1 /*-
2 * Copyright (c) 2004 Tim J. Robbins
3 * Copyright (c) 2003 Peter Wemm
4 * Copyright (c) 2002 Doug Rabson
5 * Copyright (c) 1998-1999 Andrew Gallatin
6 * Copyright (c) 1994-1996 Søren Schmidt
7 * All rights reserved.
8 * Copyright (c) 2013, 2021 Dmitry Chagin <dchagin@FreeBSD.org>
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer
15 * in this position and unchanged.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 * 3. The name of the author may not be used to endorse or promote products
20 * derived from this software without specific prior written permission
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 */
33
34 #define __ELF_WORD_SIZE 64
35
36 #include <sys/param.h>
37 #include <sys/exec.h>
38 #include <sys/imgact.h>
39 #include <sys/imgact_elf.h>
40 #include <sys/kernel.h>
41 #include <sys/ktr.h>
42 #include <sys/lock.h>
43 #include <sys/module.h>
44 #include <sys/mutex.h>
45 #include <sys/proc.h>
46 #include <sys/stddef.h>
47 #include <sys/syscallsubr.h>
48 #include <sys/sysctl.h>
49 #include <sys/sysent.h>
50
51 #include <vm/pmap.h>
52 #include <vm/vm.h>
53 #include <vm/vm_param.h>
54
55 #include <machine/md_var.h>
56 #include <machine/trap.h>
57
58 #include <x86/linux/linux_x86.h>
59 #include <amd64/linux/linux.h>
60 #include <amd64/linux/linux_emul_md.h>
61 #include <amd64/linux/linux_proto.h>
62 #include <compat/linux/linux_elf.h>
63 #include <compat/linux/linux_emul.h>
64 #include <compat/linux/linux_fork.h>
65 #include <compat/linux/linux_ioctl.h>
66 #include <compat/linux/linux_mib.h>
67 #include <compat/linux/linux_misc.h>
68 #include <compat/linux/linux_signal.h>
69 #include <compat/linux/linux_util.h>
70 #include <compat/linux/linux_vdso.h>
71
72 #include <x86/linux/linux_x86_sigframe.h>
73
74 _Static_assert(sizeof(struct l_fpstate) ==
75 sizeof(__typeof(((mcontext_t *)0)->mc_fpstate)),
76 "fxsave area size incorrect");
77
78 MODULE_VERSION(linux64, 1);
79
80 #define LINUX_VDSOPAGE_SIZE PAGE_SIZE * 2
81 #define LINUX_VDSOPAGE_LA48 (VM_MAXUSER_ADDRESS_LA48 - \
82 LINUX_VDSOPAGE_SIZE)
83 #define LINUX_SHAREDPAGE_LA48 (LINUX_VDSOPAGE_LA48 - PAGE_SIZE)
84 /*
85 * PAGE_SIZE - the size
86 * of the native SHAREDPAGE
87 */
88 #define LINUX_USRSTACK_LA48 LINUX_SHAREDPAGE_LA48
89 #define LINUX_PS_STRINGS_LA48 (LINUX_USRSTACK_LA48 - \
90 sizeof(struct ps_strings))
91
92 static int linux_szsigcode;
93 static vm_object_t linux_vdso_obj;
94 static char *linux_vdso_mapping;
95 extern char _binary_linux_vdso_so_o_start;
96 extern char _binary_linux_vdso_so_o_end;
97 static vm_offset_t linux_vdso_base;
98
99 extern struct sysent linux_sysent[LINUX_SYS_MAXSYSCALL];
100 extern const char *linux_syscallnames[];
101
102 SET_DECLARE(linux_ioctl_handler_set, struct linux_ioctl_handler);
103
104 static void linux_vdso_install(const void *param);
105 static void linux_vdso_deinstall(const void *param);
106 static void linux_vdso_reloc(char *mapping, Elf_Addr offset);
107 static void linux_set_syscall_retval(struct thread *td, int error);
108 static int linux_fetch_syscall_args(struct thread *td);
109 static void linux_exec_setregs(struct thread *td, struct image_params *imgp,
110 uintptr_t stack);
111 static void linux_exec_sysvec_init(void *param);
112 static int linux_on_exec_vmspace(struct proc *p,
113 struct image_params *imgp);
114 static void linux_set_fork_retval(struct thread *td);
115 static int linux_vsyscall(struct thread *td);
116
117 LINUX_VDSO_SYM_INTPTR(linux_rt_sigcode);
118 LINUX_VDSO_SYM_CHAR(linux_platform);
119 LINUX_VDSO_SYM_INTPTR(kern_timekeep_base);
120 LINUX_VDSO_SYM_INTPTR(kern_tsc_selector);
121 LINUX_VDSO_SYM_INTPTR(kern_cpu_selector);
122
123 /*
124 * According to the Intel x86 ISA 64-bit syscall
125 * saves %rip to %rcx and rflags to %r11. Registers on syscall entry:
126 * %rax system call number
127 * %rcx return address
128 * %r11 saved rflags
129 * %rdi arg1
130 * %rsi arg2
