string(arg1)))
9074             goto efault;
9075         ret = get_errno(sethostname(p, arg2));
9076         unlock_user(p, arg1, 0);
9077         break;
9078     case TARGET_NR_setrlimit:
9079         {
9080             int resource = target_to_host_resource(arg1);
9081             struct target_rlimit *target_rlim;
9082             struct rlimit rlim;
9083             if (!lock_user_struct(VERIFY_READ, target_rlim, arg2, 1))
9084                 goto efault;
9085             rlim.rlim_cur = target_to_host_rlim(target_rlim->rlim_cur);
9086             rlim.rlim_max = target_to_host_rlim(target_rlim->rlim_max);
9087             unlock_user_struct(target_rlim, arg2, 0);
9088             ret = get_errno(setrlimit(resource, &rlim));
9089         }
9090         break;
9091     case TARGET_NR_getrlimit:
9092         {
9093             int resource = target_to_host_resource(arg1);
9094             struct target_rlimit *target_rlim;
9095             struct rlimit rlim;
9096
9097             ret = get_errno(getrlimit(resource, &rlim));
9098             if (!is_error(ret)) {
9099                 if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
9100                     goto efault;
9101                 target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
9102                 target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
9103                 unlock_user_struct(target_rlim, arg2, 1);
9104             }
9105         }
9106         break;
9107     case TARGET_NR_getrusage:
9108         {
9109             struct rusage rusage;
9110             ret = get_errno(getrusage(arg1, &rusage));
9111             if (!is_error(ret)) {
9112                 ret = host_to_target_rusage(arg2, &rusage);
9113             }
9114         }
9115         break;
9116     case TARGET_NR_gettimeofday:
9117         {
9118             struct timeval tv;
9119             ret = get_errno(gettimeofday(&tv, NULL));
9120             if (!is_error(ret)) {
9121                 if (copy_to_user_timeval(arg1, &tv))
9122                     goto efault;
9123             }
9124         }
9125         break;
9126     case TARGET_NR_settimeofday:
9127         {
9128             struct timeval tv, *ptv = NULL;
9129             struct timezone tz, *ptz = NULL;
9130
9131             if (arg1) {
9132                 if (copy_from_user_timeval(&tv, arg1)) {
9133                     goto efault;
9134                 }
9135                 ptv = &tv;
9136             }
9137
9138             if (arg2) {
9139                 if (copy_from_user_timezone(&tz, arg2)) {
9140                     goto efault;
9141                 }
9142                 ptz = &tz;
9143             }
9144
9145             ret = get_errno(settimeofday(ptv, ptz));
9146         }
9147         break;
9148 #if defined(TARGET_NR_select)
9149     case TARGET_NR_select:
9150 #if defined(TARGET_WANT_NI_OLD_SELECT)
9151         /* some architectures used to have old_select here
9152          * but now ENOSYS it.
9153          */
9154         ret = -TARGET_ENOSYS;
9155 #elif defined(TARGET_WANT_OLD_SYS_SELECT)
9156         ret = do_old_select(arg1);
9157 #else
9158         ret = do_select(arg1, arg2, arg3, arg4, arg5);
9159 #endif
9160         break;
9161 #endif
9162 #ifdef TARGET_NR_pselect6
9163     case TARGET_NR_pselect6:
9164         {
9165             abi_long rfd_addr, wfd_addr, efd_addr, n, ts_addr;
9166             fd_set rfds, wfds, efds;
9167             fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
9168             struct timespec ts, *ts_ptr;
9169
9170             /*
9171              * The 6th arg is actually two args smashed together,
9172              * so we cannot use the C library.
9173              */
9174             sigset_t set;
9175             struct {
9176                 sigset_t *set;
9177                 size_t size;
9178             } sig, *sig_ptr;
9179
9180             abi_ulong arg_sigset, arg_sigsize, *arg7;
9181             target_sigset_t *target_sigset;
9182
9183             n = arg1;
9184             rfd_addr = arg2;
9185             wfd_addr = arg3;
9186             efd_addr = arg4;
9187             ts_addr = arg5;
9188
9189             ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
9190             if (ret) {
9191                 goto fail;
9192             }
9193             ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
9194             if (ret) {
9195                 goto fail;
9196             }
9197             ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
9198             if (ret) {
9199                 goto fail;
9200             }
9201
9202             /*
9203              * This takes a timespec, and not a timeval, so we cannot
9204              * use the do_select() helper ...
9205              */
9206             if (ts_addr) {
9207                 if (target_to_host_timespec(&ts, ts_addr)) {
9208                     goto efault;
9209                 }
9210                 ts_ptr = &ts;
9211             } else {
9212                 ts_ptr = NULL;
9213             }
9214
9215             /* Extract the two packed args for the sigset */
9216             if (arg6) {
9217                 sig_ptr = &sig;
9218                 sig.size = SIGSET_T_SIZE;
9219
9220                 arg7 = lock_user(VERIFY_READ, arg6, sizeof(*arg7) * 2, 1);
9221                 if (!arg7) {
9222                     goto efault;
9223                 }
9224                 arg_sigset = tswapal(arg7[0]);
9225                 arg_sigsize = tswapal(arg7[1]);
9226                 unlock_user(arg7, arg6, 0);
9227
9228                 if (arg_sigset) {
9229                     sig.set = &set;
9230                     if (arg_sigsize != sizeof(*target_sigset)) {
9231                         /* Like the kernel, we enforce correct size sigsets */
9232                         ret = -TARGET_EINVAL;
9233                         goto fail;
9234                     }
9235                     target_sigset = lock_user(VERIFY_READ, arg_sigset,
9236                                               sizeof(*target_sigset), 1);
9237                     if (!target_sigset) {
9238                         goto efault;
9239                     }
9240                     target_to_host_sigset(&set, target_sigset);
9241                     unlock_user(target_sigset, arg_sigset, 0);
9242                 } else {
9243                     sig.set = NULL;
9244                 }
9245             } else {
9246                 sig_ptr = NULL;
9247             }
9248
9249             ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
9250                                           ts_ptr, sig_ptr));
9251
9252             if (!is_error(ret)) {
9253                 if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n))
9254                     goto efault;
9255                 if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n))
9256                     goto efault;
9257                 if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n))
9258                     goto efault;
9259
9260                 if (ts_addr && host_to_target_timespec(ts_addr, &ts))
9261                     goto efault;
9262             }
9263         }
9264         break;
9265 #endif
9266 #ifdef TARGET_NR_symlink
9267     case TARGET_NR_symlink:
9268         {
9269             void *p2;
9270             p = lock_user_string(arg1);
9271             p2 = lock_user_string(arg2);
9272             if (!p || !p2)
9273                 ret = -TARGET_EFAULT;
9274             else
9275                 ret = get_errno(symlink(p, p2));
9276             unlock_user(p2, arg2, 0);
9277             unlock_user(p, arg1, 0);
9278         }
9279         break;
9280 #endif
9281 #if defined(TARGET_NR_symlinkat)
9282     case TARGET_NR_symlinkat:
9283         {
9284             void *p2;
9285             p  = lock_user_string(arg1);
9286             p2 = lock_user_string(arg3);
9287             if (!p || !p2)
9288                 ret = -TARGET_EFAULT;
9289             else
9290                 ret = get_errno(symlinkat(p, arg2, p2));
9291             unlock_user(p2, arg3, 0);
9292             unlock_user(p, arg1, 0);
9293         }
9294         break;
9295 #endif
9296 #ifdef TARGET_NR_oldlstat
9297     case TARGET_NR_oldlstat:
9298         goto unimplemented;
9299 #endif
9300 #ifdef TARGET_NR_readlink
9301     case TARGET_NR_readlink:
9302         {
9303             void *p2;
9304             p = lock_user_string(arg1);
9305             p2 = lock_user(VERIFY_WRITE, arg2, arg3, 0);
9306             if (!p || !p2) {
9307                 ret = -TARGET_EFAULT;
9308             } else if (!arg3) {
9309                 /* Short circuit this for the magic exe check. */
9310                 ret = -TARGET_EINVAL;
9311             } else if (is_proc_myself((const char *)p, "exe")) {
9312                 char real[PATH_MAX], *temp;
9313                 temp = realpath(exec_path, real);
9314                 /* Return value is # of bytes that we wrote to the buffer. */
9315                 if (temp == NULL) {
9316                     ret = get_errno(-1);
9317                 } else {
9318                     /* Don't worry about sign mismatch as earlier mapping
9319                      * logic would have thrown a bad address error. */
9320                     ret = MIN(strlen(real), arg3);
9321                     /* We cannot NUL terminate the string. */
9322                     memcpy(p2, real, ret);
9323                 }
9324             } else {
9325                 ret = get_errno(readlink(path(p), p2, arg3));
9326             }
9327             unlock_user(p2, arg2, ret);
9328             unlock_user(p, arg1, 0);
9329         }
9330         break;
9331 #endif
9332 #if defined(TARGET_NR_readlinkat)
9333     case TARGET_NR_readlinkat:
9334         {
9335             void *p2;
9336             p  = lock_user_string(arg2);
9337             p2 = lock_user(VERIFY_WRITE, arg3, arg4, 0);
9338             if (!p || !p2) {
9339                 ret = -TARGET_EFAULT;
9340             } else if (is_proc_myself((const char *)p, "exe")) {
9341                 char real[PATH_MAX], *temp;
9342                 temp = realpath(exec_path, real);
9343                 ret = temp == NULL ? get_errno(-1) : strlen(real) ;
9344                 snprintf((char *)p2, arg4, "%s", real);
9345             } else {
9346                 ret = get_errno(readlinkat(arg1, path(p), p2, arg4));
9347             }
9348             unlock_user(p2, arg3, ret);
9349             unlock_user(p, arg2, 0);
9350         }
9351         break;
9352 #endif
9353 #ifdef TARGET_NR_uselib
9354     case TARGET_NR_uselib:
9355         goto unimplemented;
9356 #endif
9357 #ifdef TARGET_NR_swapon
9358     case TARGET_NR_swapon:
9359         if (!(p = lock_user_string(arg1)))
9360             goto efault;
9361         ret = get_errno(swapon(p, arg2));
9362         unlock_user(p, arg1, 0);
9363         break;
9364 #endif
9365     case TARGET_NR_reboot:
9366         if (arg3 == LINUX_REBOOT_CMD_RESTART2) {
9367            /* arg4 must be ignored in all other cases */
9368            p = lock_user_string(arg4);
9369            if (!p) {
9370               goto efault;
9371            }
9372            ret = get_errno(reboot(arg1, arg2, arg3, p));
9373            unlock_user(p, arg4, 0);
9374         } else {
9375            ret = get_errno(reboot(arg1, arg2, arg3, NULL));
9376         }
9377         break;
9378 #ifdef TARGET_NR_readdir
9379     case TARGET_NR_readdir:
9380         goto unimplemented;
9381 #endif
9382 #ifdef TARGET_NR_mmap
9383     case TARGET_NR_mmap:
9384 #if (defined(TARGET_I386) && defined(TARGET_ABI32)) || \
9385     (defined(TARGET_ARM) && defined(TARGET_ABI32)) || \
9386     defined(TARGET_M68K) || defined(TARGET_CRIS) || defined(TARGET_MICROBLAZE) \
9387     || defined(TARGET_S390X)
9388         {
9389             abi_ulong *v;
9390             abi_ulong v1, v2, v3, v4, v5, v6;
9391             if (!(v = lock_user(VERIFY_READ, arg1, 6 * sizeof(abi_ulong), 1)))
9392                 goto efault;
9393             v1 = tswapal(v[0]);
9394             v2 = tswapal(v[1]);
9395             v3 = tswapal(v[2]);
9396             v4 = tswapal(v[3]);
9397             v5 = tswapal(v[4]);
9398             v6 = tswapal(v[5]);
9399             unlock_user(v, arg1, 0);
9400             ret = get_errno(target_mmap(v1, v2, v3,
9401                                         target_to_host_bitmask(v4, mmap_flags_tbl),
9402                                         v5, v6));
9403         }
9404 #else
9405         ret = get_errno(target_mmap(arg1, arg2, arg3,
9406                                     target_to_host_bitmask(arg4, mmap_flags_tbl),
9407                                     arg5,
9408                                     arg6));
9409 #endif
9410         break;
9411 #endif
9412 #ifdef TARGET_NR_mmap2
9413     case TARGET_NR_mmap2:
9414 #ifndef MMAP_SHIFT
9415 #define MMAP_SHIFT 12
9416 #endif
9417         ret = get_errno(target_mmap(arg1, arg2, arg3,
9418                                     target_to_host_bitmask(arg4, mmap_flags_tbl),
9419                                     arg5,
9420                                     arg6 << MMAP_SHIFT));
9421         break;
9422 #endif
9423     case TARGET_NR_munmap:
9424         ret = get_errno(target_munmap(arg1, arg2));
9425         break;
9426     case TARGET_NR_mprotect:
9427         {
9428             TaskState *ts = cpu->opaque;
9429             /* Special hack to detect libc making the stack executable.  */
9430             if ((arg3 & PROT_GROWSDOWN)
9431                 && arg1 >= ts->info->stack_limit
9432                 && arg1 <= ts->info->start_stack) {
9433                 arg3 &= ~PROT_GROWSDOWN;
9434                 arg2 = arg2 + arg1 - ts->info->stack_limit;
9435                 arg1 = ts->info->stack_limit;
9436             }
9437         }
9438         ret = get_errno(target_mprotect(arg1, arg2, arg3));
9439         break;
9440 #ifdef TARGET_NR_mremap
9441     case TARGET_NR_mremap:
9442         ret = get_errno(target_mremap(arg1, arg2, arg3, arg4, arg5));
9443         break;
9444 #endif
9445         /* ??? msync/mlock/munlock are broken for softmmu.  */
9446 #ifdef TARGET_NR_msync
9447     case TARGET_NR_msync:
9448         ret = get_errno(msync(g2h(arg1), arg2, arg3));
9449         break;
9450 #endif
9451 #ifdef TARGET_NR_mlock
9452     case TARGET_NR_mlock:
9453         ret = get_errno(mlock(g2h(arg1), arg2));
9454         break;
9455 #endif
9456 #ifdef TARGET_NR_munlock
9457     case TARGET_NR_munlock:
9458         ret = get_errno(munlock(g2h(arg1), arg2));
9459         break;
9460 #endif
9461 #ifdef TARGET_NR_mlockall
9462     case TARGET_NR_mlockall:
9463         ret = get_errno(mlockall(target_to_host_mlockall_arg(arg1)));
9464         break;
9465 #endif
9466 #ifdef TARGET_NR_munlockall
9467     case TARGET_NR_munlockall:
9468         ret = get_errno(munlockall());
9469         break;
9470 #endif
9471     case TARGET_NR_truncate:
9472         if (!(p = lock_user_string(arg1)))
9473             goto efault;
9474         ret = get_errno(truncate(p, arg2));
9475         unlock_user(p, arg1, 0);
9476         break;
9477     case TARGET_NR_ftruncate:
9478         ret = get_errno(ftruncate(arg1, arg2));
9479         break;
9480     case TARGET_NR_fchmod:
9481         ret = get_errno(fchmod(arg1, arg2));
9482         break;
9483 #if defined(TARGET_NR_fchmodat)
9484     case TARGET_NR_fchmodat:
9485         if (!(p = lock_user_string(arg2)))
9486             goto efault;
9487         ret = get_errno(fchmodat(arg1, p, arg3, 0));
9488         unlock_user(p, arg2, 0);
9489         break;
9490 #endif
9491     case TARGET_NR_getpriority:
9492         /* Note that negative values are valid for getpriority, so we must
9493            differentiate based on errno settings.  */
9494         errno = 0;
9495         ret = getpriority(arg1, arg2);
9496         if (ret == -1 && errno != 0) {
9497             ret = -host_to_target_errno(errno);
9498             break;
9499         }
9500 #ifdef TARGET_ALPHA
9501         /* Return value is the unbiased priority.  Signal no error.  */
9502         ((CPUAlphaState *)cpu_env)->ir[IR_V0] = 0;
9503 #else
9504         /* Return value is a biased priority to avoid negative numbers.  */
9505         ret = 20 - ret;
9506 #endif
9507         break;
9508     case TARGET_NR_setpriority:
9509         ret = get_errno(setpriority(arg1, arg2, arg3));
9510         break;
9511 #ifdef TARGET_NR_profil
9512     case TARGET_NR_profil:
9513         goto unimplemented;
9514 #endif
9515     case TARGET_NR_statfs:
9516         if (!(p = lock_user_string(arg1)))
9517             goto efault;
9518         ret = get_errno(statfs(path(p), &stfs));
9519         unlock_user(p, arg1, 0);
9520     convert_statfs:
9521         if (!is_error(ret)) {
9522             struct target_statfs *target_stfs;
9523
9524             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg2, 0))
9525                 goto efault;
9526             __put_user(stfs.f_type, &target_stfs->f_type);
9527             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
9528             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
