1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2000 Marcel Moolenaar 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __FBSDID("$FreeBSD$"); 31 32 #include "opt_posix.h" 33 34 #include <sys/param.h> 35 #include <sys/imgact_aout.h> 36 #include <sys/fcntl.h> 37 #include <sys/lock.h> 38 #include <sys/malloc.h> 39 #include <sys/mman.h> 40 #include <sys/mutex.h> 41 #include <sys/namei.h> 42 #include <sys/priv.h> 43 #include <sys/proc.h> 44 #include <sys/racct.h> 45 #include <sys/resource.h> 46 #include <sys/resourcevar.h> 47 #include <sys/syscallsubr.h> 48 #include <sys/sysproto.h> 49 #include <sys/vnode.h> 50 51 #include <security/audit/audit.h> 52 #include <security/mac/mac_framework.h> 53 54 #include <machine/frame.h> 55 #include <machine/pcb.h> /* needed for pcb definition in linux_set_thread_area */ 56 #include <machine/psl.h> 57 #include <machine/segments.h> 58 #include <machine/sysarch.h> 59 60 #include <vm/pmap.h> 61 #include <vm/vm.h> 62 #include <vm/vm_extern.h> 63 #include <vm/vm_kern.h> 64 #include <vm/vm_map.h> 65 #include <vm/vm_param.h> 66 67 #include <x86/reg.h> 68 69 #include <i386/linux/linux.h> 70 #include <i386/linux/linux_proto.h> 71 #include <compat/linux/linux_emul.h> 72 #include <compat/linux/linux_fork.h> 73 #include <compat/linux/linux_ipc.h> 74 #include <compat/linux/linux_misc.h> 75 #include <compat/linux/linux_mmap.h> 76 #include <compat/linux/linux_signal.h> 77 #include <compat/linux/linux_util.h> 78 79 80 struct l_descriptor { 81 l_uint entry_number; 82 l_ulong base_addr; 83 l_uint limit; 84 l_uint seg_32bit:1; 85 l_uint contents:2; 86 l_uint read_exec_only:1; 87 l_uint limit_in_pages:1; 88 l_uint seg_not_present:1; 89 l_uint useable:1; 90 }; 91 92 struct l_old_select_argv { 93 l_int nfds; 94 l_fd_set *readfds; 95 l_fd_set *writefds; 96 l_fd_set *exceptfds; 97 struct l_timeval *timeout; 98 }; 99 100 struct l_ipc_kludge { 101 struct l_msgbuf *msgp; 102 l_long msgtyp; 103 }; 104 105 int 106 linux_ipc(struct thread *td, struct linux_ipc_args *args) 107 { 108 109 switch (args->what & 0xFFFF) { 110 case LINUX_SEMOP: { 111 112 return (kern_semop(td, args->arg1, PTRIN(args->ptr), 113 args->arg2, NULL)); 114 } 115 case LINUX_SEMGET: { 116 struct linux_semget_args a; 117 118 a.key = args->arg1; 119 a.nsems = args->arg2; 120 a.semflg = args->arg3; 121 return (linux_semget(td, &a)); 122 } 123 case LINUX_SEMCTL: { 124 struct linux_semctl_args a; 125 int error; 126 127 a.semid = args->arg1; 128 a.semnum = args->arg2; 129 a.cmd = args->arg3; 130 error = copyin(PTRIN(args->ptr), &a.arg, sizeof(a.arg)); 131 if (error) 132 return (error); 133 return (linux_semctl(td, &a)); 134 } 135 case LINUX_SEMTIMEDOP: { 136 struct linux_semtimedop_args a; 137 138 a.semid = args->arg1; 139 a.tsops = PTRIN(args->ptr); 140 a.nsops = args->arg2; 141 a.timeout = PTRIN(args->arg5); 142 return (linux_semtimedop(td, &a)); 143 } 144 case LINUX_MSGSND: { 145 struct linux_msgsnd_args a; 146 147 a.msqid = args->arg1; 