131 * %rdx arg3
132 * %r10 arg4
133 * %r8 arg5
134 * %r9 arg6
135 *
136 * Then FreeBSD fast_syscall() move registers:
137 * %rcx -> trapframe.tf_rip
138 * %r10 -> trapframe.tf_rcx
139 */
140 static int
linux_fetch_syscall_args(struct thread * td)141 linux_fetch_syscall_args(struct thread *td)
142 {
143 struct proc *p;
144 struct trapframe *frame;
145 struct syscall_args *sa;
146
147 p = td->td_proc;
148 frame = td->td_frame;
149 sa = &td->td_sa;
150
151 sa->args[0] = frame->tf_rdi;
152 sa->args[1] = frame->tf_rsi;
153 sa->args[2] = frame->tf_rdx;
154 sa->args[3] = frame->tf_rcx;
155 sa->args[4] = frame->tf_r8;
156 sa->args[5] = frame->tf_r9;
157 sa->code = frame->tf_rax;
158 sa->original_code = sa->code;
159
160 if (sa->code >= p->p_sysent->sv_size)
161 /* nosys */
162 sa->callp = &nosys_sysent;
163 else
164 sa->callp = &p->p_sysent->sv_table[sa->code];
165
166 /* Restore r10 earlier to avoid doing this multiply times. */
167 frame->tf_r10 = frame->tf_rcx;
168 /* Restore %rcx for machine context. */
169 frame->tf_rcx = frame->tf_rip;
170
171 td->td_retval[0] = 0;
172 return (0);
173 }
174
175 static void
linux_set_syscall_retval(struct thread * td,int error)176 linux_set_syscall_retval(struct thread *td, int error)
177 {
178 struct trapframe *frame;
179
180 frame = td->td_frame;
181
182 switch (error) {
183 case 0:
184 frame->tf_rax = td->td_retval[0];
185 break;
186
187 case ERESTART:
188 /*
189 * Reconstruct pc, we know that 'syscall' is 2 bytes,
190 * lcall $X,y is 7 bytes, int 0x80 is 2 bytes.
191 * We saved this in tf_err.
192 *
193 */
194 frame->tf_rip -= frame->tf_err;
195 break;
196
197 case EJUSTRETURN:
198 break;
199
200 default:
201 frame->tf_rax = bsd_to_linux_errno(error);
202 break;
203 }
204
205 /*
206 * Differently from FreeBSD native ABI, on Linux only %rcx
207 * and %r11 values are not preserved across the syscall.
208 * Require full context restore to get all registers except
209 * those two restored at return to usermode.
210 */
211 set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
212 }
213
214 static void
linux_set_fork_retval(struct thread * td)215 linux_set_fork_retval(struct thread *td)
216 {
217 struct trapframe *frame = td->td_frame;
218
219 frame->tf_rax = 0;
220 }
221
222 void
linux64_arch_copyout_auxargs(struct image_params * imgp,Elf_Auxinfo ** pos)223 linux64_arch_copyout_auxargs(struct image_params *imgp, Elf_Auxinfo **pos)
224 {
225
226 AUXARGS_ENTRY((*pos), LINUX_AT_SYSINFO_EHDR, linux_vdso_base);
227 AUXARGS_ENTRY((*pos), LINUX_AT_HWCAP, cpu_feature);
228 AUXARGS_ENTRY((*pos), LINUX_AT_HWCAP2, linux_x86_elf_hwcap2());
229 AUXARGS_ENTRY((*pos), LINUX_AT_PLATFORM, PTROUT(linux_platform));
230 }
231
232 /*
233 * Reset registers to default values on exec.
234 */
235 static void
linux_exec_setregs(struct thread * td,struct image_params * imgp,uintptr_t stack)236 linux_exec_setregs(struct thread *td, struct image_params *imgp,
237 uintptr_t stack)
238 {
239 struct trapframe *regs;
240 struct pcb *pcb;
241 register_t saved_rflags;
242
243 regs = td->td_frame;
244 pcb = td->td_pcb;
245
246 if (td->td_proc->p_md.md_ldt != NULL)
247 user_ldt_free(td);
248
249 pcb->pcb_fsbase = 0;
250 pcb->pcb_gsbase = 0;
251 clear_pcb_flags(pcb, PCB_32BIT | PCB_TLSBASE);
252 pcb->pcb_initial_fpucw = __LINUX_NPXCW__;
253 set_pcb_flags(pcb, PCB_FULL_IRET);
254
255 saved_rflags = regs->tf_rflags & PSL_T;
256 bzero((char *)regs, sizeof(struct trapframe));
257 regs->tf_rip = imgp->entry_addr;
258 regs->tf_rsp = stack;
259 regs->tf_rflags = PSL_USER | saved_rflags;
260 regs->tf_ss = _udatasel;
261 regs->tf_cs = _ucodesel;
262 regs->tf_ds = _udatasel;
263 regs->tf_es = _udatasel;
264 regs->tf_fs = _ufssel;
265 regs->tf_gs = _ugssel;
266 regs->tf_flags = TF_HASSEGS;
267
268 x86_clear_dbregs(pcb);
269
270 /*
271 * Drop the FP state if we hold it, so that the process gets a
272 * clean FP state if it uses the FPU again.
