qilingframework / qilingframework/qiling
MIPS socket option (SO_*) values are wrong — setsockopt fails (e.g. busybox ping)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 798
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 9
Description
MIPS socket option (SO_*) values are wrong — setsockopt fails (e.g. busybox ping)
Describe the bug
linux_mips_socket_options (qiling/os/posix/const.py) uses generic/incorrect SO_* values. MIPS has its own numbering (arch/mips/include/uapi/asm/socket.h) where the buffer/timeout/type options live in the 0x1000 range, unlike the asm-generic values used by most arches. The table is wrong in several places:
| option | table has | MIPS uapi |
|---|---|---|
SO_SNDBUF |
0x01 |
0x1001 |
SO_RCVBUF |
0x02 |
0x1002 |
SO_SNDLOWAT |
0x03 |
0x1003 |
SO_RCVLOWAT |
0x04 |
0x1004 |
SO_SNDTIMEO_OLD |
0x05 |
0x1005 |
SO_RCVTIMEO_OLD |
0x06 |
0x1006 |
SO_OOBINLINE |
0x00 |
0x0100 |
SO_REUSEPORT |
0x00 |
0x0200 |
SO_RCVLOWAT = 0x04 also silently collides with SO_REUSEADDR = 0x04 (it becomes an Enum alias), and SO_TYPE/SO_ERROR are missing entirely.
Consequently a guest setsockopt(SOL_SOCKET, SO_RCVBUF, ...) aborts emulation:
NotImplementedError: Could not convert emulated socket option 4098 to a socket option name
(4098 == 0x1002 == SO_RCVBUF on MIPS.) This is hit by ordinary programs — e.g. busybox ping sets SO_RCVBUF/SO_SNDBUF right after creating its socket.
Repro (Python)
from qiling import Qiling
from qiling.const import QL_ARCH, QL_OS, QL_ENDIAN, QL_VERBOSE
from qiling.os.posix.syscall.socket import ql_syscall_socket, ql_syscall_setsockopt
ql = Qiling(code=b"\x00\x00\x00\x00", archtype=QL_ARCH.MIPS, ostype=QL_OS.LINUX,
endian=QL_ENDIAN.EB, rootfs="examples/rootfs/mips32_linux", verbose=QL_VERBOSE.OFF)
fd = ql_syscall_socket(ql, 2, 2, 0) # AF_INET, SOCK_DGRAM
base = 0x100000
ql.mem.map(base, 0x1000)
ql.mem.write_ptr(base, 16384, 4)
# SOL_SOCKET=0xffff, SO_RCVBUF=0x1002 on MIPS
ql_syscall_setsockopt(ql, fd, 0xffff, 0x1002, base, 4)
Without the fix this raises NotImplementedError: Could not convert emulated socket option 4098.
Expected behavior
setsockopt with the MIPS SO_* values should map to the host option and succeed, matching the kernel's MIPS SO_* numbering.
Environment
- Affects MIPS / MIPS64 (the values are shared); reproduces on any host.
- Same code area as the already-closed #1286 (socket-level mapping for
IPPROTO_TCP).
A fix (correct the SO_* values + add the missing ones, with a regression test) is proposed in the linked PR.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in qiling/os/posix/const.py at linux_mips_socket_options and compare its entries with the MIPS uapi socket values described in the issue. Exercise ql_syscall_setsockopt using the provided MIPS reproduction, then add a regression test covering the corrected options and the missing SO_TYPE/SO_ERROR mappings. Done means MIPS SO_RCVBUF and SO_SNDBUF map successfully without NotImplementedError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- operating-systems, reverse-engineering
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- Half a day
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100