148 a.msgp = PTRIN(args->ptr); 149 a.msgsz = args->arg2; 150 a.msgflg = args->arg3; 151 return (linux_msgsnd(td, &a)); 152 } 153 case LINUX_MSGRCV: { 154 struct linux_msgrcv_args a; 155 156 a.msqid = args->arg1; 157 a.msgsz = args->arg2; 158 a.msgflg = args->arg3; 159 if ((args->what >> 16) == 0) { 160 struct l_ipc_kludge tmp; 161 int error; 162 163 if (args->ptr == 0) 164 return (EINVAL); 165 error = copyin(PTRIN(args->ptr), &tmp, sizeof(tmp)); 166 if (error) 167 return (error); 168 a.msgp = PTRIN(tmp.msgp); 169 a.msgtyp = tmp.msgtyp; 170 } else { 171 a.msgp = PTRIN(args->ptr); 172 a.msgtyp = args->arg5; 173 } 174 return (linux_msgrcv(td, &a)); 175 } 176 case LINUX_MSGGET: { 177 struct linux_msgget_args a; 178 179 a.key = args->arg1; 180 a.msgflg = args->arg2; 181 return (linux_msgget(td, &a)); 182 } 183 case LINUX_MSGCTL: { 184 struct linux_msgctl_args a; 185 186 a.msqid = args->arg1; 187 a.cmd = args->arg2; 188 a.buf = PTRIN(args->ptr); 189 return (linux_msgctl(td, &a)); 190 } 191 case LINUX_SHMAT: { 192 struct linux_shmat_args a; 193 l_uintptr_t addr; 194 int error; 195 196 a.shmid = args->arg1; 197 a.shmaddr = PTRIN(args->ptr); 198 a.shmflg = args->arg2; 199 error = linux_shmat(td, &a); 200 if (error != 0) 201 return (error); 202 addr = td->td_retval[0]; 203 error = copyout(&addr, PTRIN(args->arg3), sizeof(addr)); 204 td->td_retval[0] = 0; 205 return (error); 206 } 207 case LINUX_SHMDT: { 208 struct linux_shmdt_args a; 209 210 a.shmaddr = PTRIN(args->ptr); 211 return (linux_shmdt(td, &a)); 212 } 213 case LINUX_SHMGET: { 214 struct linux_shmget_args a; 215 216 a.key = args->arg1; 217 a.size = args->arg2; 218 a.shmflg = args->arg3; 219 return (linux_shmget(td, &a)); 220 } 221 case LINUX_SHMCTL: { 222 struct linux_shmctl_args a; 223 224 a.shmid = args->arg1; 225 a.cmd = args->arg2; 226 a.buf = PTRIN(args->ptr); 227 return (linux_shmctl(td, &a)); 228 } 229 default: 230 break; 231 } 232 233 return (EINVAL); 234 } 235 236 int 237 linux_old_select(struct thread *td, struct linux_old_select_args *args) 238 { 239 struct l_old_select_argv linux_args; 240 struct linux_select_args newsel; 241 int error; 242 243 error = copyin(args->ptr, &linux_args, sizeof(linux_args)); 244 if (error) 245 return (error); 246 247 newsel.nfds = linux_args.nfds; 248 newsel.readfds = linux_args.readfds; 249 newsel.writefds = linux_args.writefds; 250 newsel.exceptfds = linux_args.exceptfds; 251 newsel.timeout = linux_args.timeout; 252 return (linux_select(td, &newsel)); 253 } 254 255 int 256 linux_set_cloned_tls(struct thread *td, void *desc) 257 { 258 struct segment_descriptor sd; 259 struct l_user_desc info; 260 int idx, error; 261 int a[2]; 262 263 error = copyin(desc, &info, sizeof(struct l_user_desc)); 264 if (error) { 265 linux_msg(td, "set_cloned_tls copyin failed!"); 266 } else { 267 idx = info.entry_number; 268 269 /* 270 * looks like we're getting the idx we returned 271 * in the set_thread_area() syscall 272 */ 273 if (idx != 6 && idx != 3) { 274 linux_msg(td, "set_cloned_tls resetting idx!"); 275 idx = 3; 276 } 277 278 /* this doesnt happen in practice */ 279 if (idx == 6) { 280 /* we might copy out the entry_number as 3 */ 281 info.entry_number = 3; 282 error = copyout(&info, desc, sizeof(struct l_user_desc)); 283 if (error) 284 linux_msg(td, "set_cloned_tls copyout failed!"); 285 } 286 287 a[0] = LINUX_LDT_entry_a(&info); 288 a[1] = LINUX_LDT_entry_b(&info); 289 290 memcpy(&sd, &a, sizeof(a)); 291 /* set %gs */ 292 td->td_pcb->pcb_gsd = sd; 293 td->td_pcb->pcb_gs = GSEL(GUGS_SEL, SEL_UPL); 294 } 295 296 return (error); 297 } 298 299 int 300 linux_set_upcall(struct thread *td, register_t stack) 301 { 302 303 if (stack) 304 td->td_frame->tf_esp = stack; 305 306 /* 307 * The newly created Linux thread returns 308 * to the user space by the same path that a parent do. 309 */ 310 td->td_frame->tf_eax = 0; 311 return (0); 312 } 313 314 int 315 linux_mmap2(struct thread *td, struct linux_mmap2_args *args) 316 { 317 318 return (linux_mmap_common(td, args->addr, args->len, args->prot, 319 args->flags, args->fd, (uint64_t)(uint32_t)args->pgoff * 320 PAGE_SIZE)); 321 } 322 323 int 324 linux_mmap(struct thread *td, struct linux_mmap_args *args) 325 { 326 int error; 327 struct l_mmap_argv linux_args; 328 329 error = copyin(args->ptr, &linux_args, sizeof(linux_args)); 330 if (error) 331 return (error); 332 333 return (linux_mmap_common(td, linux_args.addr, linux_args.len, 334 linux_args.prot, linux_args.flags, linux_args.fd, 335 (uint32_t)linux_args.pgoff)); 336 } 337 338 int 339 linux_mprotect(struct thread *td, struct linux_mprotect_args *uap) 340 { 341 342 return (linux_mprotect_common(td, PTROUT(uap->addr), uap->len, uap->prot)); 343 } 344 345 int 346 linux_madvise(struct thread *td, struct linux_madvise_args *uap) 347 { 348 349 return (linux_madvise_common(td, PTROUT(uap->addr), uap->len, uap->behav)); 350 } 351 352 int 353 linux_ioperm(struct thread *td, struct linux_ioperm_args *args) 354 { 355 int error; 356 struct i386_ioperm_args iia; 357 358 iia.start = args->start; 359 iia.length = args->length; 360 iia.enable = args->enable; 361 error = i386_set_ioperm(td, &iia); 362 return (error); 363 } 364 365 int 366 linux_iopl(struct thread *td, struct linux_iopl_args *args) 367 { 368 int error; 369 370 if (args->level < 0 || args->level > 3) 371 return (EINVAL); 372 if ((error = priv_check(td, PRIV_IO)) != 0) 373 return (error); 374 if ((error = securelevel_gt(td->td_ucred, 0)) != 0) 375 return (error); 376 td->td_frame->tf_eflags = (td->td_frame->tf_eflags & ~PSL_IOPL) | 377 (args->level * (PSL_IOPL / 3)); 378 return (0); 379 } 380 381 int 382 linux_modify_ldt(struct thread *td, struct linux_modify_ldt_args *uap) 383 { 384 int error; 385 struct i386_ldt_args ldt; 386 struct l_descriptor ld; 387 union descriptor desc; 388 int size, written; 389 390 switch (uap->func) { 391 case 0x00: /* read_ldt */ 392 ldt.start = 0; 393 ldt.descs = uap->ptr; 394 