9529             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
9530             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
9531             __put_user(stfs.f_files, &target_stfs->f_files);
9532             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
9533             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
9534             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
9535             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
9536             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
9537             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
9538             unlock_user_struct(target_stfs, arg2, 1);
9539         }
9540         break;
9541     case TARGET_NR_fstatfs:
9542         ret = get_errno(fstatfs(arg1, &stfs));
9543         goto convert_statfs;
9544 #ifdef TARGET_NR_statfs64
9545     case TARGET_NR_statfs64:
9546         if (!(p = lock_user_string(arg1)))
9547             goto efault;
9548         ret = get_errno(statfs(path(p), &stfs));
9549         unlock_user(p, arg1, 0);
9550     convert_statfs64:
9551         if (!is_error(ret)) {
9552             struct target_statfs64 *target_stfs;
9553
9554             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg3, 0))
9555                 goto efault;
9556             __put_user(stfs.f_type, &target_stfs->f_type);
9557             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
9558             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
9559             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
9560             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
9561             __put_user(stfs.f_files, &target_stfs->f_files);
9562             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
9563             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
9564             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
9565             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
9566             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
9567             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
9568             unlock_user_struct(target_stfs, arg3, 1);
9569         }
9570         break;
9571     case TARGET_NR_fstatfs64:
9572         ret = get_errno(fstatfs(arg1, &stfs));
9573         goto convert_statfs64;
9574 #endif
9575 #ifdef TARGET_NR_ioperm
9576     case TARGET_NR_ioperm:
9577         goto unimplemented;
9578 #endif
9579 #ifdef TARGET_NR_socketcall
9580     case TARGET_NR_socketcall:
9581         ret = do_socketcall(arg1, arg2);
9582         break;
9583 #endif
9584 #ifdef TARGET_NR_accept
9585     case TARGET_NR_accept:
9586         ret = do_accept4(arg1, arg2, arg3, 0);
9587         break;
9588 #endif
9589 #ifdef TARGET_NR_accept4
9590     case TARGET_NR_accept4:
9591         ret = do_accept4(arg1, arg2, arg3, arg4);
9592         break;
9593 #endif
9594 #ifdef TARGET_NR_bind
9595     case TARGET_NR_bind:
9596         ret = do_bind(arg1, arg2, arg3);
9597         break;
9598 #endif
9599 #ifdef TARGET_NR_connect
9600     case TARGET_NR_connect:
9601         ret = do_connect(arg1, arg2, arg3);
9602         break;
9603 #endif
9604 #ifdef TARGET_NR_getpeername
9605     case TARGET_NR_getpeername:
9606         ret = do_getpeername(arg1, arg2, arg3);
9607         break;
9608 #endif
9609 #ifdef TARGET_NR_getsockname
9610     case TARGET_NR_getsockname:
9611         ret = do_getsockname(arg1, arg2, arg3);
9612         break;
9613 #endif
9614 #ifdef TARGET_NR_getsockopt
9615     case TARGET_NR_getsockopt:
9616         ret = do_getsockopt(arg1, arg2, arg3, arg4, arg5);
9617         break;
9618 #endif
9619 #ifdef TARGET_NR_listen
9620     case TARGET_NR_listen:
9621         ret = get_errno(listen(arg1, arg2));
9622         break;
9623 #endif
9624 #ifdef TARGET_NR_recv
9625     case TARGET_NR_recv:
9626         ret = do_recvfrom(arg1, arg2, arg3, arg4, 0, 0);
9627         break;
9628 #endif
9629 #ifdef TARGET_NR_recvfrom
9630     case TARGET_NR_recvfrom:
9631         ret = do_recvfrom(arg1, arg2, arg3, arg4, arg5, arg6);
9632         break;
9633 #endif
9634 #ifdef TARGET_NR_recvmsg
9635     case TARGET_NR_recvmsg:
9636         ret = do_sendrecvmsg(arg1, arg2, arg3, 0);
9637         break;
9638 #endif
9639 #ifdef TARGET_NR_send
9640     case TARGET_NR_send:
9641         ret = do_sendto(arg1, arg2, arg3, arg4, 0, 0);
9642         break;
9643 #endif
9644 #ifdef TARGET_NR_sendmsg
9645     case TARGET_NR_sendmsg:
9646         ret = do_sendrecvmsg(arg1, arg2, arg3, 1);
9647         break;
9648 #endif
9649 #ifdef TARGET_NR_sendmmsg
9650     case TARGET_NR_sendmmsg:
9651         ret = do_sendrecvmmsg(arg1, arg2, arg3, arg4, 1);
9652         break;
9653     case TARGET_NR_recvmmsg:
9654         ret = do_sendrecvmmsg(arg1, arg2, arg3, arg4, 0);
9655         break;
9656 #endif
9657 #ifdef TARGET_NR_sendto
9658     case TARGET_NR_sendto:
9659         ret = do_sendto(arg1, arg2, arg3, arg4, arg5, arg6);
9660         break;
9661 #endif
9662 #ifdef TARGET_NR_shutdown
9663     case TARGET_NR_shutdown:
9664         ret = get_errno(shutdown(arg1, arg2));
9665         break;
9666 #endif
9667 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
9668     case TARGET_NR_getrandom:
9669         p = lock_user(VERIFY_WRITE, arg1, arg2, 0);
9670         if (!p) {
9671             goto efault;
9672         }
9673         ret = get_errno(getrandom(p, arg2, arg3));
9674         unlock_user(p, arg1, ret);
9675         break;
9676 #endif
9677 #ifdef TARGET_NR_socket
9678     case TARGET_NR_socket:
9679         ret = do_socket(arg1, arg2, arg3);
9680         break;
9681 #endif
9682 #ifdef TARGET_NR_socketpair
9683     case TARGET_NR_socketpair:
9684         ret = do_socketpair(arg1, arg2, arg3, arg4);
9685         break;
9686 #endif
9687 #ifdef TARGET_NR_setsockopt
9688     case TARGET_NR_setsockopt:
9689         ret = do_setsockopt(arg1, arg2, arg3, arg4, (socklen_t) arg5);
9690         break;
9691 #endif
9692 #if defined(TARGET_NR_syslog)
9693     case TARGET_NR_syslog:
9694         {
9695             int len = arg2;
9696
9697             switch (arg1) {
9698             case TARGET_SYSLOG_ACTION_CLOSE:         /* Close log */
9699             case TARGET_SYSLOG_ACTION_OPEN:          /* Open log */
9700             case TARGET_SYSLOG_ACTION_CLEAR:         /* Clear ring buffer */
9701             case TARGET_SYSLOG_ACTION_CONSOLE_OFF:   /* Disable logging */
9702             case TARGET_SYSLOG_ACTION_CONSOLE_ON:    /* Enable logging */
9703             case TARGET_SYSLOG_ACTION_CONSOLE_LEVEL: /* Set messages level */
9704             case TARGET_SYSLOG_ACTION_SIZE_UNREAD:   /* Number of chars */
9705             case TARGET_SYSLOG_ACTION_SIZE_BUFFER:   /* Size of the buffer */
9706                 {
9707                     ret = get_errno(sys_syslog((int)arg1, NULL, (int)arg3));
9708                 }
9709                 break;
9710             case TARGET_SYSLOG_ACTION_READ:          /* Read from log */
9711             case TARGET_SYSLOG_ACTION_READ_CLEAR:    /* Read/clear msgs */
9712             case TARGET_SYSLOG_ACTION_READ_ALL:      /* Read last messages */
9713                 {
9714                     ret = -TARGET_EINVAL;
9715                     if (len < 0) {
9716                         goto fail;
9717                     }
9718                     ret = 0;
9719                     if (len == 0) {
9720                         break;
9721                     }
9722                     p = lock_user(VERIFY_WRITE, arg2, arg3, 0);
9723                     if (!p) {
9724                         ret = -TARGET_EFAULT;
9725                         goto fail;
9726                     }
9727                     ret = get_errno(sys_syslog((int)arg1, p, (int)arg3));
9728                     unlock_user(p, arg2, arg3);
9729                 }
9730                 break;
9731             default:
9732                 ret = -EINVAL;
9733                 break;
9734             }
9735         }
9736         break;
9737 #endif
9738     case TARGET_NR_setitimer:
9739         {
9740             struct itimerval value, ovalue, *pvalue;
9741
9742             if (arg2) {
9743                 pvalue = &value;
9744                 if (copy_from_user_timeval(&pvalue->it_interval, arg2)
9745                     || copy_from_user_timeval(&pvalue->it_value,
9746                                               arg2 + sizeof(struct target_timeval)))
9747                     goto efault;
9748             } else {
9749                 pvalue = NULL;
9750             }
9751             ret = get_errno(setitimer(arg1, pvalue, &ovalue));
9752             if (!is_error(ret) && arg3) {
9753                 if (copy_to_user_timeval(arg3,
9754                                          &ovalue.it_interval)
9755                     || copy_to_user_timeval(arg3 + sizeof(struct target_timeval),
9756                                             &ovalue.it_value))
9757                     goto efault;
9758             }
9759         }
9760         break;
9761     case TARGET_NR_getitimer:
9762         {
9763             struct itimerval value;
9764
9765             ret = get_errno(getitimer(arg1, &value));
9766             if (!is_error(ret) && arg2) {
9767                 if (copy_to_user_timeval(arg2,
9768                                          &value.it_interval)
9769                     || copy_to_user_timeval(arg2 + sizeof(struct target_timeval),
9770                                             &value.it_value))
9771                     goto efault;
9772             }
9773         }
9774         break;
9775 #ifdef TARGET_NR_stat
9776     case TARGET_NR_stat:
9777         if (!(p = lock_user_string(arg1)))
9778             goto efault;
9779         ret = get_errno(stat(path(p), &st));
9780         unlock_user(p, arg1, 0);
9781         goto do_stat;
9782 #endif
9783 #ifdef TARGET_NR_lstat
9784     case TARGET_NR_lstat:
9785         if (!(p = lock_user_string(arg1)))
9786             goto efault;
9787         ret = get_errno(lstat(path(p), &st));
9788         unlock_user(p, arg1, 0);
9789         goto do_stat;
9790 #endif
9791     case TARGET_NR_fstat:
9792         {
9793             ret = get_errno(fstat(arg1, &st));
9794 #if defined(TARGET_NR_stat) || defined(TARGET_NR_lstat)
9795         do_stat:
9796 #endif
9797             if (!is_error(ret)) {
9798                 struct target_stat *target_st;
9799
9800                 if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
9801                     goto efault;
9802                 memset(target_st, 0, sizeof(*target_st));
9803                 __put_user(st.st_dev, &target_st->st_dev);
9804                 __put_user(st.st_ino, &target_st->st_ino);
9805                 __put_user(st.st_mode, &target_st->st_mode);
9806                 __put_user(st.st_uid, &target_st->st_uid);
9807                 __put_user(st.st_gid, &target_st->st_gid);
9808                 __put_user(st.st_nlink, &target_st->st_nlink);
9809                 __put_user(st.st_rdev, &target_st->st_rdev);
9810                 __put_user(st.st_size, &target_st->st_size);
9811                 __put_user(st.st_blksize, &target_st->st_blksize);
9812                 __put_user(st.st_blocks, &target_st->st_blocks);
9813                 __put_user(st.st_atime, &target_st->target_st_atime);
9814                 __put_user(st.st_mtime, &target_st->target_st_mtime);
9815                 __put_user(st.st_ctime, &target_st->target_st_ctime);
9816                 unlock_user_struct(target_st, arg2, 1);
9817             }
9818         }
9819         break;
9820 #ifdef TARGET_NR_olduname
9821     case TARGET_NR_olduname:
9822         goto unimplemented;
9823 #endif
9824 #ifdef TARGET_NR_iopl
9825     case TARGET_NR_iopl:
9826         goto unimplemented;
9827 #endif
9828     case TARGET_NR_vhangup:
9829         ret = get_errno(vhangup());
9830         break;
9831 #ifdef TARGET_NR_idle
9832     case TARGET_NR_idle:
9833         goto unimplemented;
9834 #endif
9835 #ifdef TARGET_NR_syscall
9836     case TARGET_NR_syscall:
9837         ret = do_syscall(cpu_env, arg1 & 0xffff, arg2, arg3, arg4, arg5,
9838                          arg6, arg7, arg8, 0);
9839         break;
9840 #endif
9841     case TARGET_NR_wait4:
9842         {
9843             int status;
9844             abi_long status_ptr = arg2;
9845             struct rusage rusage, *rusage_ptr;
9846             abi_ulong target_rusage = arg4;
9847             abi_long rusage_err;
9848             if (target_rusage)
9849                 rusage_ptr = &rusage;
9850             else
9851                 rusage_ptr = NULL;
9852             ret = get_errno(safe_wait4(arg1, &status, arg3, rusage_ptr));
9853             if (!is_error(ret)) {
9854                 if (status_ptr && ret) {
9855                     status = host_to_target_waitstatus(status);
9856                     if (put_user_s32(status, status_ptr))
9857                         goto efault;
9858                 }
9859                 if (target_rusage) {
9860                     rusage_err = host_to_target_rusage(target_rusage, &rusage);
9861                     if (rusage_err) {
9862                         ret = rusage_err;
9863                     }
9864                 }
9865             }
9866         }
9867         break;
9868 #ifdef TARGET_NR_swapoff
9869     case TARGET_NR_swapoff:
9870         if (!(p = lock_user_string(arg1)))
9871             goto efault;
9872         ret = get_errno(swapoff(p));
9873         unlock_user(p, arg1, 0);
9874         break;
9875 #endif
9876     case TARGET_NR_sysinfo:
9877         {
9878             struct target_sysinfo *target_value;
9879             struct sysinfo value;
9880             ret = get_errno(sysinfo(&value));
9881             if (!is_error(ret) && arg1)
9882             {
9883                 if (!lock_user_struct(VERIFY_WRITE, target_value, arg1, 0))
9884                     goto efault;
9885                 __put_user(value.uptime, &target_value->uptime);
9886                 __put_user(value.loads[0], &target_value->loads[0]);
9887                 __put_user(value.loads[1], &target_value->loads[1]);
9888                 __put_user(value.loads[2], &target_value->loads[2]);
9889                 __put_user(value.totalram, &target_value->totalram);
9890                 __put_user(value.freeram, &target_value->freeram);
9891                 __put_user(value.sharedram, &target_value->sharedram);
9892                 __put_user(value.bufferram, &target_value->bufferram);
9893                 __put_user(value.totalswap, &target_value->totalswap);
9894                 __put_user(value.freeswap, &target_value->freeswap);
9895                 __put_user(value.procs, &target_value->procs);
9896                 __put_user(value.totalhigh, &target_value->totalhigh);
9897                 __put_user(value.freehigh, &target_value->freehigh);
9898                 __put_user(value.mem_unit, &target_value->mem_unit);
9899                 unlock_user_struct(target_value, arg1, 1);
9900             }
9901         }
9902         break;
9903 #ifdef TARGET_NR_ipc
9904     case TARGET_NR_ipc:
9905         ret = do_ipc(cpu_env, arg1, arg2, arg3, arg4, arg5, arg6);
9906         break;
9907 #endif
9908 #ifdef TARGET_NR_semget
9909     case TARGET_NR_semget:
9910         ret = get_errno(semget(arg1, arg2, arg3));
9911         break;
9912 #endif
9913 #ifdef TARGET_NR_semop
9914     case TARGET_NR_semop:
9915         ret = do_semop(arg1, arg2, arg3);
9916         break;
9917 #endif
9918 #ifdef TARGET_NR_semctl
9919     case TARGET_NR_semctl:
9920         ret = do_semctl(arg1, arg2, arg3, arg4);
9921         break;
9922 #endif
9923 #ifdef TARGET_NR_msgctl
9924     case TARGET_NR_msgctl:
9925         ret = do_msgctl(arg1, arg2, arg3);
9926         break;
9927 #endif
9928 #ifdef TARGET_NR_msgget
9929     case TARGET_NR_msgget:
9930         ret = get_errno(msgget(arg1, arg2));
9931         break;
9932 #endif
9933 #ifdef TARGET_NR_msgrcv
9934     case TARGET_NR_msgrcv:
9935         ret = do_msgrcv(arg1, arg2, arg3, arg4, arg5);
9936         break;
9937 #endif
9938 #ifdef TARGET_NR_msgsnd
9939     case TARGET_NR_msgsnd:
9940         ret = do_msgsnd(arg1, arg2, arg3, arg4);
9941         break;
9942 #endif
9943 #ifdef TARGET_NR_shmget
9944     case TARGET_NR_shmget:
9945         ret = get_errno(shmget(arg1, arg2, arg3));
9946         break;
9947 #endif
9948 #ifdef TARGET_NR_shmctl
9949     case TARGET_NR_shmctl:
9950         ret = do_shmctl(arg1, arg2, arg3);
9951         break;
9952 #endif
9953 #ifdef TARGET_NR_shmat
9954     case TARGET_NR_shmat:
9955         ret = do_shmat(cpu_env, arg1, arg2, arg3);
9956         break;
9957 #endif
9958 #ifdef TARGET_NR_shmdt
9959     case TARGET_NR_shmdt:
9960         ret = do_shmdt(arg1);
9961         break;
9962 #endif
9963     case TARGET_NR_fsync:
9964         ret = get_errno(fsync(arg1));
9965         break;
9966     case TARGET_NR_clone:
9967         /* Linux manages to have three different orderings for its
9968          * arguments to clone(); the BACKWARDS and BACKWARDS2 defines
9969          * match the kernel's CONFIG_CLONE_* settings.