273 */
274 fpstate_drop(td);
275
276 /* Linux processes start with PKRU denying unallocated keys. */
277 linux_pkru_exec_init(td);
278 }
279
280 static int
linux_fxrstor(struct thread * td,mcontext_t * mcp,struct l_sigcontext * sc)281 linux_fxrstor(struct thread *td, mcontext_t *mcp, struct l_sigcontext *sc)
282 {
283 struct savefpu *fp = (struct savefpu *)&mcp->mc_fpstate[0];
284 int error;
285
286 error = copyin(PTRIN(sc->sc_fpstate), fp, sizeof(mcp->mc_fpstate));
287 if (error != 0)
288 return (error);
289 bzero(&fp->sv_pad[0], sizeof(fp->sv_pad));
290 return (set_fpcontext(td, mcp, NULL, 0));
291 }
292
293 static int
linux_xrstor(struct thread * td,mcontext_t * mcp,struct l_sigcontext * sc)294 linux_xrstor(struct thread *td, mcontext_t *mcp, struct l_sigcontext *sc)
295 {
296 struct savefpu *fp = (struct savefpu *)&mcp->mc_fpstate[0];
297 char *xfpustate;
298 struct proc *p;
299 uint32_t magic2;
300 int error;
301
302 p = td->td_proc;
303 mcp->mc_xfpustate_len = cpu_max_ext_state_size - sizeof(struct savefpu);
304
305 /* Legacy region of an xsave area. */
306 error = copyin(PTRIN(sc->sc_fpstate), fp, sizeof(mcp->mc_fpstate));
307 if (error != 0)
308 return (error);
309 bzero(&fp->sv_pad[0], sizeof(fp->sv_pad));
310
311 /* Extended region of an xsave area. */
312 sc->sc_fpstate += sizeof(mcp->mc_fpstate);
313 xfpustate = (char *)fpu_save_area_alloc();
314 error = copyin(PTRIN(sc->sc_fpstate), xfpustate, mcp->mc_xfpustate_len);
315 if (error != 0) {
316 fpu_save_area_free((struct savefpu *)xfpustate);
317 uprintf("pid %d (%s): linux xrstor failed\n", p->p_pid,
318 td->td_name);
319 return (error);
320 }
321
322 /* Linux specific end of xsave area marker. */
323 sc->sc_fpstate += mcp->mc_xfpustate_len;
324 error = copyin(PTRIN(sc->sc_fpstate), &magic2, LINUX_FP_XSTATE_MAGIC2_SIZE);
325 if (error != 0 || magic2 != LINUX_FP_XSTATE_MAGIC2) {
326 fpu_save_area_free((struct savefpu *)xfpustate);
327 uprintf("pid %d (%s): sigreturn magic2 0x%x error %d\n",
328 p->p_pid, td->td_name, magic2, error);
329 return (error);
330 }
331
332 error = set_fpcontext(td, mcp, xfpustate, mcp->mc_xfpustate_len);
333 fpu_save_area_free((struct savefpu *)xfpustate);
334 if (error != 0) {
335 uprintf("pid %d (%s): sigreturn set_fpcontext error %d\n",
336 p->p_pid, td->td_name, error);
337 }
338 return (error);
339 }
340
341 static int
linux_copyin_fpstate(struct thread * td,struct l_ucontext * uc)342 linux_copyin_fpstate(struct thread *td, struct l_ucontext *uc)
343 {
344 mcontext_t mc;
345
346 bzero(&mc, sizeof(mc));
347 mc.mc_ownedfp = _MC_FPOWNED_FPU;
348 mc.mc_fpformat = _MC_FPFMT_XMM;
349
350 if ((uc->uc_flags & LINUX_UC_FP_XSTATE) != 0)
351 return (linux_xrstor(td, &mc, &uc->uc_mcontext));
352 else
353 return (linux_fxrstor(td, &mc, &uc->uc_mcontext));
354 }
355
356 /*
357 * Copied from amd64/amd64/machdep.c
358 */
359 int
linux_rt_sigreturn(struct thread * td,struct linux_rt_sigreturn_args * args)360 linux_rt_sigreturn(struct thread *td, struct linux_rt_sigreturn_args *args)
361 {
362 struct proc *p;
363 struct l_rt_sigframe sf;
364 struct l_sigcontext *context;
365 struct trapframe *regs;
366 unsigned long rflags;
367 sigset_t bmask;
368 int error;
369 ksiginfo_t ksi;
370
371 regs = td->td_frame;
372 error = copyin((void *)regs->tf_rbx, &sf, sizeof(sf));
373 if (error != 0)
374 return (error);
375
376 p = td->td_proc;
377 context = &sf.sf_uc.uc_mcontext;
378 rflags = context->sc_rflags;
379
380 /*
381 * Don't allow users to change privileged or reserved flags.
382 */
383 /*
384 * XXX do allow users to change the privileged flag PSL_RF.
385 * The cpu sets PSL_RF in tf_rflags for faults. Debuggers
386 * should sometimes set it there too. tf_rflags is kept in
387 * the signal context during signal handling and there is no
388 * other place to remember it, so the PSL_RF bit may be
389 * corrupted by the signal handler without us knowing.
390 * Corruption of the PSL_RF bit at worst causes one more or
391 * one less debugger trap, so allowing it is fairly harmless.
392 */
393 if (!EFL_SECURE(rflags & ~PSL_RF, regs->tf_rflags & ~PSL_RF)) {
394 uprintf("pid %d comm %s linux mangled rflags %#lx\n",
395 p->p_pid, p->p_comm, rflags);
396 return (EINVAL);
397 }
398
399 /*
400 * Don't allow users to load a valid privileged %cs. Let the
401 * hardware check for invalid selectors, excess privilege in
402 * other selectors, invalid %eip's and invalid %esp's.