ldt.num = uap->bytecount / sizeof(union descriptor); 395 error = i386_get_ldt(td, &ldt); 396 td->td_retval[0] *= sizeof(union descriptor); 397 break; 398 case 0x02: /* read_default_ldt = 0 */ 399 size = 5*sizeof(struct l_desc_struct); 400 if (size > uap->bytecount) 401 size = uap->bytecount; 402 for (written = error = 0; written < size && error == 0; written++) 403 error = subyte((char *)uap->ptr + written, 0); 404 td->td_retval[0] = written; 405 break; 406 case 0x01: /* write_ldt */ 407 case 0x11: /* write_ldt */ 408 if (uap->bytecount != sizeof(ld)) 409 return (EINVAL); 410 411 error = copyin(uap->ptr, &ld, sizeof(ld)); 412 if (error) 413 return (error); 414 415 ldt.start = ld.entry_number; 416 ldt.descs = &desc; 417 ldt.num = 1; 418 desc.sd.sd_lolimit = (ld.limit & 0x0000ffff); 419 desc.sd.sd_hilimit = (ld.limit & 0x000f0000) >> 16; 420 desc.sd.sd_lobase = (ld.base_addr & 0x00ffffff); 421 desc.sd.sd_hibase = (ld.base_addr & 0xff000000) >> 24; 422 desc.sd.sd_type = SDT_MEMRO | ((ld.read_exec_only ^ 1) << 1) | 423 (ld.contents << 2); 424 desc.sd.sd_dpl = 3; 425 desc.sd.sd_p = (ld.seg_not_present ^ 1); 426 desc.sd.sd_xx = 0; 427 desc.sd.sd_def32 = ld.seg_32bit; 428 desc.sd.sd_gran = ld.limit_in_pages; 429 error = i386_set_ldt(td, &ldt, &desc); 430 break; 431 default: 432 error = ENOSYS; 433 break; 434 } 435 436 if (error == EOPNOTSUPP) { 437 linux_msg(td, "modify_ldt needs kernel option USER_LDT"); 438 error = ENOSYS; 439 } 440 441 return (error); 442 } 443 444 int 445 linux_sigaction(struct thread *td, struct linux_sigaction_args *args) 446 { 447 l_osigaction_t osa; 448 l_sigaction_t act, oact; 449 int error; 450 451 if (args->nsa != NULL) { 452 error = copyin(args->nsa, &osa, sizeof(l_osigaction_t)); 453 if (error) 454 return (error); 455 act.lsa_handler = osa.lsa_handler; 456 act.lsa_flags = osa.lsa_flags; 457 act.lsa_restorer = osa.lsa_restorer; 458 LINUX_SIGEMPTYSET(act.lsa_mask); 459 act.lsa_mask.__mask = osa.lsa_mask; 460 } 461 462 error = linux_do_sigaction(td, args->sig, args->nsa ? &act : NULL, 463 args->osa ? &oact : NULL); 464 465 if (args->osa != NULL && !error) { 466 osa.lsa_handler = oact.lsa_handler; 467 osa.lsa_flags = oact.lsa_flags; 468 osa.lsa_restorer = oact.lsa_restorer; 469 osa.lsa_mask = oact.lsa_mask.__mask; 470 error = copyout(&osa, args->osa, sizeof(l_osigaction_t)); 471 } 472 473 return (error); 474 } 475 476 /* 477 * Linux has two extra args, restart and oldmask. We dont use these, 478 * but it seems that "restart" is actually a context pointer that 479 * enables the signal to happen with a different register set. 480 */ 481 int 482 linux_sigsuspend(struct thread *td, struct linux_sigsuspend_args *args) 483 { 484 sigset_t sigmask; 485 l_sigset_t mask; 486 487 LINUX_SIGEMPTYSET(mask); 488 mask.