9970          * Microblaze is further special in that it uses a sixth
9971          * implicit argument to clone for the TLS pointer.
9972          */
9973 #if defined(TARGET_MICROBLAZE)
9974         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg4, arg6, arg5));
9975 #elif defined(TARGET_CLONE_BACKWARDS)
9976         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg4, arg5));
9977 #elif defined(TARGET_CLONE_BACKWARDS2)
9978         ret = get_errno(do_fork(cpu_env, arg2, arg1, arg3, arg5, arg4));
9979 #else
9980         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg5, arg4));
9981 #endif
9982         break;
9983 #ifdef __NR_exit_group
9984         /* new thread calls */
9985     case TARGET_NR_exit_group:
9986 #ifdef TARGET_GPROF
9987         _mcleanup();
9988 #endif
9989         gdb_exit(cpu_env, arg1);
9990         ret = get_errno(exit_group(arg1));
9991         break;
9992 #endif
9993     case TARGET_NR_setdomainname:
9994         if (!(p = lock_user_string(arg1)))
9995             goto efault;
9996         ret = get_errno(setdomainname(p, arg2));
9997         unlock_user(p, arg1, 0);
9998         break;
9999     case TARGET_NR_uname:
10000         /* no need to transcode because we use the linux syscall */
10001         {
10002             struct new_utsname * buf;
10003
10004             if (!lock_user_struct(VERIFY_WRITE, buf, arg1, 0))
10005                 goto efault;
10006             ret = get_errno(sys_uname(buf));
10007             if (!is_error(ret)) {
10008                 /* Overwrite the native machine name with whatever is being
10009                    emulated. */
10010                 strcpy (buf->machine, cpu_to_uname_machine(cpu_env));
10011                 /* Allow the user to override the reported release.  */
10012                 if (qemu_uname_release && *qemu_uname_release) {
10013                     g_strlcpy(buf->release, qemu_uname_release,
10014                               sizeof(buf->release));
10015                 }
10016             }
10017             unlock_user_struct(buf, arg1, 1);
10018         }
10019         break;
10020 #ifdef TARGET_I386
10021     case TARGET_NR_modify_ldt:
10022         ret = do_modify_ldt(cpu_env, arg1, arg2, arg3);
10023         break;
10024 #if !defined(TARGET_X86_64)
10025     case TARGET_NR_vm86old:
10026         goto unimplemented;
10027     case TARGET_NR_vm86:
10028         ret = do_vm86(cpu_env, arg1, arg2);
10029         break;
10030 #endif
10031 #endif
10032     case TARGET_NR_adjtimex:
10033         {
10034             struct timex host_buf;
10035
10036             if (target_to_host_timex(&host_buf, arg1) != 0) {
10037                 goto efault;
10038             }
10039             ret = get_errno(adjtimex(&host_buf));
10040             if (!is_error(ret)) {
10041                 if (host_to_target_timex(arg1, &host_buf) != 0) {
10042                     goto efault;
10043                 }
10044             }
10045         }
10046         break;
10047 #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
10048     case TARGET_NR_clock_adjtime:
10049         {
10050             struct timex htx, *phtx = &htx;
10051
10052             if (target_to_host_timex(phtx, arg2) != 0) {
10053                 goto efault;
10054             }
10055             ret = get_errno(clock_adjtime(arg1, phtx));
10056             if (!is_error(ret) && phtx) {
10057                 if (host_to_target_timex(arg2, phtx) != 0) {
10058                     goto efault;
10059                 }
10060             }
10061         }
10062         break;
10063 #endif
10064 #ifdef TARGET_NR_create_module
10065     case TARGET_NR_create_module:
10066 #endif
10067     case TARGET_NR_init_module:
10068     case TARGET_NR_delete_module:
10069 #ifdef TARGET_NR_get_kernel_syms
10070     case TARGET_NR_get_kernel_syms:
10071 #endif
10072         goto unimplemented;
10073     case TARGET_NR_quotactl:
10074         goto unimplemented;
10075     case TARGET_NR_getpgid:
10076         ret = get_errno(getpgid(arg1));
10077         break;
10078     case TARGET_NR_fchdir:
10079         ret = get_errno(fchdir(arg1));
10080         break;
10081 #ifdef TARGET_NR_bdflush /* not on x86_64 */
10082     case TARGET_NR_bdflush:
10083         goto unimplemented;
10084 #endif
10085 #ifdef TARGET_NR_sysfs
10086     case TARGET_NR_sysfs:
10087         goto unimplemented;
10088 #endif
10089     case TARGET_NR_personality:
10090         ret = get_errno(personality(arg1));
10091         break;
10092 #ifdef TARGET_NR_afs_syscall
10093     case TARGET_NR_afs_syscall:
10094         goto unimplemented;
10095 #endif
10096 #ifdef TARGET_NR__llseek /* Not on alpha */
10097     case TARGET_NR__llseek:
10098         {
10099             int64_t res;
10100 #if !defined(__NR_llseek)
10101             res = lseek(arg1, ((uint64_t)arg2 << 32) | (abi_ulong)arg3, arg5);
10102             if (res == -1) {
10103                 ret = get_errno(res);
10104             } else {
10105                 ret = 0;
10106             }
10107 #else
10108             ret = get_errno(_llseek(arg1, arg2, arg3, &res, arg5));
10109 #endif
10110             if ((ret == 0) && put_user_s64(res, arg4)) {
10111                 goto efault;
10112             }
10113         }
10114         break;
10115 #endif
10116 #ifdef TARGET_NR_getdents
10117     case TARGET_NR_getdents:
10118 #ifdef __NR_getdents
10119 #if TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64
10120         {
10121             struct target_dirent *target_dirp;
10122             struct linux_dirent *dirp;
10123             abi_long count = arg3;
10124
10125             dirp = g_try_malloc(count);
10126             if (!dirp) {
10127                 ret = -TARGET_ENOMEM;
10128                 goto fail;
10129             }
10130
10131             ret = get_errno(sys_getdents(arg1, dirp, count));
10132             if (!is_error(ret)) {
10133                 struct linux_dirent *de;
10134                 struct target_dirent *tde;
10135                 int len = ret;
10136                 int reclen, treclen;
10137                 int count1, tnamelen;
10138
10139                 count1 = 0;
10140                 de = dirp;
10141                 if (!(target_dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
10142                     goto efault;
10143                 tde = target_dirp;
10144                 while (len > 0) {
10145                     reclen = de->d_reclen;
10146                     tnamelen = reclen - offsetof(struct linux_dirent, d_name);
10147                     assert(tnamelen >= 0);
10148                     treclen = tnamelen + offsetof(struct target_dirent, d_name);
10149                     assert(count1 + treclen <= count);
10150                     tde->d_reclen = tswap16(treclen);
10151                     tde->d_ino = tswapal(de->d_ino);
10152                     tde->d_off = tswapal(de->d_off);
10153                     memcpy(tde->d_name, de->d_name, tnamelen);
10154                     de = (struct linux_dirent *)((char *)de + reclen);
10155                     len -= reclen;
10156                     tde = (struct target_dirent *)((char *)tde + treclen);
10157                     count1 += treclen;
10158                 }
10159                 ret = count1;
10160                 unlock_user(target_dirp, arg2, ret);
10161             }
10162             g_free(dirp);
10163         }
10164 #else
10165         {
10166             struct linux_dirent *dirp;
10167             abi_long count = arg3;
10168
10169             if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
10170                 goto efault;
10171             ret = get_errno(sys_getdents(arg1, dirp, count));
10172             if (!is_error(ret)) {
10173                 struct linux_dirent *de;
10174                 int len = ret;
10175                 int reclen;
10176                 de = dirp;
10177                 while (len > 0) {
10178                     reclen = de->d_reclen;
10179                     if (reclen > len)
10180                         break;
10181                     de->d_reclen = tswap16(reclen);
10182                     tswapls(&de->d_ino);
10183                     tswapls(&de->d_off);
10184                     de = (struct linux_dirent *)((char *)de + reclen);
10185                     len -= reclen;
10186                 }
10187             }
10188             unlock_user(dirp, arg2, ret);
10189         }
10190 #endif
10191 #else
10192         /* Implement getdents in terms of getdents64 */
10193         {
10194             struct linux_dirent64 *dirp;
10195             abi_long count = arg3;
10196
10197             dirp = lock_user(VERIFY_WRITE, arg2, count, 0);
10198             if (!dirp) {
10199                 goto efault;
10200             }
10201             ret = get_errno(sys_getdents64(arg1, dirp, count));
10202             if (!is_error(ret)) {
10203                 /* Convert the dirent64 structs to target dirent.  We do this
10204                  * in-place, since we can guarantee that a target_dirent is no
10205                  * larger than a dirent64; however this means we have to be
10206                  * careful to read everything before writing in the new format.
10207                  */
10208                 struct linux_dirent64 *de;
10209                 struct target_dirent *tde;
10210                 int len = ret;
10211                 int tlen = 0;
10212
10213                 de = dirp;
10214                 tde = (struct target_dirent *)dirp;
10215                 while (len > 0) {
10216                     int namelen, treclen;
10217                     int reclen = de->d_reclen;
10218                     uint64_t ino = de->d_ino;
10219                     int64_t off = de->d_off;
10220                     uint8_t type = de->d_type;
10221
10222                     namelen = strlen(de->d_name);
10223                     treclen = offsetof(struct target_dirent, d_name)
10224                         + namelen + 2;
10225                     treclen = QEMU_ALIGN_UP(treclen, sizeof(abi_long));
10226
10227                     memmove(tde->d_name, de->d_name, namelen + 1);
10228                     tde->d_ino = tswapal(ino);
10229                     tde->d_off = tswapal(off);
10230                     tde->d_reclen = tswap16(treclen);
10231                     /* The target_dirent type is in what was formerly a padding
10232                      * byte at the end of the structure:
10233                      */
10234                     *(((char *)tde) + treclen - 1) = type;
10235
10236                     de = (struct linux_dirent64 *)((char *)de + reclen);
10237                     tde = (struct target_dirent *)((char *)tde + treclen);
10238                     len -= reclen;
10239                     tlen += treclen;
10240                 }
10241                 ret = tlen;
10242             }
10243             unlock_user(dirp, arg2, ret);
10244         }
10245 #endif
10246         break;
10247 #endif /* TARGET_NR_getdents */
10248 #if defined(TARGET_NR_getdents64) && defined(__NR_getdents64)
10249     case TARGET_NR_getdents64:
10250         {
10251             struct linux_dirent64 *dirp;
10252             abi_long count = arg3;
10253             if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
10254                 goto efault;
10255             ret = get_errno(sys_getdents64(arg1, dirp, count));
10256             if (!is_error(ret)) {
10257                 struct linux_dirent64 *de;
10258                 int len = ret;
10259                 int reclen;
10260                 de = dirp;
10261                 while (len > 0) {
10262                     reclen = de->d_reclen;
10263                     if (reclen > len)
10264                         break;
10265                     de->d_reclen = tswap16(reclen);
10266                     tswap64s((uint64_t *)&de->d_ino);
10267                     tswap64s((uint64_t *)&de->d_off);
10268                     de = (struct linux_dirent64 *)((char *)de + reclen);
10269                     len -= reclen;
10270                 }
10271             }
10272             unlock_user(dirp, arg2, ret);
10273         }
10274         break;
10275 #endif /* TARGET_NR_getdents64 */
10276 #if defined(TARGET_NR__newselect)
10277     case TARGET_NR__newselect:
10278         ret = do_select(arg1, arg2, arg3, arg4, arg5);
10279         break;
10280 #endif
10281 #if defined(TARGET_NR_poll) || defined(TARGET_NR_ppoll)
10282 # ifdef TARGET_NR_poll
10283     case TARGET_NR_poll:
10284 # endif
10285 # ifdef TARGET_NR_ppoll
10286     case TARGET_NR_ppoll:
10287 # endif
10288         {
10289             struct target_pollfd *target_pfd;
10290             unsigned int nfds = arg2;
10291             struct pollfd *pfd;
10292             unsigned int i;
10293
10294             pfd = NULL;
10295             target_pfd = NULL;
10296             if (nfds) {
10297                 if (nfds > (INT_MAX / sizeof(struct target_pollfd))) {
10298                     ret = -TARGET_EINVAL;
10299                     break;
10300                 }
10301
10302                 target_pfd = lock_user(VERIFY_WRITE, arg1,
10303                                        sizeof(struct target_pollfd) * nfds, 1);
10304                 if (!target_pfd) {
10305                     goto efault;
10306                 }
10307
10308                 pfd = alloca(sizeof(struct pollfd) * nfds);
10309                 for (i = 0; i < nfds; i++) {
10310                     pfd[i].fd = tswap32(target_pfd[i].fd);
10311                     pfd[i].events = tswap16(target_pfd[i].events);
10312                 }
10313             }
10314
10315             switch (num) {
10316 # ifdef TARGET_NR_ppoll
10317             case TARGET_NR_ppoll:
10318             {
10319                 struct timespec _timeout_ts, *timeout_ts = &_timeout_ts;
10320                 target_sigset_t *target_set;
10321                 sigset_t _set, *set = &_set;
10322
10323                 if (arg3) {
10324                     if (target_to_host_timespec(timeout_ts, arg3)) {
10325                         unlock_user(target_pfd, arg1, 0);
10326                         goto efault;
10327                     }
10328                 } else {
10329                     timeout_ts = NULL;
10330                 }
10331
10332                 if (arg4) {
10333                     if (arg5 != sizeof(target_sigset_t)) {
10334                         unlock_user(target_pfd, arg1, 0);
10335                         ret = -TARGET_EINVAL;
10336                         break;
10337                     }
10338
10339                     target_set = lock_user(VERIFY_READ, arg4, sizeof(target_sigset_t), 1);
10340                     if (!target_set) {
10341                         unlock_user(target_pfd, arg1, 0);
10342                         goto efault;
10343                     }
10344                     target_to_host_sigset(set, target_set);
10345                 } else {
10346                     set = NULL;
10347                 }
10348
10349                 ret = get_errno(safe_ppoll(pfd, nfds, timeout_ts,
10350                                            set, SIGSET_T_SIZE));
10351
10352                 if (!is_error(ret) && arg3) {
10353                     host_to_target_timespec(arg3, timeout_ts);
10354                 }
10355                 if (arg4) {
10356                     unlock_user(target_set, arg4, 0);
10357                 }
10358                 break;
10359             }
10360 # endif
10361 # ifdef TARGET_NR_poll
10362             case TARGET_NR_poll:
10363             {
10364                 struct timespec ts, *pts;
10365
10366                 if (arg3 >= 0) {
10367                     /* Convert ms to secs, ns */
10368                     ts.tv_sec = arg3 / 1000;
10369                     ts.tv_nsec = (arg3 % 1000) * 1000000LL;
10370                     pts = &ts;
10371                 } else {
10372                     /* -ve poll() timeout means "infinite" */
10373                     pts = NULL;
10374                 }
10375                 ret = get_errno(safe_ppoll(pfd, nfds, pts, NULL, 0));
10376                 break;
10377             }
10378 # endif
10379             default:
10380                 g_assert_not_reached();
10381             }
10382
10383             if (!is_error(ret)) {
10384                 for(i = 0; i < nfds; i++) {
10385                     target_pfd[i].revents = tswap16(pfd[i].revents);
10386                 }
10387             }
10388             unlock_user(target_pfd, arg1, sizeof(struct target_pollfd) * nfds);
10389         }
10390         break;
10391 #endif
10392     case TARGET_NR_flock:
10393         /* NOTE: the flock constant seems to be the same for every
10394            Linux platform */
10395         ret = get_errno(safe_flock(arg1, arg2));
10396         break;
10397     case TARGET_NR_readv:
10398         {
10399             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
10400             if (vec != NULL) {
10401                 ret = get_errno(safe_readv(arg1, vec, arg3));
10402                 unlock_iovec(vec, arg2, arg3, 1);
10403             } else {
10404                 ret = -host_to_target_errno(errno);
10405             }
10406         }
10407         break;
10408     case TARGET_NR_writev:
10409         {
10410             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
10411             if (vec != NULL) {
10412                 ret = get_errno(safe_writev(arg1, vec, arg3));
10413                 unlock_iovec(vec, arg2, arg3, 0);
10414             } else {
10415                 ret = -host_to_target_errno(errno);
10416             }
10417         }
10418         break;
10419 #if defined(TARGET_NR_preadv)
10420     case TARGET_NR_preadv:
10421         {
10422             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
10423             if (vec != NULL) {
10424                 ret = get_errno(safe_preadv(arg1, vec, arg3, arg4, arg5));
10425                 unlock_iovec(vec, arg2, arg3, 1);
10426             } else {
10427                 ret = -host_to_target_errno(errno);
10428            }
10429         }
10430         break;
10431 #endif
10432 #if defined(TARGET_NR_pwritev)
10433     case TARGET_NR_pwritev:
10434         {
10435             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
10436             if (vec != NULL) {
10437                 ret = get_errno(safe_pwritev(arg1, vec, arg3, arg4, arg5));
10438                 unlock_iovec(vec, arg2, arg3, 0);
10439             } else {
10440                 ret = -host_to_target_errno(errno);
10441            }
10442         }
10443         break;
10444 #endif
10445     case TARGET_NR_getsid:
10446         ret = get_errno(getsid(arg1));
10447         break;
10448 #if defined(TARGET_NR_fdatasync) /* Not on alpha (osf_datasync ?) */
10449     case TARGET_NR_fdatasync:
10450         ret = get_errno(fdatasync(arg1));
10451         break;
10452 #endif
10453 #ifdef TARGET_NR__sysctl
10454     case TARGET_NR__sysctl:
10455         /* We don't implement this, but ENOTDIR is always a safe
10456            return value. */
10457         ret = -TARGET_ENOTDIR;
10458         break;
10459 #endif
10460     case TARGET_NR_sched_getaffinity:
10461         {
10462             unsigned int mask_size;
10463             unsigned long *mask;
10464
10465             /*
10466              * sched_getaffinity needs multiples of ulong, so need to take
10467              * care of mismatches between target ulong and host ulong sizes.
