1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2000 Marcel Moolenaar 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __FBSDID("$FreeBSD$"); 31 32 #include <sys/param.h> 33 #include <sys/capsicum.h> 34 #include <sys/fcntl.h> 35 #include <sys/file.h> 36 #include <sys/imgact.h> 37 #include <sys/lock.h> 38 #include <sys/malloc.h> 39 #include <sys/mman.h> 40 #include <sys/mutex.h> 41 #include <sys/priv.h> 42 #include <sys/proc.h> 43 #include <sys/queue.h> 44 #include <sys/resource.h> 45 #include <sys/resourcevar.h> 46 #include <sys/sched.h> 47 #include <sys/signalvar.h> 48 #include <sys/syscallsubr.h> 49 #include <sys/sysproto.h> 50 #include <sys/systm.h> 51 #include <sys/sx.h> 52 #include <sys/unistd.h> 53 #include <sys/wait.h> 54 55 #include <machine/frame.h> 56 #include <machine/psl.h> 57 #include <machine/segments.h> 58 #include <machine/sysarch.h> 59 60 #include <vm/pmap.h> 61 #include <vm/vm.h> 62 #include <vm/vm_map.h> 63 64 #include <security/audit/audit.h> 65 66 #include <i386/linux/linux.h> 67 #include <i386/linux/linux_proto.h> 68 #include <compat/linux/linux_emul.h> 69 #include <compat/linux/linux_fork.h> 70 #include <compat/linux/linux_ipc.h> 71 #include <compat/linux/linux_misc.h> 72 #include <compat/linux/linux_mmap.h> 73 #include <compat/linux/linux_signal.h> 74 #include <compat/linux/linux_util.h> 75 76 #include <i386/include/pcb.h> /* needed for pcb definition in linux_set_thread_area */ 77 78 #include "opt_posix.h" 79 80 struct l_descriptor { 81 l_uint entry_number; 82 l_ulong base_addr; 83 l_uint limit; 84 l_uint seg_32bit:1; 85 l_uint contents:2; 86 l_uint read_exec_only:1; 87 l_uint limit_in_pages:1; 88 l_uint seg_not_present:1; 89 l_uint useable:1; 90 }; 91 92 struct l_old_select_argv { 93 l_int nfds; 94 l_fd_set *readfds; 95 l_fd_set *writefds; 96 l_fd_set *exceptfds; 97 struct l_timeval *timeout; 98 }; 99 100 int 101 linux_execve(struct thread *td, struct linux_execve_args *args) 102 { 103 struct image_args eargs; 104 char *newpath; 105 int error; 106 107 if (!LUSECONVPATH(td)) { 108 error = exec_copyin_args(&eargs, args->path, UIO_USERSPACE, 109 args->argp, args->envp); 110 } else { 111 LCONVPATHEXIST(args->path, &newpath); 112 error = exec_copyin_args(&eargs, newpath, UIO_SYSSPACE, 113 args->argp, args->envp); 114 LFREEPATH(newpath); 115 } 116 if (error == 0) 117 error = linux_common_execve(td, &eargs); 118 AUDIT_SYSCALL_EXIT(error == EJUSTRETURN ? 0 : error, td); 119 return (error); 120 } 121 122 struct l_ipc_kludge { 123 struct l_msgbuf *msgp; 124 l_long msgtyp; 125 }; 126 127 int 128 linux_ipc(struct thread *td, struct linux_ipc_args *args) 129 { 130 131 switch (args->what & 0xFFFF) { 132 case LINUX_SEMOP: { 133 struct linux_semop_args a; 134 135 a.semid = args->arg1; 136 a.tsops = PTRIN(args->ptr); 137 a.nsops = args->arg2; 138 return (linux_semop(td, &a)); 139 } 140 case LINUX_SEMGET: { 141 struct linux_semget_args a; 142 143 a.key = args->arg1; 144 a.nsems = args->arg2; 145 a.semflg = args->arg3; 146 return (linux_semget(td, &a)); 147 } 148 case LINUX_SEMCTL: { 149 struct linux_semctl_args a; 150 int error; 151 152 a.semid = args->arg1; 153 a.semnum = args->arg2; 154 a.cmd = args->arg3; 155 error = copyin(PTRIN(args->ptr), &a.arg, sizeof(a.arg)); 156 if (error) 157 return (error); 158 return (linux_semctl(td, &a)); 159 } 160 case LINUX_MSGSND: { 161 struct linux_msgsnd_args a; 162 163 a.msqid = args->arg1; 164 a.msgp = PTRIN(args->ptr); 165 a.msgsz = args->arg2; 166 a.msgflg = args->arg3; 167 return (linux_msgsnd(td, &a)); 168 } 169 case LINUX_MSGRCV: { 170 struct linux_msgrcv_args a; 171 172 a.msqid = args->arg1; 173 a.msgsz = args->arg2; 174 a.msgflg = args->arg3; 175 if ((args->what >> 16) == 0) { 176 struct l_ipc_kludge tmp; 177 int error; 178 179 if (args->ptr == 0) 180 return (EINVAL); 181 error = copyin(PTRIN(args->ptr), &tmp, sizeof(tmp)); 182 if (error) 183 return (error); 184 a.msgp = PTRIN(tmp.msgp); 185 a.msgtyp = tmp.msgtyp; 186 } else { 187 a.msgp = PTRIN(args->ptr); 188 a.msgtyp = args->arg5; 189 } 190 return (linux_msgrcv(td, &a)); 191 } 192 case LINUX_MSGGET: { 193 struct linux_msgget_args a; 194 195 a.key = args->arg1; 196 a.msgflg = args->arg2; 197 return (linux_msgget(td, &a)); 198 } 199 case LINUX_MSGCTL: { 200 struct linux_msgctl_args a; 201 202 a.msqid = args->arg1; 203 a.cmd = args->arg2; 204 a.buf = PTRIN(args->ptr); 205 return (linux_msgctl(td, &a)); 206 } 207 case LINUX_SHMAT: { 208 struct linux_shmat_args a; 209 l_uintptr_t addr; 210 int error; 211 212 a.shmid = args->arg1; 213 a.shmaddr = PTRIN(args->ptr); 214 a.shmflg = args->arg2; 215 error = linux_shmat(td, &a); 216 if (error != 0) 217 return (error); 218 addr = td->td_retval[0]; 219 error = copyout(&addr, PTRIN(args->arg3), sizeof(addr)); 220 td->td_retval[0] = 0; 221 return (error); 222 } 223 case LINUX_SHMDT: { 224 struct linux_shmdt_args a; 225 226 a.shmaddr = PTRIN(args->ptr); 227 return (linux_shmdt(td, &a)); 228 } 229 case LINUX_SHMGET: { 230 struct linux_shmget_args a; 231 232 a.key = args->arg1; 233 a.size = args->arg2; 234 a.shmflg = args->arg3; 235 return (linux_shmget(td, &a)); 236 } 237 case LINUX_SHMCTL: { 238 struct linux_shmctl_args a; 239 240 a.shmid = args->arg1; 241 a.cmd = args->arg2; 242 a.buf = PTRIN(args->ptr); 243 return (linux_shmctl(td, &a)); 244 } 245 default: 246 break; 247 } 248 249 return (EINVAL); 250 } 251 252 int 253 linux_old_select(struct thread *td, struct linux_old_select_args *args) 254 { 255 struct l_old_select_argv linux_args; 256 struct linux_select_args newsel; 257 int error; 258 259 error = copyin(args->ptr, &linux_args, sizeof(linux_args)); 260 if (error) 261 return (error); 262 263 newsel.nfds = linux_args.nfds; 264 newsel.readfds = linux_args.readfds; 265 newsel.writefds = linux_args.writefds; 266 newsel.exceptfds = linux_args.exceptfds; 267 newsel.timeout = linux_args.timeout; 268 return (linux_select(td, &newsel)); 269 } 270 271 int 272 linux_set_cloned_tls(struct thread *td, void *desc) 273 { 274 struct segment_descriptor sd; 275 struct l_user_desc info; 276 int idx, error; 277 int a[2]; 278 279 error = copyin(desc, &info, sizeof(struct l_user_desc)); 280 if (error) { 281 linux_msg(td, "set_cloned_tls copyin failed!"); 282 } else { 283 idx = info.entry_number; 284 285 /* 286 * looks like we're getting the idx we returned 287 * in the set_thread_area() syscall 288 */ 289 if (idx != 6 && idx != 3) { 290 linux_msg(td, "set_cloned_tls resetting idx!"); 291 idx = 3; 292 } 293 294 /* this doesnt happen in practice */ 295 if (idx == 6) { 296 /* we might copy out the entry_number as 3 */ 297 info.entry_number = 3; 298 error = copyout(&info, desc, sizeof(struct l_user_desc)); 299 if (error) 300 linux_msg(td, "set_cloned_tls copyout failed!"); 301 } 302 303 a[0] = LINUX_LDT_entry_a(&info); 304 a[1] = LINUX_LDT_entry_b(&info); 305 306 memcpy(&sd, &a, sizeof(a)); 307 /* set %gs */ 308 td->td_pcb->pcb_gsd = sd; 309 td->td_pcb->pcb_gs = GSEL(GUGS_SEL, SEL_UPL); 