__mask = args->mask; 489 linux_to_bsd_sigset(&mask, &sigmask); 490 return (kern_sigsuspend(td, sigmask)); 491 } 492 493 int 494 linux_pause(struct thread *td, struct linux_pause_args *args) 495 { 496 struct proc *p = td->td_proc; 497 sigset_t sigmask; 498 499 PROC_LOCK(p); 500 sigmask = td->td_sigmask; 501 PROC_UNLOCK(p); 502 return (kern_sigsuspend(td, sigmask)); 503 } 504 505 int 506 linux_set_thread_area(struct thread *td, struct linux_set_thread_area_args *args) 507 { 508 struct l_user_desc info; 509 int error; 510 int idx; 511 int a[2]; 512 struct segment_descriptor sd; 513 514 error = copyin(args->desc, &info, sizeof(struct l_user_desc)); 515 if (error) 516 return (error); 517 518 idx = info.entry_number; 519 /* 520 * Semantics of Linux version: every thread in the system has array of 521 * 3 tls descriptors. 1st is GLIBC TLS, 2nd is WINE, 3rd unknown. This 522 * syscall loads one of the selected tls decriptors with a value and 523 * also loads GDT descriptors 6, 7 and 8 with the content of the 524 * per-thread descriptors. 525 * 526 * Semantics of FreeBSD version: I think we can ignore that Linux has 3 527 * per-thread descriptors and use just the 1st one. The tls_array[] 528 * is used only in set/get-thread_area() syscalls and for loading the 529 * GDT descriptors. In FreeBSD we use just one GDT descriptor for TLS 530 * so we will load just one. 531 * 532 * XXX: this doesn't work when a user space process tries to use more 533 * than 1 TLS segment. Comment in the Linux sources says wine might do 534 * this. 535 */ 536 537 /* 538 * we support just GLIBC TLS now 539 * we should let 3 proceed as well because we use this segment so 540 * if code does two subsequent calls it should succeed 541 */ 542 if (idx != 6 && idx != -1 && idx != 3) 543 return (EINVAL); 544 545 /* 546 * we have to copy out the GDT entry we use 547 * FreeBSD uses GDT entry #3 for storing %gs so load that 548 * 549 * XXX: what if a user space program doesn't check this value and tries 550 * to use 6, 7 or 8? 551 */ 552 idx = info.entry_number = 3; 553 error = copyout(&info, args->desc, sizeof(struct l_user_desc)); 554 if (error) 555 return (error); 556 557 if (LINUX_LDT_empty(&info)) { 558 a[0] = 0; 559 a[1] = 0; 560 } else { 561 a[0] = LINUX_LDT_entry_a(&info); 562 a[1] = LINUX_LDT_entry_b(&info); 563 } 564 565 memcpy(&sd, &a, sizeof(a)); 566 /* this is taken from i386 version of cpu_set_user_tls() */ 567 critical_enter(); 568 /* set %gs */ 569 td->td_pcb->pcb_gsd = sd; 570 PCPU_GET(fsgs_gdt)[1] = sd; 571 load_gs(GSEL(GUGS_SEL, SEL_UPL)); 572 critical_exit(); 573 574 return (0); 575 } 576 577 int 578 linux_get_thread_area(struct thread *td, struct linux_get_thread_area_args *args) 579 { 580 581 struct l_user_desc info; 582 int error; 583 int idx; 584 struct l_desc_struct desc; 585 struct segment_descriptor sd; 586 587 error = copyin(args->desc, &info, sizeof(struct l_user_desc)); 588 if (error) 589 return (error); 590 591 idx = info.entry_number; 592 /* XXX: I am not sure if we want 3 to be allowed too. */ 593 if (idx != 6 && idx != 3) 594 return (EINVAL); 595 596 idx = 3; 597 598 memset(&info, 0, sizeof(info)); 599 600 sd = PCPU_GET(fsgs_gdt)[1]; 601 602 memcpy(&desc, &sd, sizeof(desc)); 603 604 info.entry_number = idx; 605 info.base_addr = LINUX_GET_BASE(&desc); 606 info.limit = LINUX_GET_LIMIT(&desc); 607 info.seg_32bit = LINUX_GET_32BIT(&desc); 608 info.contents = LINUX_GET_CONTENTS(&desc); 609 info.read_exec_only = !LINUX_GET_WRITABLE(&desc); 610 info.limit_in_pages = LINUX_GET_LIMIT_PAGES(&desc); 611 info.seg_not_present = !LINUX_GET_PRESENT(&desc); 612 info.useable = LINUX_GET_USEABLE(&desc); 613 614 error = copyout(&info, args->desc, sizeof(struct l_user_desc)); 615 if (error) 616 return (EFAULT); 617 618 return (0); 619 } 620 621 /* XXX: this wont work with module - convert it */ 622 int 623 linux_mq_open(struct thread *td, struct linux_mq_open_args *args) 624 { 625 #ifdef P1003_1B_MQUEUE 626 return (sys_kmq_open(td, (struct kmq_open_args *)args)); 627 #else 628 return (ENOSYS); 629 #endif 630 } 631 632 int 633 linux_mq_unlink(struct thread *td, struct linux_mq_unlink_args *args) 634 { 635 #ifdef P1003_1B_MQUEUE 636 return (sys_kmq_unlink(td, (struct kmq_unlink_args *)args)); 637 #else 638 return (ENOSYS); 639 #endif 640 } 641 642 int 643 linux_mq_timedsend(struct thread *td, struct linux_mq_timedsend_args *args) 644 { 645 #ifdef P1003_1B_MQUEUE 646 return (sys_kmq_timedsend(td, (struct kmq_timedsend_args *)args)); 647 #else 648 return (ENOSYS); 649 #endif 650 } 651 652 int 653 linux_mq_timedreceive(struct thread *td, struct linux_mq_timedreceive_args *args) 654 { 655 #ifdef P1003_1B_MQUEUE 656 return (sys_kmq_timedreceive(td, (struct kmq_timedreceive_args *)args)); 657 #else 658 return (ENOSYS); 659 #endif 660 } 661 662 int 663 linux_mq_notify(struct thread *td, struct linux_mq_notify_args *args) 664 { 665 #ifdef P1003_1B_MQUEUE 666 return (sys_kmq_notify(td, (struct kmq_notify_args *)args)); 667 #else 668 return (ENOSYS); 669 #endif 670 } 671 672 int 673 linux_mq_getsetattr(struct thread *td, struct linux_mq_getsetattr_args *args) 674 { 675 #ifdef P1003_1B_MQUEUE 676 return (sys_kmq_setattr(td, (struct kmq_setattr_args *)args)); 677 #else 678 return (ENOSYS); 679 #endif 680 } 681 682 void 683 bsd_to_linux_regset(const struct reg *b_reg, 684 struct linux_pt_regset *l_regset) 685 { 686 687 l_regset->ebx = b_reg->r_ebx; 688 l_regset->ecx = b_reg->r_ecx; 689 l_regset->edx = b_reg->r_edx; 690 l_regset->esi = b_reg->r_esi; 691 l_regset->edi = b_reg->r_edi; 692 l_regset->ebp = b_reg->r_ebp; 693 l_regset->eax = b_reg->r_eax; 694 l_regset->ds = b_reg->r_ds; 695 l_regset->es = b_reg->r_es; 696 l_regset->fs = b_reg->r_fs; 697 l_regset->gs = b_reg->r_gs; 698 l_regset->orig_eax = b_reg->r_eax; 699 l_regset->eip = b_reg->r_eip; 700 l_regset->cs = b_reg->r_cs; 701 l_regset->eflags = b_reg->r_eflags; 702 l_regset->esp = b_reg->r_esp; 703 l_regset->ss = b_reg->r_ss; 704 } 705 706 int 707 linux_uselib(struct thread *td, struct linux_uselib_args *args) 708 { 709 struct nameidata ni; 710 struct vnode *vp; 711 struct exec *a_out; 712 vm_map_t map; 