xref: /freebsd/sys/amd64/linux32/linux32_sysvec.c (revision e960cb4c033c8f65af1e8b09310c1bd5414f21ac)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 2004 Tim J. Robbins
5  * Copyright (c) 2003 Peter Wemm
6  * Copyright (c) 2002 Doug Rabson
7  * Copyright (c) 1998-1999 Andrew Gallatin
8  * Copyright (c) 1994-1996 Søren Schmidt
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer
16  *    in this position and unchanged.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. The name of the author may not be used to endorse or promote products
21  *    derived from this software without specific prior written permission
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
24  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
27  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
28  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
32  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #ifndef COMPAT_FREEBSD32
36 #error "Unable to compile Linux-emulator due to missing COMPAT_FREEBSD32 option!"
37 #endif
38 
39 #define	__ELF_WORD_SIZE	32
40 
41 #include <sys/param.h>
42 #include <sys/exec.h>
43 #include <sys/imgact.h>
44 #include <sys/imgact_elf.h>
45 #include <sys/kernel.h>
46 #include <sys/lock.h>
47 #include <sys/module.h>
48 #include <sys/mutex.h>
49 #include <sys/proc.h>
50 #include <sys/stddef.h>
51 #include <sys/syscallsubr.h>
52 #include <sys/sysctl.h>
53 #include <sys/sysent.h>
54 
55 #include <vm/pmap.h>
56 #include <vm/vm.h>
57 #include <vm/vm_map.h>
58 #include <vm/vm_param.h>
59 
60 #include <machine/md_var.h>
61 #include <machine/trap.h>
62 
63 #include <x86/linux/linux_x86.h>
64 #include <amd64/linux/linux_emul_md.h>
65 #include <amd64/linux32/linux.h>
66 #include <amd64/linux32/linux32_proto.h>
67 #include <compat/linux/linux_elf.h>
68 #include <compat/linux/linux_emul.h>
69 #include <compat/linux/linux_fork.h>
70 #include <compat/linux/linux_ioctl.h>
71 #include <compat/linux/linux_mib.h>
72 #include <compat/linux/linux_misc.h>
73 #include <compat/linux/linux_signal.h>
74 #include <compat/linux/linux_util.h>
75 #include <compat/linux/linux_vdso.h>
76 
77 #include <x86/linux/linux_x86_sigframe.h>
78 
79 MODULE_VERSION(linux, 1);
80 
81 #define	LINUX32_MAXUSER		((1ul << 32) - PAGE_SIZE)
82 #define	LINUX32_VDSOPAGE_SIZE	PAGE_SIZE * 2
83 #define	LINUX32_VDSOPAGE	(LINUX32_MAXUSER - LINUX32_VDSOPAGE_SIZE)
84 #define	LINUX32_SHAREDPAGE	(LINUX32_VDSOPAGE - PAGE_SIZE)
85 				/*
86 				 * PAGE_SIZE - the size
87 				 * of the native SHAREDPAGE
88 				 */
89 #define	LINUX32_USRSTACK	LINUX32_SHAREDPAGE
90 
91 static int linux_szsigcode;
92 static vm_object_t linux_vdso_obj;
93 static char *linux_vdso_mapping;
94 extern char _binary_linux32_vdso_so_o_start;
95 extern char _binary_linux32_vdso_so_o_end;
96 static vm_offset_t linux_vdso_base;
97 
98 extern struct sysent linux32_sysent[LINUX32_SYS_MAXSYSCALL];
99 extern const char *linux32_syscallnames[];
100 
101 SET_DECLARE(linux_ioctl_handler_set, struct linux_ioctl_handler);
102 
103 static int	linux_copyout_strings(struct image_params *imgp,
104 		    uintptr_t *stack_base);
105 static void     linux_sendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask);
106 static void	linux_exec_setregs(struct thread *td,
107 				   struct image_params *imgp, uintptr_t stack);
108 static void	linux_exec_sysvec_init(void *param);
109 static int	linux_on_exec_vmspace(struct proc *p,
110 		    struct image_params *imgp);
111 static void	linux32_fixlimit(struct rlimit *rl, int which);
112 static void	linux_vdso_install(const void *param);
113 static void	linux_vdso_deinstall(const void *param);
114 static void	linux_vdso_reloc(char *mapping, Elf_Addr offset);
115 static void	linux32_set_fork_retval(struct thread *td);
116 static void	linux32_set_syscall_retval(struct thread *td, int error);
117 
118 struct linux32_ps_strings {
119 	u_int32_t ps_argvstr;	/* first of 0 or more argument strings */
120 	u_int ps_nargvstr;	/* the number of argument strings */
121 	u_int32_t ps_envstr;	/* first of 0 or more environment strings */
122 	u_int ps_nenvstr;	/* the number of environment strings */
123 };
124 #define	LINUX32_PS_STRINGS	(LINUX32_USRSTACK - \
125 				    sizeof(struct linux32_ps_strings))
126 
127 LINUX_VDSO_SYM_INTPTR(__kernel_vsyscall);
128 LINUX_VDSO_SYM_INTPTR(linux32_vdso_sigcode);
129 LINUX_VDSO_SYM_INTPTR(linux32_vdso_rt_sigcode);
130 LINUX_VDSO_SYM_INTPTR(kern_timekeep_base);