310 } 311 312 return (error); 313 } 314 315 int 316 linux_set_upcall(struct thread *td, register_t stack) 317 { 318 319 if (stack) 320 td->td_frame->tf_esp = stack; 321 322 /* 323 * The newly created Linux thread returns 324 * to the user space by the same path that a parent do. 325 */ 326 td->td_frame->tf_eax = 0; 327 return (0); 328 } 329 330 int 331 linux_mmap2(struct thread *td, struct linux_mmap2_args *args) 332 { 333 334 return (linux_mmap_common(td, args->addr, args->len, args->prot, 335 args->flags, args->fd, (uint64_t)(uint32_t)args->pgoff * 336 PAGE_SIZE)); 337 } 338 339 int 340 linux_mmap(struct thread *td, struct linux_mmap_args *args) 341 { 342 int error; 343 struct l_mmap_argv linux_args; 344 345 error = copyin(args->ptr, &linux_args, sizeof(linux_args)); 346 if (error) 347 return (error); 348 349 return (linux_mmap_common(td, linux_args.addr, linux_args.len, 350 linux_args.prot, linux_args.flags, linux_args.fd, 351 (uint32_t)linux_args.pgoff)); 352 } 353 354 int 355 linux_mprotect(struct thread *td, struct linux_mprotect_args *uap) 356 { 357 358 return (linux_mprotect_common(td, PTROUT(uap->addr), uap->len, uap->prot)); 359 } 360 361 int 362 linux_madvise(struct thread *td, struct linux_madvise_args *uap) 363 { 364 365 return (linux_madvise_common(td, PTROUT(uap->addr), uap->len, uap->behav)); 366 } 367 368 int 369 linux_ioperm(struct thread *td, struct linux_ioperm_args *args) 370 { 371 int error; 372 struct i386_ioperm_args iia; 373 374 iia.start = args->start; 375 iia.length = args->length; 376 iia.enable = args->enable; 377 error = i386_set_ioperm(td, &iia); 378 return (error); 379 } 380 381 int 382 linux_iopl(struct thread *td, struct linux_iopl_args *args) 383 { 384 int error; 385 386 if (args->level < 0 || args->level > 3) 387 return (EINVAL); 388 if ((error = priv_check(td, PRIV_IO)) != 0) 389 return (error); 390 if ((error = securelevel_gt(td->td_ucred, 0)) != 0) 391 return (error); 392 td->td_frame->tf_eflags = (td->td_frame->tf_eflags & ~PSL_IOPL) | 393 (args->level * (PSL_IOPL / 3)); 394 return (0); 395 } 396 397 int 398 linux_modify_ldt(struct thread *td, struct linux_modify_ldt_args *uap) 399 { 400 int error; 401 struct i386_ldt_args ldt; 402 struct l_descriptor ld; 403 union descriptor desc; 404 int size, written; 405 406 switch (uap->func) { 407 case 0x00: /* read_ldt */ 408 ldt.start = 0; 409 ldt.descs = uap->ptr; 410 ldt.num = uap->bytecount / sizeof(union descriptor); 411 error = i386_get_ldt(td, &ldt); 412 td->td_retval[0] *= sizeof(union descriptor); 413 break; 414 case 0x02: /* read_default_ldt = 0 */ 415 size = 5*sizeof(struct l_desc_struct); 416 if (size > uap->bytecount) 417 size = uap->bytecount; 418 for (written = error = 0; written < size && error == 0; written++) 419 error = subyte((char *)uap->ptr + written, 0); 420 td->td_retval[0] = written; 421 break; 422 case 0x01: /* write_ldt */ 423 case 0x11: /* write_ldt */ 424 if (uap->bytecount != sizeof(ld)) 425 return (EINVAL); 426 427 error = copyin(uap->ptr, &ld, sizeof(ld)); 428 if (error) 429 return (error); 430 431 ldt.start = ld.entry_number; 432 ldt.descs = &desc; 433 ldt.num = 1; 434 desc.sd.sd_lolimit = (ld.limit & 0x0000ffff); 435 desc.sd.sd_hilimit = (ld.limit & 0x000f0000) >> 16; 436 desc.sd.sd_lobase = (ld.base_addr & 0x00ffffff); 437 desc.sd.sd_hibase = (ld.base_addr & 0xff000000) >> 24; 438 desc.sd.sd_type = SDT_MEMRO | ((ld.read_exec_only ^ 1) << 1) | 439 (ld.contents << 2); 440 desc.sd.sd_dpl = 3; 441 