1 /*- 2 * Copyright (c) 2004 Tim J. Robbins 3 * Copyright (c) 2002 Doug Rabson 4 * Copyright (c) 2000 Marcel Moolenaar 5 * All rights reserved. 6 * Copyright (c) 2013 Dmitry Chagin <dchagin@FreeBSD.org> 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer 13 * in this position and unchanged. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. The name of the author may not be used to endorse or promote products 18 * derived from this software without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 23 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/param.h> 33 #include <sys/systm.h> 34 #include <sys/ktr.h> 35 #include <sys/lock.h> 36 #include <sys/malloc.h> 37 #include <sys/mman.h> 38 #include <sys/mutex.h> 39 #include <sys/priv.h> 40 #include <sys/proc.h> 41 #include <sys/ptrace.h> 42 #include <sys/syscallsubr.h> 43 44 #include <security/mac/mac_framework.h> 45 46 #include <ufs/ufs/extattr.h> 47 #include <ufs/ufs/quota.h> 48 #include <ufs/ufs/ufsmount.h> 49 50 #include <machine/frame.h> 51 #include <machine/md_var.h> 52 #include <machine/pcb.h> 53 #include <machine/psl.h> 54 #include <machine/segments.h> 55 #include <machine/specialreg.h> 56 57 #include <vm/pmap.h> 58 #include <vm/vm.h> 59 #include <vm/vm_param.h> 60 #include <vm/vm_extern.h> 61 #include <vm/vm_kern.h> 62 #include <vm/vm_map.h> 63 64 #include <x86/ifunc.h> 65 #include <x86/reg.h> 66 #include <x86/sysarch.h> 67 68 #include <amd64/linux/linux.h> 69 #include <amd64/linux/linux_proto.h> 70 #include <compat/linux/linux_fork.h> 71 #include <compat/linux/linux_misc.h> 72 #include <compat/linux/linux_mmap.h> 73 #include <compat/linux/linux_util.h> 74 75 #define LINUX_ARCH_AMD64 0xc000003e 76 77 int 78 linux_set_upcall(struct thread *td, register_t stack) 79 { 80 81 if (stack) 82 td->td_frame->tf_rsp = stack; 83 84 /* 85 * The newly created Linux thread returns 86 * to the user space by the same path that a parent does. 87 */ 88 td->td_frame->tf_rax = 0; 89 return (0); 90 } 91 92 int 93 linux_mmap2(struct thread *td, struct linux_mmap2_args *args) 94 { 95 96 return (linux_mmap_common(td, args->addr, args->len, args->prot, 97 args->flags, args->fd, args->pgoff)); 98 } 99 100 int 101 linux_mprotect(struct thread *td, struct linux_mprotect_args *uap) 102 { 103 104 return (linux_mprotect_common(td, uap->addr, uap->len, uap->prot)); 105 } 106 107 int 108 linux_madvise(struct thread *td, struct linux_madvise_args *uap) 109 { 110 111 return (linux_madvise_common(td, uap->addr, uap->len, uap->behav)); 112 } 113 114 int 115 linux_iopl(struct thread *td, struct linux_iopl_args *args) 116 { 117 int error; 118 119 LINUX_CTR(iopl); 120 121 if (args->level > 3) 122 return (EINVAL); 123 if ((error = priv_check(td, PRIV_IO)) != 0) 124 return (error); 125 if ((error = securelevel_gt(td->td_ucred, 0)) != 0) 126 return (error); 127 td->td_frame->tf_rflags = (td->td_frame->tf_rflags & ~PSL_IOPL) | 128 (args->level * (PSL_IOPL / 3)); 129 130 return (0); 131 } 132 133 int 134 linux_pause(struct thread *td, struct linux_pause_args *args) 135 { 136 struct proc *p = td->td_proc; 137 sigset_t sigmask; 138 139 LINUX_CTR(pause); 