403 */
404 if (!CS_SECURE(context->sc_cs)) {
405 uprintf("pid %d comm %s linux mangled cs %#x\n",
406 p->p_pid, p->p_comm, context->sc_cs);
407 ksiginfo_init_trap(&ksi);
408 ksi.ksi_signo = SIGBUS;
409 ksi.ksi_code = BUS_OBJERR;
410 ksi.ksi_trapno = T_PROTFLT;
411 ksi.ksi_addr = (void *)regs->tf_rip;
412 trapsignal(td, &ksi);
413 return (EINVAL);
414 }
415
416 linux_to_bsd_sigset(&sf.sf_uc.uc_sigmask, &bmask);
417 kern_sigprocmask(td, SIG_SETMASK, &bmask, NULL, 0);
418
419 regs->tf_rdi = context->sc_rdi;
420 regs->tf_rsi = context->sc_rsi;
421 regs->tf_rdx = context->sc_rdx;
422 regs->tf_rbp = context->sc_rbp;
423 regs->tf_rbx = context->sc_rbx;
424 regs->tf_rcx = context->sc_rcx;
425 regs->tf_rax = context->sc_rax;
426 regs->tf_rip = context->sc_rip;
427 regs->tf_rsp = context->sc_rsp;
428 regs->tf_r8 = context->sc_r8;
429 regs->tf_r9 = context->sc_r9;
430 regs->tf_r10 = context->sc_r10;
431 regs->tf_r11 = context->sc_r11;
432 regs->tf_r12 = context->sc_r12;
433 regs->tf_r13 = context->sc_r13;
434 regs->tf_r14 = context->sc_r14;
435 regs->tf_r15 = context->sc_r15;
436 regs->tf_cs = context->sc_cs;
437 regs->tf_err = context->sc_err;
438 regs->tf_rflags = rflags;
439
440 error = linux_copyin_fpstate(td, &sf.sf_uc);
441 if (error != 0) {
442 uprintf("pid %d comm %s linux can't restore fpu state %d\n",
443 p->p_pid, p->p_comm, error);
444 return (error);
445 }
446
447 set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
448 return (EJUSTRETURN);
449 }
450
451 static int
linux_fxsave(mcontext_t * mcp,void * ufp)452 linux_fxsave(mcontext_t *mcp, void *ufp)
453 {
454 struct l_fpstate *fx = (struct l_fpstate *)&mcp->mc_fpstate[0];
455
456 bzero(&fx->reserved2[0], sizeof(fx->reserved2));
457 return (copyout(fx, ufp, sizeof(*fx)));
458 }
459
460 static int
linux_xsave(mcontext_t * mcp,char * xfpusave,char * ufp)461 linux_xsave(mcontext_t *mcp, char *xfpusave, char *ufp)
462 {
463 struct l_fpstate *fx = (struct l_fpstate *)&mcp->mc_fpstate[0];
464 uint32_t magic2;
465 int error;
466
467 /* Legacy region of an xsave area. */
468 fx->sw_reserved.magic1 = LINUX_FP_XSTATE_MAGIC1;
469 fx->sw_reserved.xstate_size = mcp->mc_xfpustate_len + sizeof(*fx);
470 fx->sw_reserved.extended_size = fx->sw_reserved.xstate_size +
471 LINUX_FP_XSTATE_MAGIC2_SIZE;
472 fx->sw_reserved.xfeatures = xsave_mask;
473
474 error = copyout(fx, ufp, sizeof(*fx));
475 if (error != 0)
476 return (error);
477 ufp += sizeof(*fx);
478
479 /* Extended region of an xsave area. */
480 error = copyout(xfpusave, ufp, mcp->mc_xfpustate_len);
481 if (error != 0)
482 return (error);
483
484 /* Linux specific end of xsave area marker. */
485 ufp += mcp->mc_xfpustate_len;
486 magic2 = LINUX_FP_XSTATE_MAGIC2;
487 return (copyout(&magic2, ufp, LINUX_FP_XSTATE_MAGIC2_SIZE));
488 }
489
490 static int
linux_copyout_fpstate(struct thread * td,struct l_ucontext * uc,char ** sp)491 linux_copyout_fpstate(struct thread *td, struct l_ucontext *uc, char **sp)
492 {
493 size_t xfpusave_len;
494 char *xfpusave;
495 mcontext_t mc;
496 char *ufp = *sp;
497
498 get_fpcontext(td, &mc, &xfpusave, &xfpusave_len);
499 KASSERT(mc.mc_fpformat != _MC_FPFMT_NODEV, ("fpu not present"));
500
501 /* Room for fxsave area. */
502 ufp -= sizeof(struct l_fpstate);
503 if (xfpusave != NULL) {
504 /* Room for xsave area. */
505 ufp -= (xfpusave_len + LINUX_FP_XSTATE_MAGIC2_SIZE);
506 uc->uc_flags |= LINUX_UC_FP_XSTATE;
507 }
508 *sp = ufp = (char *)((unsigned long)ufp & ~0x3Ful);
509
510 if (xfpusave != NULL)
511 return (linux_xsave(&mc, xfpusave, ufp));
512 else
513 return (linux_fxsave(&mc, ufp));
514 }
515
516 /*
517 * copied from amd64/amd64/machdep.c
518 *
519 * Send an interrupt to process.