10468              */
10469             if (arg2 & (sizeof(abi_ulong) - 1)) {
10470                 ret = -TARGET_EINVAL;
10471                 break;
10472             }
10473             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
10474
10475             mask = alloca(mask_size);
10476             memset(mask, 0, mask_size);
10477             ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask));
10478
10479             if (!is_error(ret)) {
10480                 if (ret > arg2) {
10481                     /* More data returned than the caller's buffer will fit.
10482                      * This only happens if sizeof(abi_long) < sizeof(long)
10483                      * and the caller passed us a buffer holding an odd number
10484                      * of abi_longs. If the host kernel is actually using the
10485                      * extra 4 bytes then fail EINVAL; otherwise we can just
10486                      * ignore them and only copy the interesting part.
10487                      */
10488                     int numcpus = sysconf(_SC_NPROCESSORS_CONF);
10489                     if (numcpus > arg2 * 8) {
10490                         ret = -TARGET_EINVAL;
10491                         break;
10492                     }
10493                     ret = arg2;
10494                 }
10495
10496                 ret = host_to_target_cpu_mask(mask, mask_size, arg3, arg2);
10497             }
10498         }
10499         break;
10500     case TARGET_NR_sched_setaffinity:
10501         {
10502             unsigned int mask_size;
10503             unsigned long *mask;
10504
10505             /*
10506              * sched_setaffinity needs multiples of ulong, so need to take
10507              * care of mismatches between target ulong and host ulong sizes.
10508              */
10509             if (arg2 & (sizeof(abi_ulong) - 1)) {
10510                 ret = -TARGET_EINVAL;
10511                 break;
10512             }
10513             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
10514             mask = alloca(mask_size);
10515
10516             ret = target_to_host_cpu_mask(mask, mask_size, arg3, arg2);
10517             if (ret) {
10518                 break;
10519             }
10520
10521             ret = get_errno(sys_sched_setaffinity(arg1, mask_size, mask));
10522         }
10523         break;
10524     case TARGET_NR_getcpu:
10525         {
10526             unsigned cpu, node;
10527             ret = get_errno(sys_getcpu(arg1 ? &cpu : NULL,
10528                                        arg2 ? &node : NULL,
10529                                        NULL));
10530             if (is_error(ret)) {
10531                 goto fail;
10532             }
10533             if (arg1 && put_user_u32(cpu, arg1)) {
10534                 goto efault;
10535             }
10536             if (arg2 && put_user_u32(node, arg2)) {
10537                 goto efault;
10538             }
10539         }
10540         break;
10541     case TARGET_NR_sched_setparam:
10542         {
10543             struct sched_param *target_schp;
10544             struct sched_param schp;
10545
10546             if (arg2 == 0) {
10547                 return -TARGET_EINVAL;
10548             }
10549             if (!lock_user_struct(VERIFY_READ, target_schp, arg2, 1))
10550                 goto efault;
10551             schp.sched_priority = tswap32(target_schp->sched_priority);
10552             unlock_user_struct(target_schp, arg2, 0);
10553             ret = get_errno(sched_setparam(arg1, &schp));
10554         }
10555         break;
10556     case TARGET_NR_sched_getparam:
10557         {
10558             struct sched_param *target_schp;
10559             struct sched_param schp;
10560
10561             if (arg2 == 0) {
10562                 return -TARGET_EINVAL;
10563             }
10564             ret = get_errno(sched_getparam(arg1, &schp));
10565             if (!is_error(ret)) {
10566                 if (!lock_user_struct(VERIFY_WRITE, target_schp, arg2, 0))
10567                     goto efault;
10568                 target_schp->sched_priority = tswap32(schp.sched_priority);
10569                 unlock_user_struct(target_schp, arg2, 1);
10570             }
10571         }
10572         break;
10573     case TARGET_NR_sched_setscheduler:
10574         {
10575             struct sched_param *target_schp;
10576             struct sched_param schp;
10577             if (arg3 == 0) {
10578                 return -TARGET_EINVAL;
10579             }
10580             if (!lock_user_struct(VERIFY_READ, target_schp, arg3, 1))
10581                 goto efault;
10582             schp.sched_priority = tswap32(target_schp->sched_priority);
10583             unlock_user_struct(target_schp, arg3, 0);
10584             ret = get_errno(sched_setscheduler(arg1, arg2, &schp));
10585         }
10586         break;
10587     case TARGET_NR_sched_getscheduler:
10588         ret = get_errno(sched_getscheduler(arg1));
10589         break;
10590     case TARGET_NR_sched_yield:
10591         ret = get_errno(sched_yield());
10592         break;
10593     case TARGET_NR_sched_get_priority_max:
10594         ret = get_errno(sched_get_priority_max(arg1));
10595         break;
10596     case TARGET_NR_sched_get_priority_min:
10597         ret = get_errno(sched_get_priority_min(arg1));
10598         break;
10599     case TARGET_NR_sched_rr_get_interval:
10600         {
10601             struct timespec ts;
10602             ret = get_errno(sched_rr_get_interval(arg1, &ts));
10603             if (!is_error(ret)) {
10604                 ret = host_to_target_timespec(arg2, &ts);
10605             }
10606         }
10607         break;
10608     case TARGET_NR_nanosleep:
10609         {
10610             struct timespec req, rem;
10611             target_to_host_timespec(&req, arg1);
10612             ret = get_errno(safe_nanosleep(&req, &rem));
10613             if (is_error(ret) && arg2) {
10614                 host_to_target_timespec(arg2, &rem);
10615             }
10616         }
10617         break;
10618 #ifdef TARGET_NR_query_module
10619     case TARGET_NR_query_module:
10620         goto unimplemented;
10621 #endif
10622 #ifdef TARGET_NR_nfsservctl
10623     case TARGET_NR_nfsservctl:
10624         goto unimplemented;
10625 #endif
10626     case TARGET_NR_prctl:
10627         switch (arg1) {
10628         case PR_GET_PDEATHSIG:
10629         {
10630             int deathsig;
10631             ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
10632             if (!is_error(ret) && arg2
10633                 && put_user_ual(deathsig, arg2)) {
10634                 goto efault;
10635             }
10636             break;
10637         }
10638 #ifdef PR_GET_NAME
10639         case PR_GET_NAME:
10640         {
10641             void *name = lock_user(VERIFY_WRITE, arg2, 16, 1);
10642             if (!name) {
10643                 goto efault;
10644             }
10645             ret = get_errno(prctl(arg1, (unsigned long)name,
10646                                   arg3, arg4, arg5));
10647             unlock_user(name, arg2, 16);
10648             break;
10649         }
10650         case PR_SET_NAME:
10651         {
10652             void *name = lock_user(VERIFY_READ, arg2, 16, 1);
10653             if (!name) {
10654                 goto efault;
10655             }
10656             ret = get_errno(prctl(arg1, (unsigned long)name,
10657                                   arg3, arg4, arg5));
10658             unlock_user(name, arg2, 0);
10659             break;
10660         }
10661 #endif
10662         case PR_GET_SECCOMP:
10663         case PR_SET_SECCOMP:
10664             /* Disable seccomp to prevent the target disabling syscalls we
10665              * need. */
10666             ret = -TARGET_EINVAL;
10667             break;
10668         default:
10669             /* Most prctl options have no pointer arguments */
10670             ret = get_errno(prctl(arg1, arg2, arg3, arg4, arg5));
10671             break;
10672         }
10673         break;
10674 #ifdef TARGET_NR_arch_prctl
10675     case TARGET_NR_arch_prctl:
10676 #if defined(TARGET_I386) && !defined(TARGET_ABI32)
10677         ret = do_arch_prctl(cpu_env, arg1, arg2);
10678         break;
10679 #else
10680         goto unimplemented;
10681 #endif
10682 #endif
10683 #ifdef TARGET_NR_pread64
10684     case TARGET_NR_pread64:
10685         if (regpairs_aligned(cpu_env, num)) {
10686             arg4 = arg5;
10687             arg5 = arg6;
10688         }
10689         if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
10690             goto efault;
10691         ret = get_errno(pread64(arg1, p, arg3, target_offset64(arg4, arg5)));
10692         unlock_user(p, arg2, ret);
10693         break;
10694     case TARGET_NR_pwrite64:
10695         if (regpairs_aligned(cpu_env, num)) {
10696             arg4 = arg5;
10697             arg5 = arg6;
10698         }
10699         if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
10700             goto efault;
10701         ret = get_errno(pwrite64(arg1, p, arg3, target_offset64(arg4, arg5)));
10702         unlock_user(p, arg2, 0);
10703         break;
10704 #endif
10705     case TARGET_NR_getcwd:
10706         if (!(p = lock_user(VERIFY_WRITE, arg1, arg2, 0)))
10707             goto efault;
10708         ret = get_errno(sys_getcwd1(p, arg2));
10709         unlock_user(p, arg1, ret);
10710         break;
10711     case TARGET_NR_capget:
10712     case TARGET_NR_capset:
10713     {
10714         struct target_user_cap_header *target_header;
10715         struct target_user_cap_data *target_data = NULL;
10716         struct __user_cap_header_struct header;
10717         struct __user_cap_data_struct data[2];
10718         struct __user_cap_data_struct *dataptr = NULL;
10719         int i, target_datalen;
10720         int data_items = 1;
10721
10722         if (!lock_user_struct(VERIFY_WRITE, target_header, arg1, 1)) {
10723             goto efault;
10724         }
10725         header.version = tswap32(target_header->version);
10726         header.pid = tswap32(target_header->pid);
10727
10728         if (header.version != _LINUX_CAPABILITY_VERSION) {
10729             /* Version 2 and up takes pointer to two user_data structs */
10730             data_items = 2;
10731         }
10732
10733         target_datalen = sizeof(*target_data) * data_items;
10734
10735         if (arg2) {
10736             if (num == TARGET_NR_capget) {
10737                 target_data = lock_user(VERIFY_WRITE, arg2, target_datalen, 0);
10738             } else {
10739                 target_data = lock_user(VERIFY_READ, arg2, target_datalen, 1);
10740             }
10741             if (!target_data) {
10742                 unlock_user_struct(target_header, arg1, 0);
10743                 goto efault;
10744             }
10745
10746             if (num == TARGET_NR_capset) {
10747                 for (i = 0; i < data_items; i++) {
10748                     data[i].effective = tswap32(target_data[i].effective);
10749                     data[i].permitted = tswap32(target_data[i].permitted);
10750                     data[i].inheritable = tswap32(target_data[i].inheritable);
10751                 }
10752             }
10753
10754             dataptr = data;
10755         }
10756
10757         if (num == TARGET_NR_capget) {
10758             ret = get_errno(capget(&header, dataptr));
10759         } else {
10760             ret = get_errno(capset(&header, dataptr));
10761         }
10762
10763         /* The kernel always updates version for both capget and capset */
10764         target_header->version = tswap32(header.version);
10765         unlock_user_struct(target_header, arg1, 1);
10766
10767         if (arg2) {
10768             if (num == TARGET_NR_capget) {
10769                 for (i = 0; i < data_items; i++) {
10770                     target_data[i].effective = tswap32(data[i].effective);
10771                     target_data[i].permitted = tswap32(data[i].permitted);
10772                     target_data[i].inheritable = tswap32(data[i].inheritable);
10773                 }
10774                 unlock_user(target_data, arg2, target_datalen);
10775             } else {
10776                 unlock_user(target_data, arg2, 0);
10777             }
10778         }
10779         break;
10780     }
10781     case TARGET_NR_sigaltstack:
10782         ret = do_sigaltstack(arg1, arg2, get_sp_from_cpustate((CPUArchState *)cpu_env));
10783         break;
10784
10785 #ifdef CONFIG_SENDFILE
10786     case TARGET_NR_sendfile:
10787     {
10788         off_t *offp = NULL;
10789         off_t off;
10790         if (arg3) {
10791             ret = get_user_sal(off, arg3);
10792             if (is_error(ret)) {
10793                 break;
10794             }
10795             offp = &off;
10796         }
10797         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
10798         if (!is_error(ret) && arg3) {
10799             abi_long ret2 = put_user_sal(off, arg3);
10800             if (is_error(ret2)) {
10801                 ret = ret2;
10802             }
10803         }
10804         break;
10805     }
10806 #ifdef TARGET_NR_sendfile64
10807     case TARGET_NR_sendfile64:
10808     {
10809         off_t *offp = NULL;
10810         off_t off;
10811         if (arg3) {
10812             ret = get_user_s64(off, arg3);
10813             if (is_error(ret)) {
10814                 break;
10815             }
10816             offp = &off;
10817         }
10818         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
10819         if (!is_error(ret) && arg3) {
10820             abi_long ret2 = put_user_s64(off, arg3);
10821             if (is_error(ret2)) {
10822                 ret = ret2;
10823             }
10824         }
10825         break;
10826     }
10827 #endif
10828 #else
10829     case TARGET_NR_sendfile:
10830 #ifdef TARGET_NR_sendfile64
10831     case TARGET_NR_sendfile64:
10832 #endif
10833         goto unimplemented;
10834 #endif
10835
10836 #ifdef TARGET_NR_getpmsg
10837     case TARGET_NR_getpmsg:
10838         goto unimplemented;
10839 #endif
10840 #ifdef TARGET_NR_putpmsg
10841     case TARGET_NR_putpmsg:
10842         goto unimplemented;
10843 #endif
10844 #ifdef TARGET_NR_vfork
10845     case TARGET_NR_vfork:
10846         ret = get_errno(do_fork(cpu_env,
10847                         CLONE_VFORK | CLONE_VM | TARGET_SIGCHLD,
10848                         0, 0, 0, 0));
10849         break;
10850 #endif
10851 #ifdef TARGET_NR_ugetrlimit
10852     case TARGET_NR_ugetrlimit:
10853     {
10854         struct rlimit rlim;
10855         int resource = target_to_host_resource(arg1);
10856         ret = get_errno(getrlimit(resource, &rlim));
10857         if (!is_error(ret)) {
10858             struct target_rlimit *target_rlim;
