xref: /freebsd/sys/amd64/ia32/ia32_signal.c (revision 4e99f45480598189d49d45a825533a6c9e12f02c)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 2003 Peter Wemm
5  * Copyright (c) 1982, 1987, 1990 The Regents of the University of California.
6  * All rights reserved.
7  *
8  * This code is derived from software contributed to Berkeley by
9  * William Jolitz.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. Neither the name of the University nor the names of its contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include <sys/param.h>
40 #include <sys/exec.h>
41 #include <sys/fcntl.h>
42 #include <sys/imgact.h>
43 #include <sys/kernel.h>
44 #include <sys/lock.h>
45 #include <sys/malloc.h>
46 #include <sys/mutex.h>
47 #include <sys/mman.h>
48 #include <sys/namei.h>
49 #include <sys/proc.h>
50 #include <sys/procfs.h>
51 #include <sys/resourcevar.h>
52 #include <sys/systm.h>
53 #include <sys/signalvar.h>
54 #include <sys/stat.h>
55 #include <sys/sx.h>
56 #include <sys/syscall.h>
57 #include <sys/syscallsubr.h>
58 #include <sys/sysctl.h>
59 #include <sys/sysent.h>
60 #include <sys/vnode.h>
61 
62 #include <vm/vm.h>
63 #include <vm/vm_kern.h>
64 #include <vm/vm_param.h>
65 #include <vm/pmap.h>
66 #include <vm/vm_map.h>
67 #include <vm/vm_object.h>
68 #include <vm/vm_extern.h>
69 
70 #include <compat/freebsd32/freebsd32_signal.h>
71 #include <compat/freebsd32/freebsd32_util.h>
72 #include <compat/freebsd32/freebsd32_proto.h>
73 #include <compat/freebsd32/freebsd32.h>
74 #include <compat/ia32/ia32_signal.h>
75 #include <machine/psl.h>
76 #include <machine/segments.h>
77 #include <machine/specialreg.h>
78 #include <machine/frame.h>
79 #include <machine/md_var.h>
80 #include <machine/pcb.h>
81 #include <machine/cpufunc.h>
82 #include <machine/trap.h>
83 
84 #ifdef COMPAT_FREEBSD4
85 static void freebsd4_ia32_sendsig(sig_t, ksiginfo_t *, sigset_t *);
86 #endif
87 
88 #define	CS_SECURE(cs)		(ISPL(cs) == SEL_UPL)
89 #define	EFL_SECURE(ef, oef)	((((ef) ^ (oef)) & ~PSL_USERCHANGE) == 0)
90 
91 static void
92 ia32_get_fpcontext(struct thread *td, struct ia32_mcontext *mcp,
93     char *xfpusave, size_t xfpusave_len)
94 {
95 	size_t max_len, len;
96 
97 	/*
98 	 * XXX Format of 64bit and 32bit FXSAVE areas differs. FXSAVE
99 	 * in 32bit mode saves %cs and %ds, while on 64bit it saves
100 	 * 64bit instruction and data pointers. Ignore the difference
101 	 * for now, it should be irrelevant for most applications.
102 	 */
103 	mcp->mc_ownedfp = fpugetregs(td);
104 	bcopy(get_pcb_user_save_td(td), &mcp->mc_fpstate[0],
105 	    sizeof(mcp->mc_fpstate));
106 	mcp->mc_fpformat = fpuformat();
107 	if (!use_xsave || xfpusave_len == 0)
108 		return;
109 	max_len = cpu_max_ext_state_size - sizeof(struct savefpu);
110 	len = xfpusave_len;
111 	if (len > max_len) {
112 		len = max_len;
113 		bzero(xfpusave + max_len, len - max_len);
114 	}
115 	mcp->mc_flags |= _MC_IA32_HASFPXSTATE;
116 	mcp->mc_xfpustate_len = len;
117 	bcopy(get_pcb_user_save_td(td) + 1, xfpusave, len);
118 }
119 
120 static int
121 ia32_set_fpcontext(struct thread *td, struct ia32_mcontext *mcp,
122     char *xfpustate, size_t xfpustate_len)
123 {
124 	int error;
125 
126 	if (mcp->mc_fpformat == _MC_FPFMT_NODEV)
127 		return (0);
128 	else if (mcp->mc_fpformat != _MC_FPFMT_XMM)
129 		return (EINVAL);
130 	else if (mcp->mc_ownedfp == _MC_FPOWNED_NONE) {
131 		/* We don't care what state is left in the FPU or PCB. */
132 		fpstate_drop(td);
133 		error = 0;
134 	} else if (mcp->mc_ownedfp == _MC_FPOWNED_FPU ||
135 	    mcp->mc_ownedfp == _MC_FPOWNED_PCB) {
136 		error = fpusetregs(td, (struct savefpu *)&mcp->mc_fpstate,
137 		    xfpustate, xfpustate_len);
138 	} else
139 		return (EINVAL);
140 	return (error);
141 }
142 
143 /*
144  * Get machine context.
