Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-2.12-pull-request' into staging

# gpg: Signature made Tue 13 Mar 2018 17:33:03 GMT
# gpg:                using RSA key F30C38BD3F2FBE3C
# gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>"
# gpg:                 aka "Laurent Vivier <laurent@vivier.eu>"
# gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>"
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier2/tags/linux-user-for-2.12-pull-request:
  linux-user: init_guest_space: Add a comment about search strategy
  linux-user: init_guest_space: Don't try to align if we'll reject it
  linux-user: init_guest_space: Clean up control flow a bit
  linux-user: init_guest_commpage: Add a comment about size check
  linux-user: init_guest_space: Clarify page alignment logic
  linux-user: init_guest_space: Correctly handle guest_start in commpage initialization
  linux-user: init_guest_space: Clean up if we can't initialize the commpage
  linux-user: Rename validate_guest_space => init_guest_commpage
  linux-user: Use #if to only call validate_guest_space for 32-bit ARM target
  qemu-binfmt-conf.sh: add qemu-xtensa
  linux-user: drop unused target_msync function
  linux-user: fix target_mprotect/target_munmap error return values
  linux-user: fix assertion in shmdt
  linux-user: fix mmap/munmap/mprotect/mremap/shmat
  linux-user: Support f_flags in statfs when available.
  linux-user: allows to use "--systemd ALL" with qemu-binfmt-conf.sh
  linux-user: Remove the unused "not implemented" signal handling stubs
  linux-user: Drop unicore32 code

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

17 files changed, 161 insertions, 875 deletions

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 0b141683f0..f4fa94e966 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -159,8 +159,12 @@ extern unsigned long guest_base;
 extern int have_guest_base;
 extern unsigned long reserved_va;
 
-#define GUEST_ADDR_MAX (reserved_va ? reserved_va : \
+#if HOST_LONG_BITS <= TARGET_VIRT_ADDR_SPACE_BITS
+#define GUEST_ADDR_MAX (~0ul)
+#else
+#define GUEST_ADDR_MAX (reserved_va ? reserved_va - 1 : \
                                     (1ul << TARGET_VIRT_ADDR_SPACE_BITS) - 1)
+#endif
 #else
 
 #include "exec/hwaddr.h"
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index 191f2e962a..5de8c8a5af 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -51,15 +51,13 @@
 /* All direct uses of g2h and h2g need to go away for usermode softmmu.  */
 #define g2h(x) ((void *)((unsigned long)(target_ulong)(x) + guest_base))
 
-#if HOST_LONG_BITS <= TARGET_VIRT_ADDR_SPACE_BITS
-#define h2g_valid(x) 1
-#else
-#define h2g_valid(x) ({ \
-    unsigned long __guest = (unsigned long)(x) - guest_base; \
-    (__guest < (1ul << TARGET_VIRT_ADDR_SPACE_BITS)) && \
-    (!reserved_va || (__guest < reserved_va)); \
-})
-#endif
+#define guest_addr_valid(x) ((x) <= GUEST_ADDR_MAX)
+#define h2g_valid(x) guest_addr_valid((unsigned long)(x) - guest_base)
+
+static inline int guest_range_valid(unsigned long start, unsigned long len)
+{
+    return len - 1 <= GUEST_ADDR_MAX && start <= GUEST_ADDR_MAX - len + 1;
+}
 
 #define h2g_nocheck(x) ({ \
     unsigned long __ret = (unsigned long)(x) - guest_base; \
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 5fc130cc20..9d10a5f592 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -354,7 +354,6 @@ enum {
 
 /* The commpage only exists for 32 bit kernels */
 
-#define TARGET_HAS_VALIDATE_GUEST_SPACE
 /* Return 1 if the proposed guest space is suitable for the guest.
  * Return 0 if the proposed guest space isn't suitable, but another
  * address space should be tried.
@@ -363,8 +362,8 @@ enum {
  * The guest code may leave a page mapped and populate it if the
  * address is suitable.
  */
-static int validate_guest_space(unsigned long guest_base,
-                                unsigned long guest_size)
+static int init_guest_commpage(unsigned long guest_base,
+                               unsigned long guest_size)
 {
     unsigned long real_start, test_page_addr;
 
@@ -375,6 +374,11 @@ static int validate_guest_space(unsigned long guest_base,
 
     /* If the commpage lies within the already allocated guest space,
      * then there is no way we can allocate it.
+     *
+     * You may be thinking that that this check is redundant because
+     * we already validated the guest size against MAX_RESERVED_VA;
+     * but if qemu_host_page_mask is unusually large, then
+     * test_page_addr may be lower.
      */
     if (test_page_addr >= guest_base
         && test_page_addr < (guest_base + guest_size)) {
@@ -563,78 +567,6 @@ static uint32_t get_elf_hwcap(void)
 #endif /* not TARGET_AARCH64 */
 #endif /* TARGET_ARM */
 
-#ifdef TARGET_UNICORE32
-
-#define ELF_START_MMAP          0x80000000
-
-#define ELF_CLASS               ELFCLASS32
-#define ELF_DATA                ELFDATA2LSB
-#define ELF_ARCH                EM_UNICORE32
-
-static inline void init_thread(struct target_pt_regs *regs,
-        struct image_info *infop)
-{
-    abi_long stack = infop->start_stack;
-    memset(regs, 0, sizeof(*regs));
-    regs->UC32_REG_asr = 0x10;
-    regs->UC32_REG_pc = infop->entry & 0xfffffffe;
-    regs->UC32_REG_sp = infop->start_stack;
-    /* FIXME - what to for failure of get_user()? */
-    get_user_ual(regs->UC32_REG_02, stack + 8); /* envp */
-    get_user_ual(regs->UC32_REG_01, stack + 4); /* envp */
-    /* XXX: it seems that r0 is zeroed after ! */
-    regs->UC32_REG_00 = 0;
-}
-
-#define ELF_NREG    34
-typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
-
-static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUUniCore32State *env)
-{
-    (*regs)[0] = env->regs[0];
-    (*regs)[1] = env->regs[1];
-    (*regs)[2] = env->regs[2];
-    (*regs)[3] = env->regs[3];
-    (*regs)[4] = env->regs[4];
-    (*regs)[5] = env->regs[5];
-    (*regs)[6] = env->regs[6];
-    (*regs)[7] = env->regs[7];
-    (*regs)[8] = env->regs[8];
-    (*regs)[9] = env->regs[9];
-    (*regs)[10] = env->regs[10];
-    (*regs)[11] = env->regs[11];
-    (*regs)[12] = env->regs[12];
-    (*regs)[13] = env->regs[13];
-    (*regs)[14] = env->regs[14];
-    (*regs)[15] = env->regs[15];
-    (*regs)[16] = env->regs[16];
-    (*regs)[17] = env->regs[17];
-    (*regs)[18] = env->regs[18];
-    (*regs)[19] = env->regs[19];
-    (*regs)[20] = env->regs[20];
-    (*regs)[21] = env->regs[21];
-    (*regs)[22] = env->regs[22];
-    (*regs)[23] = env->regs[23];
-    (*regs)[24] = env->regs[24];
-    (*regs)[25] = env->regs[25];
-    (*regs)[26] = env->regs[26];
-    (*regs)[27] = env->regs[27];
-    (*regs)[28] = env->regs[28];
-    (*regs)[29] = env->regs[29];
-    (*regs)[30] = env->regs[30];
-    (*regs)[31] = env->regs[31];
-
-    (*regs)[32] = cpu_asr_read((CPUUniCore32State *)env);
-    (*regs)[33] = env->regs[0]; /* XXX */
-}
-
-#define USE_ELF_CORE_DUMP
-#define ELF_EXEC_PAGESIZE               4096
-
-#define ELF_HWCAP                       (UC32_HWCAP_CMOV | UC32_HWCAP_UCF64)
-
-#endif
-
 #ifdef TARGET_SPARC
 #ifdef TARGET_SPARC64
 