10859             if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
10860                 goto efault;
10861             target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
10862             target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
10863             unlock_user_struct(target_rlim, arg2, 1);
10864         }
10865         break;
10866     }
10867 #endif
10868 #ifdef TARGET_NR_truncate64
10869     case TARGET_NR_truncate64:
10870         if (!(p = lock_user_string(arg1)))
10871             goto efault;
10872         ret = target_truncate64(cpu_env, p, arg2, arg3, arg4);
10873         unlock_user(p, arg1, 0);
10874         break;
10875 #endif
10876 #ifdef TARGET_NR_ftruncate64
10877     case TARGET_NR_ftruncate64:
10878         ret = target_ftruncate64(cpu_env, arg1, arg2, arg3, arg4);
10879         break;
10880 #endif
10881 #ifdef TARGET_NR_stat64
10882     case TARGET_NR_stat64:
10883         if (!(p = lock_user_string(arg1)))
10884             goto efault;
10885         ret = get_errno(stat(path(p), &st));
10886         unlock_user(p, arg1, 0);
10887         if (!is_error(ret))
10888             ret = host_to_target_stat64(cpu_env, arg2, &st);
10889         break;
10890 #endif
10891 #ifdef TARGET_NR_lstat64
10892     case TARGET_NR_lstat64:
10893         if (!(p = lock_user_string(arg1)))
10894             goto efault;
10895         ret = get_errno(lstat(path(p), &st));
10896         unlock_user(p, arg1, 0);
10897         if (!is_error(ret))
10898             ret = host_to_target_stat64(cpu_env, arg2, &st);
10899         break;
10900 #endif
10901 #ifdef TARGET_NR_fstat64
10902     case TARGET_NR_fstat64:
10903         ret = get_errno(fstat(arg1, &st));
10904         if (!is_error(ret))
10905             ret = host_to_target_stat64(cpu_env, arg2, &st);
10906         break;
10907 #endif
10908 #if (defined(TARGET_NR_fstatat64) || defined(TARGET_NR_newfstatat))
10909 #ifdef TARGET_NR_fstatat64
10910     case TARGET_NR_fstatat64:
10911 #endif
10912 #ifdef TARGET_NR_newfstatat
10913     case TARGET_NR_newfstatat:
10914 #endif
10915         if (!(p = lock_user_string(arg2)))
10916             goto efault;
10917         ret = get_errno(fstatat(arg1, path(p), &st, arg4));
10918         if (!is_error(ret))
10919             ret = host_to_target_stat64(cpu_env, arg3, &st);
10920         break;
10921 #endif
10922 #ifdef TARGET_NR_lchown
10923     case TARGET_NR_lchown:
10924         if (!(p = lock_user_string(arg1)))
10925             goto efault;
10926         ret = get_errno(lchown(p, low2highuid(arg2), low2highgid(arg3)));
10927         unlock_user(p, arg1, 0);
10928         break;
10929 #endif
10930 #ifdef TARGET_NR_getuid
10931     case TARGET_NR_getuid:
10932         ret = get_errno(high2lowuid(getuid()));
10933         break;
10934 #endif
10935 #ifdef TARGET_NR_getgid
10936     case TARGET_NR_getgid:
10937         ret = get_errno(high2lowgid(getgid()));
10938         break;
10939 #endif
10940 #ifdef TARGET_NR_geteuid
10941     case TARGET_NR_geteuid:
10942         ret = get_errno(high2lowuid(geteuid()));
10943         break;
10944 #endif
10945 #ifdef TARGET_NR_getegid
10946     case TARGET_NR_getegid:
10947         ret = get_errno(high2lowgid(getegid()));
10948         break;
10949 #endif
10950     case TARGET_NR_setreuid:
10951         ret = get_errno(setreuid(low2highuid(arg1), low2highuid(arg2)));
10952         break;
10953     case TARGET_NR_setregid:
10954         ret = get_errno(setregid(low2highgid(arg1), low2highgid(arg2)));
10955         break;
10956     case TARGET_NR_getgroups:
10957         {
10958             int gidsetsize = arg1;
10959             target_id *target_grouplist;
10960             gid_t *grouplist;
10961             int i;
10962
10963             grouplist = alloca(gidsetsize * sizeof(gid_t));
10964             ret = get_errno(getgroups(gidsetsize, grouplist));
10965             if (gidsetsize == 0)
10966                 break;
10967             if (!is_error(ret)) {
10968                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * sizeof(target_id), 0);
10969                 if (!target_grouplist)
10970                     goto efault;
10971                 for(i = 0;i < ret; i++)
10972                     target_grouplist[i] = tswapid(high2lowgid(grouplist[i]));
10973                 unlock_user(target_grouplist, arg2, gidsetsize * sizeof(target_id));
10974             }
10975         }
10976         break;
10977     case TARGET_NR_setgroups:
10978         {
10979             int gidsetsize = arg1;
10980             target_id *target_grouplist;
10981             gid_t *grouplist = NULL;
10982             int i;
10983             if (gidsetsize) {
10984                 grouplist = alloca(gidsetsize * sizeof(gid_t));
10985                 target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * sizeof(target_id), 1);
10986                 if (!target_grouplist) {
10987                     ret = -TARGET_EFAULT;
10988                     goto fail;
10989                 }
10990                 for (i = 0; i < gidsetsize; i++) {
10991                     grouplist[i] = low2highgid(tswapid(target_grouplist[i]));
10992                 }
10993                 unlock_user(target_grouplist, arg2, 0);
10994             }
10995             ret = get_errno(setgroups(gidsetsize, grouplist));
10996         }
10997         break;
10998     case TARGET_NR_fchown:
10999         ret = get_errno(fchown(arg1, low2highuid(arg2), low2highgid(arg3)));
11000         break;
11001 #if defined(TARGET_NR_fchownat)
11002     case TARGET_NR_fchownat:
11003         if (!(p = lock_user_string(arg2)))
11004             goto efault;
11005         ret = get_errno(fchownat(arg1, p, low2highuid(arg3),
11006                                  low2highgid(arg4), arg5));
11007         unlock_user(p, arg2, 0);
11008         break;
11009 #endif
11010 #ifdef TARGET_NR_setresuid
11011     case TARGET_NR_setresuid:
11012         ret = get_errno(sys_setresuid(low2highuid(arg1),
11013                                       low2highuid(arg2),
11014                                       low2highuid(arg3)));
11015         break;
11016 #endif
11017 #ifdef TARGET_NR_getresuid
11018     case TARGET_NR_getresuid:
11019         {
11020             uid_t ruid, euid, suid;
11021             ret = get_errno(getresuid(&ruid, &euid, &suid));
11022             if (!is_error(ret)) {
11023                 if (put_user_id(high2lowuid(ruid), arg1)
11024                     || put_user_id(high2lowuid(euid), arg2)
11025                     || put_user_id(high2lowuid(suid), arg3))
11026                     goto efault;
11027             }
11028         }
11029         break;
11030 #endif
11031 #ifdef TARGET_NR_getresgid
11032     case TARGET_NR_setresgid:
11033         ret = get_errno(sys_setresgid(low2highgid(arg1),
11034                                       low2highgid(arg2),
11035                                       low2highgid(arg3)));
11036         break;
11037 #endif
11038 #ifdef TARGET_NR_getresgid
11039     case TARGET_NR_getresgid:
11040         {
11041             gid_t rgid, egid, sgid;
11042             ret = get_errno(getresgid(&rgid, &egid, &sgid));
11043             if (!is_error(ret)) {
11044                 if (put_user_id(high2lowgid(rgid), arg1)
11045                     || put_user_id(high2lowgid(egid), arg2)
11046                     || put_user_id(high2lowgid(sgid), arg3))
11047                     goto efault;
11048             }
11049         }
11050         break;
11051 #endif
11052 #ifdef TARGET_NR_chown
11053     case TARGET_NR_chown:
11054         if (!(p = lock_user_string(arg1)))
11055             goto efault;
11056         ret = get_errno(chown(p, low2highuid(arg2), low2highgid(arg3)));
11057         unlock_user(p, arg1, 0);
11058         break;
11059 #endif
11060     case TARGET_NR_setuid:
11061         ret = get_errno(sys_setuid(low2highuid(arg1)));
11062         break;
11063     case TARGET_NR_setgid:
11064         ret = get_errno(sys_setgid(low2highgid(arg1)));
11065         break;
11066     case TARGET_NR_setfsuid:
11067         ret = get_errno(setfsuid(arg1));
11068         break;
11069     case TARGET_NR_setfsgid:
11070         ret = get_errno(setfsgid(arg1));
11071         break;
11072
11073 #ifdef TARGET_NR_lchown32
11074     case TARGET_NR_lchown32:
11075         if (!(p = lock_user_string(arg1)))
11076             goto efault;
11077         ret = get_errno(lchown(p, arg2, arg3));
11078         unlock_user(p, arg1, 0);
11079         break;
11080 #endif
11081 #ifdef TARGET_NR_getuid32
11082     case TARGET_NR_getuid32:
11083         ret = get_errno(getuid());
11084         break;
11085 #endif
11086
11087 #if defined(TARGET_NR_getxuid) && defined(TARGET_ALPHA)
11088    /* Alpha specific */
11089     case TARGET_NR_getxuid:
11090          {
11091             uid_t euid;
11092             euid=geteuid();
11093             ((CPUAlphaState *)cpu_env)->ir[IR_A4]=euid;
11094          }
11095         ret = get_errno(getuid());
11096         break;
11097 #endif
11098 #if defined(TARGET_NR_getxgid) && defined(TARGET_ALPHA)
11099    /* Alpha specific */
11100     case TARGET_NR_getxgid:
11101          {
11102             uid_t egid;
11103             egid=getegid();
11104             ((CPUAlphaState *)cpu_env)->ir[IR_A4]=egid;
11105          }
11106         ret = get_errno(getgid());
11107         break;
11108 #endif
11109 #if defined(TARGET_NR_osf_getsysinfo) && defined(TARGET_ALPHA)
11110     /* Alpha specific */
11111     case TARGET_NR_osf_getsysinfo:
11112         ret = -TARGET_EOPNOTSUPP;
11113         switch (arg1) {
11114           case TARGET_GSI_IEEE_FP_CONTROL:
11115             {
11116                 uint64_t swcr, fpcr = cpu_alpha_load_fpcr (cpu_env);
11117
11118                 /* Copied from linux ieee_fpcr_to_swcr.  */
11119                 swcr = (fpcr >> 35) & SWCR_STATUS_MASK;
11120                 swcr |= (fpcr >> 36) & SWCR_MAP_DMZ;
11121                 swcr |= (~fpcr >> 48) & (SWCR_TRAP_ENABLE_INV
11122                                         | SWCR_TRAP_ENABLE_DZE
11123                                         | SWCR_TRAP_ENABLE_OVF);
11124                 swcr |= (~fpcr >> 57) & (SWCR_TRAP_ENABLE_UNF
11125                                         | SWCR_TRAP_ENABLE_INE);
11126                 swcr |= (fpcr >> 47) & SWCR_MAP_UMZ;
11127                 swcr |= (~fpcr >> 41) & SWCR_TRAP_ENABLE_DNO;
11128
11129                 if (put_user_u64 (swcr, arg2))
11130                         goto efault;
11131                 ret = 0;
11132             }
11133             break;
11134
11135           /* case GSI_IEEE_STATE_AT_SIGNAL:
11136              -- Not implemented in linux kernel.
11137              case GSI_UACPROC:
11138              -- Retrieves current unaligned access state; not much used.
11139              case GSI_PROC_TYPE:
11140              -- Retrieves implver information; surely not used.
11141              case GSI_GET_HWRPB:
11142              -- Grabs a copy of the HWRPB; surely not used.
11143           */
11144         }
11145         break;
11146 #endif
11147 #if defined(TARGET_NR_osf_setsysinfo) && defined(TARGET_ALPHA)
11148     /* Alpha specific */
11149     case TARGET_NR_osf_setsysinfo:
11150         ret = -TARGET_EOPNOTSUPP;
11151         switch (arg1) {
11152           case TARGET_SSI_IEEE_FP_CONTROL:
11153             {
11154                 uint64_t swcr, fpcr, orig_fpcr;
11155
11156                 if (get_user_u64 (swcr, arg2)) {
11157                     goto efault;
11158                 }
11159                 orig_fpcr = cpu_alpha_load_fpcr(cpu_env);
11160                 fpcr = orig_fpcr & FPCR_DYN_MASK;
11161
11162                 /* Copied from linux ieee_swcr_to_fpcr.  */
11163                 fpcr |= (swcr & SWCR_STATUS_MASK) << 35;
11164                 fpcr |= (swcr & SWCR_MAP_DMZ) << 36;
11165                 fpcr |= (~swcr & (SWCR_TRAP_ENABLE_INV
11166                                   | SWCR_TRAP_ENABLE_DZE
11167                                   | SWCR_TRAP_ENABLE_OVF)) << 48;
11168                 fpcr |= (~swcr & (SWCR_TRAP_ENABLE_UNF
11169                                   | SWCR_TRAP_ENABLE_INE)) << 57;
11170                 fpcr |= (swcr & SWCR_MAP_UMZ ? FPCR_UNDZ | FPCR_UNFD : 0);
11171                 fpcr |= (~swcr & SWCR_TRAP_ENABLE_DNO) << 41;
11172
11173                 cpu_alpha_store_fpcr(cpu_env, fpcr);
11174                 ret = 0;
11175             }
11176             break;
11177
11178           case TARGET_SSI_IEEE_RAISE_EXCEPTION:
11179             {
11180                 uint64_t exc, fpcr, orig_fpcr;
11181                 int si_code;
11182
11183                 if (get_user_u64(exc, arg2)) {
11184                     goto efault;
11185                 }
11186
11187                 orig_fpcr = cpu_alpha_load_fpcr(cpu_env);
11188
11189                 /* We only add to the exception status here.  */
11190                 fpcr = orig_fpcr | ((exc & SWCR_STATUS_MASK) << 35);
11191
11192                 cpu_alpha_store_fpcr(cpu_env, fpcr);
11193                 ret = 0;
11194
11195                 /* Old exceptions are not signaled.  */
11196                 fpcr &= ~(orig_fpcr & FPCR_STATUS_MASK);
11197
11198                 /* If any exceptions set by this call,
11199                    and are unmasked, send a signal.  */
11200                 si_code = 0;
11201                 if ((fpcr & (FPCR_INE | FPCR_INED)) == FPCR_INE) {
11202                     si_code = TARGET_FPE_FLTRES;
11203                 }
11204                 if ((fpcr & (FPCR_UNF | FPCR_UNFD)) == FPCR_UNF) {
11205                     si_code = TARGET_FPE_FLTUND;
11206                 }
11207                 if ((fpcr & (FPCR_OVF | FPCR_OVFD)) == FPCR_OVF) {
11208                     si_code = TARGET_FPE_FLTOVF;
11209                 }
11210                 if ((fpcr & (FPCR_DZE | FPCR_DZED)) == FPCR_DZE) {
11211                     si_code = TARGET_FPE_FLTDIV;
11212                 }
11213                 if ((fpcr & (FPCR_INV | FPCR_INVD)) == FPCR_INV) {
11214                     si_code = TARGET_FPE_FLTINV;
11215                 }
11216                 if (si_code != 0) {
11217                     target_siginfo_t info;
11218                     info.si_signo = SIGFPE;
11219                     info.si_errno = 0;
11220                     info.si_code = si_code;
11221                     info._sifields._sigfault._addr
11222                         = ((CPUArchState *)cpu_env)->pc;
11223                     queue_signal((CPUArchState *)cpu_env, info.si_signo,
11224                                  QEMU_SI_FAULT, &info);
11225                 }
11226             }
11227             break;
11228
11229           /* case SSI_NVPAIRS:
11230              -- Used with SSIN_UACPROC to enable unaligned accesses.