520 */
521 static void
linux_rt_sendsig(sig_t catcher,ksiginfo_t * ksi,sigset_t * mask)522 linux_rt_sendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask)
523 {
524 struct l_rt_sigframe sf, *sfp;
525 struct proc *p;
526 struct thread *td;
527 struct sigacts *psp;
528 char *sp;
529 struct trapframe *regs;
530 int sig, code;
531 int oonstack, issiginfo;
532
533 td = curthread;
534 p = td->td_proc;
535 PROC_LOCK_ASSERT(p, MA_OWNED);
536 sig = linux_translate_traps(ksi->ksi_signo, ksi->ksi_trapno);
537 psp = p->p_sigacts;
538 issiginfo = SIGISMEMBER(psp->ps_siginfo, sig);
539 code = ksi->ksi_code;
540 mtx_assert(&psp->ps_mtx, MA_OWNED);
541 regs = td->td_frame;
542 oonstack = sigonstack(regs->tf_rsp);
543
544 LINUX_CTR4(rt_sendsig, "%p, %d, %p, %u",
545 catcher, sig, mask, code);
546
547 bzero(&sf, sizeof(sf));
548 sf.sf_uc.uc_stack.ss_sp = PTROUT(td->td_sigstk.ss_sp);
549 sf.sf_uc.uc_stack.ss_size = td->td_sigstk.ss_size;
550 sf.sf_uc.uc_stack.ss_flags = (td->td_pflags & TDP_ALTSTACK)
551 ? ((oonstack) ? LINUX_SS_ONSTACK : 0) : LINUX_SS_DISABLE;
552
553 /* Allocate space for the signal handler context. */
554 if ((td->td_pflags & TDP_ALTSTACK) != 0 && !oonstack &&
555 SIGISMEMBER(psp->ps_sigonstack, sig)) {
556 sp = (char *)td->td_sigstk.ss_sp + td->td_sigstk.ss_size;
557 } else
558 sp = (char *)regs->tf_rsp - 128;
559
560 mtx_unlock(&psp->ps_mtx);
561 PROC_UNLOCK(p);
562
563 if (linux_copyout_fpstate(td, &sf.sf_uc, &sp) != 0) {
564 uprintf("pid %d comm %s linux can't save fpu state, killing\n",
565 p->p_pid, p->p_comm);
566 PROC_LOCK(p);
567 sigexit(td, SIGILL);
568 }
569 sf.sf_uc.uc_mcontext.sc_fpstate = (register_t)sp;
570
571 /* Make room, keeping the stack aligned. */
572 sp -= sizeof(struct l_rt_sigframe);
573 sfp = (struct l_rt_sigframe *)((unsigned long)sp & ~0xFul);
574
575 /* Save user context. */
576 bsd_to_linux_sigset(mask, &sf.sf_uc.uc_sigmask);
577 sf.sf_uc.uc_mcontext.sc_mask = sf.sf_uc.uc_sigmask;
578 sf.sf_uc.uc_mcontext.sc_rdi = regs->tf_rdi;
579 sf.sf_uc.uc_mcontext.sc_rsi = regs->tf_rsi;
580 sf.sf_uc.uc_mcontext.sc_rdx = regs->tf_rdx;
581 sf.sf_uc.uc_mcontext.sc_rbp = regs->tf_rbp;
582 sf.sf_uc.uc_mcontext.sc_rbx = regs->tf_rbx;
583 sf.sf_uc.uc_mcontext.sc_rcx = regs->tf_rcx;
584 sf.sf_uc.uc_mcontext.sc_rax = regs->tf_rax;
585 sf.sf_uc.uc_mcontext.sc_rip = regs->tf_rip;
586 sf.sf_uc.uc_mcontext.sc_rsp = regs->tf_rsp;
587 sf.sf_uc.uc_mcontext.sc_r8 = regs->tf_r8;
588 sf.sf_uc.uc_mcontext.sc_r9 = regs->tf_r9;
589 sf.sf_uc.uc_mcontext.sc_r10 = regs->tf_r10;
590 sf.sf_uc.uc_mcontext.sc_r11 = regs->tf_r11;
591 sf.sf_uc.uc_mcontext.sc_r12 = regs->tf_r12;
592 sf.sf_uc.uc_mcontext.sc_r13 = regs->tf_r13;
593 sf.sf_uc.uc_mcontext.sc_r14 = regs->tf_r14;
594 sf.sf_uc.uc_mcontext.sc_r15 = regs->tf_r15;
595 sf.sf_uc.uc_mcontext.sc_cs = regs->tf_cs;
596 sf.sf_uc.uc_mcontext.sc_rflags = regs->tf_rflags;
597 sf.sf_uc.uc_mcontext.sc_err = regs->tf_err;
598 sf.sf_uc.uc_mcontext.sc_trapno = bsd_to_linux_trapcode(code);
599 sf.sf_uc.uc_mcontext.sc_cr2 = (register_t)ksi->ksi_addr;
600
601 /* Translate the signal. */
602 sig = bsd_to_linux_signal(sig);
603 /* Fill in POSIX parts. */
604 siginfo_to_lsiginfo(&ksi->ksi_info, &sf.sf_si, sig);
605
606 /* Copy the sigframe out to the user's stack. */
607 if (copyout(&sf, sfp, sizeof(*sfp)) != 0) {
608 uprintf("pid %d comm %s has trashed its stack, killing\n",
609 p->p_pid, p->p_comm);
610 PROC_LOCK(p);
611 sigexit(td, SIGILL);
612 }
613
614 fpstate_drop(td);
615 /* Build the argument list for the signal handler. */
616 regs->tf_rdi = sig; /* arg 1 in %rdi */
617 regs->tf_rax = 0;
618 if (issiginfo) {
619 regs->tf_rsi = (register_t)&sfp->sf_si; /* arg 2 in %rsi */
620 regs->tf_rdx = (register_t)&sfp->sf_uc; /* arg 3 in %rdx */
621 } else {
622 regs->tf_rsi = 0;