@@ -1869,21 +1801,12 @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
     return sp;
 }
 
-#ifndef TARGET_HAS_VALIDATE_GUEST_SPACE
-/* If the guest doesn't have a validation function just agree */
-static int validate_guest_space(unsigned long guest_base,
-                                unsigned long guest_size)
-{
-    return 1;
-}
-#endif
-
 unsigned long init_guest_space(unsigned long host_start,
                                unsigned long host_size,
                                unsigned long guest_start,
                                bool fixed)
 {
-    unsigned long current_start, real_start;
+    unsigned long current_start, aligned_start;
     int flags;
 
     assert(host_start || host_size);
@@ -1891,11 +1814,12 @@ unsigned long init_guest_space(unsigned long host_start,
     /* If just a starting address is given, then just verify that
      * address.  */
     if (host_start && !host_size) {
-        if (validate_guest_space(host_start, host_size) == 1) {
-            return host_start;
-        } else {
+#if defined(TARGET_ARM) && !defined(TARGET_AARCH64)
+        if (init_guest_commpage(host_start, host_size) != 1) {
             return (unsigned long)-1;
         }
+#endif
+        return host_start;
     }
 
     /* Setup the initial flags and start address.  */
@@ -1908,7 +1832,8 @@ unsigned long init_guest_space(unsigned long host_start,
     /* Otherwise, a non-zero size region of memory needs to be mapped
      * and validated.  */
     while (1) {
-        unsigned long real_size = host_size;
+        unsigned long real_start, real_size, aligned_size;
+        aligned_size = real_size = host_size;
 
         /* Do not use mmap_find_vma here because that is limited to the
          * guest address space.  We are going to make the
@@ -1920,30 +1845,63 @@ unsigned long init_guest_space(unsigned long host_start,
             return (unsigned long)-1;
         }
 
+        /* Check to see if the address is valid.  */
+        if (host_start && real_start != current_start) {
+            goto try_again;
+        }
+
         /* Ensure the address is properly aligned.  */
         if (real_start & ~qemu_host_page_mask) {
+            /* Ideally, we adjust like
+             *
+             *    pages: [  ][  ][  ][  ][  ]
+             *      old:   [   real   ]
+             *             [ aligned  ]
+             *      new:   [     real     ]
+             *               [ aligned  ]
+             *
+             * But if there is something else mapped right after it,
+             * then obviously it won't have room to grow, and the
+             * kernel will put the new larger real someplace else with
+             * unknown alignment (if we made it to here, then
+             * fixed=false).  Which is why we grow real by a full page
+             * size, instead of by part of one; so that even if we get
+             * moved, we can still guarantee alignment.  But this does
+             * mean that there is a padding of < 1 page both before
+             * and after the aligned range; the "after" could could
+             * cause problems for ARM emulation where it could butt in
+             * to where we need to put the commpage.
+             */
             munmap((void *)real_start, host_size);
-            real_size = host_size + qemu_host_page_size;
+            real_size = aligned_size + qemu_host_page_size;
             real_start = (unsigned long)
                 mmap((void *)real_start, real_size, PROT_NONE, flags, -1, 0);
             if (real_start == (unsigned long)-1) {
                 return (unsigned long)-1;
             }
-            real_start = HOST_PAGE_ALIGN(real_start);
+            aligned_start = HOST_PAGE_ALIGN(real_start);
+        } else {
+            aligned_start = real_start;
         }
 
-        /* Check to see if the address is valid.  */
-        if (!host_start || real_start == current_start) {
-            int valid = validate_guest_space(real_start - guest_start,
-                                             real_size);
-            if (valid == 1) {
-                break;
-            } else if (valid == -1) {
-                return (unsigned long)-1;
-            }
-            /* valid == 0, so try again. */
+#if defined(TARGET_ARM) && !defined(TARGET_AARCH64)
+        /* On 32-bit ARM, we need to also be able to map the commpage.  */
+        int valid = init_guest_commpage(aligned_start - guest_start,
+                                        aligned_size + guest_start);
+        if (valid == -1) {
+            munmap((void *)real_start, real_size);
+            return (unsigned long)-1;
+        } else if (valid == 0) {
+            goto try_again;
         }
+#endif
+
+        /* If nothing has said `return -1` or `goto try_again` yet,
+         * then the address we have is good.
+         */
+        break;
 
+    try_again:
         /* That address didn't work.  Unmap and try a different one.
          * The address the host picked because is typically right at
          * the top of the host address space and leaves the guest with
@@ -1952,8 +1910,12 @@ unsigned long init_guest_space(unsigned long host_start,
          * happen often.  Probably means we got unlucky and host
          * address space randomization put a shared library somewhere
          * inconvenient.
+         *
+         * This is probably a good strategy if host_start, but is
+         * probably a bad strategy if not, which means we got here
+         * because of trouble with ARM commpage setup.
          */
-        munmap((void *)real_start, host_size);
+        munmap((void *)real_start, real_size);
         current_start += qemu_host_page_size;
         if (host_start == current_start) {
             /* Theoretically possible if host doesn't have any suitably
@@ -1965,7 +1927,7 @@ unsigned long init_guest_space(unsigned long host_start,
 
     qemu_log_mask(CPU_LOG_PAGE, "Reserved 0x%lx bytes of guest address space\n", host_size);
 
-    return real_start;
+    return aligned_start;
 }
 
 static void probe_guest_base(const char *image_name,
diff --git a/linux-user/main.c b/linux-user/main.c
index 7bc9bc79b0..b5d5e9cf4d 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -884,95 +884,6 @@ void cpu_loop(CPUARMState *env)
 
