1 /*- 2 * Copyright (c) 2003 Peter Wemm 3 * Copyright (c) 1982, 1987, 1990 The Regents of the University of California. 4 * All rights reserved. 5 * 6 * This code is derived from software contributed to Berkeley by 7 * William Jolitz. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include <sys/cdefs.h> 35 __FBSDID("$FreeBSD$"); 36 37 #include "opt_compat.h" 38 39 #include <sys/param.h> 40 #include <sys/exec.h> 41 #include <sys/fcntl.h> 42 #include <sys/imgact.h> 43 #include <sys/kernel.h> 44 #include <sys/lock.h> 45 #include <sys/malloc.h> 46 #include <sys/mutex.h> 47 #include <sys/mman.h> 48 #include <sys/namei.h> 49 #include <sys/pioctl.h> 50 #include <sys/proc.h> 51 #include <sys/procfs.h> 52 #include <sys/resourcevar.h> 53 #include <sys/systm.h> 54 #include <sys/signalvar.h> 55 #include <sys/stat.h> 56 #include <sys/sx.h> 57 #include <sys/syscall.h> 58 #include <sys/syscallsubr.h> 59 #include <sys/sysctl.h> 60 #include <sys/sysent.h> 61 #include <sys/vnode.h> 62 63 #include <vm/vm.h> 64 #include <vm/vm_kern.h> 65 #include <vm/vm_param.h> 66 #include <vm/pmap.h> 67 #include <vm/vm_map.h> 68 #include <vm/vm_object.h> 69 #include <vm/vm_extern.h> 70 71 #include <compat/freebsd32/freebsd32_signal.h> 72 #include <compat/freebsd32/freebsd32_util.h> 73 #include <compat/freebsd32/freebsd32_proto.h> 74 #include <compat/freebsd32/freebsd32.h> 75 #include <compat/ia32/ia32_signal.h> 76 #include <machine/psl.h> 77 #include <machine/segments.h> 78 #include <machine/specialreg.h> 79 #include <machine/frame.h> 80 #include <machine/md_var.h> 81 #include <machine/pcb.h> 82 #include <machine/cpufunc.h> 83 84 #ifdef COMPAT_FREEBSD4 85 static void freebsd4_ia32_sendsig(sig_t, ksiginfo_t *, sigset_t *); 86 #endif 87 88 #define CS_SECURE(cs) (ISPL(cs) == SEL_UPL) 89 #define EFL_SECURE(ef, oef) ((((ef) ^ (oef)) & ~PSL_USERCHANGE) == 0) 90 91 static void 92 ia32_get_fpcontext(struct thread *td, struct ia32_mcontext *mcp, 93 char *xfpusave, size_t xfpusave_len) 94 { 95 size_t max_len, len; 96 97 /* 98 * XXX Format of 64bit and 32bit FXSAVE areas differs. FXSAVE 99 * in 32bit mode saves %cs and %ds, while on 64bit it saves 100 * 64bit instruction and data pointers. Ignore the difference 101 * for now, it should be irrelevant for most applications. 102 */ 103 mcp->mc_ownedfp = fpugetregs(td); 104 bcopy(get_pcb_user_save_td(td), &mcp->mc_fpstate[0], 105 sizeof(mcp->mc_fpstate)); 106 mcp->mc_fpformat = fpuformat(); 107 if (!use_xsave || xfpusave_len == 0) 108 return; 109 max_len = cpu_max_ext_state_size - sizeof(struct savefpu); 110 len = xfpusave_len; 111 if (len > max_len) { 112 len = max_len; 113 bzero(xfpusave + max_len, len - max_len); 114 } 115 mcp->mc_flags |= _MC_IA32_HASFPXSTATE; 116 mcp->mc_xfpustate_len = len; 117 bcopy(get_pcb_user_save_td(td) + 1, xfpusave, len); 118 } 119 120 static int 121 ia32_set_fpcontext(struct thread *td, const struct ia32_mcontext *mcp, 122 char *xfpustate, size_t xfpustate_len) 123 { 124 int error; 125 126 if (mcp->mc_fpformat == _MC_FPFMT_NODEV) 127 return (0); 128 else if (mcp->mc_fpformat != _MC_FPFMT_XMM) 129 return (EINVAL); 130 else if (mcp->mc_ownedfp == _MC_FPOWNED_NONE) { 131 /* We don't care what state is left in the FPU or PCB. */ 132 fpstate_drop(td); 133 error = 0; 134 } else if (mcp->mc_ownedfp == _MC_FPOWNED_FPU || 135 mcp->mc_ownedfp == _MC_FPOWNED_PCB) { 136 error = fpusetregs(td, (struct savefpu *)&mcp->mc_fpstate, 137 xfpustate, xfpustate_len); 138 } else 139 return (EINVAL); 140 return (error); 141 } 142 143 /* 144 * Get machine context. 