11231              case SSI_IEEE_STATE_AT_SIGNAL:
11232              case SSI_IEEE_IGNORE_STATE_AT_SIGNAL:
11233              -- Not implemented in linux kernel
11234           */
11235         }
11236         break;
11237 #endif
11238 #ifdef TARGET_NR_osf_sigprocmask
11239     /* Alpha specific.  */
11240     case TARGET_NR_osf_sigprocmask:
11241         {
11242             abi_ulong mask;
11243             int how;
11244             sigset_t set, oldset;
11245
11246             switch(arg1) {
11247             case TARGET_SIG_BLOCK:
11248                 how = SIG_BLOCK;
11249                 break;
11250             case TARGET_SIG_UNBLOCK:
11251                 how = SIG_UNBLOCK;
11252                 break;
11253             case TARGET_SIG_SETMASK:
11254                 how = SIG_SETMASK;
11255                 break;
11256             default:
11257                 ret = -TARGET_EINVAL;
11258                 goto fail;
11259             }
11260             mask = arg2;
11261             target_to_host_old_sigset(&set, &mask);
11262             ret = do_sigprocmask(how, &set, &oldset);
11263             if (!ret) {
11264                 host_to_target_old_sigset(&mask, &oldset);
11265                 ret = mask;
11266             }
11267         }
11268         break;
11269 #endif
11270
11271 #ifdef TARGET_NR_getgid32
11272     case TARGET_NR_getgid32:
11273         ret = get_errno(getgid());
11274         break;
11275 #endif
11276 #ifdef TARGET_NR_geteuid32
11277     case TARGET_NR_geteuid32:
11278         ret = get_errno(geteuid());
11279         break;
11280 #endif
11281 #ifdef TARGET_NR_getegid32
11282     case TARGET_NR_getegid32:
11283         ret = get_errno(getegid());
11284         break;
11285 #endif
11286 #ifdef TARGET_NR_setreuid32
11287     case TARGET_NR_setreuid32:
11288         ret = get_errno(setreuid(arg1, arg2));
11289         break;
11290 #endif
11291 #ifdef TARGET_NR_setregid32
11292     case TARGET_NR_setregid32:
11293         ret = get_errno(setregid(arg1, arg2));
11294         break;
11295 #endif
11296 #ifdef TARGET_NR_getgroups32
11297     case TARGET_NR_getgroups32:
11298         {
11299             int gidsetsize = arg1;
11300             uint32_t *target_grouplist;
11301             gid_t *grouplist;
11302             int i;
11303
11304             grouplist = alloca(gidsetsize * sizeof(gid_t));
11305             ret = get_errno(getgroups(gidsetsize, grouplist));
11306             if (gidsetsize == 0)
11307                 break;
11308             if (!is_error(ret)) {
11309                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * 4, 0);
11310                 if (!target_grouplist) {
11311                     ret = -TARGET_EFAULT;
11312                     goto fail;
11313                 }
11314                 for(i = 0;i < ret; i++)
11315                     target_grouplist[i] = tswap32(grouplist[i]);
11316                 unlock_user(target_grouplist, arg2, gidsetsize * 4);
11317             }
11318         }
11319         break;
11320 #endif
11321 #ifdef TARGET_NR_setgroups32
11322     case TARGET_NR_setgroups32:
11323         {
11324             int gidsetsize = arg1;
11325             uint32_t *target_grouplist;
11326             gid_t *grouplist;
11327             int i;
11328
11329             grouplist = alloca(gidsetsize * sizeof(gid_t));
11330             target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * 4, 1);
11331             if (!target_grouplist) {
11332                 ret = -TARGET_EFAULT;
11333                 goto fail;
11334             }
11335             for(i = 0;i < gidsetsize; i++)
11336                 grouplist[i] = tswap32(target_grouplist[i]);
11337             unlock_user(target_grouplist, arg2, 0);
11338             ret = get_errno(setgroups(gidsetsize, grouplist));
11339         }
11340         break;
11341 #endif
11342 #ifdef TARGET_NR_fchown32
11343     case TARGET_NR_fchown32:
11344         ret = get_errno(fchown(arg1, arg2, arg3));
11345         break;
11346 #endif
11347 #ifdef TARGET_NR_setresuid32
11348     case TARGET_NR_setresuid32:
11349         ret = get_errno(sys_setresuid(arg1, arg2, arg3));
11350         break;
11351 #endif
11352 #ifdef TARGET_NR_getresuid32
11353     case TARGET_NR_getresuid32:
11354         {
11355             uid_t ruid, euid, suid;
11356             ret = get_errno(getresuid(&ruid, &euid, &suid));
11357             if (!is_error(ret)) {
11358                 if (put_user_u32(ruid, arg1)
11359                     || put_user_u32(euid, arg2)
11360                     || put_user_u32(suid, arg3))
11361                     goto efault;
11362             }
11363         }
11364         break;
11365 #endif
11366 #ifdef TARGET_NR_setresgid32
11367     case TARGET_NR_setresgid32:
11368         ret = get_errno(sys_setresgid(arg1, arg2, arg3));
11369         break;
11370 #endif
11371 #ifdef TARGET_NR_getresgid32
11372     case TARGET_NR_getresgid32:
11373         {
11374             gid_t rgid, egid, sgid;
11375             ret = get_errno(getresgid(&rgid, &egid, &sgid));
11376             if (!is_error(ret)) {
11377                 if (put_user_u32(rgid, arg1)
11378                     || put_user_u32(egid, arg2)
11379                     || put_user_u32(sgid, arg3))
11380                     goto efault;
11381             }
11382         }
11383         break;
11384 #endif
11385 #ifdef TARGET_NR_chown32
11386     case TARGET_NR_chown32:
11387         if (!(p = lock_user_string(arg1)))
11388             goto efault;
11389         ret = get_errno(chown(p, arg2, arg3));
11390         unlock_user(p, arg1, 0);
11391         break;
11392 #endif
11393 #ifdef TARGET_NR_setuid32
11394     case TARGET_NR_setuid32:
11395         ret = get_errno(sys_setuid(arg1));
11396         break;
11397 #endif
11398 #ifdef TARGET_NR_setgid32
11399     case TARGET_NR_setgid32:
11400         ret = get_errno(sys_setgid(arg1));
11401         break;
11402 #endif
11403 #ifdef TARGET_NR_setfsuid32
11404     case TARGET_NR_setfsuid32:
11405         ret = get_errno(setfsuid(arg1));
11406         break;
11407 #endif
11408 #ifdef TARGET_NR_setfsgid32
11409     case TARGET_NR_setfsgid32:
11410         ret = get_errno(setfsgid(arg1));
11411         break;
11412 #endif
11413
11414     case TARGET_NR_pivot_root:
11415         goto unimplemented;
11416 #ifdef TARGET_NR_mincore
11417     case TARGET_NR_mincore:
11418         {
11419             void *a;
11420             ret = -TARGET_ENOMEM;
11421             a = lock_user(VERIFY_READ, arg1, arg2, 0);
11422             if (!a) {
11423                 goto fail;
11424             }
11425             ret = -TARGET_EFAULT;
11426             p = lock_user_string(arg3);
11427             if (!p) {
11428                 goto mincore_fail;
11429             }
11430             ret = get_errno(mincore(a, arg2, p));
11431             unlock_user(p, arg3, ret);
11432             mincore_fail:
11433             unlock_user(a, arg1, 0);
11434         }
11435         break;
11436 #endif
11437 #ifdef TARGET_NR_arm_fadvise64_64
11438     case TARGET_NR_arm_fadvise64_64:
11439         /* arm_fadvise64_64 looks like fadvise64_64 but
11440          * with different argument order: fd, advice, offset, len
11441          * rather than the usual fd, offset, len, advice.
11442          * Note that offset and len are both 64-bit so appear as
11443          * pairs of 32-bit registers.
11444          */
11445         ret = posix_fadvise(arg1, target_offset64(arg3, arg4),
11446                             target_offset64(arg5, arg6), arg2);
11447         ret = -host_to_target_errno(ret);
11448         break;
11449 #endif
11450
11451 #if TARGET_ABI_BITS == 32
11452
11453 #ifdef TARGET_NR_fadvise64_64
11454     case TARGET_NR_fadvise64_64:
11455 #if defined(TARGET_PPC)
11456         /* 6 args: fd, advice, offset (high, low), len (high, low) */
11457         ret = arg2;
11458         arg2 = arg3;
11459         arg3 = arg4;
11460         arg4 = arg5;
11461         arg5 = arg6;
11462         arg6 = ret;
11463 #else
11464         /* 6 args: fd, offset (high, low), len (high, low), advice */
11465         if (regpairs_aligned(cpu_env, num)) {
11466             /* offset is in (3,4), len in (5,6) and advice in 7 */
11467             arg2 = arg3;
11468             arg3 = arg4;
11469             arg4 = arg5;
11470             arg5 = arg6;
11471             arg6 = arg7;
11472         }
11473 #endif
11474         ret = -host_to_target_errno(posix_fadvise(arg1,
11475                                                   target_offset64(arg2, arg3),
11476                                                   target_offset64(arg4, arg5),
11477                                                   arg6));
11478         break;
11479 #endif
11480
11481 #ifdef TARGET_NR_fadvise64
11482     case TARGET_NR_fadvise64:
11483         /* 5 args: fd, offset (high, low), len, advice */
11484         if (regpairs_aligned(cpu_env, num)) {
11485             /* offset is in (3,4), len in 5 and advice in 6 */
11486             arg2 = arg3;
11487             arg3 = arg4;
11488             arg4 = arg5;
11489             arg5 = arg6;
11490         }
11491         ret = -host_to_target_errno(posix_fadvise(arg1,
11492                                                   target_offset64(arg2, arg3),
11493                                                   arg4, arg5));
11494         break;
11495 #endif
11496
11497 #else /* not a 32-bit ABI */
11498 #if defined(TARGET_NR_fadvise64_64) || defined(TARGET_NR_fadvise64)
11499 #ifdef TARGET_NR_fadvise64_64
11500     case TARGET_NR_fadvise64_64:
11501 #endif
11502 #ifdef TARGET_NR_fadvise64
11503     case TARGET_NR_fadvise64:
11504 #endif
11505 #ifdef TARGET_S390X
11506         switch (arg4) {
11507         case 4: arg4 = POSIX_FADV_NOREUSE + 1; break; /* make sure it's an invalid value */
11508         case 5: arg4 = POSIX_FADV_NOREUSE + 2; break; /* ditto */
11509         case 6: arg4 = POSIX_FADV_DONTNEED; break;
11510         case 7: arg4 = POSIX_FADV_NOREUSE; break;
11511         default: break;
11512         }
11513 #endif
11514         ret = -host_to_target_errno(posix_fadvise(arg1, arg2, arg3, arg4));
11515         break;
11516 #endif
11517 #endif /* end of 64-bit ABI fadvise handling */
11518
11519 #ifdef TARGET_NR_madvise
11520     case TARGET_NR_madvise:
11521         /* A straight passthrough may not be safe because qemu sometimes
11522            turns private file-backed mappings into anonymous mappings.
11523            This will break MADV_DONTNEED.
11524            This is a hint, so ignoring and returning success is ok.  */
11525         ret = get_errno(0);
11526         break;
11527 #endif
11528 #if TARGET_ABI_BITS == 32
11529     case TARGET_NR_fcntl64:
11530     {
11531         int cmd;
11532         struct flock64 fl;
11533         from_flock64_fn *copyfrom = copy_from_user_flock64;
11534         to_flock64_fn *copyto = copy_to_user_flock64;
11535
11536 #ifdef TARGET_ARM
11537         if (((CPUARMState *)cpu_env)->eabi) {
11538             copyfrom = copy_from_user_eabi_flock64;
11539             copyto = copy_to_user_eabi_flock64;
11540         }
11541 #endif
11542
11543         cmd = target_to_host_fcntl_cmd(arg2);
11544         if (cmd == -TARGET_EINVAL) {
11545             ret = cmd;
11546             break;
11547         }
11548
11549         switch(arg2) {
11550         case TARGET_F_GETLK64:
11551             ret = copyfrom(&fl, arg3);
11552             if (ret) {
11553                 break;
11554             }
11555             ret = get_errno(fcntl(arg1, cmd, &fl));
11556             if (ret == 0) {
11557                 ret = copyto(arg3, &fl);
11558             }
11559             break;
11560
11561         case TARGET_F_SETLK64:
11562         case TARGET_F_SETLKW64:
11563             ret = copyfrom(&fl, arg3);
11564             if (ret) {
11565                 break;
11566             }
11567             ret = get_errno(safe_fcntl(arg1, cmd, &fl));
11568             break;
11569         default:
11570             ret = do_fcntl(arg1, arg2, arg3);
11571             break;
11572         }
11573         break;
11574     }
11575 #endif
11576 #ifdef TARGET_NR_cacheflush
11577     case TARGET_NR_cacheflush:
11578         /* self-modifying code is handled automatically, so nothing needed */
11579         ret = 0;
11580         break;
11581 #endif
11582 #ifdef TARGET_NR_security
11583     case TARGET_NR_security:
11584         goto unimplemented;
11585 #endif
11586 #ifdef TARGET_NR_getpagesize
11587     case TARGET_NR_getpagesize:
11588         ret = TARGET_PAGE_SIZE;
11589         break;
11590 #endif
11591     case TARGET_NR_gettid:
11592         ret = get_errno(gettid());
11593         break;
11594 #ifdef TARGET_NR_readahead
11595     case TARGET_NR_readahead:
11596 #if TARGET_ABI_BITS == 32
11597         if (regpairs_aligned(cpu_env, num)) {
11598             arg2 = arg3;
11599             arg3 = arg4;
11600             arg4 = arg5;
11601         }
11602         ret = get_errno(readahead(arg1, target_offset64(arg2, arg3) , arg4));
11603 #else
11604         ret = get_errno(readahead(arg1, arg2, arg3));
11605 #endif
11606         break;
11607 #endif
11608 #ifdef CONFIG_ATTR
11609 #ifdef TARGET_NR_setxattr
11610     case TARGET_NR_listxattr:
11611     case TARGET_NR_llistxattr:
11612     {
11613         void *p, *b = 0;
11614         if (arg2) {
11615             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11616             if (!b) {
11617                 ret = -TARGET_EFAULT;
11618                 break;
11619             }
11620         }
11621         p = lock_user_string(arg1);
11622         if (p) {
11623             if (num == TARGET_NR_listxattr) {
11624                 ret = get_errno(listxattr(p, b, arg3));
11625             } else {
11626                 ret = get_errno(llistxattr(p, b, arg3));
11627             }
11628         } else {
11629             ret = -TARGET_EFAULT;
11630         }
11631         unlock_user(p, arg1, 0);
11632         unlock_user(b, arg2, arg3);
11633         break;
11634     }
11635     case TARGET_NR_flistxattr:
11636     {
11637         void *b = 0;
11638         if (arg2) {
11639             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11640             if (!b) {
11641                 ret = -TARGET_EFAULT;
11642                 break;
11643             }
11644         }
11645         ret = get_errno(flistxattr(arg1, b, arg3));
11646         unlock_user(b, arg2, arg3);
11647         break;
11648     }
11649     case TARGET_NR_setxattr:
11650     case TARGET_NR_lsetxattr:
11651         {
11652             void *p, *n, *v = 0;
11653             if (arg3) {
11654                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
11655                 if (!v) {
11656                     ret = -TARGET_EFAULT;
11657                     break;
11658                 }
11659             }
11660             p = lock_user_string(arg1);
11661             n = lock_user_string(arg2);
11662             if (p && n) {
11663                 if (num == TARGET_NR_setxattr) {
11664                     ret = get_errno(setxattr(p, n, v, arg4, arg5));
11665                 } else {
11666                     ret = get_errno(lsetxattr(p, n, v, arg4, arg5));
11667                 }
11668             } else {
11669                 ret = -TARGET_EFAULT;
11670             }
11671             unlock_user(p, arg1, 0);
11672             unlock_user(n, arg2, 0);
11673             unlock_user(v, arg3, 0);
11674         }
11675         break;
11676     case TARGET_NR_fsetxattr:
11677         {
11678             void *n, *v = 0;
11679             if (arg3) {
11680                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
11681                 if (!v) {
11682                     ret = -TARGET_EFAULT;
11683                     break;
11684                 }
11685             }
11686             n = lock_user_string(arg2);
11687             if (n) {
11688                 ret = get_errno(fsetxattr(arg1, n, v, arg4, arg5));
11689             } else {
11690                 ret = -TARGET_EFAULT;
11691             }
11692             unlock_user(n, arg2, 0);
11693             unlock_user(v, arg3, 0);
11694         }
11695         break;
11696     case TARGET_NR_getxattr:
11697     case TARGET_NR_lgetxattr:
11698         {
11699             void *p, *n, *v = 0;
11700             if (arg3) {
11701                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
11702                 if (!v) {
11703                     ret = -TARGET_EFAULT;
11704                     break;
11705                 }
11706             }
11707             p = lock_user_string(arg1);
11708             n = lock_user_string(arg2);
11709             if (p && n) {
11710                 if (num == TARGET_NR_getxattr) {
11711                     ret = get_errno(getxattr(p, n, v, arg4));
11712                 } else {
11713                     ret = get_errno(lgetxattr(p, n, v, arg4));
11714                 }
11715             } else {
11716                 ret = -TARGET_EFAULT;
11717             }
11718             unlock_user(p, arg1, 0);
11719             unlock_user(n, arg2, 0);
11720             unlock_user(v, arg3, arg4);
11721         }
11722         break;
11723     case TARGET_NR_fgetxattr:
11724         {
11725             void *n, *v = 0;
11726             if (arg3) {
11727                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
11728                 if (!v) {