131 LINUX_VDSO_SYM_INTPTR(kern_tsc_selector);
132 LINUX_VDSO_SYM_INTPTR(kern_cpu_selector);
133 LINUX_VDSO_SYM_CHAR(linux_platform);
134 
135 void
136 linux32_arch_copyout_auxargs(struct image_params *imgp, Elf_Auxinfo **pos)
137 {
138 
139 	AUXARGS_ENTRY((*pos), LINUX_AT_SYSINFO, __kernel_vsyscall);
140 	AUXARGS_ENTRY((*pos), LINUX_AT_SYSINFO_EHDR, linux_vdso_base);
141 	AUXARGS_ENTRY((*pos), LINUX_AT_HWCAP, cpu_feature);
142 	AUXARGS_ENTRY((*pos), LINUX_AT_HWCAP2, linux_x86_elf_hwcap2());
143 	AUXARGS_ENTRY((*pos), LINUX_AT_PLATFORM, PTROUT(linux_platform));
144 }
145 
146 static void
147 linux_rt_sendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask)
148 {
149 	struct thread *td = curthread;
150 	struct proc *p = td->td_proc;
151 	struct sigacts *psp;
152 	struct trapframe *regs;
153 	struct l_rt_sigframe *fp, frame;
154 	int oonstack;
155 	int sig;
156 	int code;
157 
158 	sig = linux_translate_traps(ksi->ksi_signo, ksi->ksi_trapno);
159 	code = ksi->ksi_code;
160 	PROC_LOCK_ASSERT(p, MA_OWNED);
161 	psp = p->p_sigacts;
162 	mtx_assert(&psp->ps_mtx, MA_OWNED);
163 	regs = td->td_frame;
164 	oonstack = sigonstack(regs->tf_rsp);
165 
166 	/* Allocate space for the signal handler context. */
167 	if ((td->td_pflags & TDP_ALTSTACK) && !oonstack &&
168 	    SIGISMEMBER(psp->ps_sigonstack, sig)) {
169 		fp = (struct l_rt_sigframe *)((uintptr_t)td->td_sigstk.ss_sp +
170 		    td->td_sigstk.ss_size - sizeof(struct l_rt_sigframe));
171 	} else
172 		fp = (struct l_rt_sigframe *)regs->tf_rsp - 1;
173 	mtx_unlock(&psp->ps_mtx);
174 
175 	/* Build the argument list for the signal handler. */
176 	sig = bsd_to_linux_signal(sig);
177 
178 	bzero(&frame, sizeof(frame));
179 
180 	frame.sf_sig = sig;
181 	frame.sf_siginfo = PTROUT(&fp->sf_si);
182 	frame.sf_ucontext = PTROUT(&fp->sf_uc);
183 
184 	/* Fill in POSIX parts. */
185 	siginfo_to_lsiginfo(&ksi->ksi_info, &frame.sf_si, sig);
186 
187 	/*
188 	 * Build the signal context to be used by sigreturn and libgcc unwind.
189 	 */
190 	frame.sf_uc.uc_stack.ss_sp = PTROUT(td->td_sigstk.ss_sp);
191 	frame.sf_uc.uc_stack.ss_size = td->td_sigstk.ss_size;
192 	frame.sf_uc.uc_stack.ss_flags = (td->td_pflags & TDP_ALTSTACK)
193 	    ? ((oonstack) ? LINUX_SS_ONSTACK : 0) : LINUX_SS_DISABLE;
194 	PROC_UNLOCK(p);
195 
196 	bsd_to_linux_sigset(mask, &frame.sf_uc.uc_sigmask);
197 
198 	frame.sf_uc.uc_mcontext.sc_mask   = frame.sf_uc.uc_sigmask.__mask;
199 	frame.sf_uc.uc_mcontext.sc_edi    = regs->tf_rdi;
200 	frame.sf_uc.uc_mcontext.sc_esi    = regs->tf_rsi;
201 	frame.sf_uc.uc_mcontext.sc_ebp    = regs->tf_rbp;
202 	frame.sf_uc.uc_mcontext.sc_ebx    = regs->tf_rbx;
203 	frame.sf_uc.uc_mcontext.sc_esp    = regs->tf_rsp;
204 	frame.sf_uc.uc_mcontext.sc_edx    = regs->tf_rdx;
205 	frame.sf_uc.uc_mcontext.sc_ecx    = regs->tf_rcx;
206 	frame.sf_uc.uc_mcontext.sc_eax    = regs->tf_rax;
207 	frame.sf_uc.uc_mcontext.sc_eip    = regs->tf_rip;
208 	frame.sf_uc.uc_mcontext.sc_cs     = regs->tf_cs;
209 	frame.sf_uc.uc_mcontext.sc_gs     = regs->tf_gs;
210 	frame.sf_uc.uc_mcontext.sc_fs     = regs->tf_fs;
211 	frame.sf_uc.uc_mcontext.sc_es     = regs->tf_es;
212 	frame.sf_uc.uc_mcontext.sc_ds     = regs->tf_ds;
213 	frame.sf_uc.uc_mcontext.sc_eflags = regs->tf_rflags;
214 	frame.sf_uc.uc_mcontext.sc_esp_at_signal = regs->tf_rsp;
215 	frame.sf_uc.uc_mcontext.sc_ss     = regs->tf_ss;
216 	frame.sf_uc.uc_mcontext.sc_err    = regs->tf_err;
217 	frame.sf_uc.uc_mcontext.sc_cr2    = (u_int32_t)(uintptr_t)ksi->ksi_addr;
218 	frame.sf_uc.uc_mcontext.sc_trapno = bsd_to_linux_trapcode(code);
219 
220 	if (copyout(&frame, fp, sizeof(frame)) != 0) {
221 		/*
222 		 * Process has trashed its stack; give it an illegal
223 		 * instruction to halt it in its tracks.
224 		 */
225 		PROC_LOCK(p);
226 		sigexit(td, SIGILL);
227 	}
228 
229 	/* Build context to run handler in. */
230 	regs->tf_rsp = PTROUT(fp);
231 	regs->tf_rip = linux32_vdso_rt_sigcode;
232 	regs->tf_rdi = PTROUT(catcher);
233 	regs->tf_rflags &= ~(PSL_T | PSL_D);
234 	regs->tf_cs = _ucode32sel;
235 	regs->tf_ss = _udatasel;
236 	regs->tf_ds = _udatasel;
237 	regs->tf_es = _udatasel;
238 	regs->tf_fs = _ufssel;
239 	regs->tf_gs = _ugssel;
240 	regs->tf_flags = TF_HASSEGS;
241 	set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
242 	PROC_LOCK(p);
243 	mtx_lock(&psp->ps_mtx);
244 }
245 
246 /*
247  * Send an interrupt to process.