713 vm_map_entry_t entry; 714 struct vattr attr; 715 vm_offset_t vmaddr; 716 unsigned long file_offset; 717 unsigned long bss_size; 718 ssize_t aresid; 719 int error; 720 bool locked, opened, textset; 721 722 a_out = NULL; 723 vp = NULL; 724 locked = false; 725 textset = false; 726 opened = false; 727 728 NDINIT(&ni, LOOKUP, ISOPEN | FOLLOW | LOCKLEAF | AUDITVNODE1, 729 UIO_USERSPACE, args->library); 730 error = namei(&ni); 731 if (error) 732 goto cleanup; 733 734 vp = ni.ni_vp; 735 NDFREE_PNBUF(&ni); 736 737 /* 738 * From here on down, we have a locked vnode that must be unlocked. 739 * XXX: The code below largely duplicates exec_check_permissions(). 740 */ 741 locked = true; 742 743 /* Executable? */ 744 error = VOP_GETATTR(vp, &attr, td->td_ucred); 745 if (error) 746 goto cleanup; 747 748 if ((vp->v_mount->mnt_flag & MNT_NOEXEC) || 749 ((attr.va_mode & 0111) == 0) || (attr.va_type != VREG)) { 750 /* EACCESS is what exec(2) returns. */ 751 error = ENOEXEC; 752 goto cleanup; 753 } 754 755 /* Sensible size? */ 756 if (attr.va_size == 0) { 757 error = ENOEXEC; 758 goto cleanup; 759 } 760 761 /* Can we access it? */ 762 error = VOP_ACCESS(vp, VEXEC, td->td_ucred, td); 763 if (error) 764 goto cleanup; 765 766 /* 767 * XXX: This should use vn_open() so that it is properly authorized, 768 * and to reduce code redundancy all over the place here. 769 * XXX: Not really, it duplicates far more of exec_check_permissions() 770 * than vn_open(). 771 */ 772 #ifdef MAC 773 error = mac_vnode_check_open(td->td_ucred, vp, VREAD); 774 if (error) 775 goto cleanup; 776 #endif 777 error = VOP_OPEN(vp, FREAD, td->td_ucred, td, NULL); 778 if (error) 779 goto cleanup; 780 opened = true; 781 782 /* Pull in executable header into exec_map */ 783 error = vm_mmap(exec_map, (vm_offset_t *)&a_out, PAGE_SIZE, 784 VM_PROT_READ, VM_PROT_READ, 0, OBJT_VNODE, vp, 0); 785 if (error) 786 goto cleanup; 787 788 /* Is it a Linux binary ? */ 789 if (((a_out->a_magic >> 16) & 0xff) != 0x64) { 790 error = ENOEXEC; 791 goto cleanup; 792 } 793 794 /* 795 * While we are here, we should REALLY do some more checks 796 */ 797 798 /* Set file/virtual offset based on a.out variant. */ 799 switch ((int)(a_out->a_magic & 0xffff)) { 800 case 0413: /* ZMAGIC */ 801 file_offset = 1024; 802 break; 803 case 0314: /* QMAGIC */ 804 file_offset = 0; 805 break; 806 default: 807 error = ENOEXEC; 808 goto cleanup; 809 } 810 811 bss_size = round_page(a_out->a_bss); 812 813 /* Check various fields in header for validity/bounds. */ 814 if (a_out->a_text & PAGE_MASK || a_out->a_data & PAGE_MASK) { 815 error = ENOEXEC; 816 goto cleanup; 817 } 818 819 /* text + data can't exceed file size */ 820 if (a_out->a_data + a_out->a_text > attr.va_size) { 821 error = EFAULT; 822 goto cleanup; 823 } 824 825 /* 826 * text/data/bss must not exceed limits 827 * XXX - this is not complete. it should check current usage PLUS 828 * the resources needed by this library. 