 #endif
 
-#ifdef TARGET_UNICORE32
-
-void cpu_loop(CPUUniCore32State *env)
-{
-    CPUState *cs = CPU(uc32_env_get_cpu(env));
-    int trapnr;
-    unsigned int n, insn;
-    target_siginfo_t info;
-
-    for (;;) {
-        cpu_exec_start(cs);
-        trapnr = cpu_exec(cs);
-        cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
-
-        switch (trapnr) {
-        case UC32_EXCP_PRIV:
-            {
-                /* system call */
-                get_user_u32(insn, env->regs[31] - 4);
-                n = insn & 0xffffff;
-
-                if (n >= UC32_SYSCALL_BASE) {
-                    /* linux syscall */
-                    n -= UC32_SYSCALL_BASE;
-                    if (n == UC32_SYSCALL_NR_set_tls) {
-                            cpu_set_tls(env, env->regs[0]);
-                            env->regs[0] = 0;
-                    } else {
-                        abi_long ret = do_syscall(env,
-                                                  n,
-                                                  env->regs[0],
-                                                  env->regs[1],
-                                                  env->regs[2],
-                                                  env->regs[3],
-                                                  env->regs[4],
-                                                  env->regs[5],
-                                                  0, 0);
-                        if (ret == -TARGET_ERESTARTSYS) {
-                            env->regs[31] -= 4;
-                        } else if (ret != -TARGET_QEMU_ESIGRETURN) {
-                            env->regs[0] = ret;
-                        }
-                    }
-                } else {
-                    goto error;
-                }
-            }
-            break;
-        case UC32_EXCP_DTRAP:
-        case UC32_EXCP_ITRAP:
-            info.si_signo = TARGET_SIGSEGV;
-            info.si_errno = 0;
-            /* XXX: check env->error_code */
-            info.si_code = TARGET_SEGV_MAPERR;
-            info._sifields._sigfault._addr = env->cp0.c4_faultaddr;
-            queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
-            break;
-        case EXCP_INTERRUPT:
-            /* just indicate that signals should be handled asap */
-            break;
-        case EXCP_DEBUG:
-            {
-                int sig;
-
-                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
-                if (sig) {
-                    info.si_signo = sig;
-                    info.si_errno = 0;
-                    info.si_code = TARGET_TRAP_BRKPT;
-                    queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
-                }
-            }
-            break;
-        case EXCP_ATOMIC:
-            cpu_exec_step_atomic(cs);
-            break;
-        default:
-            goto error;
-        }
-        process_pending_signals(env);
-    }
-
-error:
-    EXCP_DUMP(env, "qemu: unhandled CPU exception 0x%x - aborting\n", trapnr);
-    abort();
-}
-#endif
-
 #ifdef TARGET_SPARC
 #define SPARC64_STACK_BIAS 2047
 
@@ -4737,14 +4648,6 @@ int main(int argc, char **argv, char **envp)
         }
 #endif
     }
-#elif defined(TARGET_UNICORE32)
-    {
-        int i;
-        cpu_asr_write(env, regs->uregs[32], 0xffffffff);
-        for (i = 0; i < 32; i++) {
-            env->regs[i] = regs->uregs[i];
-        }
-    }
 #elif defined(TARGET_SPARC)
     {
         int i;
@@ -4974,7 +4877,7 @@ int main(int argc, char **argv, char **envp)
 #error unsupported target CPU
 #endif
 
-#if defined(TARGET_ARM) || defined(TARGET_M68K) || defined(TARGET_UNICORE32)
+#if defined(TARGET_ARM) || defined(TARGET_M68K)
     ts->stack_base = info->start_stack;
     ts->heap_base = info->brk;
     /* This will be filled in on the first SYS_HEAPINFO call.  */
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 0fbfd6dff2..9168a2051c 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -77,11 +77,12 @@ int target_mprotect(abi_ulong start, abi_ulong len, int prot)
 #endif
 
     if ((start & ~TARGET_PAGE_MASK) != 0)
-        return -EINVAL;
+        return -TARGET_EINVAL;
     len = TARGET_PAGE_ALIGN(len);
     end = start + len;
-    if (end < start)
-        return -EINVAL;
+    if (!guest_range_valid(start, len)) {
+        return -TARGET_ENOMEM;
+    }
     prot &= PROT_READ | PROT_WRITE | PROT_EXEC;
     if (len == 0)
         return 0;
@@ -481,8 +482,8 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
 	 * It can fail only on 64-bit host with 32-bit target.
 	 * On any other target/host host mmap() handles this error correctly.
 	 */
-        if ((unsigned long)start + len - 1 > (abi_ulong) -1) {
-            errno = EINVAL;
+        if (!guest_range_valid(start, len)) {
+            errno = ENOMEM;
             goto fail;
         }
 
@@ -620,10 +621,12 @@ int target_munmap(abi_ulong start, abi_ulong len)
            start, len);
 #endif
     if (start & ~TARGET_PAGE_MASK)
-        return -EINVAL;
+        return -TARGET_EINVAL;
     len = TARGET_PAGE_ALIGN(len);
-    if (len == 0)
-        return -EINVAL;
+    if (len == 0 || !guest_range_valid(start, len)) {
+        return -TARGET_EINVAL;
+    }
+
     mmap_lock();
     end = start + len;
     real_start = start & qemu_host_page_mask;
@@ -678,6 +681,13 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
     int prot;
     void *host_addr;
 
+    if (!guest_range_valid(old_addr, old_size) ||
+        ((flags & MREMAP_FIXED) &&
+         !guest_range_valid(new_addr, new_size))) {
+        errno = ENOMEM;
+        return -1;
+    }
+
     mmap_lock();
 
     if (flags & MREMAP_FIXED) {
@@ -744,20 +754,3 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
     mmap_unlock();
     return new_addr;
 }
-
-int target_msync(abi_ulong start, abi_ulong len, int flags)
-{
-    abi_ulong end;
-
-    if (start & ~TARGET_PAGE_MASK)
-        return -EINVAL;
-    len = TARGET_PAGE_ALIGN(len);
-    end = start + len;
-    if (end < start)
-        return -EINVAL;
-    if (end == start)
-        return 0;
-
-    start &= qemu_host_page_mask;
-    return msync(g2h(start), end - start, flags);
-}
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index f4b4ca72ad..192a0d2fef 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -100,9 +100,6 @@ typedef struct TaskState {
 # endif
     int swi_errno;
 #endif
-#ifdef TARGET_UNICORE32
-    int swi_errno;
-#endif
 #if defined(TARGET_I386) && !defined(TARGET_X86_64)
     abi_ulong target_v86;
     struct vm86_saved_state vm86_saved_regs;
@@ -115,7 +112,7 @@ typedef struct TaskState {
     int sim_syscalls;
     abi_ulong tp_value;
 #endif
-#if defined(TARGET_ARM) || defined(TARGET_M68K) || defined(TARGET_UNICORE32)
+#if defined(TARGET_ARM) || defined(TARGET_M68K)
     /* Extra fields for semihosted binaries.  */
     abi_ulong heap_base;
     abi_ulong heap_limit;
@@ -428,7 +425,6 @@ int target_munmap(abi_ulong start, abi_ulong len);
 abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
                        abi_ulong new_size, unsigned long flags,
                        abi_ulong new_addr);
-int target_msync(abi_ulong start, abi_ulong len, int flags);
 extern unsigned long last_brk;
 extern abi_ulong mmap_next_start;
 abi_ulong mmap_find_vma(abi_ulong, abi_ulong);
diff --git a/linux-user/signal.c b/linux-user/signal.c
index 2ce5d7a3c7..2461edf463 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -253,8 +253,7 @@ int do_sigprocmask(int how, const sigset_t *set, sigset_t *oldset)
     return 0;
 }
 
-#if !defined(TARGET_OPENRISC) && !defined(TARGET_UNICORE32) && \
-    !defined(TARGET_NIOS2)
+#if !defined(TARGET_OPENRISC) && !defined(TARGET_NIOS2)
 /* Just set the guest's signal mask to the specified value; the
  * caller is assumed to have called block_signals() already.
  */
@@ -512,7 +511,6 @@ void signal_init(void)
     }
 }
 