248  *
249  * Stack is set up to allow sigcode stored
250  * in u. to call routine, followed by kcall
251  * to sigreturn routine below.  After sigreturn
252  * resets the signal mask, the stack, and the
253  * frame pointer, it returns to the user
254  * specified pc, psl.
255  */
256 static void
257 linux_sendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask)
258 {
259 	struct thread *td = curthread;
260 	struct proc *p = td->td_proc;
261 	struct sigacts *psp;
262 	struct trapframe *regs;
263 	struct l_sigframe *fp, frame;
264 	l_sigset_t lmask;
265 	int oonstack;
266 	int sig, code;
267 
268 	sig = linux_translate_traps(ksi->ksi_signo, ksi->ksi_trapno);
269 	code = ksi->ksi_code;
270 	PROC_LOCK_ASSERT(p, MA_OWNED);
271 	psp = p->p_sigacts;
272 	mtx_assert(&psp->ps_mtx, MA_OWNED);
273 	if (SIGISMEMBER(psp->ps_siginfo, sig)) {
274 		/* Signal handler installed with SA_SIGINFO. */
275 		linux_rt_sendsig(catcher, ksi, mask);
276 		return;
277 	}
278 
279 	regs = td->td_frame;
280 	oonstack = sigonstack(regs->tf_rsp);
281 
282 	/* Allocate space for the signal handler context. */
283 	if ((td->td_pflags & TDP_ALTSTACK) && !oonstack &&
284 	    SIGISMEMBER(psp->ps_sigonstack, sig)) {
285 		fp = (struct l_sigframe *)((uintptr_t)td->td_sigstk.ss_sp +
286 		    td->td_sigstk.ss_size - sizeof(struct l_sigframe));
287 	} else
288 		fp = (struct l_sigframe *)regs->tf_rsp - 1;
289 	mtx_unlock(&psp->ps_mtx);
290 	PROC_UNLOCK(p);
291 
292 	/* Build the argument list for the signal handler. */
293 	sig = bsd_to_linux_signal(sig);
294 
295 	bzero(&frame, sizeof(frame));
296 
297 	frame.sf_sig = sig;
298 	frame.sf_sigmask = *mask;
299 	bsd_to_linux_sigset(mask, &lmask);
300 
301 	/* Build the signal context to be used by sigreturn. */
302 	frame.sf_sc.sc_mask   = lmask.__mask;
303 	frame.sf_sc.sc_gs     = regs->tf_gs;
304 	frame.sf_sc.sc_fs     = regs->tf_fs;
305 	frame.sf_sc.sc_es     = regs->tf_es;
306 	frame.sf_sc.sc_ds     = regs->tf_ds;
307 	frame.sf_sc.sc_edi    = regs->tf_rdi;
308 	frame.sf_sc.sc_esi    = regs->tf_rsi;
309 	frame.sf_sc.sc_ebp    = regs->tf_rbp;
310 	frame.sf_sc.sc_ebx    = regs->tf_rbx;
311 	frame.sf_sc.sc_esp    = regs->tf_rsp;
312 	frame.sf_sc.sc_edx    = regs->tf_rdx;
313 	frame.sf_sc.sc_ecx    = regs->tf_rcx;
314 	frame.sf_sc.sc_eax    = regs->tf_rax;
315 	frame.sf_sc.sc_eip    = regs->tf_rip;
316 	frame.sf_sc.sc_cs     = regs->tf_cs;
317 	frame.sf_sc.sc_eflags = regs->tf_rflags;
318 	frame.sf_sc.sc_esp_at_signal = regs->tf_rsp;
319 	frame.sf_sc.sc_ss     = regs->tf_ss;
320 	frame.sf_sc.sc_err    = regs->tf_err;
321 	frame.sf_sc.sc_cr2    = (u_int32_t)(uintptr_t)ksi->ksi_addr;
322 	frame.sf_sc.sc_trapno = bsd_to_linux_trapcode(code);
323 
324 	if (copyout(&frame, fp, sizeof(frame)) != 0) {
325 		/*
326 		 * Process has trashed its stack; give it an illegal
327 		 * instruction to halt it in its tracks.
328 		 */
329 		PROC_LOCK(p);
330 		sigexit(td, SIGILL);
331 	}
332 
333 	/* Build context to run handler in. */
334 	regs->tf_rsp = PTROUT(fp);
335 	regs->tf_rip = linux32_vdso_sigcode;
336 	regs->tf_rdi = PTROUT(catcher);
337 	regs->tf_rflags &= ~(PSL_T | PSL_D);
338 	regs->tf_cs = _ucode32sel;
339 	regs->tf_ss = _udatasel;
340 	regs->tf_ds = _udatasel;
341 	regs->tf_es = _udatasel;
342 	regs->tf_fs = _ufssel;
343 	regs->tf_gs = _ugssel;
344 	regs->tf_flags = TF_HASSEGS;
345 	set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
346 	PROC_LOCK(p);
347 	mtx_lock(&psp->ps_mtx);
348 }
349 
350 /*
351  * System call to cleanup state after a signal
352  * has been taken.  Reset signal mask and
353  * stack state from context left by sendsig (above).
354  * Return to previous pc and psl as specified by
355  * context left by sendsig. Check carefully to
356  * make sure that the user has not modified the
357  * psl to gain improper privileges or to cause
358  * a machine fault.
359  */
360 int
361 linux_sigreturn(struct thread *td, struct linux_sigreturn_args *args)
362 {
363 	struct l_sigframe frame;
364 	struct trapframe *regs;
365 	int eflags;
366 	ksiginfo_t ksi;
367 
368 	regs = td->td_frame;
369 
370 	/*
371 	 * The trampoline code hands us the sigframe.
372 	 * It is unsafe to keep track of it ourselves, in the event that a
373 	 * program jumps out of a signal handler.
374 	 */
375 	if (copyin(args->sfp, &frame, sizeof(frame)) != 0)
376 		return (EFAULT);
377 
378 	/* Check for security violations. */
379 	eflags = frame.sf_sc.sc_eflags;
380 	if (!EFL_SECURE(eflags, regs->tf_rflags))
381 		return(EINVAL);
382 
383 	/*
384 	 * Don't allow users to load a valid privileged %cs.  Let the
385 	 * hardware check for invalid selectors, excess privilege in
386 	 * other selectors, invalid %eip's and invalid %esp's.