145  */
146 static int
147 ia32_get_mcontext(struct thread *td, struct ia32_mcontext *mcp, int flags)
148 {
149 	struct pcb *pcb;
150 	struct trapframe *tp;
151 
152 	pcb = td->td_pcb;
153 	tp = td->td_frame;
154 
155 	PROC_LOCK(curthread->td_proc);
156 	mcp->mc_onstack = sigonstack(tp->tf_rsp);
157 	PROC_UNLOCK(curthread->td_proc);
158 	/* Entry into kernel always sets TF_HASSEGS */
159 	mcp->mc_gs = tp->tf_gs;
160 	mcp->mc_fs = tp->tf_fs;
161 	mcp->mc_es = tp->tf_es;
162 	mcp->mc_ds = tp->tf_ds;
163 	mcp->mc_edi = tp->tf_rdi;
164 	mcp->mc_esi = tp->tf_rsi;
165 	mcp->mc_ebp = tp->tf_rbp;
166 	mcp->mc_isp = tp->tf_rsp;
167 	mcp->mc_eflags = tp->tf_rflags;
168 	if (flags & GET_MC_CLEAR_RET) {
169 		mcp->mc_eax = 0;
170 		mcp->mc_edx = 0;
171 		mcp->mc_eflags &= ~PSL_C;
172 	} else {
173 		mcp->mc_eax = tp->tf_rax;
174 		mcp->mc_edx = tp->tf_rdx;
175 	}
176 	mcp->mc_ebx = tp->tf_rbx;
177 	mcp->mc_ecx = tp->tf_rcx;
178 	mcp->mc_eip = tp->tf_rip;
179 	mcp->mc_cs = tp->tf_cs;
180 	mcp->mc_esp = tp->tf_rsp;
181 	mcp->mc_ss = tp->tf_ss;
182 	mcp->mc_len = sizeof(*mcp);
183 	mcp->mc_flags = tp->tf_flags;
184 	ia32_get_fpcontext(td, mcp, NULL, 0);
185 	mcp->mc_fsbase = pcb->pcb_fsbase;
186 	mcp->mc_gsbase = pcb->pcb_gsbase;
187 	mcp->mc_xfpustate = 0;
188 	mcp->mc_xfpustate_len = 0;
189 	bzero(mcp->mc_spare2, sizeof(mcp->mc_spare2));
190 	return (0);
191 }
192 
193 /*
194  * Set machine context.
195  *
196  * However, we don't set any but the user modifiable flags, and we won't
197  * touch the cs selector.
198  */
199 static int
200 ia32_set_mcontext(struct thread *td, struct ia32_mcontext *mcp)
201 {
202 	struct trapframe *tp;
203 	char *xfpustate;
204 	long rflags;
205 	int ret;
206 
207 	tp = td->td_frame;
208 	if (mcp->mc_len != sizeof(*mcp))
209 		return (EINVAL);
210 	rflags = (mcp->mc_eflags & PSL_USERCHANGE) |
211 	    (tp->tf_rflags & ~PSL_USERCHANGE);
212 	if (mcp->mc_flags & _MC_IA32_HASFPXSTATE) {
213 		if (mcp->mc_xfpustate_len > cpu_max_ext_state_size -
214 		    sizeof(struct savefpu))
215 			return (EINVAL);
216 		xfpustate = __builtin_alloca(mcp->mc_xfpustate_len);
217 		ret = copyin(PTRIN(mcp->mc_xfpustate), xfpustate,
218 		    mcp->mc_xfpustate_len);
219 		if (ret != 0)
220 			return (ret);
221 	} else
222 		xfpustate = NULL;
223 	ret = ia32_set_fpcontext(td, mcp, xfpustate, mcp->mc_xfpustate_len);
224 	if (ret != 0)
225 		return (ret);
226 	tp->tf_gs = mcp->mc_gs;
227 	tp->tf_fs = mcp->mc_fs;
228 	tp->tf_es = mcp->mc_es;
229 	tp->tf_ds = mcp->mc_ds;
230 	tp->tf_flags = TF_HASSEGS;
231 	tp->tf_rdi = mcp->mc_edi;
232 	tp->tf_rsi = mcp->mc_esi;
233 	tp->tf_rbp = mcp->mc_ebp;
234 	tp->tf_rbx = mcp->mc_ebx;
235 	tp->tf_rdx = mcp->mc_edx;
236 	tp->tf_rcx = mcp->mc_ecx;
237 	tp->tf_rax = mcp->mc_eax;
238 	/* trapno, err */
239 	tp->tf_rip = mcp->mc_eip;
240 	tp->tf_rflags = rflags;
241 	tp->tf_rsp = mcp->mc_esp;
242 	tp->tf_ss = mcp->mc_ss;
243 	set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
244 	return (0);
245 }
246 
247 /*
248  * The first two fields of a ucontext_t are the signal mask and
249  * the machine context.  The next field is uc_link; we want to
250  * avoid destroying the link when copying out contexts.
251  */
252 #define	UC_COPY_SIZE	offsetof(struct ia32_ucontext, uc_link)
253 
254 int
255 freebsd32_getcontext(struct thread *td, struct freebsd32_getcontext_args *uap)
256 {
257 	struct ia32_ucontext uc;
258 	int ret;
259 
260 	if (uap->ucp == NULL)
261 		ret = EINVAL;
262 	else {
263 		bzero(&uc, sizeof(uc));
264 		ia32_get_mcontext(td, &uc.uc_mcontext, GET_MC_CLEAR_RET);
265 		PROC_LOCK(td->td_proc);
266 		uc.uc_sigmask = td->td_sigmask;
267 		PROC_UNLOCK(td->td_proc);
268 		ret = copyout(&uc, uap->ucp, UC_COPY_SIZE);
269 	}
270 	return (ret);
271 }
272 
273 int
274 freebsd32_setcontext(struct thread *td, struct freebsd32_setcontext_args *uap)
275 {
276 	struct ia32_ucontext uc;
277 	int ret;
278 
279 	if (uap->ucp == NULL)
280 		ret = EINVAL;
281 	else {
282 		ret = copyin(uap->ucp, &uc, UC_COPY_SIZE);
283 		if (ret == 0) {
284 			ret = ia32_set_mcontext(td, &uc.uc_mcontext);
285 			if (ret == 0) {
286 				kern_sigprocmask(td, SIG_SETMASK,
287 				    &uc.uc_sigmask, NULL, 0);
288 			}
289 		}
290 	}
291 	return (ret == 0 ? EJUSTRETURN : ret);
292 }
293 
294 int
295 freebsd32_swapcontext(struct thread *td, struct freebsd32_swapcontext_args *uap)
296 {
297 	struct ia32_ucontext uc;
298 	int ret;
299 
300 	if (uap->oucp == NULL || uap->ucp == NULL)
301 		ret = EINVAL;
302 	else {
303 		bzero(&uc, sizeof(uc));
304 		ia32_get_mcontext(td, &uc.uc_mcontext, GET_MC_CLEAR_RET);
305 		PROC_LOCK(td->td_proc);
306 		uc.uc_sigmask = td->td_sigmask;
307 		PROC_UNLOCK(td->td_proc);
308 		ret = copyout(&uc, uap->oucp, UC_COPY_SIZE);
309 		if (ret == 0) {
310 			ret = copyin(uap->ucp, &uc, UC_COPY_SIZE);
311 			if (ret == 0) {
312 				ret = ia32_set_mcontext(td, &uc.uc_mcontext);
313 				if (ret == 0) {
314 					kern_sigprocmask(td, SIG_SETMASK,
315 					    &uc.uc_sigmask, NULL, 0);
316 				}
317 			}
318 		}
319 	}
320 	return (ret == 0 ? EJUSTRETURN : ret);
321 }
322 
323 /*
324  * Send an interrupt to process.