desc.sd.sd_p = (ld.seg_not_present ^ 1); 442 desc.sd.sd_xx = 0; 443 desc.sd.sd_def32 = ld.seg_32bit; 444 desc.sd.sd_gran = ld.limit_in_pages; 445 error = i386_set_ldt(td, &ldt, &desc); 446 break; 447 default: 448 error = ENOSYS; 449 break; 450 } 451 452 if (error == EOPNOTSUPP) { 453 linux_msg(td, "modify_ldt needs kernel option USER_LDT"); 454 error = ENOSYS; 455 } 456 457 return (error); 458 } 459 460 int 461 linux_sigaction(struct thread *td, struct linux_sigaction_args *args) 462 { 463 l_osigaction_t osa; 464 l_sigaction_t act, oact; 465 int error; 466 467 if (args->nsa != NULL) { 468 error = copyin(args->nsa, &osa, sizeof(l_osigaction_t)); 469 if (error) 470 return (error); 471 act.lsa_handler = osa.lsa_handler; 472 act.lsa_flags = osa.lsa_flags; 473 act.lsa_restorer = osa.lsa_restorer; 474 LINUX_SIGEMPTYSET(act.lsa_mask); 475 act.lsa_mask.__mask = osa.lsa_mask; 476 } 477 478 error = linux_do_sigaction(td, args->sig, args->nsa ? &act : NULL, 479 args->osa ? &oact : NULL); 480 481 if (args->osa != NULL && !error) { 482 osa.lsa_handler = oact.lsa_handler; 483 osa.lsa_flags = oact.lsa_flags; 484 osa.lsa_restorer = oact.lsa_restorer; 485 osa.lsa_mask = oact.lsa_mask.__mask; 486 error = copyout(&osa, args->osa, sizeof(l_osigaction_t)); 487 } 488 489 return (error); 490 } 491 492 /* 493 * Linux has two extra args, restart and oldmask. We dont use these, 494 * but it seems that "restart" is actually a context pointer that 495 * enables the signal to happen with a different register set. 496 */ 497 int 498 linux_sigsuspend(struct thread *td, struct linux_sigsuspend_args *args) 499 { 500 sigset_t sigmask; 501 l_sigset_t mask; 502 503 LINUX_SIGEMPTYSET(mask); 504 mask.__mask = args->mask; 505 linux_to_bsd_sigset(&mask, &sigmask); 506 return (kern_sigsuspend(td, sigmask)); 507 } 508 509 int 510 linux_pause(struct thread *td, struct linux_pause_args *args) 511 { 512 struct proc *p = td->td_proc; 513 sigset_t sigmask; 514 515 PROC_LOCK(p); 516 sigmask = td->td_sigmask; 517 PROC_UNLOCK(p); 518 return (kern_sigsuspend(td, sigmask)); 519 } 520 521 int 522 linux_set_thread_area(struct thread *td, struct linux_set_thread_area_args *args) 523 { 524 struct l_user_desc info; 525 int error; 526 int idx; 527 int a[2]; 528 struct segment_descriptor sd; 529 530 error = copyin(args->desc, &info, sizeof(struct l_user_desc)); 531 if (error) 532 return (error); 533 534 idx = info.entry_number; 535 /* 536 * Semantics of Linux version: every thread in the system has array of 537 * 3 tls descriptors. 1st is GLIBC TLS, 2nd is WINE, 3rd unknown. This 538 * syscall loads one of the selected tls decriptors with a value and 539 * also loads GDT descriptors 6, 7 and 8 with the content of the 540 * per-thread descriptors. 541 * 542 * Semantics of FreeBSD version: I think we can ignore that Linux has 3 543 * per-thread descriptors and use just the 1st one. The tls_array[] 544 * is used only in set/get-thread_area() syscalls and for loading the 545 * GDT descriptors. In FreeBSD we use just one GDT descriptor for TLS 546 * so we will load just one. 547 * 548 * XXX: this doesn't work when a user space process tries to use more 549 * than 1 TLS segment. Comment in the Linux sources says wine might do 550 * this. 551 */ 552 553 /* 554 * we support just GLIBC TLS now 555 * we should let 3 proceed as well because we use this segment so 556 * if code does two subsequent calls it should succeed 557 */ 558 if (idx != 6 && idx != -1 && idx != 3) 559 return (EINVAL); 560 561 /* 562 * we have to copy out the GDT entry we use 563 * FreeBSD uses GDT entry #3 for storing %gs so load that 564 * 565 * XXX: what if a user space program doesn't check this value and tries 566 * to use 6, 7 or 8? 