145 */ 146 static int 147 ia32_get_mcontext(struct thread *td, struct ia32_mcontext *mcp, int flags) 148 { 149 struct pcb *pcb; 150 struct trapframe *tp; 151 152 pcb = td->td_pcb; 153 tp = td->td_frame; 154 155 PROC_LOCK(curthread->td_proc); 156 mcp->mc_onstack = sigonstack(tp->tf_rsp); 157 PROC_UNLOCK(curthread->td_proc); 158 /* Entry into kernel always sets TF_HASSEGS */ 159 mcp->mc_gs = tp->tf_gs; 160 mcp->mc_fs = tp->tf_fs; 161 mcp->mc_es = tp->tf_es; 162 mcp->mc_ds = tp->tf_ds; 163 mcp->mc_edi = tp->tf_rdi; 164 mcp->mc_esi = tp->tf_rsi; 165 mcp->mc_ebp = tp->tf_rbp; 166 mcp->mc_isp = tp->tf_rsp; 167 mcp->mc_eflags = tp->tf_rflags; 168 if (flags & GET_MC_CLEAR_RET) { 169 mcp->mc_eax = 0; 170 mcp->mc_edx = 0; 171 mcp->mc_eflags &= ~PSL_C; 172 } else { 173 mcp->mc_eax = tp->tf_rax; 174 mcp->mc_edx = tp->tf_rdx; 175 } 176 mcp->mc_ebx = tp->tf_rbx; 177 mcp->mc_ecx = tp->tf_rcx; 178 mcp->mc_eip = tp->tf_rip; 179 mcp->mc_cs = tp->tf_cs; 180 mcp->mc_esp = tp->tf_rsp; 181 mcp->mc_ss = tp->tf_ss; 182 mcp->mc_len = sizeof(*mcp); 183 mcp->mc_flags = tp->tf_flags; 184 ia32_get_fpcontext(td, mcp, NULL, 0); 185 mcp->mc_fsbase = pcb->pcb_fsbase; 186 mcp->mc_gsbase = pcb->pcb_gsbase; 187 mcp->mc_xfpustate = 0; 188 mcp->mc_xfpustate_len = 0; 189 bzero(mcp->mc_spare2, sizeof(mcp->mc_spare2)); 190 return (0); 191 } 192 193 /* 194 * Set machine context. 195 * 196 * However, we don't set any but the user modifiable flags, and we won't 197 * touch the cs selector. 198 */ 199 static int 200 ia32_set_mcontext(struct thread *td, const struct ia32_mcontext *mcp) 201 { 202 struct trapframe *tp; 203 char *xfpustate; 204 long rflags; 205 int ret; 206 207 tp = td->td_frame; 208 if (mcp->mc_len != sizeof(*mcp)) 209 return (EINVAL); 210 rflags = (mcp->mc_eflags & PSL_USERCHANGE) | 211 (tp->tf_rflags & ~PSL_USERCHANGE); 212 if (mcp->mc_flags & _MC_IA32_HASFPXSTATE) { 213 if (mcp->mc_xfpustate_len > cpu_max_ext_state_size - 214 sizeof(struct savefpu)) 215 return (EINVAL); 216 xfpustate = __builtin_alloca(mcp->mc_xfpustate_len); 217 ret = copyin(PTRIN(mcp->mc_xfpustate), xfpustate, 218 mcp->mc_xfpustate_len); 219 if (ret != 0) 220 return (ret); 221 } else 222 xfpustate = NULL; 223 ret = ia32_set_fpcontext(td, mcp, xfpustate, mcp->mc_xfpustate_len); 224 if (ret != 0) 225 return (ret); 226 tp->tf_gs = mcp->mc_gs; 227 tp->tf_fs = mcp->mc_fs; 228 tp->tf_es = mcp->mc_es; 229 tp->tf_ds = mcp->mc_ds; 230 tp->tf_flags = TF_HASSEGS; 231 tp->tf_rdi = mcp->mc_edi; 232 tp->tf_rsi = mcp->mc_esi; 233 tp->tf_rbp = mcp->mc_ebp; 234 tp->tf_rbx = mcp->mc_ebx; 235 tp->tf_rdx = mcp->mc_edx; 236 tp->tf_rcx = mcp->mc_ecx; 237 tp->tf_rax = mcp->mc_eax; 238 /* trapno, err */ 239 tp->tf_rip = mcp->mc_eip; 240 tp->tf_rflags = rflags; 241 tp->tf_rsp = mcp->mc_esp; 242 tp->tf_ss = mcp->mc_ss; 243 set_pcb_flags(td->td_pcb, PCB_FULL_IRET); 244 return (0); 245 } 246 247 /* 248 * The first two fields of a ucontext_t are the signal mask and 249 * the machine context. The next field is uc_link; we want to 250 * avoid destroying the link when copying out contexts. 251 */ 252 #define UC_COPY_SIZE offsetof(struct ia32_ucontext, uc_link) 253 254 int 255 freebsd32_getcontext(struct thread *td, struct freebsd32_getcontext_args *uap) 256 { 257 struct ia32_ucontext uc; 258 int ret; 259 260 if (uap->ucp == NULL) 261 ret = EINVAL; 262 else { 263 ia32_get_mcontext(td, &uc.uc_mcontext, GET_MC_CLEAR_RET); 264 PROC_LOCK(td->td_proc); 265 uc.uc_sigmask = td->td_sigmask; 266 PROC_UNLOCK(td->td_proc); 267 bzero(&uc.__spare__, sizeof(uc.__spare__)); 268 ret = copyout(&uc, uap->ucp, UC_COPY_SIZE); 269 } 270 return (ret); 271 } 272 273 int 274 freebsd32_setcontext(struct thread *td, struct freebsd32_setcontext_args *uap) 275 { 276 struct ia32_ucontext uc; 277 int ret; 278 279 if (uap->ucp == NULL) 280 ret = EINVAL; 281 else { 282 ret = copyin(uap->ucp, &uc, UC_COPY_SIZE); 283 if (ret == 0) { 284 ret = ia32_set_mcontext(td, &uc.uc_mcontext); 285 if (ret == 0) { 286 kern_sigprocmask(td, SIG_SETMASK, 287 &uc.uc_sigmask, NULL, 0); 288 } 289 } 290 } 291 return (ret == 0 ? EJUSTRETURN : ret); 292 } 293 294 int 295 freebsd32_swapcontext(struct thread *td, struct freebsd32_swapcontext_args *uap) 296 { 