387 	 */
388 	if (!CS_SECURE(frame.sf_sc.sc_cs)) {
389 		ksiginfo_init_trap(&ksi);
390 		ksi.ksi_signo = SIGBUS;
391 		ksi.ksi_code = BUS_OBJERR;
392 		ksi.ksi_trapno = T_PROTFLT;
393 		ksi.ksi_addr = (void *)regs->tf_rip;
394 		trapsignal(td, &ksi);
395 		return(EINVAL);
396 	}
397 
398 	kern_sigprocmask(td, SIG_SETMASK, &frame.sf_sigmask, NULL, 0);
399 
400 	/* Restore signal context. */
401 	regs->tf_rdi    = frame.sf_sc.sc_edi;
402 	regs->tf_rsi    = frame.sf_sc.sc_esi;
403 	regs->tf_rbp    = frame.sf_sc.sc_ebp;
404 	regs->tf_rbx    = frame.sf_sc.sc_ebx;
405 	regs->tf_rdx    = frame.sf_sc.sc_edx;
406 	regs->tf_rcx    = frame.sf_sc.sc_ecx;
407 	regs->tf_rax    = frame.sf_sc.sc_eax;
408 	regs->tf_rip    = frame.sf_sc.sc_eip;
409 	regs->tf_cs     = frame.sf_sc.sc_cs;
410 	regs->tf_ds     = frame.sf_sc.sc_ds;
411 	regs->tf_es     = frame.sf_sc.sc_es;
412 	regs->tf_fs     = frame.sf_sc.sc_fs;
413 	regs->tf_gs     = frame.sf_sc.sc_gs;
414 	regs->tf_rflags = eflags;
415 	regs->tf_rsp    = frame.sf_sc.sc_esp_at_signal;
416 	regs->tf_ss     = frame.sf_sc.sc_ss;
417 	set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
418 
419 	return (EJUSTRETURN);
420 }
421 
422 /*
423  * System call to cleanup state after a signal
424  * has been taken.  Reset signal mask and
425  * stack state from context left by rt_sendsig (above).
426  * Return to previous pc and psl as specified by
427  * context left by sendsig. Check carefully to
428  * make sure that the user has not modified the
429  * psl to gain improper privileges or to cause
430  * a machine fault.
431  */
432 int
433 linux_rt_sigreturn(struct thread *td, struct linux_rt_sigreturn_args *args)
434 {
435 	struct l_ucontext uc;
436 	struct l_sigcontext *context;
437 	sigset_t bmask;
438 	l_stack_t *lss;
439 	stack_t ss;
440 	struct trapframe *regs;
441 	int eflags;
442 	ksiginfo_t ksi;
443 
444 	regs = td->td_frame;
445 
446 	/*
447 	 * The trampoline code hands us the ucontext.
448 	 * It is unsafe to keep track of it ourselves, in the event that a
449 	 * program jumps out of a signal handler.
450 	 */
451 	if (copyin(args->ucp, &uc, sizeof(uc)) != 0)
452 		return (EFAULT);
453 
454 	context = &uc.uc_mcontext;
455 
456 	/* Check for security violations. */
457 	eflags = context->sc_eflags;
458 	if (!EFL_SECURE(eflags, regs->tf_rflags))
459 		return(EINVAL);
460 
461 	/*
462 	 * Don't allow users to load a valid privileged %cs.  Let the
463 	 * hardware check for invalid selectors, excess privilege in
464 	 * other selectors, invalid %eip's and invalid %esp's.
465 	 */
466 	if (!CS_SECURE(context->sc_cs)) {
467 		ksiginfo_init_trap(&ksi);
468 		ksi.ksi_signo = SIGBUS;
469 		ksi.ksi_code = BUS_OBJERR;
470 		ksi.ksi_trapno = T_PROTFLT;
471 		ksi.ksi_addr = (void *)regs->tf_rip;
472 		trapsignal(td, &ksi);
473 		return(EINVAL);
474 	}
475 
476 	linux_to_bsd_sigset(&uc.uc_sigmask, &bmask);
477 	kern_sigprocmask(td, SIG_SETMASK, &bmask, NULL, 0);
478 
479 	/*
480 	 * Restore signal context
481 	 */
482 	regs->tf_gs	= context->sc_gs;
483 	regs->tf_fs	= context->sc_fs;
484 	regs->tf_es	= context->sc_es;
485 	regs->tf_ds	= context->sc_ds;
486 	regs->tf_rdi    = context->sc_edi;
487 	regs->tf_rsi    = context->sc_esi;
488 	regs->tf_rbp    = context->sc_ebp;
489 	regs->tf_rbx    = context->sc_ebx;
490 	regs->tf_rdx    = context->sc_edx;
491 	regs->tf_rcx    = context->sc_ecx;
492 	regs->tf_rax    = context->sc_eax;
493 	regs->tf_rip    = context->sc_eip;
494 	regs->tf_cs     = context->sc_cs;
495 	regs->tf_rflags = eflags;
496 	regs->tf_rsp    = context->sc_esp_at_signal;
497 	regs->tf_ss     = context->sc_ss;
498 	set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
499 
500 	/*
501 	 * call sigaltstack & ignore results..