325  *
326  * Stack is set up to allow sigcode stored
327  * at top to call routine, followed by kcall
328  * to sigreturn routine below.  After sigreturn
329  * resets the signal mask, the stack, and the
330  * frame pointer, it returns to the user
331  * specified pc, psl.
332  */
333 
334 #ifdef COMPAT_43
335 static void
336 ia32_osendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask)
337 {
338 	struct ia32_sigframe3 sf, *fp;
339 	struct proc *p;
340 	struct thread *td;
341 	struct sigacts *psp;
342 	struct trapframe *regs;
343 	int sig;
344 	int oonstack;
345 
346 	td = curthread;
347 	p = td->td_proc;
348 	PROC_LOCK_ASSERT(p, MA_OWNED);
349 	sig = ksi->ksi_signo;
350 	psp = p->p_sigacts;
351 	mtx_assert(&psp->ps_mtx, MA_OWNED);
352 	regs = td->td_frame;
353 	oonstack = sigonstack(regs->tf_rsp);
354 
355 	/* Allocate space for the signal handler context. */
356 	if ((td->td_pflags & TDP_ALTSTACK) && !oonstack &&
357 	    SIGISMEMBER(psp->ps_sigonstack, sig)) {
358 		fp = (struct ia32_sigframe3 *)((uintptr_t)td->td_sigstk.ss_sp +
359 		    td->td_sigstk.ss_size - sizeof(sf));
360 		td->td_sigstk.ss_flags |= SS_ONSTACK;
361 	} else
362 		fp = (struct ia32_sigframe3 *)regs->tf_rsp - 1;
363 
364 	/* Build the argument list for the signal handler. */
365 	sf.sf_signum = sig;
366 	sf.sf_scp = (register_t)&fp->sf_siginfo.si_sc;
367 	bzero(&sf.sf_siginfo, sizeof(sf.sf_siginfo));
368 	if (SIGISMEMBER(psp->ps_siginfo, sig)) {
369 		/* Signal handler installed with SA_SIGINFO. */
370 		sf.sf_arg2 = (register_t)&fp->sf_siginfo;
371 		sf.sf_siginfo.si_signo = sig;
372 		sf.sf_siginfo.si_code = ksi->ksi_code;
373 		sf.sf_ah = (uintptr_t)catcher;
374 		sf.sf_addr = 0;
375 	} else {
376 		/* Old FreeBSD-style arguments. */
377 		sf.sf_arg2 = ksi->ksi_code;
378 		sf.sf_addr = (register_t)ksi->ksi_addr;
379 		sf.sf_ah = (uintptr_t)catcher;
380 	}
381 	mtx_unlock(&psp->ps_mtx);
382 	PROC_UNLOCK(p);
383 
384 	/* Save most if not all of trap frame. */
385 	sf.sf_siginfo.si_sc.sc_eax = regs->tf_rax;
386 	sf.sf_siginfo.si_sc.sc_ebx = regs->tf_rbx;
387 	sf.sf_siginfo.si_sc.sc_ecx = regs->tf_rcx;
388 	sf.sf_siginfo.si_sc.sc_edx = regs->tf_rdx;
389 	sf.sf_siginfo.si_sc.sc_esi = regs->tf_rsi;
390 	sf.sf_siginfo.si_sc.sc_edi = regs->tf_rdi;
391 	sf.sf_siginfo.si_sc.sc_cs = regs->tf_cs;
392 	sf.sf_siginfo.si_sc.sc_ds = regs->tf_ds;
393 	sf.sf_siginfo.si_sc.sc_ss = regs->tf_ss;
394 	sf.sf_siginfo.si_sc.sc_es = regs->tf_es;
395 	sf.sf_siginfo.si_sc.sc_fs = regs->tf_fs;
396 	sf.sf_siginfo.si_sc.sc_gs = regs->tf_gs;
397 	sf.sf_siginfo.si_sc.sc_isp = regs->tf_rsp;
398 
399 	/* Build the signal context to be used by osigreturn(). */
400 	sf.sf_siginfo.si_sc.sc_onstack = (oonstack) ? 1 : 0;
401 	SIG2OSIG(*mask, sf.sf_siginfo.si_sc.sc_mask);
402 	sf.sf_siginfo.si_sc.sc_esp = regs->tf_rsp;
403 	sf.sf_siginfo.si_sc.sc_ebp = regs->tf_rbp;
404 	sf.sf_siginfo.si_sc.sc_eip = regs->tf_rip;
405 	sf.sf_siginfo.si_sc.sc_eflags = regs->tf_rflags;
406 	sf.sf_siginfo.si_sc.sc_trapno = regs->tf_trapno;
407 	sf.sf_siginfo.si_sc.sc_err = regs->tf_err;
408 
409 	/*
410 	 * Copy the sigframe out to the user's stack.