140 141 PROC_LOCK(p); 142 sigmask = td->td_sigmask; 143 PROC_UNLOCK(p); 144 return (kern_sigsuspend(td, sigmask)); 145 } 146 147 int 148 linux_arch_prctl(struct thread *td, struct linux_arch_prctl_args *args) 149 { 150 unsigned long long cet[3]; 151 struct pcb *pcb; 152 int error; 153 154 pcb = td->td_pcb; 155 LINUX_CTR2(arch_prctl, "0x%x, %p", args->code, args->addr); 156 157 switch (args->code) { 158 case LINUX_ARCH_SET_GS: 159 if (args->addr < VM_MAXUSER_ADDRESS) { 160 update_pcb_bases(pcb); 161 pcb->pcb_gsbase = args->addr; 162 td->td_frame->tf_gs = _ugssel; 163 error = 0; 164 } else 165 error = EPERM; 166 break; 167 case LINUX_ARCH_SET_FS: 168 if (args->addr < VM_MAXUSER_ADDRESS) { 169 update_pcb_bases(pcb); 170 pcb->pcb_fsbase = args->addr; 171 td->td_frame->tf_fs = _ufssel; 172 error = 0; 173 } else 174 error = EPERM; 175 break; 176 case LINUX_ARCH_GET_FS: 177 error = copyout(&pcb->pcb_fsbase, PTRIN(args->addr), 178 sizeof(args->addr)); 179 break; 180 case LINUX_ARCH_GET_GS: 181 error = copyout(&pcb->pcb_gsbase, PTRIN(args->addr), 182 sizeof(args->addr)); 183 break; 184 case LINUX_ARCH_CET_STATUS: 185 memset(cet, 0, sizeof(cet)); 186 error = copyout(&cet, PTRIN(args->addr), sizeof(cet)); 187 break; 188 default: 189 linux_msg(td, "unsupported arch_prctl code %#x", args->code); 190 error = EINVAL; 191 } 192 return (error); 193 } 194 195 int 196 linux_set_cloned_tls(struct thread *td, void *desc) 197 { 198 struct pcb *pcb; 199 200 if ((uint64_t)desc >= VM_MAXUSER_ADDRESS) 201 return (EPERM); 202 203 pcb = td->td_pcb; 204 update_pcb_bases(pcb); 205 pcb->pcb_fsbase = (register_t)desc; 206 td->td_frame->tf_fs = _ufssel; 207 208 return (0); 209 } 210 211 int futex_xchgl_nosmap(int oparg, uint32_t *uaddr, int *oldval); 212 int futex_xchgl_smap(int oparg, uint32_t *uaddr, int *oldval); 213 DEFINE_IFUNC(, int, futex_xchgl, (int, uint32_t *, int *)) 214 { 215 216 return ((cpu_stdext_feature & CPUID_STDEXT_SMAP) != 0 ? 217 futex_xchgl_smap : futex_xchgl_nosmap); 218 } 219 220 int futex_addl_nosmap(int oparg, uint32_t *uaddr, int *oldval); 221 int futex_addl_smap(int oparg, uint32_t *uaddr, int *oldval); 222 DEFINE_IFUNC(, int, futex_addl, (int, uint32_t *, int *)) 223 { 224 225 return ((cpu_stdext_feature & CPUID_STDEXT_SMAP) != 0 ? 226 futex_addl_smap : futex_addl_nosmap); 227 } 228 229 int futex_orl_nosmap(int oparg, uint32_t *uaddr, int *oldval); 230 int futex_orl_smap(int oparg, uint32_t *uaddr, int *oldval); 231 DEFINE_IFUNC(, int, futex_orl, (int, uint32_t *, int *)) 232 { 233 234 return ((cpu_stdext_feature & CPUID_STDEXT_SMAP) != 0 ? 235 futex_orl_smap : futex_orl_nosmap); 236 } 237 238 int futex_andl_nosmap(int oparg, uint32_t *uaddr, int *oldval); 239 int futex_andl_smap(int oparg, uint32_t *uaddr, int *oldval); 240 DEFINE_IFUNC(, int, futex_andl, (int, uint32_t *, int *)) 241 { 242 243 return ((cpu_stdext_feature & CPUID_STDEXT_SMAP) != 0 ? 244 futex_andl_smap : futex_andl_nosmap); 245 } 246 247 int futex_xorl_nosmap(int oparg, uint32_t *uaddr, int *oldval); 248 int futex_xorl_smap(int oparg, uint32_t *uaddr, int *oldval); 249 DEFINE_IFUNC(, int, futex_xorl, (int, uint32_t *, int *)) 250 { 251 252 return ((cpu_stdext_feature & CPUID_STDEXT_SMAP) != 0 ? 