297 struct ia32_ucontext uc; 298 int ret; 299 300 if (uap->oucp == NULL || uap->ucp == NULL) 301 ret = EINVAL; 302 else { 303 ia32_get_mcontext(td, &uc.uc_mcontext, GET_MC_CLEAR_RET); 304 PROC_LOCK(td->td_proc); 305 uc.uc_sigmask = td->td_sigmask; 306 PROC_UNLOCK(td->td_proc); 307 ret = copyout(&uc, uap->oucp, UC_COPY_SIZE); 308 if (ret == 0) { 309 ret = copyin(uap->ucp, &uc, UC_COPY_SIZE); 310 if (ret == 0) { 311 ret = ia32_set_mcontext(td, &uc.uc_mcontext); 312 if (ret == 0) { 313 kern_sigprocmask(td, SIG_SETMASK, 314 &uc.uc_sigmask, NULL, 0); 315 } 316 } 317 } 318 } 319 return (ret == 0 ? EJUSTRETURN : ret); 320 } 321 322 /* 323 * Send an interrupt to process. 324 * 325 * Stack is set up to allow sigcode stored 326 * at top to call routine, followed by kcall 327 * to sigreturn routine below. After sigreturn 328 * resets the signal mask, the stack, and the 329 * frame pointer, it returns to the user 330 * specified pc, psl. 331 */ 332 333 #ifdef COMPAT_43 334 static void 335 ia32_osendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask) 336 { 337 struct ia32_sigframe3 sf, *fp; 338 struct proc *p; 339 struct thread *td; 340 struct sigacts *psp; 341 struct trapframe *regs; 342 int sig; 343 int oonstack; 344 345 td = curthread; 346 p = td->td_proc; 347 PROC_LOCK_ASSERT(p, MA_OWNED); 348 sig = ksi->ksi_signo; 349 psp = p->p_sigacts; 350 mtx_assert(&psp->ps_mtx, MA_OWNED); 351 regs = td->td_frame; 352 oonstack = sigonstack(regs->tf_rsp); 353 354 /* Allocate space for the signal handler context. */ 355 if ((td->td_pflags & TDP_ALTSTACK) && !oonstack && 356 SIGISMEMBER(psp->ps_sigonstack, sig)) { 357 fp = (struct ia32_sigframe3 *)(td->td_sigstk.ss_sp + 358 td->td_sigstk.ss_size - sizeof(sf)); 359 td->td_sigstk.ss_flags |= SS_ONSTACK; 360 } else 361 fp = (struct ia32_sigframe3 *)regs->tf_rsp - 1; 362 363 /* Translate the signal if appropriate. */ 364 if (p->p_sysent->sv_sigtbl && sig <= p->p_sysent->sv_sigsize) 365 sig = p->p_sysent->sv_sigtbl[_SIG_IDX(sig)]; 366 367 /* Build the argument list for the signal handler. */ 368 sf.sf_signum = sig; 369 sf.sf_scp = (register_t)&fp->sf_siginfo.si_sc; 370 if (SIGISMEMBER(psp->ps_siginfo, sig)) { 371 /* Signal handler installed with SA_SIGINFO. */ 372 sf.sf_arg2 = (register_t)&fp->sf_siginfo; 373 sf.sf_siginfo.si_signo = sig; 374 sf.sf_siginfo.si_code = ksi->ksi_code; 375 sf.sf_ah = (uintptr_t)catcher; 376 } else { 377 /* Old FreeBSD-style arguments. */ 378 sf.sf_arg2 = ksi->ksi_code; 379 sf.sf_addr = (register_t)ksi->ksi_addr; 380 sf.sf_ah = (uintptr_t)catcher; 381 } 382 mtx_unlock(&psp->ps_mtx); 383 PROC_UNLOCK(p); 384 385 /* Save most if not all of trap frame. */ 386 sf.sf_siginfo.si_sc.sc_eax = regs->tf_rax; 387 sf.sf_siginfo.si_sc.sc_ebx = regs->tf_rbx; 388 sf.sf_siginfo.si_sc.sc_ecx = regs->tf_rcx; 389 sf.sf_siginfo.si_sc.sc_edx = regs->tf_rdx; 390 sf.sf_siginfo.si_sc.sc_esi = regs->tf_rsi; 391 sf.sf_siginfo.si_sc.sc_edi = regs->tf_rdi; 392 sf.sf_siginfo.si_sc.sc_cs = regs->tf_cs; 393 sf.sf_siginfo.si_sc.sc_ds = regs->tf_ds; 394 sf.sf_siginfo.si_sc.sc_ss = regs->tf_ss; 395 sf.sf_siginfo.si_sc.sc_es = regs->tf_es; 396 sf.sf_siginfo.si_sc.sc_fs = regs->tf_fs; 397 sf.sf_siginfo.si_sc.sc_gs = regs->tf_gs; 398 sf.sf_siginfo.si_sc.sc_isp = regs->tf_rsp; 399 400 /* Build the signal context to be used by osigreturn(). */ 401 sf.sf_siginfo.si_sc.sc_onstack = (oonstack) ? 1 : 0; 402 SIG2OSIG(*mask, sf.sf_siginfo.si_sc.sc_mask); 403 sf.sf_siginfo.si_sc.sc_esp = regs->tf_rsp; 404 sf.sf_siginfo.si_sc.sc_ebp = regs->tf_rbp; 405 sf.sf_siginfo.si_sc.sc_eip = regs->tf_rip; 406 sf.sf_siginfo.si_sc.sc_eflags = regs->tf_rflags; 407 sf.sf_siginfo.si_sc.sc_trapno = regs->tf_trapno; 408 sf.sf_siginfo.si_sc.sc_err = regs->tf_err; 409 410 /* 411 * Copy the sigframe out to the user's stack. 