411 	 */
412 	if (copyout(&sf, fp, sizeof(*fp)) != 0) {
413 #ifdef DEBUG
414 		printf("process %ld has trashed its stack\n", (long)p->p_pid);
415 #endif
416 		PROC_LOCK(p);
417 		sigexit(td, SIGILL);
418 	}
419 
420 	regs->tf_rsp = (uintptr_t)fp;
421 	regs->tf_rip = p->p_sysent->sv_psstrings - sz_ia32_osigcode;
422 	regs->tf_rflags &= ~(PSL_T | PSL_D);
423 	regs->tf_cs = _ucode32sel;
424 	regs->tf_ds = _udatasel;
425 	regs->tf_es = _udatasel;
426 	regs->tf_fs = _udatasel;
427 	regs->tf_ss = _udatasel;
428 	set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
429 	PROC_LOCK(p);
430 	mtx_lock(&psp->ps_mtx);
431 }
432 #endif
433 
434 #ifdef COMPAT_FREEBSD4
435 static void
436 freebsd4_ia32_sendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask)
437 {
438 	struct ia32_sigframe4 sf, *sfp;
439 	struct siginfo32 siginfo;
440 	struct proc *p;
441 	struct thread *td;
442 	struct sigacts *psp;
443 	struct trapframe *regs;
444 	int oonstack;
445 	int sig;
446 
447 	td = curthread;
448 	p = td->td_proc;
449 	siginfo_to_siginfo32(&ksi->ksi_info, &siginfo);
450 
451 	PROC_LOCK_ASSERT(p, MA_OWNED);
452 	sig = siginfo.si_signo;
453 	psp = p->p_sigacts;
454 	mtx_assert(&psp->ps_mtx, MA_OWNED);
455 	regs = td->td_frame;
456 	oonstack = sigonstack(regs->tf_rsp);
457 
458 	/* Save user context. */
459 	bzero(&sf, sizeof(sf));
460 	sf.sf_uc.uc_sigmask = *mask;
461 	sf.sf_uc.uc_stack.ss_sp = (uintptr_t)td->td_sigstk.ss_sp;
462 	sf.sf_uc.uc_stack.ss_size = td->td_sigstk.ss_size;
463 	sf.sf_uc.uc_stack.ss_flags = (td->td_pflags & TDP_ALTSTACK)
464 	    ? ((oonstack) ? SS_ONSTACK : 0) : SS_DISABLE;
465 	sf.sf_uc.uc_mcontext.mc_onstack = (oonstack) ? 1 : 0;
466 	sf.sf_uc.uc_mcontext.mc_edi = regs->tf_rdi;
467 	sf.sf_uc.uc_mcontext.mc_esi = regs->tf_rsi;
468 	sf.sf_uc.uc_mcontext.mc_ebp = regs->tf_rbp;
469 	sf.sf_uc.uc_mcontext.mc_isp = regs->tf_rsp; /* XXX */
470 	sf.sf_uc.uc_mcontext.mc_ebx = regs->tf_rbx;
471 	sf.sf_uc.uc_mcontext.mc_edx = regs->tf_rdx;
472 	sf.sf_uc.uc_mcontext.mc_ecx = regs->tf_rcx;
473 	sf.sf_uc.uc_mcontext.mc_eax = regs->tf_rax;
474 	sf.sf_uc.uc_mcontext.mc_trapno = regs->tf_trapno;
475 	sf.sf_uc.uc_mcontext.mc_err = regs->tf_err;
476 	sf.sf_uc.uc_mcontext.mc_eip = regs->tf_rip;
477 	sf.sf_uc.uc_mcontext.mc_cs = regs->tf_cs;
478 	sf.sf_uc.uc_mcontext.mc_eflags = regs->tf_rflags;
479 	sf.sf_uc.uc_mcontext.mc_esp = regs->tf_rsp;
480 	sf.sf_uc.uc_mcontext.mc_ss = regs->tf_ss;
481 	sf.sf_uc.uc_mcontext.mc_ds = regs->tf_ds;
482 	sf.sf_uc.uc_mcontext.mc_es = regs->tf_es;
483 	sf.sf_uc.uc_mcontext.mc_fs = regs->tf_fs;
484 	sf.sf_uc.uc_mcontext.mc_gs = regs->tf_gs;
485 	bzero(sf.sf_uc.uc_mcontext.mc_fpregs,
486 	    sizeof(sf.sf_uc.uc_mcontext.mc_fpregs));
487 	bzero(sf.sf_uc.uc_mcontext.__spare__,
488 	    sizeof(sf.sf_uc.uc_mcontext.__spare__));
489 	bzero(sf.sf_uc.__spare__, sizeof(sf.sf_uc.__spare__));
490 
491 	/* Allocate space for the signal handler context. */
492 	if ((td->td_pflags & TDP_ALTSTACK) != 0 && !oonstack &&
493 	    SIGISMEMBER(psp->ps_sigonstack, sig)) {
494 		sfp = (struct ia32_sigframe4 *)((uintptr_t)td->td_sigstk.ss_sp +
495 		    td->td_sigstk.ss_size - sizeof(sf));
496 	} else
497 		sfp = (struct ia32_sigframe4 *)regs->tf_rsp - 1;
498 	PROC_UNLOCK(p);
499 
500 	/* Build the argument list for the signal handler. */
501 	sf.sf_signum = sig;
502 	sf.sf_ucontext = (register_t)&sfp->sf_uc;
503 	bzero(&sf.sf_si, sizeof(sf.sf_si));
504 	if (SIGISMEMBER(psp->ps_siginfo, sig)) {
505 		/* Signal handler installed with SA_SIGINFO. */
506 		sf.sf_siginfo = (u_int32_t)(uintptr_t)&sfp->sf_si;
507 		sf.sf_ah = (u_int32_t)(uintptr_t)catcher;
508 
509 		/* Fill in POSIX parts */
510 		sf.sf_si = siginfo;
511 		sf.sf_si.si_signo = sig;
512 	} else {
513 		/* Old FreeBSD-style arguments. */
514 		sf.sf_siginfo = siginfo.si_code;
515 		sf.sf_addr = (u_int32_t)siginfo.si_addr;
516 		sf.sf_ah = (u_int32_t)(uintptr_t)catcher;
517 	}
518 	mtx_unlock(&psp->ps_mtx);
519 
520 	/*
521 	 * Copy the sigframe out to the user's stack.