253 futex_xorl_smap : futex_xorl_nosmap); 254 } 255 256 void 257 bsd_to_linux_regset(const struct reg *b_reg, struct linux_pt_regset *l_regset) 258 { 259 260 l_regset->r15 = b_reg->r_r15; 261 l_regset->r14 = b_reg->r_r14; 262 l_regset->r13 = b_reg->r_r13; 263 l_regset->r12 = b_reg->r_r12; 264 l_regset->rbp = b_reg->r_rbp; 265 l_regset->rbx = b_reg->r_rbx; 266 l_regset->r11 = b_reg->r_r11; 267 l_regset->r10 = b_reg->r_r10; 268 l_regset->r9 = b_reg->r_r9; 269 l_regset->r8 = b_reg->r_r8; 270 l_regset->rax = b_reg->r_rax; 271 l_regset->rcx = b_reg->r_rcx; 272 l_regset->rdx = b_reg->r_rdx; 273 l_regset->rsi = b_reg->r_rsi; 274 l_regset->rdi = b_reg->r_rdi; 275 l_regset->orig_rax = b_reg->r_rax; 276 l_regset->rip = b_reg->r_rip; 277 l_regset->cs = b_reg->r_cs; 278 l_regset->eflags = b_reg->r_rflags; 279 l_regset->rsp = b_reg->r_rsp; 280 l_regset->ss = b_reg->r_ss; 281 l_regset->fs_base = 0; 282 l_regset->gs_base = 0; 283 l_regset->ds = b_reg->r_ds; 284 l_regset->es = b_reg->r_es; 285 l_regset->fs = b_reg->r_fs; 286 l_regset->gs = b_reg->r_gs; 287 } 288 289 void 290 linux_to_bsd_regset(struct reg *b_reg, const struct linux_pt_regset *l_regset) 291 { 292 293 b_reg->r_r15 = l_regset->r15; 294 b_reg->r_r14 = l_regset->r14; 295 b_reg->r_r13 = l_regset->r13; 296 b_reg->r_r12 = l_regset->r12; 297 b_reg->r_rbp = l_regset->rbp; 298 b_reg->r_rbx = l_regset->rbx; 299 b_reg->r_r11 = l_regset->r11; 300 b_reg->r_r10 = l_regset->r10; 301 b_reg->r_r9 = l_regset->r9; 302 b_reg->r_r8 = l_regset->r8; 303 b_reg->r_rax = l_regset->rax; 304 b_reg->r_rcx = l_regset->rcx; 305 b_reg->r_rdx = l_regset->rdx; 306 b_reg->r_rsi = l_regset->rsi; 307 b_reg->r_rdi = l_regset->rdi; 308 b_reg->r_rax = l_regset->orig_rax; 309 b_reg->r_rip = l_regset->rip; 310 b_reg->r_cs = l_regset->cs; 311 b_reg->r_rflags = l_regset->eflags; 312 b_reg->r_rsp = l_regset->rsp; 313 b_reg->r_ss = l_regset->ss; 314 b_reg->r_ds = l_regset->ds; 315 b_reg->r_es = l_regset->es; 316 b_reg->r_fs = l_regset->fs; 317 b_reg->r_gs = l_regset->gs; 318 } 319 320 void 321 linux_ptrace_get_syscall_info_machdep(const struct reg *reg, 322 struct syscall_info *si) 323 { 324 325 si->arch = LINUX_ARCH_AMD64; 326 si->instruction_pointer = reg->r_rip; 327 si->stack_pointer = reg->r_rsp; 328 } 329 330 int 331 linux_ptrace_getregs_machdep(struct thread *td, pid_t pid, 332 struct linux_pt_regset *l_regset) 333 { 334 struct ptrace_lwpinfo lwpinfo; 335 struct pcb *pcb; 336 int error; 337 338 pcb = td->td_pcb; 339 if (td == curthread) 340 update_pcb_bases(pcb); 341 342 l_regset->fs_base = pcb->pcb_fsbase; 343 l_regset->gs_base = pcb->pcb_gsbase; 344 345 error = kern_ptrace(td, PT_LWPINFO, pid, &lwpinfo, sizeof(lwpinfo)); 346 if (error != 0) { 347 linux_msg(td, "PT_LWPINFO failed with error %d", error); 348 return (error); 349 } 350 if ((lwpinfo.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX)) != 0) { 351 /* 352 * In Linux, the syscall number - passed to the syscall 353 * as rax - is preserved in orig_rax; rax gets overwritten 354 * with syscall return value. 