412 */ 413 if (copyout(&sf, fp, sizeof(*fp)) != 0) { 414 #ifdef DEBUG 415 printf("process %ld has trashed its stack\n", (long)p->p_pid); 416 #endif 417 PROC_LOCK(p); 418 sigexit(td, SIGILL); 419 } 420 421 regs->tf_rsp = (uintptr_t)fp; 422 regs->tf_rip = p->p_sysent->sv_psstrings - sz_ia32_osigcode; 423 regs->tf_rflags &= ~(PSL_T | PSL_D); 424 regs->tf_cs = _ucode32sel; 425 regs->tf_ds = _udatasel; 426 regs->tf_es = _udatasel; 427 regs->tf_fs = _udatasel; 428 regs->tf_ss = _udatasel; 429 set_pcb_flags(td->td_pcb, PCB_FULL_IRET); 430 PROC_LOCK(p); 431 mtx_lock(&psp->ps_mtx); 432 } 433 #endif 434 435 #ifdef COMPAT_FREEBSD4 436 static void 437 freebsd4_ia32_sendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask) 438 { 439 struct ia32_sigframe4 sf, *sfp; 440 struct siginfo32 siginfo; 441 struct proc *p; 442 struct thread *td; 443 struct sigacts *psp; 444 struct trapframe *regs; 445 int oonstack; 446 int sig; 447 448 td = curthread; 449 p = td->td_proc; 450 siginfo_to_siginfo32(&ksi->ksi_info, &siginfo); 451 452 PROC_LOCK_ASSERT(p, MA_OWNED); 453 sig = siginfo.si_signo; 454 psp = p->p_sigacts; 455 mtx_assert(&psp->ps_mtx, MA_OWNED); 456 regs = td->td_frame; 457 oonstack = sigonstack(regs->tf_rsp); 458 459 /* Save user context. */ 460 bzero(&sf, sizeof(sf)); 461 sf.sf_uc.uc_sigmask = *mask; 462 sf.sf_uc.uc_stack.ss_sp = (uintptr_t)td->td_sigstk.ss_sp; 463 sf.sf_uc.uc_stack.ss_size = td->td_sigstk.ss_size; 464 sf.sf_uc.uc_stack.ss_flags = (td->td_pflags & TDP_ALTSTACK) 465 ? ((oonstack) ? SS_ONSTACK : 0) : SS_DISABLE; 466 sf.sf_uc.uc_mcontext.mc_onstack = (oonstack) ? 1 : 0; 467 sf.sf_uc.uc_mcontext.mc_edi = regs->tf_rdi; 468 sf.sf_uc.uc_mcontext.mc_esi = regs->tf_rsi; 469 sf.sf_uc.uc_mcontext.mc_ebp = regs->tf_rbp; 470 sf.sf_uc.uc_mcontext.mc_isp = regs->tf_rsp; /* XXX */ 471 sf.sf_uc.uc_mcontext.mc_ebx = regs->tf_rbx; 472 sf.sf_uc.uc_mcontext.mc_edx = regs->tf_rdx; 473 sf.sf_uc.uc_mcontext.mc_ecx = regs->tf_rcx; 474 sf.sf_uc.uc_mcontext.mc_eax = regs->tf_rax; 475 sf.sf_uc.uc_mcontext.mc_trapno = regs->tf_trapno; 476 sf.sf_uc.uc_mcontext.mc_err = regs->tf_err; 477 sf.sf_uc.uc_mcontext.mc_eip = regs->tf_rip; 478 sf.sf_uc.uc_mcontext.mc_cs = regs->tf_cs; 479 sf.sf_uc.uc_mcontext.mc_eflags = regs->tf_rflags; 480 sf.sf_uc.uc_mcontext.mc_esp = regs->tf_rsp; 481 sf.sf_uc.uc_mcontext.mc_ss = regs->tf_ss; 482 sf.sf_uc.uc_mcontext.mc_ds = regs->tf_ds; 483 sf.sf_uc.uc_mcontext.mc_es = regs->tf_es; 484 sf.sf_uc.uc_mcontext.mc_fs = regs->tf_fs; 485 sf.sf_uc.uc_mcontext.mc_gs = regs->tf_gs; 486 bzero(sf.sf_uc.uc_mcontext.mc_fpregs, 487 sizeof(sf.sf_uc.uc_mcontext.mc_fpregs)); 488 bzero(sf.sf_uc.uc_mcontext.__spare__, 489 sizeof(sf.sf_uc.uc_mcontext.__spare__)); 490 bzero(sf.sf_uc.__spare__, sizeof(sf.sf_uc.__spare__)); 491 492 /* Allocate space for the signal handler context. */ 493 if ((td->td_pflags & TDP_ALTSTACK) != 0 && !oonstack && 494 SIGISMEMBER(psp->ps_sigonstack, sig)) { 495 sfp = (struct ia32_sigframe4 *)(td->td_sigstk.ss_sp + 496 td->td_sigstk.ss_size - sizeof(sf)); 497 } else 498 sfp = (struct ia32_sigframe4 *)regs->tf_rsp - 1; 499 PROC_UNLOCK(p); 500 501 /* Translate the signal if appropriate. */ 502 if (p->p_sysent->sv_sigtbl && sig <= p->p_sysent->sv_sigsize) 503 sig = p->p_sysent->sv_sigtbl[_SIG_IDX(sig)]; 504 505 /* Build the argument list for the signal handler. */ 506 sf.sf_signum = sig; 507 sf.sf_ucontext = (register_t)&sfp->sf_uc; 508 bzero(&sf.sf_si, sizeof(sf.sf_si)); 509 if (SIGISMEMBER(psp->ps_siginfo, sig)) { 510 /* Signal handler installed with SA_SIGINFO. */ 511 sf.sf_siginfo = (u_int32_t)(uintptr_t)&sfp->sf_si; 512 sf.sf_ah = (u_int32_t)(uintptr_t)catcher; 513 514 /* Fill in POSIX parts */ 515 sf.sf_si = siginfo; 516 sf.sf_si.si_signo = sig; 517 } else { 518 /* Old FreeBSD-style arguments. */ 519 sf.sf_siginfo = siginfo.si_code; 520 sf.sf_addr = (u_int32_t)siginfo.si_addr; 521 sf.sf_ah = (u_int32_t)(uintptr_t)catcher; 522 } 523 mtx_unlock(&psp->ps_mtx); 524 525 /* 526 * Copy the sigframe out to the user's stack. 