522 	 */
523 	if (copyout(&sf, sfp, sizeof(*sfp)) != 0) {
524 #ifdef DEBUG
525 		printf("process %ld has trashed its stack\n", (long)p->p_pid);
526 #endif
527 		PROC_LOCK(p);
528 		sigexit(td, SIGILL);
529 	}
530 
531 	regs->tf_rsp = (uintptr_t)sfp;
532 	regs->tf_rip = p->p_sysent->sv_sigcode_base + sz_ia32_sigcode -
533 	    sz_freebsd4_ia32_sigcode;
534 	regs->tf_rflags &= ~(PSL_T | PSL_D);
535 	regs->tf_cs = _ucode32sel;
536 	regs->tf_ss = _udatasel;
537 	regs->tf_ds = _udatasel;
538 	regs->tf_es = _udatasel;
539 	set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
540 	/* leave user %fs and %gs untouched */
541 	PROC_LOCK(p);
542 	mtx_lock(&psp->ps_mtx);
543 }
544 #endif	/* COMPAT_FREEBSD4 */
545 
546 void
547 ia32_sendsig(sig_t catcher, ksiginfo_t *ksi, sigset_t *mask)
548 {
549 	struct ia32_sigframe sf, *sfp;
550 	struct siginfo32 siginfo;
551 	struct proc *p;
552 	struct thread *td;
553 	struct sigacts *psp;
554 	char *sp;
555 	struct trapframe *regs;
556 	char *xfpusave;
557 	size_t xfpusave_len;
558 	int oonstack;
559 	int sig;
560 
561 	siginfo_to_siginfo32(&ksi->ksi_info, &siginfo);
562 	td = curthread;
563 	p = td->td_proc;
564 	PROC_LOCK_ASSERT(p, MA_OWNED);
565 	sig = siginfo.si_signo;
566 	psp = p->p_sigacts;
567 #ifdef COMPAT_FREEBSD4
568 	if (SIGISMEMBER(psp->ps_freebsd4, sig)) {
569 		freebsd4_ia32_sendsig(catcher, ksi, mask);
570 		return;
571 	}
572 #endif
573 #ifdef COMPAT_43
574 	if (SIGISMEMBER(psp->ps_osigset, sig)) {
575 		ia32_osendsig(catcher, ksi, mask);
576 		return;
577 	}
578 #endif
579 	mtx_assert(&psp->ps_mtx, MA_OWNED);
580 	regs = td->td_frame;
581 	oonstack = sigonstack(regs->tf_rsp);
582 
583 	if (cpu_max_ext_state_size > sizeof(struct savefpu) && use_xsave) {
584 		xfpusave_len = cpu_max_ext_state_size - sizeof(struct savefpu);
585 		xfpusave = __builtin_alloca(xfpusave_len);
586 	} else {
587 		xfpusave_len = 0;
588 		xfpusave = NULL;
589 	}
590 
591 	/* Save user context. */
592 	bzero(&sf, sizeof(sf));
593 	sf.sf_uc.uc_sigmask = *mask;
594 	sf.sf_uc.uc_stack.ss_sp = (uintptr_t)td->td_sigstk.ss_sp;
595 	sf.sf_uc.uc_stack.ss_size = td->td_sigstk.ss_size;
596 	sf.sf_uc.uc_stack.ss_flags = (td->td_pflags & TDP_ALTSTACK)
597 	    ? ((oonstack) ? SS_ONSTACK : 0) : SS_DISABLE;
598 	sf.sf_uc.uc_mcontext.mc_onstack = (oonstack) ? 1 : 0;
599 	sf.sf_uc.uc_mcontext.mc_edi = regs->tf_rdi;
600 	sf.sf_uc.uc_mcontext.mc_esi = regs->tf_rsi;
601 	sf.sf_uc.uc_mcontext.mc_ebp = regs->tf_rbp;
602 	sf.sf_uc.uc_mcontext.mc_isp = regs->tf_rsp; /* XXX */
603 	sf.sf_uc.uc_mcontext.mc_ebx = regs->tf_rbx;
604 	sf.sf_uc.uc_mcontext.mc_edx = regs->tf_rdx;
605 	sf.sf_uc.uc_mcontext.mc_ecx = regs->tf_rcx;
606 	sf.sf_uc.uc_mcontext.mc_eax = regs->tf_rax;
607 	sf.sf_uc.uc_mcontext.mc_trapno = regs->tf_trapno;
608 	sf.sf_uc.uc_mcontext.mc_err = regs->tf_err;
609 	sf.sf_uc.uc_mcontext.mc_eip = regs->tf_rip;
610 	sf.sf_uc.uc_mcontext.mc_cs = regs->tf_cs;
611 	sf.sf_uc.uc_mcontext.mc_eflags = regs->tf_rflags;
612 	sf.sf_uc.uc_mcontext.mc_esp = regs->tf_rsp;