502 	 */
503 	lss = &uc.uc_stack;
504 	ss.ss_sp = PTRIN(lss->ss_sp);
505 	ss.ss_size = lss->ss_size;
506 	ss.ss_flags = linux_to_bsd_sigaltstack(lss->ss_flags);
507 
508 	(void)kern_sigaltstack(td, &ss, NULL);
509 
510 	return (EJUSTRETURN);
511 }
512 
513 static int
514 linux32_fetch_syscall_args(struct thread *td)
515 {
516 	struct proc *p;
517 	struct trapframe *frame;
518 	struct syscall_args *sa;
519 
520 	p = td->td_proc;
521 	frame = td->td_frame;
522 	sa = &td->td_sa;
523 
524 	sa->args[0] = frame->tf_rbx;
525 	sa->args[1] = frame->tf_rcx;
526 	sa->args[2] = frame->tf_rdx;
527 	sa->args[3] = frame->tf_rsi;
528 	sa->args[4] = frame->tf_rdi;
529 	sa->args[5] = frame->tf_rbp;
530 	sa->code = frame->tf_rax;
531 	sa->original_code = sa->code;
532 
533 	if (sa->code >= p->p_sysent->sv_size)
534 		/* nosys */
535 		sa->callp = &nosys_sysent;
536 	else
537 		sa->callp = &p->p_sysent->sv_table[sa->code];
538 
539 	td->td_retval[0] = 0;
540 	td->td_retval[1] = frame->tf_rdx;
541 
542 	return (0);
543 }
544 
545 static void
546 linux32_set_syscall_retval(struct thread *td, int error)
547 {
548 	struct trapframe *frame = td->td_frame;
549 
550 	cpu_set_syscall_retval(td, error);
551 
552 	if (__predict_false(error != 0)) {
553 		if (error != ERESTART && error != EJUSTRETURN)
554 			frame->tf_rax = bsd_to_linux_errno(error);
555 	}
556 }
557 
558 static void
559 linux32_set_fork_retval(struct thread *td)
560 {
561 	struct trapframe *frame = td->td_frame;
562 
563 	frame->tf_rax = 0;
564 }
565 
566 /*
567  * Clear registers on exec
568  * XXX copied from ia32_signal.c.
569  */
570 static void
571 linux_exec_setregs(struct thread *td, struct image_params *imgp,
572     uintptr_t stack)
573 {
574 	struct trapframe *regs = td->td_frame;
575 	struct pcb *pcb = td->td_pcb;
576 	register_t saved_rflags;
577 
578 	regs = td->td_frame;
579 	pcb = td->td_pcb;
580 
581 	if (td->td_proc->p_md.md_ldt != NULL)
582 		user_ldt_free(td);
583 
584 	/* Do full restore on return so that we can change to a different %cs */
585 	set_pcb_flags(pcb, PCB_32BIT | PCB_FULL_IRET);
586 	clear_pcb_flags(pcb, PCB_TLSBASE);
587 
588 	critical_enter();
589 	wrmsr(MSR_FSBASE, 0);
590 	wrmsr(MSR_KGSBASE, 0);	/* User value while we're in the kernel */
591 	pcb->pcb_fsbase = 0;
592 	pcb->pcb_gsbase = 0;
593 	critical_exit();
594 	pcb->pcb_initial_fpucw = __LINUX_NPXCW__;
595 
596 	saved_rflags = regs->tf_rflags & PSL_T;
597 	bzero((char *)regs, sizeof(struct trapframe));
598 	regs->tf_rip = imgp->entry_addr;
599 	regs->tf_rsp = stack;
600 	regs->tf_rflags = PSL_USER | saved_rflags;
601 	regs->tf_gs = _ugssel;
602 	regs->tf_fs = _ufssel;
603 	regs->tf_es = _udatasel;
604 	regs->tf_ds = _udatasel;
605 	regs->tf_ss = _udatasel;
606 	regs->tf_flags = TF_HASSEGS;
607 	regs->tf_cs = _ucode32sel;
608 	regs->tf_rbx = (register_t)imgp->ps_strings;
609 
610 	x86_clear_dbregs(pcb);
611 	exec_splitlock(td);
612 
613 	fpstate_drop(td);
614 
615 	/* Linux processes start with PKRU denying unallocated keys. */
616 	linux_pkru_exec_init(td);
617 }
618 
619 /*
620  * XXX copied from ia32_sysvec.c.
621  */
622 static int
623 linux_copyout_strings(struct image_params *imgp, uintptr_t *stack_base)
624 {
625 	int argc, envc, error;
626 	u_int32_t *vectp;
627 	char *stringp;
628 	uintptr_t destp, ustringp;
629 	struct linux32_ps_strings *arginfo;
630 	char canary[LINUX_AT_RANDOM_LEN];
631 	size_t execpath_len;
632 
633 	arginfo = (struct linux32_ps_strings *)PROC_PS_STRINGS(imgp->proc);
634 	destp = (uintptr_t)arginfo;
635 
636 	if (imgp->execpath != NULL && imgp->auxargs != NULL) {
637 		execpath_len = strlen(imgp->execpath) + 1;
638 		destp -= execpath_len;
639 		destp = rounddown2(destp, sizeof(uint32_t));
640 		imgp->execpathp = (void *)destp;
641 		error = copyout(imgp->execpath, imgp->execpathp, execpath_len);
642 		if (error != 0)
643 			return (error);
644 	}
645 
646 	/* Prepare the canary for SSP. */
647 	arc4rand(canary, sizeof(canary), 0);
648 	destp -= roundup(sizeof(canary), sizeof(uint32_t));
649 	imgp->canary = (void *)destp;
650 	error = copyout(canary, imgp->canary, sizeof(canary));
651 	if (error != 0)
652 		return (error);
653 
654 	/* Allocate room for the argument and environment strings. */
655 	destp -= ARG_MAX - imgp->args->stringspace;
656 	destp = rounddown2(destp, sizeof(uint32_t));
657 	ustringp = destp;
658 
659 	if (imgp->auxargs) {
660 		/*
661 		 * Allocate room on the stack for the ELF auxargs
662 		 * array.  It has LINUX_AT_COUNT entries.
663 		 */
664 		destp -= LINUX_AT_COUNT * sizeof(Elf32_Auxinfo);
665 		destp = rounddown2(destp, sizeof(uint32_t));
666 	}
667 
668 	vectp = (uint32_t *)destp;
669 
670 	/*
671 	 * Allocate room for the argv[] and env vectors including the
672 	 * terminating NULL pointers.