527 */ 528 if (copyout(&sf, sfp, sizeof(*sfp)) != 0) { 529 #ifdef DEBUG 530 printf("process %ld has trashed its stack\n", (long)p->p_pid); 531 #endif 532 PROC_LOCK(p); 533 sigexit(td, SIGILL); 534 } 535 536 regs->tf_rsp = (uintptr_t)sfp; 537 regs->tf_rip = p->p_sysent->sv_sigcode_base + sz_ia32_sigcode - 538 sz_freebsd4_ia32_sigcode; 539 regs->tf_rflags &= ~(PSL_T | PSL_D); 540 regs->tf_cs = _ucode32sel; 541 regs->tf_ss = _udatasel; 542 regs->tf_ds = _udatasel; 543 regs->tf_es = _udatasel; 544 set_pcb_flags(td->td_pcb, PCB_FULL_IRET); 545 /* leave user %fs and %gs untouched */ 546 PROC_LOCK(p); 547 mtx_lock(&psp->ps_mtx); 548 } 549 #endif /* COMPAT_FREEBSD4 */ 550 551 void 552 ia32_sendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask) 553 { 554 struct ia32_sigframe sf, *sfp; 555 struct siginfo32 siginfo; 556 struct proc *p; 557 struct thread *td; 558 struct sigacts *psp; 559 char *sp; 560 struct trapframe *regs; 561 char *xfpusave; 562 size_t xfpusave_len; 563 int oonstack; 564 int sig; 565 566 siginfo_to_siginfo32(&ksi->ksi_info, &siginfo); 567 td = curthread; 568 p = td->td_proc; 569 PROC_LOCK_ASSERT(p, MA_OWNED); 570 sig = siginfo.si_signo; 571 psp = p->p_sigacts; 572 #ifdef COMPAT_FREEBSD4 573 if (SIGISMEMBER(psp->ps_freebsd4, sig)) { 574 freebsd4_ia32_sendsig(catcher, ksi, mask); 575 return; 576 } 577 #endif 578 #ifdef COMPAT_43 579 if (SIGISMEMBER(psp->ps_osigset, sig)) { 580 ia32_osendsig(catcher, ksi, mask); 581 return; 582 } 583 #endif 584 mtx_assert(&psp->ps_mtx, MA_OWNED); 585 regs = td->td_frame; 586 oonstack = sigonstack(regs->tf_rsp); 587 588 if (cpu_max_ext_state_size > sizeof(struct savefpu) && use_xsave) { 589 xfpusave_len = cpu_max_ext_state_size - sizeof(struct savefpu); 590 xfpusave = __builtin_alloca(xfpusave_len); 591 } else { 592 xfpusave_len = 0; 593 xfpusave = NULL; 594 } 595 596 /* Save user context. */ 597 bzero(&sf, sizeof(sf)); 598 sf.sf_uc.uc_sigmask = *mask; 599 sf.sf_uc.uc_stack.ss_sp = (uintptr_t)td->td_sigstk.ss_sp; 600 sf.sf_uc.uc_stack.ss_size = td->td_sigstk.ss_size; 601 sf.sf_uc.uc_stack.ss_flags = (td->td_pflags & TDP_ALTSTACK) 602 ? ((oonstack) ? SS_ONSTACK : 0) : SS_DISABLE; 603 sf.sf_uc.uc_mcontext.mc_onstack = (oonstack) ? 1 : 0; 604 sf.sf_uc.uc_mcontext.mc_edi = regs->tf_rdi; 605 sf.sf_uc.uc_mcontext.mc_esi = regs->tf_rsi; 606 sf.sf_uc.uc_mcontext.mc_ebp = regs->tf_rbp; 607 sf.sf_uc.uc_mcontext.mc_isp = regs->tf_rsp; /* XXX */ 608 sf.sf_uc.uc_mcontext.mc_ebx = regs->tf_rbx; 609 sf.sf_uc.uc_mcontext.mc_edx = regs->tf_rdx; 610 sf.sf_uc.uc_mcontext.mc_ecx = regs->tf_rcx; 611 sf.sf_uc.uc_mcontext.mc_eax = regs->tf_rax; 612 sf.sf_uc.uc_mcontext.mc_trapno = regs->tf_trapno; 613 sf.sf_uc.uc_mcontext.mc_err = regs->tf_err; 614 sf.sf_uc.uc_mcontext.mc_eip = regs->tf_rip; 615 sf.sf_uc.uc_mcontext.mc_cs = regs->tf_cs; 616 sf.sf_uc.uc_mcontext.mc_eflags = regs->tf_rflags; 617 sf.sf_uc.uc_mcontext.mc_esp = regs->tf_rsp; 618 sf.sf_uc.uc_mcontext.mc_ss = regs->tf_ss; 619 sf.sf_uc.uc_mcontext.mc_ds = regs->tf_ds; 620 sf.sf_uc.uc_mcontext.mc_es = regs->tf_es; 621 sf.sf_uc.uc_mcontext.mc_fs = regs->tf_fs; 622 sf.sf_uc.uc_mcontext.mc_gs = regs->tf_gs; 623 sf.sf_uc.uc_mcontext.mc_len = sizeof(sf.sf_uc.uc_mcontext); /* magic */ 624 ia32_get_fpcontext(td, &sf.sf_uc.uc_mcontext, xfpusave, xfpusave_len); 625 fpstate_drop(td); 626 sf.sf_uc.uc_mcontext.mc_fsbase = td->td_pcb->pcb_fsbase; 627 sf.sf_uc.uc_mcontext.mc_gsbase = td->td_pcb->pcb_gsbase; 628 bzero(sf.sf_uc.__spare__, sizeof(sf.sf_uc.