11729                     ret = -TARGET_EFAULT;
11730                     break;
11731                 }
11732             }
11733             n = lock_user_string(arg2);
11734             if (n) {
11735                 ret = get_errno(fgetxattr(arg1, n, v, arg4));
11736             } else {
11737                 ret = -TARGET_EFAULT;
11738             }
11739             unlock_user(n, arg2, 0);
11740             unlock_user(v, arg3, arg4);
11741         }
11742         break;
11743     case TARGET_NR_removexattr:
11744     case TARGET_NR_lremovexattr:
11745         {
11746             void *p, *n;
11747             p = lock_user_string(arg1);
11748             n = lock_user_string(arg2);
11749             if (p && n) {
11750                 if (num == TARGET_NR_removexattr) {
11751                     ret = get_errno(removexattr(p, n));
11752                 } else {
11753                     ret = get_errno(lremovexattr(p, n));
11754                 }
11755             } else {
11756                 ret = -TARGET_EFAULT;
11757             }
11758             unlock_user(p, arg1, 0);
11759             unlock_user(n, arg2, 0);
11760         }
11761         break;
11762     case TARGET_NR_fremovexattr:
11763         {
11764             void *n;
11765             n = lock_user_string(arg2);
11766             if (n) {
11767                 ret = get_errno(fremovexattr(arg1, n));
11768             } else {
11769                 ret = -TARGET_EFAULT;
11770             }
11771             unlock_user(n, arg2, 0);
11772         }
11773         break;
11774 #endif
11775 #endif /* CONFIG_ATTR */
11776 #ifdef TARGET_NR_set_thread_area
11777     case TARGET_NR_set_thread_area:
11778 #if defined(TARGET_MIPS)
11779       ((CPUMIPSState *) cpu_env)->active_tc.CP0_UserLocal = arg1;
11780       ret = 0;
11781       break;
11782 #elif defined(TARGET_CRIS)
11783       if (arg1 & 0xff)
11784           ret = -TARGET_EINVAL;
11785       else {
11786           ((CPUCRISState *) cpu_env)->pregs[PR_PID] = arg1;
11787           ret = 0;
11788       }
11789       break;
11790 #elif defined(TARGET_I386) && defined(TARGET_ABI32)
11791       ret = do_set_thread_area(cpu_env, arg1);
11792       break;
11793 #elif defined(TARGET_M68K)
11794       {
11795           TaskState *ts = cpu->opaque;
11796           ts->tp_value = arg1;
11797           ret = 0;
11798           break;
11799       }
11800 #else
11801       goto unimplemented_nowarn;
11802 #endif
11803 #endif
11804 #ifdef TARGET_NR_get_thread_area
11805     case TARGET_NR_get_thread_area:
11806 #if defined(TARGET_I386) && defined(TARGET_ABI32)
11807         ret = do_get_thread_area(cpu_env, arg1);
11808         break;
11809 #elif defined(TARGET_M68K)
11810         {
11811             TaskState *ts = cpu->opaque;
11812             ret = ts->tp_value;
11813             break;
11814         }
11815 #else
11816         goto unimplemented_nowarn;
11817 #endif
11818 #endif
11819 #ifdef TARGET_NR_getdomainname
11820     case TARGET_NR_getdomainname:
11821         goto unimplemented_nowarn;
11822 #endif
11823
11824 #ifdef TARGET_NR_clock_gettime
11825     case TARGET_NR_clock_gettime:
11826     {
11827         struct timespec ts;
11828         ret = get_errno(clock_gettime(arg1, &ts));
11829         if (!is_error(ret)) {
11830             host_to_target_timespec(arg2, &ts);
11831         }
11832         break;
11833     }
11834 #endif
11835 #ifdef TARGET_NR_clock_getres
11836     case TARGET_NR_clock_getres:
11837     {
11838         struct timespec ts;
11839         ret = get_errno(clock_getres(arg1, &ts));
11840         if (!is_error(ret)) {
11841             host_to_target_timespec(arg2, &ts);
11842         }
11843         break;
11844     }
11845 #endif
11846 #ifdef TARGET_NR_clock_nanosleep
11847     case TARGET_NR_clock_nanosleep:
11848     {
11849         struct timespec ts;
11850         target_to_host_timespec(&ts, arg3);
11851         ret = get_errno(safe_clock_nanosleep(arg1, arg2,
11852                                              &ts, arg4 ? &ts : NULL));
11853         if (arg4)
11854             host_to_target_timespec(arg4, &ts);
11855
11856 #if defined(TARGET_PPC)
11857         /* clock_nanosleep is odd in that it returns positive errno values.
11858          * On PPC, CR0 bit 3 should be set in such a situation. */
11859         if (ret && ret != -TARGET_ERESTARTSYS) {
11860             ((CPUPPCState *)cpu_env)->crf[0] |= 1;
11861         }
11862 #endif
11863         break;
11864     }
11865 #endif
11866
11867 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
11868     case TARGET_NR_set_tid_address:
11869         ret = get_errno(set_tid_address((int *)g2h(arg1)));
11870         break;
11871 #endif
11872
11873     case TARGET_NR_tkill:
11874         ret = get_errno(safe_tkill((int)arg1, target_to_host_signal(arg2)));
11875         break;
11876
11877     case TARGET_NR_tgkill:
11878         ret = get_errno(safe_tgkill((int)arg1, (int)arg2,
11879                         target_to_host_signal(arg3)));
11880         break;
11881
11882 #ifdef TARGET_NR_set_robust_list
11883     case TARGET_NR_set_robust_list:
11884     case TARGET_NR_get_robust_list:
11885         /* The ABI for supporting robust futexes has userspace pass
11886          * the kernel a pointer to a linked list which is updated by
11887          * userspace after the syscall; the list is walked by the kernel
11888          * when the thread exits. Since the linked list in QEMU guest
11889          * memory isn't a valid linked list for the host and we have
11890          * no way to reliably intercept the thread-death event, we can't
11891          * support these. Silently return ENOSYS so that guest userspace
11892          * falls back to a non-robust futex implementation (which should
11893          * be OK except in the corner case of the guest crashing while
11894          * holding a mutex that is shared with another process via
11895          * shared memory).
11896          */
11897         goto unimplemented_nowarn;
11898 #endif
11899
11900 #if defined(TARGET_NR_utimensat)
11901     case TARGET_NR_utimensat:
11902         {
11903             struct timespec *tsp, ts[2];
11904             if (!arg3) {
11905                 tsp = NULL;
11906             } else {
11907                 target_to_host_timespec(ts, arg3);
11908                 target_to_host_timespec(ts+1, arg3+sizeof(struct target_timespec));
11909                 tsp = ts;
11910             }
11911             if (!arg2)
11912                 ret = get_errno(sys_utimensat(arg1, NULL, tsp, arg4));
11913             else {
11914                 if (!(p = lock_user_string(arg2))) {
11915                     ret = -TARGET_EFAULT;
11916                     goto fail;
11917                 }
11918                 ret = get_errno(sys_utimensat(arg1, path(p), tsp, arg4));
11919                 unlock_user(p, arg2, 0);
11920             }
11921         }
11922         break;
11923 #endif
11924     case TARGET_NR_futex:
11925         ret = do_futex(arg1, arg2, arg3, arg4, arg5, arg6);
11926         break;
11927 #if defined(TARGET_NR_inotify_init) && defined(__NR_inotify_init)
11928     case TARGET_NR_inotify_init:
11929         ret = get_errno(sys_inotify_init());
11930         if (ret >= 0) {
11931             fd_trans_register(ret, &target_inotify_trans);
11932         }
11933         break;
11934 #endif
11935 #ifdef CONFIG_INOTIFY1
11936 #if defined(TARGET_NR_inotify_init1) && defined(__NR_inotify_init1)
11937     case TARGET_NR_inotify_init1:
11938         ret = get_errno(sys_inotify_init1(target_to_host_bitmask(arg1,
11939                                           fcntl_flags_tbl)));
11940         if (ret >= 0) {
11941             fd_trans_register(ret, &target_inotify_trans);
11942         }
11943         break;
11944 #endif
11945 #endif
11946 #if defined(TARGET_NR_inotify_add_watch) && defined(__NR_inotify_add_watch)
11947     case TARGET_NR_inotify_add_watch:
11948         p = lock_user_string(arg2);
11949         ret = get_errno(sys_inotify_add_watch(arg1, path(p), arg3));
11950         unlock_user(p, arg2, 0);
11951         break;
11952 #endif
11953 #if defined(TARGET_NR_inotify_rm_watch) && defined(__NR_inotify_rm_watch)
11954     case TARGET_NR_inotify_rm_watch:
11955         ret = get_errno(sys_inotify_rm_watch(arg1, arg2));
11956         break;
11957 #endif
11958
11959 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
11960     case TARGET_NR_mq_open:
11961         {
11962             struct mq_attr posix_mq_attr;
11963             struct mq_attr *pposix_mq_attr;
11964             int host_flags;
11965
11966             host_flags = target_to_host_bitmask(arg2, fcntl_flags_tbl);
11967             pposix_mq_attr = NULL;
11968             if (arg4) {
11969                 if (copy_from_user_mq_attr(&posix_mq_attr, arg4) != 0) {
11970                     goto efault;
11971                 }
11972                 pposix_mq_attr = &posix_mq_attr;
11973             }
11974             p = lock_user_string(arg1 - 1);
11975             if (!p) {
11976                 goto efault;
11977             }
11978             ret = get_errno(mq_open(p, host_flags, arg3, pposix_mq_attr));
11979             unlock_user (p, arg1, 0);
11980         }
11981         break;
11982
11983     case TARGET_NR_mq_unlink:
11984         p = lock_user_string(arg1 - 1);
11985         if (!p) {
11986             ret = -TARGET_EFAULT;
11987             break;
11988         }
11989         ret = get_errno(mq_unlink(p));
11990         unlock_user (p, arg1, 0);
11991         break;
11992
11993     case TARGET_NR_mq_timedsend:
11994         {
11995             struct timespec ts;
11996
11997             p = lock_user (VERIFY_READ, arg2, arg3, 1);
11998             if (arg5 != 0) {
11999                 target_to_host_timespec(&ts, arg5);
12000                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, &ts));
12001                 host_to_target_timespec(arg5, &ts);
12002             } else {
12003                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, NULL));
12004             }
12005             unlock_user (p, arg2, arg3);
12006         }
12007         break;
12008
12009     case TARGET_NR_mq_timedreceive:
12010         {
12011             struct timespec ts;
12012             unsigned int prio;
12013
12014             p = lock_user (VERIFY_READ, arg2, arg3, 1);
12015             if (arg5 != 0) {
12016                 target_to_host_timespec(&ts, arg5);
12017                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12018                                                      &prio, &ts));
12019                 host_to_target_timespec(arg5, &ts);
12020             } else {
12021                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12022                                                      &prio, NULL));
12023             }
12024             unlock_user (p, arg2, arg3);
12025             if (arg4 != 0)
12026                 put_user_u32(prio, arg4);
12027         }
12028         break;
12029
12030     /* Not implemented for now... */
12031 /*     case TARGET_NR_mq_notify: */
12032 /*         break; */
12033
12034     case TARGET_NR_mq_getsetattr:
12035         {
12036             struct mq_attr posix_mq_attr_in, posix_mq_attr_out;
12037             ret = 0;
12038             if (arg3 != 0) {
12039                 ret = mq_getattr(arg1, &posix_mq_attr_out);
12040                 copy_to_user_mq_attr(arg3, &posix_mq_attr_out);
12041             }
12042             if (arg2 != 0) {
12043                 copy_from_user_mq_attr(&posix_mq_attr_in, arg2);
12044                 ret |= mq_setattr(arg1, &posix_mq_attr_in, &posix_mq_attr_out);
12045             }
12046
12047         }
12048         break;
12049 #endif
12050
12051 #ifdef CONFIG_SPLICE
12052 #ifdef TARGET_NR_tee
12053     case TARGET_NR_tee:
12054         {
12055             ret = get_errno(tee(arg1,arg2,arg3,arg4));
12056         }
12057         break;
12058 #endif
12059 #ifdef TARGET_NR_splice
12060     case TARGET_NR_splice:
12061         {
12062             loff_t loff_in, loff_out;
12063             loff_t *ploff_in = NULL, *ploff_out = NULL;
12064             if (arg2) {
12065                 if (get_user_u64(loff_in, arg2)) {
12066                     goto efault;
12067                 }
12068                 ploff_in = &loff_in;
12069             }
12070             if (arg4) {
12071                 if (get_user_u64(loff_out, arg4)) {
12072                     goto efault;
12073                 }
12074                 ploff_out = &loff_out;
12075             }
12076             ret = get_errno(splice(arg1, ploff_in, arg3, ploff_out, arg5, arg6));
12077             if (arg2) {
12078                 if (put_user_u64(loff_in, arg2)) {
12079                     goto efault;
12080                 }
12081             }
12082             if (arg4) {
12083                 if (put_user_u64(loff_out, arg4)) {
12084                     goto efault;
12085                 }
12086             }
12087         }
12088         break;
12089 #endif
12090 #ifdef TARGET_NR_vmsplice
12091         case TARGET_NR_vmsplice:
12092         {
12093             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
12094             if (vec != NULL) {
12095                 ret = get_errno(vmsplice(arg1, vec, arg3, arg4));
12096                 unlock_iovec(vec, arg2, arg3, 0);
12097             } else {
12098                 ret = -host_to_target_errno(errno);
12099             }
12100         }
12101         break;
12102 #endif
12103 #endif /* CONFIG_SPLICE */
12104 #ifdef CONFIG_EVENTFD
12105 #if defined(TARGET_NR_eventfd)
12106     case TARGET_NR_eventfd:
12107         ret = get_errno(eventfd(arg1, 0));
12108         if (ret >= 0) {
12109             fd_trans_register(ret, &target_eventfd_trans);
12110         }
12111         break;
12112 #endif
12113 #if defined(TARGET_NR_eventfd2)
12114     case TARGET_NR_eventfd2:
12115     {
12116         int host_flags = arg2 & (~(TARGET_O_NONBLOCK | TARGET_O_CLOEXEC));
12117         if (arg2 & TARGET_O_NONBLOCK) {
12118             host_flags |= O_NONBLOCK;
12119         }
12120         if (arg2 & TARGET_O_CLOEXEC) {
12121             host_flags |= O_CLOEXEC;
12122         }
12123         ret = get_errno(eventfd(arg1, host_flags));
12124         if (ret >= 0) {
12125             fd_trans_register(ret, &target_eventfd_trans);
12126         }
12127         break;
12128     }
12129 #endif
12130 #endif /* CONFIG_EVENTFD  */
12131 #if defined(CONFIG_FALLOCATE) && defined(TARGET_NR_fallocate)
12132     case TARGET_NR_fallocate:
12133 #if TARGET_ABI_BITS == 32
12134         ret = get_errno(fallocate(arg1, arg2, target_offset64(arg3, arg4),
12135                                   target_offset64(arg5, arg6)));
12136 #else
12137         ret = get_errno(fallocate(arg1, arg2, arg3, arg4));
12138 #endif
12139         break;
12140 #endif
12141 #if defined(CONFIG_SYNC_FILE_RANGE)
12142 #if defined(TARGET_NR_sync_file_range)
12143     case TARGET_NR_sync_file_range:
12144 #if TARGET_ABI_BITS == 32
12145 #if defined(TARGET_MIPS)
12146         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
12147                                         target_offset64(arg5, arg6), arg7));
12148 #else
12149         ret = get_errno(sync_file_range(arg1, target_offset64(arg2, arg3),
12150                                         target_offset64(arg4, arg5), arg6));
12151 #endif /* !TARGET_MIPS */
12152 #else
12153         ret = get_errno(sync_file_range(arg1, arg2, arg3, arg4));
12154 #endif
12155         break;
12156 #endif
12157 #if defined(TARGET_NR_sync_file_range2)
12158     case TARGET_NR_sync_file_range2:
12159         /* This is like sync_file_range but the arguments are reordered */
12160 #if TARGET_ABI_BITS == 32
12161         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
12162                                         target_offset64(arg5, arg6), arg2));
12163 #else
12164         ret = get_errno(sync_file_range(arg1, arg3, arg4, arg2));
12165 #endif
12166         break;
12167 #endif
12168 #endif
12169 #if defined(TARGET_NR_signalfd4)
12170     case TARGET_NR_signalfd4:
12171         ret = do_signalfd4(arg1, arg2, arg4);
12172         break;
12173 #endif
12174 #if defined(TARGET_NR_signalfd)
12175     case TARGET_NR_signalfd:
12176         ret = do_signalfd4(arg1, arg2, 0);
12177         break;
12178 #endif
12179 #if defined(CONFIG_EPOLL)
12180 #if defined(TARGET_NR_epoll_create)
12181     case TARGET_NR_epoll_create:
12182         ret = get_errno(epoll_create(arg1));
12183         break;
12184 #endif
12185 #if defined(TARGET_NR_epoll_create1) && defined(CONFIG_EPOLL_CREATE1)
12186     case TARGET_NR_epoll_create1:
12187         ret = get_errno(epoll_create1(arg1));
12188         break;
12189 #endif
12190 #if defined(TARGET_NR_epoll_ctl)
12191     case TARGET_NR_epoll_ctl:
12192     {
12193         struct epoll_event ep;
12194         struct epoll_event *epp = 0;
12195         if (arg4) {
12196             struct target_epoll_event *target_ep;
12197             if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
12198                 goto efault;
12199             }
12200             ep.events = tswap32(target_ep->events);
12201             /* The epoll_data_t union is just opaque data to the kernel,
12202              * so we transfer all 64 bits across and need not worry what
12203              * actual data type it is.