613 	sf.sf_uc.uc_mcontext.mc_ss = regs->tf_ss;
614 	sf.sf_uc.uc_mcontext.mc_ds = regs->tf_ds;
615 	sf.sf_uc.uc_mcontext.mc_es = regs->tf_es;
616 	sf.sf_uc.uc_mcontext.mc_fs = regs->tf_fs;
617 	sf.sf_uc.uc_mcontext.mc_gs = regs->tf_gs;
618 	sf.sf_uc.uc_mcontext.mc_len = sizeof(sf.sf_uc.uc_mcontext); /* magic */
619 	ia32_get_fpcontext(td, &sf.sf_uc.uc_mcontext, xfpusave, xfpusave_len);
620 	fpstate_drop(td);
621 	sf.sf_uc.uc_mcontext.mc_fsbase = td->td_pcb->pcb_fsbase;
622 	sf.sf_uc.uc_mcontext.mc_gsbase = td->td_pcb->pcb_gsbase;
623 
624 	/* Allocate space for the signal handler context. */
625 	if ((td->td_pflags & TDP_ALTSTACK) != 0 && !oonstack &&
626 	    SIGISMEMBER(psp->ps_sigonstack, sig))
627 		sp = (char *)td->td_sigstk.ss_sp + td->td_sigstk.ss_size;
628 	else
629 		sp = (char *)regs->tf_rsp;
630 	if (xfpusave != NULL) {
631 		sp -= xfpusave_len;
632 		sp = (char *)((unsigned long)sp & ~0x3Ful);
633 		sf.sf_uc.uc_mcontext.mc_xfpustate = (register_t)sp;
634 	}
635 	sp -= sizeof(sf);
636 	/* Align to 16 bytes. */
637 	sfp = (struct ia32_sigframe *)((uintptr_t)sp & ~0xF);
638 	PROC_UNLOCK(p);
639 
640 	/* Build the argument list for the signal handler. */
641 	sf.sf_signum = sig;
642 	sf.sf_ucontext = (register_t)&sfp->sf_uc;
643 	bzero(&sf.sf_si, sizeof(sf.sf_si));
644 	if (SIGISMEMBER(psp->ps_siginfo, sig)) {
645 		/* Signal handler installed with SA_SIGINFO. */
646 		sf.sf_siginfo = (u_int32_t)(uintptr_t)&sfp->sf_si;
647 		sf.sf_ah = (u_int32_t)(uintptr_t)catcher;
648 
649 		/* Fill in POSIX parts */
650 		sf.sf_si = siginfo;
651 		sf.sf_si.si_signo = sig;
652 	} else {
653 		/* Old FreeBSD-style arguments. */
654 		sf.sf_siginfo = siginfo.si_code;
655 		sf.sf_addr = (u_int32_t)siginfo.si_addr;
656 		sf.sf_ah = (u_int32_t)(uintptr_t)catcher;
657 	}
658 	mtx_unlock(&psp->ps_mtx);
659 
660 	/*
661 	 * Copy the sigframe out to the user's stack.
662 	 */
663 	if (copyout(&sf, sfp, sizeof(*sfp)) != 0 ||
664 	    (xfpusave != NULL && copyout(xfpusave,
665 	    PTRIN(sf.sf_uc.uc_mcontext.mc_xfpustate), xfpusave_len)
666 	    != 0)) {
667 #ifdef DEBUG
668 		printf("process %ld has trashed its stack\n", (long)p->p_pid);
669 #endif
670 		PROC_LOCK(p);
671 		sigexit(td, SIGILL);
672 	}
673 
674 	regs->tf_rsp = (uintptr_t)sfp;
675 	regs->tf_rip = p->p_sysent->sv_sigcode_base;
676 	regs->tf_rflags &= ~(PSL_T | PSL_D);
677 	regs->tf_cs = _ucode32sel;
678 	regs->tf_ss = _udatasel;
679 	regs->tf_ds = _udatasel;
680 	regs->tf_es = _udatasel;
681 	set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
682 	/* XXXKIB leave user %fs and %gs untouched */
683 	PROC_LOCK(p);
684 	mtx_lock(&psp->ps_mtx);
685 }
686 
687 /*
688  * System call to cleanup state after a signal
689  * has been taken.  Reset signal mask and
690  * stack state from context left by sendsig (above).
691  * Return to previous pc and psl as specified by
692  * context left by sendsig. Check carefully to
693  * make sure that the user has not modified the
694  * state to gain improper privileges.