-#ifndef TARGET_UNICORE32
 /* Force a synchronously taken signal. The kernel force_sig() function
  * also forces the signal to "not blocked, not ignored", but for QEMU
  * that work is done in process_pending_signals().
@@ -546,7 +544,6 @@ static void force_sigsegv(int oldsig)
     }
     force_sig(TARGET_SIGSEGV);
 }
-#endif
 
 #endif
 
@@ -7052,32 +7049,7 @@ long do_rt_sigreturn(CPUArchState *env)
 }
 
 #else
-
-static void setup_frame(int sig, struct target_sigaction *ka,
-                        target_sigset_t *set, CPUArchState *env)
-{
-    fprintf(stderr, "setup_frame: not implemented\n");
-}
-
-static void setup_rt_frame(int sig, struct target_sigaction *ka,
-                           target_siginfo_t *info,
-                           target_sigset_t *set, CPUArchState *env)
-{
-    fprintf(stderr, "setup_rt_frame: not implemented\n");
-}
-
-long do_sigreturn(CPUArchState *env)
-{
-    fprintf(stderr, "do_sigreturn: not implemented\n");
-    return -TARGET_ENOSYS;
-}
-
-long do_rt_sigreturn(CPUArchState *env)
-{
-    fprintf(stderr, "do_rt_sigreturn: not implemented\n");
-    return -TARGET_ENOSYS;
-}
-
+#error Target needs to add support for signal handling
 #endif
 
 static void handle_pending_signal(CPUArchState *cpu_env, int sig,
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index b4f7b14fbe..f7ebe6233b 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4900,6 +4900,9 @@ static inline abi_ulong do_shmat(CPUArchState *cpu_env,
             return -TARGET_EINVAL;
         }
     }
+    if (!guest_range_valid(shmaddr, shm_info.shm_segsz)) {
+        return -TARGET_EINVAL;
+    }
 
     mmap_lock();
 
@@ -4944,6 +4947,9 @@ static inline abi_ulong do_shmat(CPUArchState *cpu_env,
 static inline abi_long do_shmdt(abi_ulong shmaddr)
 {
     int i;
+    abi_long rv;
+
+    mmap_lock();
 
     for (i = 0; i < N_SHM_REGIONS; ++i) {
         if (shm_regions[i].in_use && shm_regions[i].start == shmaddr) {
@@ -4952,8 +4958,11 @@ static inline abi_long do_shmdt(abi_ulong shmaddr)
             break;
         }
     }
+    rv = get_errno(shmdt(g2h(shmaddr)));
 
-    return get_errno(shmdt(g2h(shmaddr)));
+    mmap_unlock();
+
+    return rv;
 }
 
 #ifdef TARGET_NR_ipc
@@ -7468,7 +7477,7 @@ static int open_self_maps(void *cpu_env, int fd)
         }
         if (h2g_valid(min)) {
             int flags = page_get_flags(h2g(min));
-            max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX);
+            max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX) + 1;
             if (page_check_range(h2g(min), max - min, flags) == -1) {
                 continue;
             }
@@ -9545,6 +9554,11 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
+#ifdef _STATFS_F_FLAGS
+            __put_user(stfs.f_flags, &target_stfs->f_flags);
+#else
+            __put_user(0, &target_stfs->f_flags);
+#endif
             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
             unlock_user_struct(target_stfs, arg2, 1);
         }
diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index e00e1b3862..e53583e921 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -69,7 +69,7 @@
 
 #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SH4) \
     || defined(TARGET_M68K) || defined(TARGET_CRIS) \
-    || defined(TARGET_UNICORE32) || defined(TARGET_S390X) \
+    || defined(TARGET_S390X) \
     || defined(TARGET_OPENRISC) || defined(TARGET_TILEGX) \
     || defined(TARGET_NIOS2) || defined(TARGET_RISCV)
 
@@ -352,19 +352,6 @@ typedef struct {
         int     val[2];
 } kernel_fsid_t;
 
-struct kernel_statfs {
-	int f_type;
-	int f_bsize;
-	int f_blocks;
-	int f_bfree;
-	int f_bavail;
-	int f_files;
-	int f_ffree;
-        kernel_fsid_t f_fsid;
-	int f_namelen;
-	int f_spare[6];
-};
-
 struct target_dirent {
         abi_long        d_ino;
         abi_long        d_off;
@@ -433,7 +420,7 @@ int do_sigaction(int sig, const struct target_sigaction *act,
 #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SPARC) \
     || defined(TARGET_PPC) || defined(TARGET_MIPS) || defined(TARGET_SH4) \
     || defined(TARGET_M68K) || defined(TARGET_ALPHA) || defined(TARGET_CRIS) \
-    || defined(TARGET_MICROBLAZE) || defined(TARGET_UNICORE32) \
+    || defined(TARGET_MICROBLAZE) \
     || defined(TARGET_S390X) || defined(TARGET_OPENRISC) \
     || defined(TARGET_TILEGX) || defined(TARGET_HPPA) || defined(TARGET_NIOS2) \
     || defined(TARGET_RISCV)
@@ -1409,7 +1396,7 @@ struct target_winsize {
 
 #if (defined(TARGET_I386) && defined(TARGET_ABI32)) \
     || (defined(TARGET_ARM) && defined(TARGET_ABI32)) \
-    || defined(TARGET_CRIS) || defined(TARGET_UNICORE32)
+    || defined(TARGET_CRIS)
 struct target_stat {
 	unsigned short st_dev;
 	unsigned short __pad1;
@@ -2226,7 +2213,8 @@ struct target_statfs {
 	/* Linux specials */
 	target_fsid_t		f_fsid;
 	int32_t			f_namelen;
-	int32_t			f_spare[6];
+	int32_t			f_flags;
+	int32_t			f_spare[5];
 };
 #else
 struct target_statfs {
@@ -2242,7 +2230,8 @@ struct target_statfs {
 	/* Linux specials */
 	target_fsid_t		f_fsid;
 	abi_long		f_namelen;
-	abi_long		f_spare[6];
+	abi_long		f_flags;
+	abi_long		f_spare[5];
 };
 #endif
 
@@ -2258,7 +2247,8 @@ struct target_statfs64 {
 	uint64_t	f_bavail;
 	target_fsid_t	f_fsid;
 	uint32_t	f_namelen;
-	uint32_t	f_spare[6];
+	uint32_t	f_flags;
+	uint32_t	f_spare[5];
 };
 #elif (defined(TARGET_PPC64) || defined(TARGET_X86_64) || \
        defined(TARGET_SPARC64) || defined(TARGET_AARCH64) || \
@@ -2274,7 +2264,8 @@ struct target_statfs {
 	target_fsid_t f_fsid;
 	abi_long f_namelen;
 	abi_long f_frsize;
-	abi_long f_spare[5];
+	abi_long f_flags;
+	abi_long f_spare[4];
 };
 
 struct target_statfs64 {
@@ -2288,7 +2279,8 @@ struct target_statfs64 {
 	target_fsid_t f_fsid;
 	abi_long f_namelen;
 	abi_long f_frsize;
-	abi_long f_spare[5];
+	abi_long f_flags;
+	abi_long f_spare[4];
 };
 #elif defined(TARGET_S390X)
 struct target_statfs {
@@ -2302,7 +2294,9 @@ struct target_statfs {
     kernel_fsid_t f_fsid;
     int32_t  f_namelen;
     int32_t  f_frsize;
-    int32_t  f_spare[5];
+    int32_t  f_flags;
+    int32_t  f_spare[4];
+
 };
 