673 	 */
674 	vectp -= imgp->args->argc + 1 + imgp->args->envc + 1;
675 
676 	/* vectp also becomes our initial stack base. */
677 	*stack_base = (uintptr_t)vectp;
678 
679 	stringp = imgp->args->begin_argv;
680 	argc = imgp->args->argc;
681 	envc = imgp->args->envc;
682 
683 	/* Copy out strings - arguments and environment. */
684 	error = copyout(stringp, (void *)ustringp,
685 	    ARG_MAX - imgp->args->stringspace);
686 	if (error != 0)
687 		return (error);
688 
689 	/* Fill in "ps_strings" struct for ps, w, etc. */
690 	if (suword32(&arginfo->ps_argvstr, (uint32_t)(intptr_t)vectp) != 0 ||
691 	    suword32(&arginfo->ps_nargvstr, argc) != 0)
692 		return (EFAULT);
693 
694 	/* Fill in argument portion of vector table. */
695 	for (; argc > 0; --argc) {
696 		if (suword32(vectp++, ustringp) != 0)
697 			return (EFAULT);
698 		while (*stringp++ != 0)
699 			ustringp++;
700 		ustringp++;
701 	}
702 
703 	/* A null vector table pointer separates the argp's from the envp's. */
704 	if (suword32(vectp++, 0) != 0)
705 		return (EFAULT);
706 
707 	if (suword32(&arginfo->ps_envstr, (uint32_t)(intptr_t)vectp) != 0 ||
708 	    suword32(&arginfo->ps_nenvstr, envc) != 0)
709 		return (EFAULT);
710 
711 	/* Fill in environment portion of vector table. */
712 	for (; envc > 0; --envc) {
713 		if (suword32(vectp++, ustringp) != 0)
714 			return (EFAULT);
715 		while (*stringp++ != 0)
716 			ustringp++;
717 		ustringp++;
718 	}
719 
720 	/* The end of the vector table is a null pointer. */
721 	if (suword32(vectp, 0) != 0)
722 		return (EFAULT);
723 
724 	if (imgp->auxargs) {
725 		vectp++;
726 		error = imgp->sysent->sv_copyout_auxargs(imgp,
727 		    (uintptr_t)vectp);
728 		if (error != 0)
729 			return (error);
730 	}
731 
732 	return (0);
733 }
734 
735 static SYSCTL_NODE(_compat, OID_AUTO, linux32, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
736     "32-bit Linux emulation");
737 
738 static u_long	linux32_maxdsiz = LINUX32_MAXDSIZ;
739 SYSCTL_ULONG(_compat_linux32, OID_AUTO, maxdsiz, CTLFLAG_RW,
740     &linux32_maxdsiz, 0, "");
741 static u_long	linux32_maxssiz = LINUX32_MAXSSIZ;
742 SYSCTL_ULONG(_compat_linux32, OID_AUTO, maxssiz, CTLFLAG_RW,
743     &linux32_maxssiz, 0, "");
744 static u_long	linux32_maxvmem = LINUX32_MAXVMEM;
745 SYSCTL_ULONG(_compat_linux32, OID_AUTO, maxvmem, CTLFLAG_RW,
746     &linux32_maxvmem, 0, "");
747 bool linux32_emulate_i386 = false;
748 SYSCTL_BOOL(_compat_linux32, OID_AUTO, emulate_i386, CTLFLAG_RWTUN,
749     &linux32_emulate_i386, 0, "Emulate the real i386");
750 
751 static void
752 linux32_fixlimit(struct rlimit *rl, int which)
753 {
754 
755 	switch (which) {
756 	case RLIMIT_DATA:
757 		if (linux32_maxdsiz != 0) {
758 			if (rl->rlim_cur > linux32_maxdsiz)
759 				rl->rlim_cur = linux32_maxdsiz;
760 			if (rl->rlim_max > linux32_maxdsiz)
761 				rl->rlim_max = linux32_maxdsiz;
762 		}
763 		break;
764 	case RLIMIT_STACK:
765 		if (linux32_maxssiz != 0) {
766 			if (rl->rlim_cur > linux32_maxssiz)
767 				rl->rlim_cur = linux32_maxssiz;
768 			if (rl->rlim_max > linux32_maxssiz)
769 				rl->rlim_max = linux32_maxssiz;
770 		}
771 		break;
772 	case RLIMIT_VMEM:
773 		if (linux32_maxvmem != 0) {
774 			if (rl->rlim_cur > linux32_maxvmem)
775 				rl->rlim_cur = linux32_maxvmem;
776 			if (rl->rlim_max > linux32_maxvmem)
777 				rl->rlim_max = linux32_maxvmem;
778 		}
779 		break;
780 	}
781 }
782 
783 struct sysentvec elf_linux_sysvec = {
784 	.sv_size	= LINUX32_SYS_MAXSYSCALL,
785 	.sv_table	= linux32_sysent,
786 	.sv_fixup	= elf32_freebsd_fixup,
787 	.sv_sendsig	= linux_sendsig,
788 	.sv_sigcode	= &_binary_linux32_vdso_so_o_start,
789 	.sv_szsigcode	= &linux_szsigcode,
790 	.sv_name	= "Linux ELF32",
791 	.sv_coredump	= elf32_coredump,
792 	.sv_elf_core_osabi = ELFOSABI_NONE,
793 	.sv_elf_core_abi_vendor = LINUX_ABI_VENDOR,
794 	.sv_elf_core_prepare_notes = linux32_prepare_notes,
795 	.sv_minsigstksz	= LINUX_MINSIGSTKSZ,
796 	.sv_minuser	= VM_MIN_ADDRESS,
797 	.sv_maxuser	= LINUX32_MAXUSER,
798 	.sv_usrstack	= LINUX32_USRSTACK,
799 	.sv_psstrings	= LINUX32_PS_STRINGS,
800 	.sv_psstringssz	= sizeof(struct linux32_ps_strings),
801 	.sv_stackprot	= VM_PROT_ALL,
802 	.sv_copyout_auxargs = __linuxN(copyout_auxargs),