623 regs->tf_rdx = 0;
624 }
625 regs->tf_rcx = (register_t)catcher;
626 regs->tf_rsp = (long)sfp;
627 regs->tf_rip = linux_rt_sigcode;
628 regs->tf_rflags &= ~(PSL_T | PSL_D);
629 regs->tf_cs = _ucodesel;
630 set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
631 PROC_LOCK(p);
632 mtx_lock(&psp->ps_mtx);
633 }
634
635 #define LINUX_VSYSCALL_START (-10UL << 20)
636 #define LINUX_VSYSCALL_SZ 1024
637
638 const unsigned long linux_vsyscall_vector[] = {
639 LINUX_SYS_gettimeofday,
640 LINUX_SYS_linux_time,
641 LINUX_SYS_linux_getcpu,
642 };
643
644 static int
linux_vsyscall(struct thread * td)645 linux_vsyscall(struct thread *td)
646 {
647 struct trapframe *frame;
648 uint64_t retqaddr;
649 int code, traced;
650 int error;
651
652 frame = td->td_frame;
653
654 /* Check %rip for vsyscall area. */
655 if (__predict_true(frame->tf_rip < LINUX_VSYSCALL_START))
656 return (EINVAL);
657 if ((frame->tf_rip & (LINUX_VSYSCALL_SZ - 1)) != 0)
658 return (EINVAL);
659 code = (frame->tf_rip - LINUX_VSYSCALL_START) / LINUX_VSYSCALL_SZ;
660 if (code >= nitems(linux_vsyscall_vector))
661 return (EINVAL);
662
663 /*
664 * vsyscall called as callq *(%rax), so we must
665 * use return address from %rsp and also fixup %rsp.
666 */
667 error = copyin((void *)frame->tf_rsp, &retqaddr, sizeof(retqaddr));
668 if (error)
669 return (error);
670
671 frame->tf_rip = retqaddr;
672 frame->tf_rax = linux_vsyscall_vector[code];
673 frame->tf_rsp += 8;
674
675 traced = (frame->tf_flags & PSL_T);
676
677 amd64_syscall(td, traced);
678
679 return (0);
680 }
681
682 struct sysentvec elf_linux_sysvec = {
683 .sv_size = LINUX_SYS_MAXSYSCALL,
684 .sv_table = linux_sysent,
685 .sv_fixup = __elfN(freebsd_fixup),
686 .sv_sendsig = linux_rt_sendsig,
687 .sv_sigcode = &_binary_linux_vdso_so_o_start,
688 .sv_szsigcode = &linux_szsigcode,
689 .sv_name = "Linux ELF64",
690 .sv_coredump = elf64_coredump,
691 .sv_elf_core_osabi = ELFOSABI_NONE,
692 .sv_elf_core_abi_vendor = LINUX_ABI_VENDOR,
693 .sv_elf_core_prepare_notes = linux64_prepare_notes,
694 .sv_minsigstksz = LINUX_MINSIGSTKSZ,
695 .sv_minuser = VM_MIN_ADDRESS,
696 .sv_maxuser = VM_MAXUSER_ADDRESS_LA48,
697 .sv_usrstack = LINUX_USRSTACK_LA48,
698 .sv_psstrings = LINUX_PS_STRINGS_LA48,
699 .sv_psstringssz = sizeof(struct ps_strings),
700 .sv_stackprot = VM_PROT_ALL,
701 .sv_copyout_auxargs = __linuxN(copyout_auxargs),
702 .sv_copyout_strings = __linuxN(copyout_strings),
703 .sv_setregs = linux_exec_setregs,
704 .sv_fixlimit = NULL,
705 .sv_maxssiz = NULL,
706 .sv_flags = SV_ABI_LINUX | SV_LP64 | SV_SHP | SV_SIG_DISCIGN |
707 SV_SIG_WAITNDQ | SV_TIMEKEEP,
708 .sv_set_syscall_retval = linux_set_syscall_retval,
709 .sv_fetch_syscall_args = linux_fetch_syscall_args,
710 .sv_syscallnames = linux_syscallnames,
711 .sv_shared_page_base = LINUX_SHAREDPAGE_LA48,
712 .sv_shared_page_len = PAGE_SIZE,
713 .sv_schedtail = linux_schedtail,
714 .sv_thread_detach = linux_thread_detach,
715 .sv_trap = linux_vsyscall,
716 .sv_hwcap = NULL,
717 .sv_hwcap2 = NULL,
718 .sv_hwcap3 = NULL,
719 .sv_hwcap4 = NULL,
720 .sv_onexec = linux_on_exec_vmspace,
721 .sv_onexit = linux_on_exit,
722 .sv_ontdexit = linux_thread_dtor,
723 .sv_setid_allowed = &linux_setid_allowed_query,
724 .sv_set_fork_retval = linux_set_fork_retval,
725 };
726
727 static int
linux_on_exec_vmspace(struct proc * p,struct image_params * imgp)728 linux_on_exec_vmspace(struct proc *p, struct image_params *imgp)
729 {
730 int error;
731
732 error = linux_map_vdso(p, linux_vdso_obj, linux_vdso_base,
733 LINUX_VDSOPAGE_SIZE, imgp);
734 if (error == 0)
735 error = linux_on_exec(p, imgp);
736 return (error);
737 }
738
739 /*
740 * linux_vdso_install() and linux_exec_sysvec_init() must be called
741 * after exec_sysvec_init() which is SI_SUB_EXEC (SI_ORDER_ANY).