 struct target_statfs64 {
@@ -2316,7 +2310,8 @@ struct target_statfs64 {
     kernel_fsid_t f_fsid;
     int32_t  f_namelen;
     int32_t  f_frsize;
-    int32_t  f_spare[5];
+    int32_t  f_flags;
+    int32_t  f_spare[4];
 };
 #else
 struct target_statfs {
@@ -2330,7 +2325,8 @@ struct target_statfs {
 	target_fsid_t f_fsid;
 	uint32_t f_namelen;
 	uint32_t f_frsize;
-	uint32_t f_spare[5];
+	uint32_t f_flags;
+	uint32_t f_spare[4];
 };
 
 struct target_statfs64 {
@@ -2344,7 +2340,8 @@ struct target_statfs64 {
 	target_fsid_t f_fsid;
         uint32_t f_namelen;
 	uint32_t f_frsize;
-	uint32_t f_spare[5];
+	uint32_t f_flags;
+	uint32_t f_spare[4];
 };
 #endif
 
diff --git a/linux-user/unicore32/syscall_nr.h b/linux-user/unicore32/syscall_nr.h
deleted file mode 100644
index 486b8c45a0..0000000000
--- a/linux-user/unicore32/syscall_nr.h
+++ /dev/null
@@ -1,371 +0,0 @@
-/*
- * This file contains the system call numbers for UniCore32 oldabi.
- *
- * Copyright (C) 2010-2011 GUAN Xue-tao
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#define TARGET_NR_restart_syscall               0
-#define TARGET_NR_exit                          1
-#define TARGET_NR_fork                          2
-#define TARGET_NR_read                          3
-#define TARGET_NR_write                         4
-#define TARGET_NR_open                          5
-#define TARGET_NR_close                         6
-#define TARGET_NR_waitpid                       7
-#define TARGET_NR_creat                         8
-#define TARGET_NR_link                          9
-#define TARGET_NR_unlink                        10
-#define TARGET_NR_execve                        11
-#define TARGET_NR_chdir                         12
-#define TARGET_NR_time                          13
-#define TARGET_NR_mknod                         14
-#define TARGET_NR_chmod                         15
-#define TARGET_NR_lchown                        16
-#define TARGET_NR_break                         17
-                                                /* 18 */
-#define TARGET_NR_lseek                         19
-#define TARGET_NR_getpid                        20
-#define TARGET_NR_mount                         21
-#define TARGET_NR_umount                        22
-#define TARGET_NR_setuid                        23
-#define TARGET_NR_getuid                        24
-#define TARGET_NR_stime                         25
-#define TARGET_NR_ptrace                        26
-#define TARGET_NR_alarm                         27
-                                                /* 28 */
-#define TARGET_NR_pause                         29
-#define TARGET_NR_utime                         30
-#define TARGET_NR_stty                          31
-#define TARGET_NR_gtty                          32
-#define TARGET_NR_access                        33
-#define TARGET_NR_nice                          34
-#define TARGET_NR_ftime                         35
-#define TARGET_NR_sync                          36
-#define TARGET_NR_kill                          37
-#define TARGET_NR_rename                        38
-#define TARGET_NR_mkdir                         39
-#define TARGET_NR_rmdir                         40
-#define TARGET_NR_dup                           41
-#define TARGET_NR_pipe                          42
-#define TARGET_NR_times                         43
-#define TARGET_NR_prof                          44
-#define TARGET_NR_brk                           45
-#define TARGET_NR_setgid                        46
-#define TARGET_NR_getgid                        47
-#define TARGET_NR_signal                        48
-#define TARGET_NR_geteuid                       49
-#define TARGET_NR_getegid                       50
-#define TARGET_NR_acct                          51
-#define TARGET_NR_umount2                       52
-#define TARGET_NR_lock                          53
-#define TARGET_NR_ioctl                         54
-#define TARGET_NR_fcntl                         55
-#define TARGET_NR_mpx                           56
-#define TARGET_NR_setpgid                       57
-#define TARGET_NR_ulimit                        58
-                                                /* 59 */
-#define TARGET_NR_umask                         60
-#define TARGET_NR_chroot                        61
-#define TARGET_NR_ustat                         62
-#define TARGET_NR_dup2                          63
-#define TARGET_NR_getppid                       64
-#define TARGET_NR_getpgrp                       65
-#define TARGET_NR_setsid                        66
-#define TARGET_NR_sigaction                     67
-#define TARGET_NR_sgetmask                      68
-#define TARGET_NR_ssetmask                      69
-#define TARGET_NR_setreuid                      70
-#define TARGET_NR_setregid                      71
-#define TARGET_NR_sigsuspend                    72
-#define TARGET_NR_sigpending                    73
-#define TARGET_NR_sethostname                   74
-#define TARGET_NR_setrlimit                     75
-#define TARGET_NR_getrlimit                     76
-#define TARGET_NR_getrusage                     77
-#define TARGET_NR_gettimeofday                  78
-#define TARGET_NR_settimeofday                  79
-#define TARGET_NR_getgroups                     80
-#define TARGET_NR_setgroups                     81
-#define TARGET_NR_select                        82
-#define TARGET_NR_symlink                       83
-                                                /* 84 */
-#define TARGET_NR_readlink                      85
-#define TARGET_NR_uselib                        86
-#define TARGET_NR_swapon                        87
-#define TARGET_NR_reboot                        88
-#define TARGET_NR_readdir                       89
-#define TARGET_NR_mmap                          90
-#define TARGET_NR_munmap                        91
-#define TARGET_NR_truncate                      92
-#define TARGET_NR_ftruncate                     93
-#define TARGET_NR_fchmod                        94
-#define TARGET_NR_fchown                        95
-#define TARGET_NR_getpriority                   96
-#define TARGET_NR_setpriority                   97
-#define TARGET_NR_profil                        98
-#define TARGET_NR_statfs                        99
-#define TARGET_NR_fstatfs                       100
-#define TARGET_NR_ioperm                        101
-#define TARGET_NR_socketcall                    102
-#define TARGET_NR_syslog                        103
-#define TARGET_NR_setitimer                     104
-#define TARGET_NR_getitimer                     105
-#define TARGET_NR_stat                          106
-#define TARGET_NR_lstat                         107
-#define TARGET_NR_fstat                         108
-                                                /* 109 */
-                                                /* 110 */
-#define TARGET_NR_vhangup                       111
-#define TARGET_NR_idle                          112
-#define TARGET_NR_syscall                       113
-#define TARGET_NR_wait4                         114
-#define TARGET_NR_swapoff                       115
-#define TARGET_NR_sysinfo                       116
-#define TARGET_NR_ipc                           117
-#define TARGET_NR_fsync                         118
-#define TARGET_NR_sigreturn                     119
-#define TARGET_NR_clone                         120
-#define TARGET_NR_setdomainname                 121
-#define TARGET_NR_uname                         122
-#define TARGET_NR_modify_ldt                    123
-#define TARGET_NR_adjtimex                      124
-#define TARGET_NR_mprotect                      125
-#define TARGET_NR_sigprocmask                   126
-#define TARGET_NR_create_module                 127
-#define TARGET_NR_init_module                   128
-#define TARGET_NR_delete_module                 129
-#define TARGET_NR_get_kernel_syms               130
-#define TARGET_NR_quotactl                      131
-#define TARGET_NR_getpgid                       132
-#define TARGET_NR_fchdir                        133
-#define TARGET_NR_bdflush                       134
-#define TARGET_NR_sysfs                         135
-#define TARGET_NR_personality                   136
-#define TARGET_NR_afs_syscall                   137
-#define TARGET_NR_setfsuid                      138
-#define TARGET_NR_setfsgid                      139
-#define TARGET_NR__llseek                       140
-#define TARGET_NR_getdents                      141
-#define TARGET_NR__newselect                    142
-#define TARGET_NR_flock                         143
-#define TARGET_NR_msync                         144
-#define TARGET_NR_readv                         145
-#define TARGET_NR_writev                        146
-#define TARGET_NR_getsid                        147
-#define TARGET_NR_fdatasync                     148
-#define TARGET_NR__sysctl                       149
-#define TARGET_NR_mlock                         150
-#define TARGET_NR_munlock                       151
-#define TARGET_NR_mlockall                      152