803 	.sv_copyout_strings = linux_copyout_strings,
804 	.sv_setregs	= linux_exec_setregs,
805 	.sv_fixlimit	= linux32_fixlimit,
806 	.sv_maxssiz	= &linux32_maxssiz,
807 	.sv_flags	= SV_ABI_LINUX | SV_ILP32 | SV_SHP |
808 	    SV_SIG_DISCIGN | SV_SIG_WAITNDQ | SV_TIMEKEEP,
809 	.sv_set_syscall_retval = linux32_set_syscall_retval,
810 	.sv_fetch_syscall_args = linux32_fetch_syscall_args,
811 	.sv_syscallnames = linux32_syscallnames,
812 	.sv_shared_page_base = LINUX32_SHAREDPAGE,
813 	.sv_shared_page_len = PAGE_SIZE,
814 	.sv_schedtail	= linux_schedtail,
815 	.sv_thread_detach = linux_thread_detach,
816 	.sv_trap	= NULL,
817 	.sv_hwcap	= NULL,
818 	.sv_hwcap2	= NULL,
819 	.sv_hwcap3	= NULL,
820 	.sv_hwcap4	= NULL,
821 	.sv_onexec	= linux_on_exec_vmspace,
822 	.sv_onexit	= linux_on_exit,
823 	.sv_ontdexit	= linux_thread_dtor,
824 	.sv_setid_allowed = &linux_setid_allowed_query,
825 	.sv_set_fork_retval = linux32_set_fork_retval,
826 };
827 
828 static int
829 linux_on_exec_vmspace(struct proc *p, struct image_params *imgp)
830 {
831 	int error;
832 
833 	error = linux_map_vdso(p, linux_vdso_obj, linux_vdso_base,
834 	    LINUX32_VDSOPAGE_SIZE, imgp);
835 	if (error == 0)
836 		error = linux_on_exec(p, imgp);
837 	return (error);
838 }
839 
840 /*
841  * linux_vdso_install() and linux_exec_sysvec_init() must be called
842  * after exec_sysvec_init() which is SI_SUB_EXEC (SI_ORDER_ANY).
843  */
844 static void
845 linux_exec_sysvec_init(void *param)
846 {
847 	l_uintptr_t *ktimekeep_base, *ktsc_selector;
848 	struct sysentvec *sv;
849 	ptrdiff_t tkoff;
850 
851 	sv = param;
852 	/* Fill timekeep_base */
853 	exec_sysvec_init(sv);
854 
855 	tkoff = kern_timekeep_base - linux_vdso_base;
856 	ktimekeep_base = (l_uintptr_t *)(linux_vdso_mapping + tkoff);
857 	*ktimekeep_base = sv->sv_shared_page_base + sv->sv_timekeep_offset;
858 
859 	tkoff = kern_tsc_selector - linux_vdso_base;
860 	ktsc_selector = (l_uintptr_t *)(linux_vdso_mapping + tkoff);
861 	*ktsc_selector = linux_vdso_tsc_selector_idx();
862 	if (bootverbose)
863 		printf("Linux i386 vDSO tsc_selector: %u\n", *ktsc_selector);
864 
865 	tkoff = kern_cpu_selector - linux_vdso_base;
866 	ktsc_selector = (l_uintptr_t *)(linux_vdso_mapping + tkoff);
867 	*ktsc_selector = linux_vdso_cpu_selector_idx();
868 	if (bootverbose)
869 		printf("Linux i386 vDSO cpu_selector: %u\n", *ktsc_selector);
870 }
871 SYSINIT(elf_linux_exec_sysvec_init, SI_SUB_EXEC + 1, SI_ORDER_ANY,
872     linux_exec_sysvec_init, &elf_linux_sysvec);
873 
874 static void
875 linux_vdso_install(const void *param)
876 {
877 	char *vdso_start = &_binary_linux32_vdso_so_o_start;
878 	char *vdso_end = &_binary_linux32_vdso_so_o_end;
879 
880 	linux_szsigcode = vdso_end - vdso_start;
881 	MPASS(linux_szsigcode <= LINUX32_VDSOPAGE_SIZE);
882 
883 	linux_vdso_base = LINUX32_VDSOPAGE;
884 
885 	__elfN(linux_vdso_fixup)(vdso_start, linux_vdso_base);
886 
887 	linux_vdso_obj = __elfN(linux_shared_page_init)
888 	    (&linux_vdso_mapping, LINUX32_VDSOPAGE_SIZE);
889 	bcopy(vdso_start, linux_vdso_mapping, linux_szsigcode);
890 
891 	linux_vdso_reloc(linux_vdso_mapping, linux_vdso_base);
892 }
893 SYSINIT(elf_linux_vdso_init, SI_SUB_EXEC + 1, SI_ORDER_FIRST,
894     linux_vdso_install, NULL);
895 
896 static void
897 linux_vdso_deinstall(const void *param)
898 {
899 
900 	__elfN(linux_shared_page_fini)(linux_vdso_obj,
901 	    linux_vdso_mapping, LINUX32_VDSOPAGE_SIZE);
902 }
903 SYSUNINIT(elf_linux_vdso_uninit, SI_SUB_EXEC, SI_ORDER_FIRST,
904     linux_vdso_deinstall, NULL);
905 
906 static void
907 linux_vdso_reloc(char *mapping, Elf_Addr offset)
908 {
909 	const Elf_Shdr *shdr;
910 	const Elf_Rel *rel;
911 	const Elf_Ehdr *ehdr;
912 	Elf32_Addr *where;
913 	Elf_Size rtype, symidx;
914 	Elf32_Addr addr, addend;
915 	int i, relcnt;
916 
917 	MPASS(offset != 0);
918 
919 	relcnt = 0;
920 	ehdr = (const Elf_Ehdr *)mapping;
921 	shdr = (const Elf_Shdr *)(mapping + ehdr->e_shoff);
922 	for (i = 0; i < ehdr->e_shnum; i++)
923 	{
924 		switch (shdr[i].sh_type) {
925 		case SHT_REL:
926 			rel = (const Elf_Rel *)(mapping + shdr[i].sh_offset);
927 			relcnt = shdr[i].sh_size / sizeof(*rel);
928 			break;
929 		case SHT_RELA:
930 			printf("Linux i386 vDSO: unexpected Rela section\n");
931 			break;
932 		}
933 	}
934 
935 	for (i = 0; i < relcnt; i++, rel++) {
936 		where = (Elf32_Addr *)(mapping + rel->r_offset);
937 		addend = *where;
938 		rtype = ELF_R_TYPE(rel->r_info);
939 		symidx = ELF_R_SYM(rel->r_info);
940 
941 		switch (rtype) {
942 		case R_386_NONE:	/* none */
943 			break;
944 
945 		case R_386_RELATIVE:	/* B + A */
946 			addr = (Elf32_Addr)PTROUT(offset + addend);
947 			if (*where != addr)
948 				*where = addr;
949 			break;
950 
951 		case R_386_IRELATIVE:
952 			printf("Linux i386 vDSO: unexpected ifunc relocation, "
953 			    "symbol index %ld\n", (intmax_t)symidx);
954 			break;
955 		default:
956 			printf("Linux i386 vDSO: unexpected relocation type %ld, "
957 			    "symbol index %ld\n", (intmax_t)rtype, (intmax_t)symidx);
958 		}
959 	}
960 }
961 
962 static const Elf_Brandnote linux32_brandnote = {
963 	.hdr.n_namesz	= sizeof(GNU_ABI_VENDOR),
964 	.hdr.n_descsz	= 16,	/* XXX at least 16 */
965 	.hdr.n_type	= 1,
966 	.vendor		= GNU_ABI_VENDOR,
967 	.flags		= BN_TRANSLATE_OSREL,
968 	.trans_osrel	= linux_trans_osrel
969 };
970 
971 static const Elf32_Brandinfo linux_brand = {
972 	.brand		= ELFOSABI_LINUX,
973 	.machine	= EM_386,
974 	.compat_3_brand	= "Linux",
975 	.interp_path	= "/lib/ld-linux.so.1",
976 	.sysvec		= &elf_linux_sysvec,
977 	.interp_newpath	= NULL,
978 	.brand_note	= &linux32_brandnote,
979 	.flags		= BI_CAN_EXEC_DYN | BI_BRAND_NOTE
980 };
981 
982 static const Elf32_Brandinfo linux_glibc2brand = {
983 	.brand		= ELFOSABI_LINUX,
984 	.machine	= EM_386,
985 	.compat_3_brand	= "Linux",
986 	.interp_path	= "/lib/ld-linux.so.2",
987 	.sysvec		= &elf_linux_sysvec,
988 	.interp_newpath	= NULL,
989 	.brand_note	= &linux32_brandnote,
990 	.flags		= BI_CAN_EXEC_DYN | BI_BRAND_NOTE
991 };
992 
993 static const Elf32_Brandinfo linux_muslbrand = {
994 	.brand		= ELFOSABI_LINUX,
995 	.machine	= EM_386,
996 	.compat_3_brand	= "Linux",
997 	.interp_path	= "/lib/ld-musl-i386.so.1",
998 	.sysvec		= &elf_linux_sysvec,
999 	.interp_newpath	= NULL,
1000 	.brand_note	= &linux32_brandnote,
1001 	.flags		= BI_CAN_EXEC_DYN | BI_BRAND_NOTE |
1002 			    LINUX_BI_FUTEX_REQUEUE
1003 };
1004 
1005 static const Elf32_Brandinfo *linux_brandlist[] = {
1006 	&linux_brand,
1007 	&linux_glibc2brand,
1008 	&linux_muslbrand,
1009 	NULL
1010 };
1011 
1012 static int
1013 linux_elf_modevent(module_t mod, int type, void *data)
1014 {
1015 	const Elf32_Brandinfo **brandinfo;
1016 	int error;
1017 	struct linux_ioctl_handler **lihp;
1018 
1019 	error = 0;
1020 
1021 	switch(type) {
1022 	case MOD_LOAD:
1023 		for (brandinfo = &linux_brandlist[0]; *brandinfo != NULL;
1024 		     ++brandinfo)
1025 			if (elf32_insert_brand_entry(*brandinfo) < 0)
1026 				error = EINVAL;
1027 		if (error == 0) {
1028 			SET_FOREACH(lihp, linux_ioctl_handler_set)
1029 				linux32_ioctl_register_handler(*lihp);
1030 			stclohz = (stathz ? stathz : hz);
1031 			if (bootverbose)
1032 				printf("Linux i386 ELF exec handler installed\n");
1033 		} else
1034 			printf("cannot insert Linux i386 ELF brand handler\n");
1035 		break;
1036 	case MOD_UNLOAD:
1037 		for (brandinfo = &linux_brandlist[0]; *brandinfo != NULL;
1038 		     ++brandinfo)
1039 			if (elf32_brand_inuse(*brandinfo))
1040 				error = EBUSY;
1041 		if (error == 0) {
1042 			for (brandinfo = &linux_brandlist[0];
1043 			     *brandinfo != NULL; ++brandinfo)
1044 				if (elf32_remove_brand_entry(*brandinfo) < 0)
1045 					error = EINVAL;
1046 		}
1047 		if (error == 0) {
1048 			SET_FOREACH(lihp, linux_ioctl_handler_set)
1049 				linux32_ioctl_unregister_handler(*lihp);
1050 			if (bootverbose)
1051 				printf("Linux i386 ELF exec handler removed\n");
1052 		} else
1053 			printf("Could not deinstall Linux i386 ELF interpreter entry\n");
1054 		break;
1055 	default:
1056 		return (EOPNOTSUPP);
1057 	}
1058 	return (error);
1059 }
1060 
1061 static moduledata_t linux_elf_mod = {
1062 	"linuxelf",
1063 	linux_elf_modevent,
1064 	0
1065 };
1066 
1067 DECLARE_MODULE_TIED(linuxelf, linux_elf_mod, SI_SUB_EXEC, SI_ORDER_ANY);
1068 MODULE_DEPEND(linuxelf, linux_common, 1, 1, 1);
1069 FEATURE(linux, "Linux 32bit support");
1070