742 */
743 static void
linux_exec_sysvec_init(void * param)744 linux_exec_sysvec_init(void *param)
745 {
746 l_uintptr_t *ktimekeep_base, *ktsc_selector;
747 struct sysentvec *sv;
748 ptrdiff_t tkoff;
749
750 sv = param;
751 amd64_lower_shared_page(sv);
752 /* Fill timekeep_base */
753 exec_sysvec_init(sv);
754
755 tkoff = kern_timekeep_base - linux_vdso_base;
756 ktimekeep_base = (l_uintptr_t *)(linux_vdso_mapping + tkoff);
757 *ktimekeep_base = sv->sv_shared_page_base + sv->sv_timekeep_offset;
758
759 tkoff = kern_tsc_selector - linux_vdso_base;
760 ktsc_selector = (l_uintptr_t *)(linux_vdso_mapping + tkoff);
761 *ktsc_selector = linux_vdso_tsc_selector_idx();
762 if (bootverbose)
763 printf("Linux x86-64 vDSO tsc_selector: %lu\n", *ktsc_selector);
764
765 tkoff = kern_cpu_selector - linux_vdso_base;
766 ktsc_selector = (l_uintptr_t *)(linux_vdso_mapping + tkoff);
767 *ktsc_selector = linux_vdso_cpu_selector_idx();
768 if (bootverbose)
769 printf("Linux x86-64 vDSO cpu_selector: %lu\n", *ktsc_selector);
770 }
771 SYSINIT(elf_linux_exec_sysvec_init, SI_SUB_EXEC + 1, SI_ORDER_ANY,
772 linux_exec_sysvec_init, &elf_linux_sysvec);
773
774 static void
linux_vdso_install(const void * param)775 linux_vdso_install(const void *param)
776 {
777 char *vdso_start = &_binary_linux_vdso_so_o_start;
778 char *vdso_end = &_binary_linux_vdso_so_o_end;
779
780 linux_szsigcode = vdso_end - vdso_start;
781 MPASS(linux_szsigcode <= LINUX_VDSOPAGE_SIZE);
782
783 linux_vdso_base = LINUX_VDSOPAGE_LA48;
784 if (hw_lower_amd64_sharedpage != 0)
785 linux_vdso_base -= PAGE_SIZE;
786
787 __elfN(linux_vdso_fixup)(vdso_start, linux_vdso_base);
788
789 linux_vdso_obj = __elfN(linux_shared_page_init)
790 (&linux_vdso_mapping, LINUX_VDSOPAGE_SIZE);
791 bcopy(vdso_start, linux_vdso_mapping, linux_szsigcode);
792
793 linux_vdso_reloc(linux_vdso_mapping, linux_vdso_base);
794 }
795 SYSINIT(elf_linux_vdso_init, SI_SUB_EXEC + 1, SI_ORDER_FIRST,
796 linux_vdso_install, NULL);
797
798 static void
linux_vdso_deinstall(const void * param)799 linux_vdso_deinstall(const void *param)
800 {
801
802 __elfN(linux_shared_page_fini)(linux_vdso_obj,
803 linux_vdso_mapping, LINUX_VDSOPAGE_SIZE);
804 }
805 SYSUNINIT(elf_linux_vdso_uninit, SI_SUB_EXEC, SI_ORDER_FIRST,
806 linux_vdso_deinstall, NULL);
807
808 static void
linux_vdso_reloc(char * mapping,Elf_Addr offset)809 linux_vdso_reloc(char *mapping, Elf_Addr offset)
810 {
811 const Elf_Ehdr *ehdr;
812 const Elf_Shdr *shdr;
813 Elf64_Addr *where, val;
814 Elf_Size rtype, symidx;
815 const Elf_Rela *rela;
816 Elf_Addr addr, addend;
817 int relacnt;
818 int i, j;
819
820 MPASS(offset != 0);
821
822 relacnt = 0;
823 ehdr = (const Elf_Ehdr *)mapping;
824 shdr = (const Elf_Shdr *)(mapping + ehdr->e_shoff);
825 for (i = 0; i < ehdr->e_shnum; i++)
826 {
827 switch (shdr[i].sh_type) {
828 case SHT_REL:
829 printf("Linux x86_64 vDSO: unexpected Rel section\n");
830 break;
831 case SHT_RELA:
832 rela = (const Elf_Rela *)(mapping + shdr[i].sh_offset);
833 relacnt = shdr[i].sh_size / sizeof(*rela);
834 }
835 }
836
837 for (j = 0; j < relacnt; j++, rela++) {
838 where = (Elf_Addr *)(mapping + rela->r_offset);
839 addend = rela->r_addend;
840 rtype = ELF_R_TYPE(rela->r_info);
841 symidx = ELF_R_SYM(rela->r_info);
842
843 switch (rtype) {
844 case R_X86_64_NONE: /* none */
845 break;
846
847 case R_X86_64_RELATIVE: /* B + A */
848 addr = (Elf_Addr)(offset + addend);
849 val = addr;
850 if (*where != val)
851 *where = val;
852 break;