-#define TARGET_NR_munlockall                    153
-#define TARGET_NR_sched_setparam                154
-#define TARGET_NR_sched_getparam                155
-#define TARGET_NR_sched_setscheduler            156
-#define TARGET_NR_sched_getscheduler            157
-#define TARGET_NR_sched_yield                   158
-#define TARGET_NR_sched_get_priority_max        159
-#define TARGET_NR_sched_get_priority_min        160
-#define TARGET_NR_sched_rr_get_interval         161
-#define TARGET_NR_nanosleep                     162
-#define TARGET_NR_mremap                        163
-#define TARGET_NR_setresuid                     164
-#define TARGET_NR_getresuid                     165
-#define TARGET_NR_vm86                          166
-#define TARGET_NR_query_module                  167
-#define TARGET_NR_poll                          168
-#define TARGET_NR_nfsservctl                    169
-#define TARGET_NR_setresgid                     170
-#define TARGET_NR_getresgid                     171
-#define TARGET_NR_prctl                         172
-#define TARGET_NR_rt_sigreturn                  173
-#define TARGET_NR_rt_sigaction                  174
-#define TARGET_NR_rt_sigprocmask                175
-#define TARGET_NR_rt_sigpending                 176
-#define TARGET_NR_rt_sigtimedwait               177
-#define TARGET_NR_rt_sigqueueinfo               178
-#define TARGET_NR_rt_sigsuspend                 179
-#define TARGET_NR_pread64                       180
-#define TARGET_NR_pwrite64                      181
-#define TARGET_NR_chown                         182
-#define TARGET_NR_getcwd                        183
-#define TARGET_NR_capget                        184
-#define TARGET_NR_capset                        185
-#define TARGET_NR_sigaltstack                   186
-#define TARGET_NR_sendfile                      187
-                                                /* 188 */
-                                                /* 189 */
-#define TARGET_NR_vfork                         190
-#define TARGET_NR_ugetrlimit                    191
-#define TARGET_NR_mmap2                         192
-#define TARGET_NR_truncate64                    193
-#define TARGET_NR_ftruncate64                   194
-#define TARGET_NR_stat64                        195
-#define TARGET_NR_lstat64                       196
-#define TARGET_NR_fstat64                       197
-#define TARGET_NR_lchown32                      198
-#define TARGET_NR_getuid32                      199
-#define TARGET_NR_getgid32                      200
-#define TARGET_NR_geteuid32                     201
-#define TARGET_NR_getegid32                     202
-#define TARGET_NR_setreuid32                    203
-#define TARGET_NR_setregid32                    204
-#define TARGET_NR_getgroups32                   205
-#define TARGET_NR_setgroups32                   206
-#define TARGET_NR_fchown32                      207
-#define TARGET_NR_setresuid32                   208
-#define TARGET_NR_getresuid32                   209
-#define TARGET_NR_setresgid32                   210
-#define TARGET_NR_getresgid32                   211
-#define TARGET_NR_chown32                       212
-#define TARGET_NR_setuid32                      213
-#define TARGET_NR_setgid32                      214
-#define TARGET_NR_setfsuid32                    215
-#define TARGET_NR_setfsgid32                    216
-#define TARGET_NR_getdents64                    217
-#define TARGET_NR_pivot_root                    218
-#define TARGET_NR_mincore                       219
-#define TARGET_NR_madvise                       220
-#define TARGET_NR_fcntl64                       221
-                                                /* 222 */
-                                                /* 223 */
-#define TARGET_NR_gettid                        224
-#define TARGET_NR_readahead                     225
-#define TARGET_NR_setxattr                      226
-#define TARGET_NR_lsetxattr                     227
-#define TARGET_NR_fsetxattr                     228
-#define TARGET_NR_getxattr                      229
-#define TARGET_NR_lgetxattr                     230
-#define TARGET_NR_fgetxattr                     231
-#define TARGET_NR_listxattr                     232
-#define TARGET_NR_llistxattr                    233
-#define TARGET_NR_flistxattr                    234
-#define TARGET_NR_removexattr                   235
-#define TARGET_NR_lremovexattr                  236
-#define TARGET_NR_fremovexattr                  237
-#define TARGET_NR_tkill                         238
-#define TARGET_NR_sendfile64                    239
-#define TARGET_NR_futex                         240
-#define TARGET_NR_sched_setaffinity             241
-#define TARGET_NR_sched_getaffinity             242
-#define TARGET_NR_io_setup                      243
-#define TARGET_NR_io_destroy                    244
-#define TARGET_NR_io_getevents                  245
-#define TARGET_NR_io_submit                     246
-#define TARGET_NR_io_cancel                     247
-#define TARGET_NR_exit_group                    248
-#define TARGET_NR_lookup_dcookie                249
-#define TARGET_NR_epoll_create                  250
-#define TARGET_NR_epoll_ctl                     251
-#define TARGET_NR_epoll_wait                    252
-#define TARGET_NR_remap_file_pages              253
-                                                /* 254 */
-                                                /* 255 */
-                                                /* 256 */
-#define TARGET_NR_set_tid_address               256
-#define TARGET_NR_timer_create                  257
-#define TARGET_NR_timer_settime                 258
-#define TARGET_NR_timer_gettime                 259
-#define TARGET_NR_timer_getoverrun              260
-#define TARGET_NR_timer_delete                  261
-#define TARGET_NR_clock_settime                 262
-#define TARGET_NR_clock_gettime                 263
-#define TARGET_NR_clock_getres                  264
-#define TARGET_NR_clock_nanosleep               265
-#define TARGET_NR_statfs64                      266
-#define TARGET_NR_fstatfs64                     267
-#define TARGET_NR_tgkill                        268
-#define TARGET_NR_utimes                        269
-#define TARGET_NR_fadvise64_64                  270
-#define TARGET_NR_pciconfig_iobase              271
-#define TARGET_NR_pciconfig_read                272
-#define TARGET_NR_pciconfig_write               273
-#define TARGET_NR_mq_open                       274
-#define TARGET_NR_mq_unlink                     275
-#define TARGET_NR_mq_timedsend                  276
-#define TARGET_NR_mq_timedreceive               277
-#define TARGET_NR_mq_notify                     278
-#define TARGET_NR_mq_getsetattr                 279
-#define TARGET_NR_waitid                        280
-#define TARGET_NR_socket                        281
-#define TARGET_NR_bind                          282
-#define TARGET_NR_connect                       283
-#define TARGET_NR_listen                        284
-#define TARGET_NR_accept                        285
-#define TARGET_NR_getsockname                   286
-#define TARGET_NR_getpeername                   287
-#define TARGET_NR_socketpair                    288
-#define TARGET_NR_send                          289
-#define TARGET_NR_sendto                        290
-#define TARGET_NR_recv                          291
-#define TARGET_NR_recvfrom                      292
-#define TARGET_NR_shutdown                      293
-#define TARGET_NR_setsockopt                    294
-#define TARGET_NR_getsockopt                    295
-#define TARGET_NR_sendmsg                       296
-#define TARGET_NR_recvmsg                       297
-#define TARGET_NR_semop                         298
-#define TARGET_NR_semget                        299
-#define TARGET_NR_semctl                        300
-#define TARGET_NR_msgsnd                        301
-#define TARGET_NR_msgrcv                        302
-#define TARGET_NR_msgget                        303
-#define TARGET_NR_msgctl                        304
-#define TARGET_NR_shmat                         305
-#define TARGET_NR_shmdt                         306
-#define TARGET_NR_shmget                        307
-#define TARGET_NR_shmctl                        308
-#define TARGET_NR_add_key                       309
-#define TARGET_NR_request_key                   310
-#define TARGET_NR_keyctl                        311
-#define TARGET_NR_semtimedop                    312
-#define TARGET_NR_vserver                       313
-#define TARGET_NR_ioprio_set                    314
-#define TARGET_NR_ioprio_get                    315
-#define TARGET_NR_inotify_init                  316
-#define TARGET_NR_inotify_add_watch             317
-#define TARGET_NR_inotify_rm_watch              318
-#define TARGET_NR_mbind                         319
-#define TARGET_NR_get_mempolicy                 320
-#define TARGET_NR_set_mempolicy                 321