695  */
696 
697 #ifdef COMPAT_43
698 int
699 ofreebsd32_sigreturn(struct thread *td, struct ofreebsd32_sigreturn_args *uap)
700 {
701 	struct ia32_sigcontext3 sc, *scp;
702 	struct trapframe *regs;
703 	int eflags, error;
704 	ksiginfo_t ksi;
705 
706 	regs = td->td_frame;
707 	error = copyin(uap->sigcntxp, &sc, sizeof(sc));
708 	if (error != 0)
709 		return (error);
710 	scp = &sc;
711 	eflags = scp->sc_eflags;
712 	if (!EFL_SECURE(eflags, regs->tf_rflags)) {
713 		return (EINVAL);
714 	}
715 	if (!CS_SECURE(scp->sc_cs)) {
716 		ksiginfo_init_trap(&ksi);
717 		ksi.ksi_signo = SIGBUS;
718 		ksi.ksi_code = BUS_OBJERR;
719 		ksi.ksi_trapno = T_PROTFLT;
720 		ksi.ksi_addr = (void *)regs->tf_rip;
721 		trapsignal(td, &ksi);
722 		return (EINVAL);
723 	}
724 	regs->tf_ds = scp->sc_ds;
725 	regs->tf_es = scp->sc_es;
726 	regs->tf_fs = scp->sc_fs;
727 	regs->tf_gs = scp->sc_gs;
728 
729 	regs->tf_rax = scp->sc_eax;
730 	regs->tf_rbx = scp->sc_ebx;
731 	regs->tf_rcx = scp->sc_ecx;
732 	regs->tf_rdx = scp->sc_edx;
733 	regs->tf_rsi = scp->sc_esi;
734 	regs->tf_rdi = scp->sc_edi;
735 	regs->tf_cs = scp->sc_cs;
736 	regs->tf_ss = scp->sc_ss;
737 	regs->tf_rbp = scp->sc_ebp;
738 	regs->tf_rsp = scp->sc_esp;
739 	regs->tf_rip = scp->sc_eip;
740 	regs->tf_rflags = eflags;
741 
742 	if (scp->sc_onstack & 1)
743 		td->td_sigstk.ss_flags |= SS_ONSTACK;
744 	else
745 		td->td_sigstk.ss_flags &= ~SS_ONSTACK;
746 
747 	kern_sigprocmask(td, SIG_SETMASK, (sigset_t *)&scp->sc_mask, NULL,
748 	    SIGPROCMASK_OLD);
749 	set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
750 	return (EJUSTRETURN);
751 }
752 #endif
753 
754 #ifdef COMPAT_FREEBSD4
755 /*
756  * MPSAFE
757  */
758 int
759 freebsd4_freebsd32_sigreturn(td, uap)
760 	struct thread *td;
761 	struct freebsd4_freebsd32_sigreturn_args /* {
762 		const struct freebsd4_freebsd32_ucontext *sigcntxp;
763 	} */ *uap;
764 {
765 	struct ia32_ucontext4 uc;
766 	struct trapframe *regs;
767 	struct ia32_ucontext4 *ucp;
768 	int cs, eflags, error;
769 	ksiginfo_t ksi;
770 
771 	error = copyin(uap->sigcntxp, &uc, sizeof(uc));
772 	if (error != 0)
773 		return (error);
774 	ucp = &uc;
775 	regs = td->td_frame;
776 	eflags = ucp->uc_mcontext.mc_eflags;
777 	/*
778 	 * Don't allow users to change privileged or reserved flags.
779 	 */
780 	if (!EFL_SECURE(eflags, regs->tf_rflags)) {
781 		uprintf("pid %d (%s): freebsd4_freebsd32_sigreturn eflags = 0x%x\n",
782 		    td->td_proc->p_pid, td->td_name, eflags);
783 		return (EINVAL);
784 	}
785 
786 	/*
787 	 * Don't allow users to load a valid privileged %cs.  Let the
788 	 * hardware check for invalid selectors, excess privilege in
789 	 * other selectors, invalid %eip's and invalid %esp's.
790 	 */
791 	cs = ucp->uc_mcontext.mc_cs;
792 	if (!CS_SECURE(cs)) {
793 		uprintf("pid %d (%s): freebsd4_sigreturn cs = 0x%x\n",
794 		    td->td_proc->p_pid, td->td_name, cs);
795 		ksiginfo_init_trap(&ksi);
796 		ksi.ksi_signo = SIGBUS;
797 		ksi.ksi_code = BUS_OBJERR;
798 		ksi.ksi_trapno = T_PROTFLT;
799 		ksi.ksi_addr = (void *)regs->tf_rip;
800 		trapsignal(td, &ksi);
801 		return (EINVAL);
802 	}
803 
804 	regs->tf_rdi = ucp->uc_mcontext.mc_edi;
805 	regs->tf_rsi = ucp->uc_mcontext.mc_esi;
806 	regs->tf_rbp = ucp->uc_mcontext.mc_ebp;
807 	regs->tf_rbx = ucp->uc_mcontext.mc_ebx;
808 	regs->tf_rdx = ucp->uc_mcontext.mc_edx;
809 	regs->tf_rcx = ucp->uc_mcontext.mc_ecx;
810 	regs->tf_rax = ucp->uc_mcontext.mc_eax;
811 	regs->tf_trapno = ucp->uc_mcontext.mc_trapno;
812 	regs->tf_err = ucp->uc_mcontext.mc_err;
813 	regs->tf_rip = ucp->uc_mcontext.mc_eip;
814 	regs->tf_cs = cs;
815 	regs->tf_rflags = ucp->uc_mcontext.mc_eflags;
816 	regs->tf_rsp = ucp->uc_mcontext.mc_esp;
817 	regs->tf_ss = ucp->uc_mcontext.mc_ss;
818 	regs->tf_ds = ucp->uc_mcontext.mc_ds;
819 	regs->tf_es = ucp->uc_mcontext.mc_es;
820 	regs->tf_fs = ucp->uc_mcontext.mc_fs;
821 	regs->tf_gs = ucp->uc_mcontext.mc_gs;
822 
823 	kern_sigprocmask(td, SIG_SETMASK, &ucp->uc_sigmask, NULL, 0);
824 	set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
825 	return (EJUSTRETURN);
826 }
827 #endif	/* COMPAT_FREEBSD4 */
828 
829 /*
830  * MPSAFE
831  */
832 int
833 freebsd32_sigreturn(td, uap)
834 	struct thread *td;
835 	struct freebsd32_sigreturn_args /* {
836 		const struct freebsd32_ucontext *sigcntxp;
837 	} */ *uap;
838 {
839 	struct ia32_ucontext uc;
840 	struct trapframe *regs;
841 	struct ia32_ucontext *ucp;
842 	char *xfpustate;
843 	size_t xfpustate_len;
844 	int cs, eflags, error, ret;
845 	ksiginfo_t ksi;
846 
847 	error = copyin(uap->sigcntxp, &uc, sizeof(uc));
848 	if (error != 0)
849 		return (error);
850 	ucp = &uc;
851 	regs = td->td_frame;
852 	eflags = ucp->uc_mcontext.mc_eflags;
853 	/*
854 	 * Don't allow users to change privileged or reserved flags.