__spare__)); 629 630 /* Allocate space for the signal handler context. */ 631 if ((td->td_pflags & TDP_ALTSTACK) != 0 && !oonstack && 632 SIGISMEMBER(psp->ps_sigonstack, sig)) 633 sp = td->td_sigstk.ss_sp + td->td_sigstk.ss_size; 634 else 635 sp = (char *)regs->tf_rsp; 636 if (xfpusave != NULL) { 637 sp -= xfpusave_len; 638 sp = (char *)((unsigned long)sp & ~0x3Ful); 639 sf.sf_uc.uc_mcontext.mc_xfpustate = (register_t)sp; 640 } 641 sp -= sizeof(sf); 642 /* Align to 16 bytes. */ 643 sfp = (struct ia32_sigframe *)((uintptr_t)sp & ~0xF); 644 PROC_UNLOCK(p); 645 646 /* Translate the signal if appropriate. */ 647 if (p->p_sysent->sv_sigtbl && sig <= p->p_sysent->sv_sigsize) 648 sig = p->p_sysent->sv_sigtbl[_SIG_IDX(sig)]; 649 650 /* Build the argument list for the signal handler. */ 651 sf.sf_signum = sig; 652 sf.sf_ucontext = (register_t)&sfp->sf_uc; 653 bzero(&sf.sf_si, sizeof(sf.sf_si)); 654 if (SIGISMEMBER(psp->ps_siginfo, sig)) { 655 /* Signal handler installed with SA_SIGINFO. */ 656 sf.sf_siginfo = (u_int32_t)(uintptr_t)&sfp->sf_si; 657 sf.sf_ah = (u_int32_t)(uintptr_t)catcher; 658 659 /* Fill in POSIX parts */ 660 sf.sf_si = siginfo; 661 sf.sf_si.si_signo = sig; 662 } else { 663 /* Old FreeBSD-style arguments. */ 664 sf.sf_siginfo = siginfo.si_code; 665 sf.sf_addr = (u_int32_t)siginfo.si_addr; 666 sf.sf_ah = (u_int32_t)(uintptr_t)catcher; 667 } 668 mtx_unlock(&psp->ps_mtx); 669 670 /* 671 * Copy the sigframe out to the user's stack. 672 */ 673 if (copyout(&sf, sfp, sizeof(*sfp)) != 0 || 674 (xfpusave != NULL && copyout(xfpusave, 675 PTRIN(sf.sf_uc.uc_mcontext.mc_xfpustate), xfpusave_len) 676 != 0)) { 677 #ifdef DEBUG 678 printf("process %ld has trashed its stack\n", (long)p->p_pid); 679 #endif 680 PROC_LOCK(p); 681 sigexit(td, SIGILL); 682 } 683 684 regs->tf_rsp = (uintptr_t)sfp; 685 regs->tf_rip = p->p_sysent->sv_sigcode_base; 686 regs->tf_rflags &= ~(PSL_T | PSL_D); 687 regs->tf_cs = _ucode32sel; 688 regs->tf_ss = _udatasel; 689 regs->tf_ds = _udatasel; 690 regs->tf_es = _udatasel; 691 set_pcb_flags(td->td_pcb, PCB_FULL_IRET); 692 /* XXXKIB leave user %fs and %gs untouched */ 693 PROC_LOCK(p); 694 mtx_lock(&psp->ps_mtx); 695 } 696 697 /* 698 * System call to cleanup state after a signal 699 * has been taken. Reset signal mask and 700 * stack state from context left by sendsig (above). 701 * Return to previous pc and psl as specified by 702 * context left by sendsig. Check carefully to 703 * make sure that the user has not modified the 704 * state to gain improper privileges. 705 */ 706 707 #ifdef COMPAT_43 708 int 709 ofreebsd32_sigreturn(struct thread *td, struct ofreebsd32_sigreturn_args *uap) 710 { 711 struct ia32_sigcontext3 sc, *scp; 712 struct trapframe *regs; 713 int eflags, error; 714 ksiginfo_t ksi; 715 716 regs = td->td_frame; 717 error = copyin(uap->sigcntxp, &sc, sizeof(sc)); 718 if (error != 0) 719 return (error); 720 scp = ≻ 721 eflags = scp->sc_eflags; 722 if (!EFL_SECURE(eflags & ~PSL_RF, regs->tf_rflags & ~PSL_RF)) { 723 return (EINVAL); 724 } 725 if (!CS_SECURE(scp->sc_cs)) { 726 ksiginfo_init_trap(&ksi); 727 ksi.ksi_signo = SIGBUS; 728 ksi.ksi_code = BUS_OBJERR; 729 ksi.ksi_trapno = T_PROTFLT; 730 ksi.ksi_addr = (void *)regs->tf_rip; 731 trapsignal(td, &ksi); 732 return (EINVAL); 733 } 734 regs->tf_ds = scp->sc_ds; 735 regs->tf_es = scp->sc_es; 736 regs->tf_fs = scp->sc_fs; 737 regs->tf_gs = scp->sc_gs; 738 739 regs->tf_rax = scp->sc_eax; 740 regs->tf_rbx = scp->sc_ebx; 741 regs->tf_rcx = scp->sc_ecx; 742 regs->tf_rdx = scp->sc_edx; 743 regs->tf_rsi = scp->sc_esi; 744 regs->tf_rdi = scp->sc_edi; 745 regs->tf_cs = scp->sc_cs; 746 regs->tf_ss = scp->sc_ss; 747 regs->tf_rbp = scp->sc_ebp; 748 regs->tf_rsp = scp->sc_esp; 749 regs->tf_rip = scp->sc_eip; 750 regs->tf_rflags = eflags; 751 752 if (scp->sc_onstack & 1) 753 td->td_sigstk.ss_flags |= SS_ONSTACK; 754 else 755 td->td_sigstk.ss_flags &= ~SS_ONSTACK; 756 757 kern_sigprocmask(td, SIG_SETMASK, (sigset_t *)&scp->sc_mask, NULL, 758 SIGPROCMASK_OLD); 759 set_pcb_flags(td->td_pcb, PCB_FULL_IRET); 760 return (EJUSTRETURN); 761 } 762 #endif 763 764 #ifdef COMPAT_FREEBSD4 765 /* 766 * MPSAFE 767 */ 768 int 769 freebsd4_freebsd32_sigreturn(td, uap) 770 struct thread *td; 771 struct freebsd4_freebsd32_sigreturn_args /* { 772 const struct freebsd4_freebsd32_ucontext *sigcntxp; 773 } */ *uap; 774 { 775 struct ia32_ucontext4 uc; 776 struct trapframe *regs; 777 struct ia32_ucontext4 *ucp; 778 int cs, eflags, error; 779 ksiginfo_t ksi; 780 781 error = copyin(uap->sigcntxp, &uc, sizeof(uc)); 782 if (error != 0) 783 return (error); 784 ucp = &uc; 785 regs = td->td_frame; 786 eflags = ucp->uc_mcontext.mc_eflags; 787 /* 788 * Don't allow users to change privileged or reserved flags. 