-#define TARGET_NR_openat                        322
-#define TARGET_NR_mkdirat                       323
-#define TARGET_NR_mknodat                       324
-#define TARGET_NR_fchownat                      325
-#define TARGET_NR_futimesat                     326
-#define TARGET_NR_fstatat64                     327
-#define TARGET_NR_unlinkat                      328
-#define TARGET_NR_renameat                      329
-#define TARGET_NR_linkat                        330
-#define TARGET_NR_symlinkat                     331
-#define TARGET_NR_readlinkat                    332
-#define TARGET_NR_fchmodat                      333
-#define TARGET_NR_faccessat                     334
-                                                /* 335 */
-                                                /* 336 */
-#define TARGET_NR_unshare                       337
-#define TARGET_NR_set_robust_list               338
-#define TARGET_NR_get_robust_list               339
-#define TARGET_NR_splice                        340
-#define TARGET_NR_sync_file_range2              341
-#define TARGET_NR_tee                           342
-#define TARGET_NR_vmsplice                      343
-#define TARGET_NR_move_pages                    344
-#define TARGET_NR_getcpu                        345
-                                                /* 346 */
-#define TARGET_NR_kexec_load                    347
-#define TARGET_NR_utimensat                     348
-#define TARGET_NR_signalfd                      349
-#define TARGET_NR_timerfd                       350
-#define TARGET_NR_eventfd                       351
-#define TARGET_NR_fallocate                     352
-#define TARGET_NR_timerfd_settime               353
-#define TARGET_NR_timerfd_gettime               354
-#define TARGET_NR_signalfd4                     355
-#define TARGET_NR_eventfd2                      356
-#define TARGET_NR_epoll_create1                 357
-#define TARGET_NR_dup3                          358
-#define TARGET_NR_pipe2                         359
-#define TARGET_NR_inotify_init1                 360
diff --git a/linux-user/unicore32/target_cpu.h b/linux-user/unicore32/target_cpu.h
deleted file mode 100644
index d7d2e7b083..0000000000
--- a/linux-user/unicore32/target_cpu.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * UniCore32 specific CPU ABI and functions for linux-user
- *
- * Copyright (C) 2010-2012 Guan Xuetao
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation, or (at your option) any
- * later version. See the COPYING file in the top-level directory.
- */
-#ifndef UNICORE32_TARGET_CPU_H
-#define UNICORE32_TARGET_CPU_H
-
-static inline void cpu_clone_regs(CPUUniCore32State *env, target_ulong newsp)
-{
-    if (newsp) {
-        env->regs[29] = newsp;
-    }
-    env->regs[0] = 0;
-}
-
-static inline void cpu_set_tls(CPUUniCore32State *env, target_ulong newtls)
-{
-    env->regs[16] = newtls;
-}
-
-#endif
diff --git a/linux-user/unicore32/target_elf.h b/linux-user/unicore32/target_elf.h
deleted file mode 100644
index e2bfcb2ca3..0000000000
--- a/linux-user/unicore32/target_elf.h
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation, or (at your option) any
- * later version. See the COPYING file in the top-level directory.
- */
-
-#ifndef UNICORE32_TARGET_ELF_H
-#define UNICORE32_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "any";
-}
-#endif
diff --git a/linux-user/unicore32/target_signal.h b/linux-user/unicore32/target_signal.h
deleted file mode 100644
index c6496fb9ea..0000000000
--- a/linux-user/unicore32/target_signal.h
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright (C) 2010-2011 GUAN Xue-tao
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef UNICORE32_TARGET_SIGNAL_H
-#define UNICORE32_TARGET_SIGNAL_H
-
-/* this struct defines a stack used during syscall handling */
-typedef struct target_sigaltstack {
-    abi_ulong ss_sp;
-    abi_ulong ss_flags;
-    abi_ulong ss_size;
-} target_stack_t;
-
-/*
- * sigaltstack controls
- */
-#define TARGET_SS_ONSTACK               1
-#define TARGET_SS_DISABLE               2
-
-static inline abi_ulong get_sp_from_cpustate(CPUUniCore32State *state)
-{
-    return state->regs[29];
-}
-
-
-#endif /* UNICORE32_TARGET_SIGNAL_H */
diff --git a/linux-user/unicore32/target_structs.h b/linux-user/unicore32/target_structs.h
deleted file mode 100644
index fbd4fa3f53..0000000000
--- a/linux-user/unicore32/target_structs.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * UniCore32 specific structures for linux-user
- *
- * Copyright (c) 2013 Fabrice Bellard
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-#ifndef UNICORE32_TARGET_STRUCTS_H
-#define UNICORE32_TARGET_STRUCTS_H
-
-struct target_ipc_perm {
-    abi_int __key;                      /* Key.  */
-    abi_uint uid;                       /* Owner's user ID.  */
-    abi_uint gid;                       /* Owner's group ID.  */
-    abi_uint cuid;                      /* Creator's user ID.  */
-    abi_uint cgid;                      /* Creator's group ID.  */
-    abi_ushort mode;                    /* Read/write permission.  */
-    abi_ushort __pad1;
-    abi_ushort __seq;                   /* Sequence number.  */
-    abi_ushort __pad2;
-    abi_ulong __unused1;
-    abi_ulong __unused2;
-};
-
-struct target_shmid_ds {
-    struct target_ipc_perm shm_perm;    /* operation permission struct */
-    abi_long shm_segsz;                 /* size of segment in bytes */
-    abi_ulong shm_atime;                /* time of last shmat() */
-#if TARGET_ABI_BITS == 32
-    abi_ulong __unused1;
-#endif
-    abi_ulong shm_dtime;                /* time of last shmdt() */
-#if TARGET_ABI_BITS == 32
-    abi_ulong __unused2;
-#endif
-    abi_ulong shm_ctime;                /* time of last change by shmctl() */
-#if TARGET_ABI_BITS == 32
-    abi_ulong __unused3;
-#endif
-    abi_int shm_cpid;                   /* pid of creator */
-    abi_int shm_lpid;                   /* pid of last shmop */
-    abi_ulong shm_nattch;               /* number of current attaches */
-    abi_ulong __unused4;
-    abi_ulong __unused5;
-};
-
-#endif
diff --git a/linux-user/unicore32/target_syscall.h b/linux-user/unicore32/target_syscall.h
deleted file mode 100644
index 346b207700..0000000000
--- a/linux-user/unicore32/target_syscall.h
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright (C) 2010-2011 GUAN Xue-tao
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef UNICORE32_TARGET_SYSCALL_H
-#define UNICORE32_TARGET_SYSCALL_H
-
-struct target_pt_regs {
-    abi_ulong uregs[34];
-};
-
-#define UC32_REG_pc             uregs[31]
-#define UC32_REG_lr             uregs[30]
-#define UC32_REG_sp             uregs[29]
-#define UC32_REG_ip             uregs[28]
-#define UC32_REG_fp             uregs[27]
-#define UC32_REG_26             uregs[26]
-#define UC32_REG_25             uregs[25]
-#define UC32_REG_24             uregs[24]
-#define UC32_REG_23             uregs[23]
-#define UC32_REG_22             uregs[22]
-#define UC32_REG_21             uregs[21]
-#define UC32_REG_20             uregs[20]
-#define UC32_REG_19             uregs[19]
-#define UC32_REG_18             uregs[18]
-#define UC32_REG_17             uregs[17]
-#define UC32_REG_16             uregs[16]
-#define UC32_REG_15             uregs[15]
-#define UC32_REG_14             uregs[14]
-#define UC32_REG_13             uregs[13]
-#define UC32_REG_12             uregs[12]
-#define UC32_REG_11             uregs[11]
-#define UC32_REG_10             uregs[10]
-#define UC32_REG_09             uregs[9]
-#define UC32_REG_08             uregs[8]
-#define UC32_REG_07             uregs[7]
-#define UC32_REG_06             uregs[6]
-#define UC32_REG_05             uregs[5]
-#define UC32_REG_04             uregs[4]
-#define UC32_REG_03             uregs[3]
-#define UC32_REG_02             uregs[2]
-#define UC32_REG_01             uregs[1]
-#define UC32_REG_00             uregs[0]
-#define UC32_REG_asr            uregs[32]
-#define UC32_REG_ORIG_00        uregs[33]
-
-#define UC32_SYSCALL_BASE               0x900000
-#define UC32_SYSCALL_ARCH_BASE          0xf0000
-#define UC32_SYSCALL_NR_set_tls         (UC32_SYSCALL_ARCH_BASE + 5)
-
-#define UNAME_MACHINE "UniCore-II"
-#define UNAME_MINIMUM_RELEASE "2.6.32"
-
-#define TARGET_MINSIGSTKSZ 2048
-#define TARGET_MLOCKALL_MCL_CURRENT 1
-#define TARGET_MLOCKALL_MCL_FUTURE  2
-
-#endif /* UNICORE32_TARGET_SYSCALL_H */
diff --git a/linux-user/unicore32/termbits.h b/linux-user/unicore32/termbits.h
deleted file mode 100644
index a5fcd64abf..0000000000
--- a/linux-user/unicore32/termbits.h
+++ /dev/null
@@ -1,2 +0,0 @@
-/* NOTE: exactly the same as i386 */
-#include "../i386/termbits.h"
diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
index bdb21bdd58..f39ad344fc 100755
--- a/scripts/qemu-binfmt-conf.sh
+++ b/scripts/qemu-binfmt-conf.sh
@@ -1,10 +1,10 @@
 #!/bin/sh
-# enable automatic i386/ARM/M68K/MIPS/SPARC/PPC/s390/HPPA
+# enable automatic i386/ARM/M68K/MIPS/SPARC/PPC/s390/HPPA/Xtensa
 # program execution by the kernel
 