567 */ 568 idx = info.entry_number = 3; 569 error = copyout(&info, args->desc, sizeof(struct l_user_desc)); 570 if (error) 571 return (error); 572 573 if (LINUX_LDT_empty(&info)) { 574 a[0] = 0; 575 a[1] = 0; 576 } else { 577 a[0] = LINUX_LDT_entry_a(&info); 578 a[1] = LINUX_LDT_entry_b(&info); 579 } 580 581 memcpy(&sd, &a, sizeof(a)); 582 /* this is taken from i386 version of cpu_set_user_tls() */ 583 critical_enter(); 584 /* set %gs */ 585 td->td_pcb->pcb_gsd = sd; 586 PCPU_GET(fsgs_gdt)[1] = sd; 587 load_gs(GSEL(GUGS_SEL, SEL_UPL)); 588 critical_exit(); 589 590 return (0); 591 } 592 593 int 594 linux_get_thread_area(struct thread *td, struct linux_get_thread_area_args *args) 595 { 596 597 struct l_user_desc info; 598 int error; 599 int idx; 600 struct l_desc_struct desc; 601 struct segment_descriptor sd; 602 603 error = copyin(args->desc, &info, sizeof(struct l_user_desc)); 604 if (error) 605 return (error); 606 607 idx = info.entry_number; 608 /* XXX: I am not sure if we want 3 to be allowed too. */ 609 if (idx != 6 && idx != 3) 610 return (EINVAL); 611 612 idx = 3; 613 614 memset(&info, 0, sizeof(info)); 615 616 sd = PCPU_GET(fsgs_gdt)[1]; 617 618 memcpy(&desc, &sd, sizeof(desc)); 619 620 info.entry_number = idx; 621 info.base_addr = LINUX_GET_BASE(&desc); 622 info.limit = LINUX_GET_LIMIT(&desc); 623 info.seg_32bit = LINUX_GET_32BIT(&desc); 624 info.contents = LINUX_GET_CONTENTS(&desc); 625 info.read_exec_only = !LINUX_GET_WRITABLE(&desc); 626 info.limit_in_pages = LINUX_GET_LIMIT_PAGES(&desc); 627 info.seg_not_present = !LINUX_GET_PRESENT(&desc); 628 info.useable = LINUX_GET_USEABLE(&desc); 629 630 error = copyout(&info, args->desc, sizeof(struct l_user_desc)); 631 if (error) 632 return (EFAULT); 633 634 return (0); 635 } 636 637 /* XXX: this wont work with module - convert it */ 638 int 639 linux_mq_open(struct thread *td, struct linux_mq_open_args *args) 640 { 641 #ifdef P1003_1B_MQUEUE 642 return (sys_kmq_open(td, (struct kmq_open_args *)args)); 643 #else 644 return (ENOSYS); 645 #endif 646 } 647 648 int 649 linux_mq_unlink(struct thread *td, struct linux_mq_unlink_args *args) 650 { 651 #ifdef P1003_1B_MQUEUE 652 return (sys_kmq_unlink(td, (struct kmq_unlink_args *)args)); 653 #else 654 return (ENOSYS); 655 #endif 656 } 657 658 int 659 linux_mq_timedsend(struct thread *td, struct linux_mq_timedsend_args *args) 660 { 661 #ifdef P1003_1B_MQUEUE 662 return (sys_kmq_timedsend(td, (struct kmq_timedsend_args *)args)); 663 #else 664 return (ENOSYS); 665 #endif 666 } 667 668 int 669 linux_mq_timedreceive(struct thread *td, struct linux_mq_timedreceive_args *args) 670 { 671 #ifdef P1003_1B_MQUEUE 672 return (sys_kmq_timedreceive(td, (struct kmq_timedreceive_args *)args)); 673 #else 674 return (ENOSYS); 675 #endif 676 } 677 678 int 679 linux_mq_notify(struct thread *td, struct linux_mq_notify_args *args) 680 { 681 #ifdef P1003_1B_MQUEUE 682 return (sys_kmq_notify(td, (struct kmq_notify_args *)args)); 683 #else 684 return (ENOSYS); 685 #endif 686 } 687 688 int 689 linux_mq_getsetattr(struct thread *td, struct linux_mq_getsetattr_args *args) 690 { 691 #ifdef P1003_1B_MQUEUE 692 return (sys_kmq_setattr(td, (struct kmq_setattr_args *)args)); 693 #else 694 return (ENOSYS); 695 #endif 696 } 697