829 */ 830 PROC_LOCK(td->td_proc); 831 if (a_out->a_text > maxtsiz || 832 a_out->a_data + bss_size > lim_cur_proc(td->td_proc, RLIMIT_DATA) || 833 racct_set(td->td_proc, RACCT_DATA, a_out->a_data + 834 bss_size) != 0) { 835 PROC_UNLOCK(td->td_proc); 836 error = ENOMEM; 837 goto cleanup; 838 } 839 PROC_UNLOCK(td->td_proc); 840 841 /* 842 * Prevent more writers. 843 */ 844 error = VOP_SET_TEXT(vp); 845 if (error != 0) 846 goto cleanup; 847 textset = true; 848 849 /* 850 * Lock no longer needed 851 */ 852 locked = false; 853 VOP_UNLOCK(vp); 854 855 /* 856 * Check if file_offset page aligned. Currently we cannot handle 857 * misalinged file offsets, and so we read in the entire image 858 * (what a waste). 859 */ 860 if (file_offset & PAGE_MASK) { 861 /* Map text+data read/write/execute */ 862 863 /* a_entry is the load address and is page aligned */ 864 vmaddr = trunc_page(a_out->a_entry); 865 866 /* get anon user mapping, read+write+execute */ 867 error = vm_map_find(&td->td_proc->p_vmspace->vm_map, NULL, 0, 868 &vmaddr, a_out->a_text + a_out->a_data, 0, VMFS_NO_SPACE, 869 VM_PROT_ALL, VM_PROT_ALL, 0); 870 if (error) 871 goto cleanup; 872 873 error = vn_rdwr(UIO_READ, vp, (void *)vmaddr, file_offset, 874 a_out->a_text + a_out->a_data, UIO_USERSPACE, 0, 875 td->td_ucred, NOCRED, &aresid, td); 876 if (error != 0) 877 goto cleanup; 878 if (aresid != 0) { 879 error = ENOEXEC; 880 goto cleanup; 881 } 882 } else { 883 /* 884 * for QMAGIC, a_entry is 20 bytes beyond the load address 885 * to skip the executable header 886 */ 887 vmaddr = trunc_page(a_out->a_entry); 888 889 /* 890 * Map it all into the process's space as a single 891 * copy-on-write "data" segment. 892 */ 893 map = &td->td_proc->p_vmspace->vm_map; 894 error = vm_mmap(map, &vmaddr, 895 a_out->a_text + a_out->a_data, VM_PROT_ALL, VM_PROT_ALL, 896 MAP_PRIVATE | MAP_FIXED, OBJT_VNODE, vp, file_offset); 897 if (error) 898 goto cleanup; 899 vm_map_lock(map); 900 if (!vm_map_lookup_entry(map, vmaddr, &entry)) { 901 vm_map_unlock(map); 902 error = EDOOFUS; 903 goto cleanup; 904 } 905 entry->eflags |= MAP_ENTRY_VN_EXEC; 906 vm_map_unlock(map); 907 textset = false; 908 } 909 910 if (bss_size != 0) { 911 /* Calculate BSS start address */ 912 vmaddr = trunc_page(a_out->a_entry) + a_out->a_text + 913 a_out->a_data; 914 915 /* allocate some 'anon' space */ 916 error = vm_map_find(&td->td_proc->p_vmspace->vm_map, NULL, 0, 917 &vmaddr, bss_size, 0, VMFS_NO_SPACE, VM_PROT_ALL, 918 VM_PROT_ALL, 0); 919 if (error) 920 goto cleanup; 921 } 922 923 cleanup: 924 if (opened) { 925 if (locked) 926 VOP_UNLOCK(vp); 927 locked = false; 928 VOP_CLOSE(vp, FREAD, td->td_ucred, td); 929 } 930 if (textset) { 931 if (!locked) { 932 locked = true; 933 VOP_LOCK(vp, LK_SHARED | LK_RETRY); 934 } 935 VOP_UNSET_TEXT_CHECKED(vp); 936 } 937 if (locked) 938 VOP_UNLOCK(vp); 939 940 /* Release the temporary mapping. */ 941 if (a_out) 942 kmap_free_wakeup(exec_map, (vm_offset_t)a_out, PAGE_SIZE); 943 944 return (error); 945 } 946