qilingframework / qilingframework/qiling

MIPS socket option (SO_*) values are wrong — setsockopt fails (e.g. busybox ping)

Open Beginner friendly
#1,640 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
6.1k
Forks
798
Avg merge
1d 1h
Merged PRs (30d)
9

Description

MIPS socket option (SO_*) values are wrong — setsockopt fails (e.g. busybox ping)

Describe the bug

linux_mips_socket_options (qiling/os/posix/const.py) uses generic/incorrect SO_* values. MIPS has its own numbering (arch/mips/include/uapi/asm/socket.h) where the buffer/timeout/type options live in the 0x1000 range, unlike the asm-generic values used by most arches. The table is wrong in several places:

option table has MIPS uapi
SO_SNDBUF 0x01 0x1001
SO_RCVBUF 0x02 0x1002
SO_SNDLOWAT 0x03 0x1003
SO_RCVLOWAT 0x04 0x1004
SO_SNDTIMEO_OLD 0x05 0x1005
SO_RCVTIMEO_OLD 0x06 0x1006
SO_OOBINLINE 0x00 0x0100
SO_REUSEPORT 0x00 0x0200

SO_RCVLOWAT = 0x04 also silently collides with SO_REUSEADDR = 0x04 (it becomes an Enum alias), and SO_TYPE/SO_ERROR are missing entirely.

Consequently a guest setsockopt(SOL_SOCKET, SO_RCVBUF, ...) aborts emulation:

NotImplementedError: Could not convert emulated socket option 4098 to a socket option name

(4098 == 0x1002 == SO_RCVBUF on MIPS.) This is hit by ordinary programs — e.g. busybox ping sets SO_RCVBUF/SO_SNDBUF right after creating its socket.

Repro (Python)

from qiling import Qiling
from qiling.const import QL_ARCH, QL_OS, QL_ENDIAN, QL_VERBOSE
from qiling.os.posix.syscall.socket import ql_syscall_socket, ql_syscall_setsockopt

ql = Qiling(code=b"\x00\x00\x00\x00", archtype=QL_ARCH.MIPS, ostype=QL_OS.LINUX,
            endian=QL_ENDIAN.EB, rootfs="examples/rootfs/mips32_linux", verbose=QL_VERBOSE.OFF)

fd = ql_syscall_socket(ql, 2, 2, 0)            # AF_INET, SOCK_DGRAM
base = 0x100000
ql.mem.map(base, 0x1000)
ql.mem.write_ptr(base, 16384, 4)
# SOL_SOCKET=0xffff, SO_RCVBUF=0x1002 on MIPS
ql_syscall_setsockopt(ql, fd, 0xffff, 0x1002, base, 4)

Without the fix this raises NotImplementedError: Could not convert emulated socket option 4098.

Expected behavior

setsockopt with the MIPS SO_* values should map to the host option and succeed, matching the kernel's MIPS SO_* numbering.

Environment

  • Affects MIPS / MIPS64 (the values are shared); reproduces on any host.
  • Same code area as the already-closed #1286 (socket-level mapping for IPPROTO_TCP).

A fix (correct the SO_* values + add the missing ones, with a regression test) is proposed in the linked PR.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in qiling/os/posix/const.py at linux_mips_socket_options and compare its entries with the MIPS uapi socket values described in the issue. Exercise ql_syscall_setsockopt using the provided MIPS reproduction, then add a regression test covering the corrected options and the missing SO_TYPE/SO_ERROR mappings. Done means MIPS SO_RCVBUF and SO_SNDBUF map successfully without NotImplementedError.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
operating-systems, reverse-engineering
Issue type
Bug
Difficulty
2/5
Estimated time
Half a day
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
82/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.