789 */ 790 /* 791 * XXX do allow users to change the privileged flag PSL_RF. 792 * The cpu sets PSL_RF in tf_eflags for faults. Debuggers 793 * should sometimes set it there too. tf_eflags is kept in 794 * the signal context during signal handling and there is no 795 * other place to remember it, so the PSL_RF bit may be 796 * corrupted by the signal handler without us knowing. 797 * Corruption of the PSL_RF bit at worst causes one more or 798 * one less debugger trap, so allowing it is fairly harmless. 799 */ 800 if (!EFL_SECURE(eflags & ~PSL_RF, regs->tf_rflags & ~PSL_RF)) { 801 uprintf("pid %d (%s): freebsd4_freebsd32_sigreturn eflags = 0x%x\n", 802 td->td_proc->p_pid, td->td_name, eflags); 803 return (EINVAL); 804 } 805 806 /* 807 * Don't allow users to load a valid privileged %cs. Let the 808 * hardware check for invalid selectors, excess privilege in 809 * other selectors, invalid %eip's and invalid %esp's. 810 */ 811 cs = ucp->uc_mcontext.mc_cs; 812 if (!CS_SECURE(cs)) { 813 uprintf("pid %d (%s): freebsd4_sigreturn cs = 0x%x\n", 814 td->td_proc->p_pid, td->td_name, cs); 815 ksiginfo_init_trap(&ksi); 816 ksi.ksi_signo = SIGBUS; 817 ksi.ksi_code = BUS_OBJERR; 818 ksi.ksi_trapno = T_PROTFLT; 819 ksi.ksi_addr = (void *)regs->tf_rip; 820 trapsignal(td, &ksi); 821 return (EINVAL); 822 } 823 824 regs->tf_rdi = ucp->uc_mcontext.mc_edi; 825 regs->tf_rsi = ucp->uc_mcontext.mc_esi; 826 regs->tf_rbp = ucp->uc_mcontext.mc_ebp; 827 regs->tf_rbx = ucp->uc_mcontext.mc_ebx; 828 regs->tf_rdx = ucp->uc_mcontext.mc_edx; 829 regs->tf_rcx = ucp->uc_mcontext.mc_ecx; 830 regs->tf_rax = ucp->uc_mcontext.mc_eax; 831 regs->tf_trapno = ucp->uc_mcontext.mc_trapno; 832 regs->tf_err = ucp->uc_mcontext.mc_err; 833 regs->tf_rip = ucp->uc_mcontext.mc_eip; 834 regs->tf_cs = cs; 835 regs->tf_rflags = ucp->uc_mcontext.mc_eflags; 836 regs->tf_rsp = ucp->uc_mcontext.mc_esp; 837 regs->tf_ss = ucp->uc_mcontext.mc_ss; 838 regs->tf_ds = ucp->uc_mcontext.mc_ds; 839 regs->tf_es = ucp->uc_mcontext.mc_es; 840 regs->tf_fs = ucp->uc_mcontext.mc_fs; 841 regs->tf_gs = ucp->uc_mcontext.mc_gs; 842 843 kern_sigprocmask(td, SIG_SETMASK, &ucp->uc_sigmask, NULL, 0); 844 set_pcb_flags(td->td_pcb, PCB_FULL_IRET); 845 return (EJUSTRETURN); 846 } 847 #endif /* COMPAT_FREEBSD4 */ 848 849 /* 850 * MPSAFE 851 */ 852 int 853 freebsd32_sigreturn(td, uap) 854 struct thread *td; 855 struct freebsd32_sigreturn_args /* { 856 const struct freebsd32_ucontext *sigcntxp; 857 } */ *uap; 858 { 859 struct ia32_ucontext uc; 860 struct trapframe *regs; 861 struct ia32_ucontext *ucp; 862 char *xfpustate; 863 size_t xfpustate_len; 864 int cs, eflags, error, ret; 865 ksiginfo_t ksi; 866 867 error = copyin(uap->sigcntxp, &uc, sizeof(uc)); 868 if (error != 0) 869 return (error); 870 ucp = &uc; 871 regs = td->td_frame; 872 eflags = ucp->uc_mcontext.mc_eflags; 873 /* 874 * Don't allow users to change privileged or reserved flags. 875 */ 876 /* 877 * XXX do allow users to change the privileged flag PSL_RF. 878 * The cpu sets PSL_RF in tf_eflags for faults. Debuggers 879 * should sometimes set it there too. tf_eflags is kept in 880 * the signal context during signal handling and there is no 881 * other place to remember it, so the PSL_RF bit may be 882 * corrupted by the signal handler without us knowing. 