853 case R_X86_64_IRELATIVE:
854 printf("Linux x86_64 vDSO: unexpected ifunc relocation, "
855 "symbol index %ld\n", symidx);
856 break;
857 default:
858 printf("Linux x86_64 vDSO: unexpected relocation type %ld, "
859 "symbol index %ld\n", rtype, symidx);
860 }
861 }
862 }
863
864 static const Elf_Brandnote linux64_brandnote = {
865 .hdr.n_namesz = sizeof(GNU_ABI_VENDOR),
866 .hdr.n_descsz = 16,
867 .hdr.n_type = 1,
868 .vendor = GNU_ABI_VENDOR,
869 .flags = BN_TRANSLATE_OSREL,
870 .trans_osrel = linux_trans_osrel
871 };
872
873 static const Elf64_Brandinfo linux_glibc2brand = {
874 .brand = ELFOSABI_LINUX,
875 .machine = EM_X86_64,
876 .compat_3_brand = "Linux",
877 .interp_path = "/lib64/ld-linux-x86-64.so.2",
878 .sysvec = &elf_linux_sysvec,
879 .interp_newpath = NULL,
880 .brand_note = &linux64_brandnote,
881 .flags = BI_CAN_EXEC_DYN | BI_BRAND_NOTE
882 };
883
884 static const Elf64_Brandinfo linux_glibc2brandshort = {
885 .brand = ELFOSABI_LINUX,
886 .machine = EM_X86_64,
887 .compat_3_brand = "Linux",
888 .interp_path = "/lib64/ld-linux.so.2",
889 .sysvec = &elf_linux_sysvec,
890 .interp_newpath = NULL,
891 .brand_note = &linux64_brandnote,
892 .flags = BI_CAN_EXEC_DYN | BI_BRAND_NOTE
893 };
894
895 static const Elf64_Brandinfo linux_muslbrand = {
896 .brand = ELFOSABI_LINUX,
897 .machine = EM_X86_64,
898 .compat_3_brand = "Linux",
899 .interp_path = "/lib/ld-musl-x86_64.so.1",
900 .sysvec = &elf_linux_sysvec,
901 .interp_newpath = NULL,
902 .brand_note = &linux64_brandnote,
903 .flags = BI_CAN_EXEC_DYN | BI_BRAND_NOTE |
904 LINUX_BI_FUTEX_REQUEUE
905 };
906
907 static const Elf64_Brandinfo *linux_brandlist[] = {
908 &linux_glibc2brand,
909 &linux_glibc2brandshort,
910 &linux_muslbrand,
911 NULL
912 };
913
914 static int
linux64_elf_modevent(module_t mod,int type,void * data)915 linux64_elf_modevent(module_t mod, int type, void *data)
916 {
917 const Elf64_Brandinfo **brandinfo;
918 int error;
919 struct linux_ioctl_handler **lihp;
920
921 error = 0;
922
923 switch(type) {
924 case MOD_LOAD:
925 for (brandinfo = &linux_brandlist[0]; *brandinfo != NULL;
926 ++brandinfo)
927 if (elf64_insert_brand_entry(*brandinfo) < 0)
928 error = EINVAL;
929 if (error == 0) {
930 SET_FOREACH(lihp, linux_ioctl_handler_set)
931 linux_ioctl_register_handler(*lihp);
932 stclohz = (stathz ? stathz : hz);
933 if (bootverbose)
934 printf("Linux x86-64 ELF exec handler installed\n");
935 } else
936 printf("cannot insert Linux x86-64 ELF brand handler\n");
937 break;
938 case MOD_UNLOAD:
939 for (brandinfo = &linux_brandlist[0]; *brandinfo != NULL;
940 ++brandinfo)
941 if (elf64_brand_inuse(*brandinfo))
942 error = EBUSY;
943 if (error == 0) {
944 for (brandinfo = &linux_brandlist[0];
945 *brandinfo != NULL; ++brandinfo)
946 if (elf64_remove_brand_entry(*brandinfo) < 0)
947 error = EINVAL;
948 }
949 if (error == 0) {
950 SET_FOREACH(lihp, linux_ioctl_handler_set)
951 linux_ioctl_unregister_handler(*lihp);
952 if (bootverbose)
953 printf("Linux x86_64 ELF exec handler removed\n");
954 } else
955 printf("Could not deinstall Linux x86_64 ELF interpreter entry\n");
956 break;
957 default:
958 return (EOPNOTSUPP);
959 }
960 return (error);
961 }
962
963 static moduledata_t linux64_elf_mod = {
964 "linux64elf",
965 linux64_elf_modevent,
966 0
967 };
968
969 DECLARE_MODULE_TIED(linux64elf, linux64_elf_mod, SI_SUB_EXEC, SI_ORDER_ANY);
970 MODULE_DEPEND(linux64elf, linux_common, 1, 1, 1);
971 FEATURE(linux64, "Linux 64bit support");
972