 qemu_target_list="i386 i486 alpha arm armeb sparc32plus ppc ppc64 ppc64le m68k \
 mips mipsel mipsn32 mipsn32el mips64 mips64el \
-sh4 sh4eb s390x aarch64 aarch64_be hppa riscv32 riscv64"
+sh4 sh4eb s390x aarch64 aarch64_be hppa riscv32 riscv64 xtensa xtensaeb"
 
 i386_magic='\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x03\x00'
 i386_mask='\xff\xff\xff\xff\xff\xfe\xfe\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'
@@ -108,6 +108,14 @@ riscv64_magic='\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x
 riscv64_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'
 riscv64_family=riscv
 
+xtensa_magic='\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x5e\x00'
+xtensa_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'
+xtensa_family=xtensa
+
+xtensaeb_magic='\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x5e'
+xtensaeb_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
+xtensaeb_family=xtensaeb
+
 qemu_get_family() {
     cpu=${HOST_ARCH:-$(uname -m)}
     case "$cpu" in
@@ -154,7 +162,8 @@ Usage: qemu-binfmt-conf.sh [--qemu-path PATH][--debian][--systemd CPU]
                      instead generate update-binfmts templates
        --systemd:    don't write into /proc,
                      instead generate file for systemd-binfmt.service
-                     for the given CPU
+                     for the given CPU. If CPU is "ALL", generate a
+                     file for all known cpus
        --exportdir:  define where to write configuration files
                      (default: $SYSTEMDDIR or $DEBIANDIR)
        --credential: if yes, credential and security tokens are
@@ -301,18 +310,20 @@ while true ; do
         EXPORTDIR=${EXPORTDIR:-$SYSTEMDDIR}
         shift
         # check given cpu is in the supported CPU list
-        for cpu in ${qemu_target_list} ; do
+        if [ "$1" != "ALL" ] ; then
+            for cpu in ${qemu_target_list} ; do
+                if [ "$cpu" = "$1" ] ; then
+                    break
+                fi
+            done
+
             if [ "$cpu" = "$1" ] ; then
-                break
+                qemu_target_list="$1"
+            else
+                echo "ERROR: unknown CPU \"$1\"" 1>&2
+                usage
+                exit 1
             fi
-        done
-
-        if [ "$cpu" = "$1" ] ; then
-            qemu_target_list="$1"
-        else
-            echo "ERROR: unknown CPU \"$1\"" 1>&2
-            usage
-            exit 1
         fi
         ;;
     -Q|--qemu-path)