883 * Corruption of the PSL_RF bit at worst causes one more or 884 * one less debugger trap, so allowing it is fairly harmless. 885 */ 886 if (!EFL_SECURE(eflags & ~PSL_RF, regs->tf_rflags & ~PSL_RF)) { 887 uprintf("pid %d (%s): freebsd32_sigreturn eflags = 0x%x\n", 888 td->td_proc->p_pid, td->td_name, eflags); 889 return (EINVAL); 890 } 891 892 /* 893 * Don't allow users to load a valid privileged %cs. Let the 894 * hardware check for invalid selectors, excess privilege in 895 * other selectors, invalid %eip's and invalid %esp's. 896 */ 897 cs = ucp->uc_mcontext.mc_cs; 898 if (!CS_SECURE(cs)) { 899 uprintf("pid %d (%s): sigreturn cs = 0x%x\n", 900 td->td_proc->p_pid, td->td_name, cs); 901 ksiginfo_init_trap(&ksi); 902 ksi.ksi_signo = SIGBUS; 903 ksi.ksi_code = BUS_OBJERR; 904 ksi.ksi_trapno = T_PROTFLT; 905 ksi.ksi_addr = (void *)regs->tf_rip; 906 trapsignal(td, &ksi); 907 return (EINVAL); 908 } 909 910 if ((ucp->uc_mcontext.mc_flags & _MC_HASFPXSTATE) != 0) { 911 xfpustate_len = uc.uc_mcontext.mc_xfpustate_len; 912 if (xfpustate_len > cpu_max_ext_state_size - 913 sizeof(struct savefpu)) { 914 uprintf("pid %d (%s): sigreturn xfpusave_len = 0x%zx\n", 915 td->td_proc->p_pid, td->td_name, xfpustate_len); 916 return (EINVAL); 917 } 918 xfpustate = __builtin_alloca(xfpustate_len); 919 error = copyin(PTRIN(ucp->uc_mcontext.mc_xfpustate), 920 xfpustate, xfpustate_len); 921 if (error != 0) { 922 uprintf( 923 "pid %d (%s): sigreturn copying xfpustate failed\n", 924 td->td_proc->p_pid, td->td_name); 925 return (error); 926 } 927 } else { 928 xfpustate = NULL; 929 xfpustate_len = 0; 930 } 931 ret = ia32_set_fpcontext(td, &ucp->uc_mcontext, xfpustate, 932 xfpustate_len); 933 if (ret != 0) { 934 uprintf("pid %d (%s): sigreturn set_fpcontext err %d\n", 935 td->td_proc->p_pid, td->td_name, ret); 936 return (ret); 937 } 938 939 regs->tf_rdi = ucp->uc_mcontext.mc_edi; 940 regs->tf_rsi = ucp->uc_mcontext.mc_esi; 941 regs->tf_rbp = ucp->uc_mcontext.mc_ebp; 942 regs->tf_rbx = ucp->uc_mcontext.mc_ebx; 943 regs->tf_rdx = ucp->uc_mcontext.mc_edx; 944 regs->tf_rcx = ucp->uc_mcontext.mc_ecx; 945 regs->tf_rax = ucp->uc_mcontext.mc_eax; 946 regs->tf_trapno = ucp->uc_mcontext.mc_trapno; 947 regs->tf_err = ucp->uc_mcontext.mc_err; 948 regs->tf_rip = ucp->uc_mcontext.mc_eip; 949 regs->tf_cs = cs; 950 regs->tf_rflags = ucp->uc_mcontext.mc_eflags; 951 regs->tf_rsp = ucp->uc_mcontext.mc_esp; 952 regs->tf_ss = ucp->uc_mcontext.mc_ss; 953 regs->tf_ds = ucp->uc_mcontext.mc_ds; 954 regs->tf_es = ucp->uc_mcontext.mc_es; 955 regs->tf_fs = ucp->uc_mcontext.mc_fs; 956 regs->tf_gs = ucp->uc_mcontext.mc_gs; 957 regs->tf_flags = TF_HASSEGS; 958 959 kern_sigprocmask(td, SIG_SETMASK, &ucp->uc_sigmask, NULL, 0); 960 set_pcb_flags(td->td_pcb, PCB_FULL_IRET); 961 return (EJUSTRETURN); 962 } 963 964 /* 965 * Clear registers on exec 966 */ 967 void 968 ia32_setregs(struct thread *td, struct image_params *imgp, u_long stack) 969 { 970 struct trapframe *regs = td->td_frame; 971 struct pcb *pcb = td->td_pcb; 972 973 mtx_lock(&dt_lock); 974 if (td->td_proc->p_md.md_ldt != NULL) 975 user_ldt_free(td); 976 else 977 mtx_unlock(&dt_lock); 978 #ifdef COMPAT_43 979 setup_lcall_gate(); 980 #endif 981 982 pcb->pcb_fsbase = 0; 983 pcb->pcb_gsbase = 0; 984 pcb->pcb_initial_fpucw = __INITIAL_FPUCW_I386__; 985 986 bzero((char *)regs, sizeof(struct trapframe)); 987 regs->tf_rip = imgp->entry_addr; 988 regs->tf_rsp = stack; 989 regs->tf_rflags = PSL_USER | (regs->tf_rflags & PSL_T); 990 regs->tf_ss = _udatasel; 991 regs->tf_cs = _ucode32sel; 992 regs->tf_rbx = imgp->ps_strings; 993 regs->tf_ds = _udatasel; 994 regs->tf_es = _udatasel; 995 regs->tf_fs = _ufssel; 996 regs->tf_gs = _ugssel; 997 regs->tf_flags = TF_HASSEGS; 998 999 fpstate_drop(td); 1000 1001 /* Return via doreti so that we can change to a different %cs */ 1002 set_pcb_flags(pcb, PCB_32BIT | PCB_FULL_IRET); 1003 td->td_retval[1] = 0; 1004 } 1005