12204              */
12205             ep.data.u64 = tswap64(target_ep->data.u64);
12206             unlock_user_struct(target_ep, arg4, 0);
12207             epp = &ep;
12208         }
12209         ret = get_errno(epoll_ctl(arg1, arg2, arg3, epp));
12210         break;
12211     }
12212 #endif
12213
12214 #if defined(TARGET_NR_epoll_wait) || defined(TARGET_NR_epoll_pwait)
12215 #if defined(TARGET_NR_epoll_wait)
12216     case TARGET_NR_epoll_wait:
12217 #endif
12218 #if defined(TARGET_NR_epoll_pwait)
12219     case TARGET_NR_epoll_pwait:
12220 #endif
12221     {
12222         struct target_epoll_event *target_ep;
12223         struct epoll_event *ep;
12224         int epfd = arg1;
12225         int maxevents = arg3;
12226         int timeout = arg4;
12227
12228         if (maxevents <= 0 || maxevents > TARGET_EP_MAX_EVENTS) {
12229             ret = -TARGET_EINVAL;
12230             break;
12231         }
12232
12233         target_ep = lock_user(VERIFY_WRITE, arg2,
12234                               maxevents * sizeof(struct target_epoll_event), 1);
12235         if (!target_ep) {
12236             goto efault;
12237         }
12238
12239         ep = g_try_new(struct epoll_event, maxevents);
12240         if (!ep) {
12241             unlock_user(target_ep, arg2, 0);
12242             ret = -TARGET_ENOMEM;
12243             break;
12244         }
12245
12246         switch (num) {
12247 #if defined(TARGET_NR_epoll_pwait)
12248         case TARGET_NR_epoll_pwait:
12249         {
12250             target_sigset_t *target_set;
12251             sigset_t _set, *set = &_set;
12252
12253             if (arg5) {
12254                 if (arg6 != sizeof(target_sigset_t)) {
12255                     ret = -TARGET_EINVAL;
12256                     break;
12257                 }
12258
12259                 target_set = lock_user(VERIFY_READ, arg5,
12260                                        sizeof(target_sigset_t), 1);
12261                 if (!target_set) {
12262                     ret = -TARGET_EFAULT;
12263                     break;
12264                 }
12265                 target_to_host_sigset(set, target_set);
12266                 unlock_user(target_set, arg5, 0);
12267             } else {
12268                 set = NULL;
12269             }
12270
12271             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
12272                                              set, SIGSET_T_SIZE));
12273             break;
12274         }
12275 #endif
12276 #if defined(TARGET_NR_epoll_wait)
12277         case TARGET_NR_epoll_wait:
12278             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
12279                                              NULL, 0));
12280             break;
12281 #endif
12282         default:
12283             ret = -TARGET_ENOSYS;
12284         }
12285         if (!is_error(ret)) {
12286             int i;
12287             for (i = 0; i < ret; i++) {
12288                 target_ep[i].events = tswap32(ep[i].events);
12289                 target_ep[i].data.u64 = tswap64(ep[i].data.u64);
12290             }
12291             unlock_user(target_ep, arg2,
12292                         ret * sizeof(struct target_epoll_event));
12293         } else {
12294             unlock_user(target_ep, arg2, 0);
12295         }
12296         g_free(ep);
12297         break;
12298     }
12299 #endif
12300 #endif
12301 #ifdef TARGET_NR_prlimit64
12302     case TARGET_NR_prlimit64:
12303     {
12304         /* args: pid, resource number, ptr to new rlimit, ptr to old rlimit */
12305         struct target_rlimit64 *target_rnew, *target_rold;
12306         struct host_rlimit64 rnew, rold, *rnewp = 0;
12307         int resource = target_to_host_resource(arg2);
12308         if (arg3) {
12309             if (!lock_user_struct(VERIFY_READ, target_rnew, arg3, 1)) {
12310                 goto efault;
12311             }
12312             rnew.rlim_cur = tswap64(target_rnew->rlim_cur);
12313             rnew.rlim_max = tswap64(target_rnew->rlim_max);
12314             unlock_user_struct(target_rnew, arg3, 0);
12315             rnewp = &rnew;
12316         }
12317
12318         ret = get_errno(sys_prlimit64(arg1, resource, rnewp, arg4 ? &rold : 0));
12319         if (!is_error(ret) && arg4) {
12320             if (!lock_user_struct(VERIFY_WRITE, target_rold, arg4, 1)) {
12321                 goto efault;
12322             }
12323             target_rold->rlim_cur = tswap64(rold.rlim_cur);
12324             target_rold->rlim_max = tswap64(rold.rlim_max);
12325             unlock_user_struct(target_rold, arg4, 1);
12326         }
12327         break;
12328     }
12329 #endif
12330 #ifdef TARGET_NR_gethostname
12331     case TARGET_NR_gethostname:
12332     {
12333         char *name = lock_user(VERIFY_WRITE, arg1, arg2, 0);
12334         if (name) {
12335             ret = get_errno(gethostname(name, arg2));
12336             unlock_user(name, arg1, arg2);
12337         } else {
12338             ret = -TARGET_EFAULT;
12339         }
12340         break;
12341     }
12342 #endif
12343 #ifdef TARGET_NR_atomic_cmpxchg_32
12344     case TARGET_NR_atomic_cmpxchg_32:
12345     {
12346         /* should use start_exclusive from main.c */
12347         abi_ulong mem_value;
12348         if (get_user_u32(mem_value, arg6)) {
12349             target_siginfo_t info;
12350             info.si_signo = SIGSEGV;
12351             info.si_errno = 0;
12352             info.si_code = TARGET_SEGV_MAPERR;
12353             info._sifields._sigfault._addr = arg6;
12354             queue_signal((CPUArchState *)cpu_env, info.si_signo,
12355                          QEMU_SI_FAULT, &info);
12356             ret = 0xdeadbeef;
12357
12358         }
12359         if (mem_value == arg2)
12360             put_user_u32(arg1, arg6);
12361         ret = mem_value;
12362         break;
12363     }
12364 #endif
12365 #ifdef TARGET_NR_atomic_barrier
12366     case TARGET_NR_atomic_barrier:
12367     {
12368         /* Like the kernel implementation and the qemu arm barrier, no-op this? */
12369         ret = 0;
12370         break;
12371     }
12372 #endif
12373
12374 #ifdef TARGET_NR_timer_create
12375     case TARGET_NR_timer_create:
12376     {
12377         /* args: clockid_t clockid, struct sigevent *sevp, timer_t *timerid */
12378
12379         struct sigevent host_sevp = { {0}, }, *phost_sevp = NULL;
12380
12381         int clkid = arg1;
12382         int timer_index = next_free_host_timer();
12383
12384         if (timer_index < 0) {
12385             ret = -TARGET_EAGAIN;
12386         } else {
12387             timer_t *phtimer = g_posix_timers  + timer_index;
12388
12389             if (arg2) {
12390                 phost_sevp = &host_sevp;
12391                 ret = target_to_host_sigevent(phost_sevp, arg2);
12392                 if (ret != 0) {
12393                     break;
12394                 }
12395             }
12396
12397             ret = get_errno(timer_create(clkid, phost_sevp, phtimer));
12398             if (ret) {
12399                 phtimer = NULL;
12400             } else {
12401                 if (put_user(TIMER_MAGIC | timer_index, arg3, target_timer_t)) {
12402                     goto efault;
12403                 }
12404             }
12405         }
12406         break;
12407     }
12408 #endif
12409
12410 #ifdef TARGET_NR_timer_settime
12411     case TARGET_NR_timer_settime:
12412     {
12413         /* args: timer_t timerid, int flags, const struct itimerspec *new_value,
12414          * struct itimerspec * old_value */
12415         target_timer_t timerid = get_timer_id(arg1);
12416
12417         if (timerid < 0) {
12418             ret = timerid;
12419         } else if (arg3 == 0) {
12420             ret = -TARGET_EINVAL;
12421         } else {
12422             timer_t htimer = g_posix_timers[timerid];
12423             struct itimerspec hspec_new = {{0},}, hspec_old = {{0},};
12424
12425             if (target_to_host_itimerspec(&hspec_new, arg3)) {
12426                 goto efault;
12427             }
12428             ret = get_errno(
12429                           timer_settime(htimer, arg2, &hspec_new, &hspec_old));
12430             if (arg4 && host_to_target_itimerspec(arg4, &hspec_old)) {
12431                 goto efault;
12432             }
12433         }
12434         break;
12435     }
12436 #endif
12437
12438 #ifdef TARGET_NR_timer_gettime
12439     case TARGET_NR_timer_gettime:
12440     {
12441         /* args: timer_t timerid, struct itimerspec *curr_value */
12442         target_timer_t timerid = get_timer_id(arg1);
12443
12444         if (timerid < 0) {
12445             ret = timerid;
12446         } else if (!arg2) {
12447             ret = -TARGET_EFAULT;
12448         } else {
12449             timer_t htimer = g_posix_timers[timerid];
12450             struct itimerspec hspec;
12451             ret = get_errno(timer_gettime(htimer, &hspec));
12452
12453             if (host_to_target_itimerspec(arg2, &hspec)) {
12454                 ret = -TARGET_EFAULT;
12455             }
12456         }
12457         break;
12458     }
12459 #endif
12460
12461 #ifdef TARGET_NR_timer_getoverrun
12462     case TARGET_NR_timer_getoverrun:
12463     {
12464         /* args: timer_t timerid */
12465         target_timer_t timerid = get_timer_id(arg1);
12466
12467         if (timerid < 0) {
12468             ret = timerid;
12469         } else {
12470             timer_t htimer = g_posix_timers[timerid];
12471             ret = get_errno(timer_getoverrun(htimer));
12472         }
12473         fd_trans_unregister(ret);
12474         break;
12475     }
12476 #endif
12477
12478 #ifdef TARGET_NR_timer_delete
12479     case TARGET_NR_timer_delete:
12480     {
12481         /* args: timer_t timerid */
12482         target_timer_t timerid = get_timer_id(arg1);
12483
12484         if (timerid < 0) {
12485             ret = timerid;
12486         } else {
12487             timer_t htimer = g_posix_timers[timerid];
12488             ret = get_errno(timer_delete(htimer));
12489             g_posix_timers[timerid] = 0;
12490         }
12491         break;
12492     }
12493 #endif
12494
12495 #if defined(TARGET_NR_timerfd_create) && defined(CONFIG_TIMERFD)
12496     case TARGET_NR_timerfd_create:
12497         ret = get_errno(timerfd_create(arg1,
12498                 target_to_host_bitmask(arg2, fcntl_flags_tbl)));
12499         break;
12500 #endif
12501
12502 #if defined(TARGET_NR_timerfd_gettime) && defined(CONFIG_TIMERFD)
12503     case TARGET_NR_timerfd_gettime:
12504         {
12505             struct itimerspec its_curr;
12506
12507             ret = get_errno(timerfd_gettime(arg1, &its_curr));
12508
12509             if (arg2 && host_to_target_itimerspec(arg2, &its_curr)) {
12510                 goto efault;
12511             }
12512         }
12513         break;
12514 #endif
12515
12516 #if defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD)
12517     case TARGET_NR_timerfd_settime:
12518         {
12519             struct itimerspec its_new, its_old, *p_new;
12520
12521             if (arg3) {
12522                 if (target_to_host_itimerspec(&its_new, arg3)) {
12523                     goto efault;
12524                 }
12525                 p_new = &its_new;
12526             } else {
12527                 p_new = NULL;
12528             }
12529
12530             ret = get_errno(timerfd_settime(arg1, arg2, p_new, &its_old));
12531
12532             if (arg4 && host_to_target_itimerspec(arg4, &its_old)) {
12533                 goto efault;
12534             }
12535         }
12536         break;
12537 #endif
12538
12539 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
12540     case TARGET_NR_ioprio_get:
12541         ret = get_errno(ioprio_get(arg1, arg2));
12542         break;
12543 #endif
12544
12545 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
12546     case TARGET_NR_ioprio_set:
12547         ret = get_errno(ioprio_set(arg1, arg2, arg3));
12548         break;
12549 #endif
12550
12551 #if defined(TARGET_NR_setns) && defined(CONFIG_SETNS)
12552     case TARGET_NR_setns:
12553         ret = get_errno(setns(arg1, arg2));
12554         break;
12555 #endif
12556 #if defined(TARGET_NR_unshare) && defined(CONFIG_SETNS)
12557     case TARGET_NR_unshare:
12558         ret = get_errno(unshare(arg1));
12559         break;
12560 #endif
12561 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
12562     case TARGET_NR_kcmp:
12563         ret = get_errno(kcmp(arg1, arg2, arg3, arg4, arg5));
12564         break;
12565 #endif
12566
12567     default:
12568     unimplemented:
12569         gemu_log("qemu: Unsupported syscall: %d\n", num);
12570 #if defined(TARGET_NR_setxattr) || defined(TARGET_NR_get_thread_area) || defined(TARGET_NR_getdomainname) || defined(TARGET_NR_set_robust_list)
12571     unimplemented_nowarn:
12572 #endif
12573         ret = -TARGET_ENOSYS;
12574         break;
12575     }
12576 fail:
12577 #ifdef DEBUG
12578     gemu_log(" = " TARGET_ABI_FMT_ld "\n", ret);
12579 #endif
12580     if(do_strace)
12581         print_syscall_ret(num, ret);
12582     trace_guest_user_syscall_ret(cpu, num, ret);
12583     return ret;
12584 efault:
12585     ret = -TARGET_EFAULT;
12586     goto fail;
12587 }