355 */ 356 l_regset->orig_rax = lwpinfo.pl_syscall_code; 357 } 358 359 return (0); 360 } 361 362 #define LINUX_URO(a,m) ((uintptr_t)a == offsetof(struct linux_pt_regset, m)) 363 364 int 365 linux_ptrace_peekuser(struct thread *td, pid_t pid, void *addr, void *data) 366 { 367 struct linux_pt_regset reg; 368 struct reg b_reg; 369 uint64_t val; 370 int error; 371 372 if ((uintptr_t)addr & (sizeof(data) -1) || (uintptr_t)addr < 0) 373 return (EIO); 374 if ((uintptr_t)addr >= sizeof(struct linux_pt_regset)) { 375 LINUX_RATELIMIT_MSG_OPT1("PTRACE_PEEKUSER offset %ld " 376 "not implemented; returning EINVAL", (uintptr_t)addr); 377 return (EINVAL); 378 } 379 380 if (LINUX_URO(addr, fs_base)) 381 return (kern_ptrace(td, PT_GETFSBASE, pid, data, 0)); 382 if (LINUX_URO(addr, gs_base)) 383 return (kern_ptrace(td, PT_GETGSBASE, pid, data, 0)); 384 if ((error = kern_ptrace(td, PT_GETREGS, pid, &b_reg, 0)) != 0) 385 return (error); 386 bsd_to_linux_regset(&b_reg, ®); 387 val = *(®.r15 + ((uintptr_t)addr / sizeof(reg.r15))); 388 return (copyout(&val, data, sizeof(val))); 389 } 390 391 static inline bool 392 linux_invalid_selector(u_short val) 393 { 394 395 return (val != 0 && ISPL(val) != SEL_UPL); 396 } 397 398 struct linux_segreg_off { 399 uintptr_t reg; 400 bool is0; 401 }; 402 403 const struct linux_segreg_off linux_segregs_off[] = { 404 { 405 .reg = offsetof(struct linux_pt_regset, gs), 406 .is0 = true, 407 }, 408 { 409 .reg = offsetof(struct linux_pt_regset, fs), 410 .is0 = true, 411 }, 412 { 413 .reg = offsetof(struct linux_pt_regset, ds), 414 .is0 = true, 415 }, 416 { 417 .reg = offsetof(struct linux_pt_regset, es), 418 .is0 = true, 419 }, 420 { 421 .reg = offsetof(struct linux_pt_regset, cs), 422 .is0 = false, 423 }, 424 { 425 .reg = offsetof(struct linux_pt_regset, ss), 426 .is0 = false, 427 }, 428 }; 429 430 int 431 linux_ptrace_pokeuser(struct thread *td, pid_t pid, void *addr, void *data) 432 { 433 struct linux_pt_regset reg; 434 struct reg b_reg, b_reg1; 435 int error, i; 436 437 if ((uintptr_t)addr & (sizeof(data) -1) || (uintptr_t)addr < 0) 438 return (EIO); 439 if ((uintptr_t)addr >= sizeof(struct linux_pt_regset)) { 440 LINUX_RATELIMIT_MSG_OPT1("PTRACE_POKEUSER offset %ld " 441 "not implemented; returning EINVAL", (uintptr_t)addr); 442 return (EINVAL); 443 } 444 445 if (LINUX_URO(addr, fs_base)) 446 return (kern_ptrace(td, PT_SETFSBASE, pid, data, 0)); 447 if (LINUX_URO(addr, gs_base)) 448 return (kern_ptrace(td, PT_SETGSBASE, pid, data, 0)); 449 for (i = 0; i < nitems(linux_segregs_off); i++) { 450 if ((uintptr_t)addr == linux_segregs_off[i].reg) { 451 if (linux_invalid_selector((uintptr_t)data)) 452 return (EIO); 453 if (!linux_segregs_off[i].is0 && (uintptr_t)data == 0) 454 return (EIO); 455 } 456 } 457 if ((error = kern_ptrace(td, PT_GETREGS, pid, &b_reg, 0)) != 0) 458 return (error); 459 bsd_to_linux_regset(&b_reg, ®); 460 *(®.r15 + ((uintptr_t)addr / sizeof(reg.r15))) = (uint64_t)data; 461 linux_to_bsd_regset(&b_reg1, ®); 462 b_reg1.r_err = b_reg.r_err; 463 b_reg1.r_trapno = b_reg.r_trapno; 464 return (kern_ptrace(td, PT_SETREGS, pid, &b_reg, 0)); 465 } 466 #undef LINUX_URO 467