855 	 */
856 	if (!EFL_SECURE(eflags, regs->tf_rflags)) {
857 		uprintf("pid %d (%s): freebsd32_sigreturn eflags = 0x%x\n",
858 		    td->td_proc->p_pid, td->td_name, eflags);
859 		return (EINVAL);
860 	}
861 
862 	/*
863 	 * Don't allow users to load a valid privileged %cs.  Let the
864 	 * hardware check for invalid selectors, excess privilege in
865 	 * other selectors, invalid %eip's and invalid %esp's.
866 	 */
867 	cs = ucp->uc_mcontext.mc_cs;
868 	if (!CS_SECURE(cs)) {
869 		uprintf("pid %d (%s): sigreturn cs = 0x%x\n",
870 		    td->td_proc->p_pid, td->td_name, cs);
871 		ksiginfo_init_trap(&ksi);
872 		ksi.ksi_signo = SIGBUS;
873 		ksi.ksi_code = BUS_OBJERR;
874 		ksi.ksi_trapno = T_PROTFLT;
875 		ksi.ksi_addr = (void *)regs->tf_rip;
876 		trapsignal(td, &ksi);
877 		return (EINVAL);
878 	}
879 
880 	if ((ucp->uc_mcontext.mc_flags & _MC_HASFPXSTATE) != 0) {
881 		xfpustate_len = uc.uc_mcontext.mc_xfpustate_len;
882 		if (xfpustate_len > cpu_max_ext_state_size -
883 		    sizeof(struct savefpu)) {
884 			uprintf("pid %d (%s): sigreturn xfpusave_len = 0x%zx\n",
885 			    td->td_proc->p_pid, td->td_name, xfpustate_len);
886 			return (EINVAL);
887 		}
888 		xfpustate = __builtin_alloca(xfpustate_len);
889 		error = copyin(PTRIN(ucp->uc_mcontext.mc_xfpustate),
890 		    xfpustate, xfpustate_len);
891 		if (error != 0) {
892 			uprintf(
893 	"pid %d (%s): sigreturn copying xfpustate failed\n",
894 			    td->td_proc->p_pid, td->td_name);
895 			return (error);
896 		}
897 	} else {
898 		xfpustate = NULL;
899 		xfpustate_len = 0;
900 	}
901 	ret = ia32_set_fpcontext(td, &ucp->uc_mcontext, xfpustate,
902 	    xfpustate_len);
903 	if (ret != 0) {
904 		uprintf("pid %d (%s): sigreturn set_fpcontext err %d\n",
905 		    td->td_proc->p_pid, td->td_name, ret);
906 		return (ret);
907 	}
908 
909 	regs->tf_rdi = ucp->uc_mcontext.mc_edi;
910 	regs->tf_rsi = ucp->uc_mcontext.mc_esi;
911 	regs->tf_rbp = ucp->uc_mcontext.mc_ebp;
912 	regs->tf_rbx = ucp->uc_mcontext.mc_ebx;
913 	regs->tf_rdx = ucp->uc_mcontext.mc_edx;
914 	regs->tf_rcx = ucp->uc_mcontext.mc_ecx;
915 	regs->tf_rax = ucp->uc_mcontext.mc_eax;
916 	regs->tf_trapno = ucp->uc_mcontext.mc_trapno;
917 	regs->tf_err = ucp->uc_mcontext.mc_err;
918 	regs->tf_rip = ucp->uc_mcontext.mc_eip;
919 	regs->tf_cs = cs;
920 	regs->tf_rflags = ucp->uc_mcontext.mc_eflags;
921 	regs->tf_rsp = ucp->uc_mcontext.mc_esp;
922 	regs->tf_ss = ucp->uc_mcontext.mc_ss;
923 	regs->tf_ds = ucp->uc_mcontext.mc_ds;
924 	regs->tf_es = ucp->uc_mcontext.mc_es;
925 	regs->tf_fs = ucp->uc_mcontext.mc_fs;
926 	regs->tf_gs = ucp->uc_mcontext.mc_gs;
927 	regs->tf_flags = TF_HASSEGS;
928 
929 	kern_sigprocmask(td, SIG_SETMASK, &ucp->uc_sigmask, NULL, 0);
930 	set_pcb_flags(td->td_pcb, PCB_FULL_IRET);
931 	return (EJUSTRETURN);
932 }
933 
934 /*
935  * Clear registers on exec
936  */
937 void
938 ia32_setregs(struct thread *td, struct image_params *imgp, uintptr_t stack)
939 {
940 	struct trapframe *regs;
941 	struct pcb *pcb;
942 	register_t saved_rflags;
943 
944 	regs = td->td_frame;
945 	pcb = td->td_pcb;
946 
947 	if (td->td_proc->p_md.md_ldt != NULL)
948 		user_ldt_free(td);
949 #ifdef COMPAT_43
950 	setup_lcall_gate();
951 #endif
952 
953 	pcb->pcb_fsbase = 0;
954 	pcb->pcb_gsbase = 0;
955 	pcb->pcb_initial_fpucw = __INITIAL_FPUCW_I386__;
956 
957 	saved_rflags = regs->tf_rflags & PSL_T;
958 	bzero((char *)regs, sizeof(struct trapframe));
959 	regs->tf_rip = imgp->entry_addr;
960 	regs->tf_rsp = stack;
961 	regs->tf_rflags = PSL_USER | saved_rflags;
962 	regs->tf_ss = _udatasel;
963 	regs->tf_cs = _ucode32sel;
964 	regs->tf_rbx = (register_t)imgp->ps_strings;
965 	regs->tf_ds = _udatasel;
966 	regs->tf_es = _udatasel;
967 	regs->tf_fs = _ufssel;
968 	regs->tf_gs = _ugssel;
969 	regs->tf_flags = TF_HASSEGS;
970 
971 	fpstate_drop(td);
972 
973 	/* Return via doreti so that we can change to a different %cs */
974 	set_pcb_flags(pcb, PCB_32BIT | PCB_FULL_IRET);
975 }
976