1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright 2015 Joyent, Inc.
24 */
25 /*
26 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
27 * Use is subject to license terms.
28 */
29
30 /* Copyright (c) 1990, 1991 UNIX System Laboratories, Inc. */
31 /* Copyright (c) 1984, 1986, 1987, 1988, 1989, 1990 AT&T */
32 /* All Rights Reserved */
33
34 #include <sys/types.h>
35 #include <sys/param.h>
36 #include <sys/sysmacros.h>
37 #include <sys/signal.h>
38 #include <sys/systm.h>
39 #include <sys/user.h>
40 #include <sys/mman.h>
41 #include <sys/class.h>
42 #include <sys/proc.h>
43 #include <sys/procfs.h>
44 #include <sys/buf.h>
45 #include <sys/kmem.h>
46 #include <sys/cred.h>
47 #include <sys/archsystm.h>
48 #include <sys/vmparam.h>
49 #include <sys/prsystm.h>
50 #include <sys/reboot.h>
51 #include <sys/uadmin.h>
52 #include <sys/vfs.h>
53 #include <sys/vnode.h>
54 #include <sys/file.h>
55 #include <sys/session.h>
56 #include <sys/ucontext.h>
57 #include <sys/dnlc.h>
58 #include <sys/var.h>
59 #include <sys/cmn_err.h>
60 #include <sys/debugreg.h>
61 #include <sys/thread.h>
62 #include <sys/vtrace.h>
63 #include <sys/consdev.h>
64 #include <sys/psw.h>
65 #include <sys/regset.h>
66
67 #include <sys/privregs.h>
68
69 #include <sys/stack.h>
70 #include <sys/swap.h>
71 #include <vm/hat.h>
72 #include <vm/anon.h>
73 #include <vm/as.h>
74 #include <vm/page.h>
75 #include <vm/seg.h>
76 #include <vm/seg_kmem.h>
77 #include <vm/seg_map.h>
78 #include <vm/seg_vn.h>
79 #include <sys/exec.h>
80 #include <sys/acct.h>
81 #include <sys/core.h>
82 #include <sys/corectl.h>
83 #include <sys/modctl.h>
84 #include <sys/tuneable.h>
85 #include <c2/audit.h>
86 #include <sys/bootconf.h>
87 #include <sys/dumphdr.h>
88 #include <sys/promif.h>
89 #include <sys/systeminfo.h>
90 #include <sys/kdi.h>
91 #include <sys/contract_impl.h>
92 #include <sys/x86_archext.h>
93 #include <sys/brand.h>
94 #include <sys/sdt.h>
95
96 /*
97 * Construct the execution environment for the user's signal
98 * handler and arrange for control to be given to it on return
99 * to userland. The library code now calls setcontext() to
100 * clean up after the signal handler, so sigret() is no longer
101 * needed.
102 *
103 * (The various 'volatile' declarations are need to ensure that values
104 * are correct on the error return from on_fault().)
105 */
106
107
108 /*
109 * An amd64 signal frame looks like this on the stack:
110 *
111 * old %rsp:
112 * <128 bytes of untouched stack space>
113 * <a siginfo_t [optional]>
114 * <a ucontext_t>
115 * <siginfo_t *>
116 * <signal number>
117 * new %rsp: <return address (deliberately invalid)>
118 *
119 * The signal number and siginfo_t pointer are only pushed onto the stack in
120 * order to allow stack backtraces. The actual signal handling code expects the
121 * arguments in registers.
122 */
123
124 struct sigframe {
125 caddr_t retaddr;
126 long signo;
127 siginfo_t *sip;
128 };
129
130 int
131 sendsig(int sig, k_siginfo_t *sip, void (*hdlr)())
132 {
133 volatile int minstacksz;
134 int newstack;
135 label_t ljb;
136 volatile caddr_t sp;
137 caddr_t fp;
138 volatile struct regs *rp;
139 volatile greg_t upc;
140 volatile proc_t *p = ttoproc(curthread);
141 struct as *as = p->p_as;
142 klwp_t *lwp = ttolwp(curthread);
143 ucontext_t *volatile tuc = NULL;
144 ucontext_t *uc;
145 siginfo_t *sip_addr;
146 volatile int watched;
147
148 /*
149 * This routine is utterly dependent upon STACK_ALIGN being
150 * 16 and STACK_ENTRY_ALIGN being 8. Let's just acknowledge
151 * that and require it.
152 */
153
154 #if STACK_ALIGN != 16 || STACK_ENTRY_ALIGN != 8
155 #error "sendsig() amd64 did not find the expected stack alignments"
156 #endif
157
158 rp = lwptoregs(lwp);
159 upc = rp->r_pc;
160
161 /*
162 * Since we're setting up to run the signal handler we have to
163 * arrange that the stack at entry to the handler is (only)
164 * STACK_ENTRY_ALIGN (i.e. 8) byte aligned so that when the handler
165 * executes its push of %rbp, the stack realigns to STACK_ALIGN
166 * (i.e. 16) correctly.
167 *
168 * The new sp will point to the sigframe and the ucontext_t. The
169 * above means that sp (and thus sigframe) will be 8-byte aligned,
170 * but not 16-byte aligned. ucontext_t, however, contains %xmm regs
171 * which must be 16-byte aligned. Because of this, for correct
172 * alignment, sigframe must be a multiple of 8-bytes in length, but
173 * not 16-bytes. This will place ucontext_t at a nice 16-byte boundary.
174 */
175
176 /* LINTED: logical expression always true: op "||" */
177 ASSERT((sizeof (struct sigframe) % 16) == 8);
178
179 minstacksz = sizeof (struct sigframe) + SA(sizeof (*uc));
180 if (sip != NULL)
181 minstacksz += SA(sizeof (siginfo_t));
182 ASSERT((minstacksz & (STACK_ENTRY_ALIGN - 1ul)) == 0);
183
184 /*
185 * Figure out whether we will be handling this signal on
186 * an alternate stack specified by the user. Then allocate
187 * and validate the stack requirements for the signal handler
188 * context. on_fault will catch any faults.
189 */
190 newstack = sigismember(&PTOU(curproc)->u_sigonstack, sig) &&
191 !(lwp->lwp_sigaltstack.ss_flags & (SS_ONSTACK|SS_DISABLE));
192
193 /*
194 * If this is a branded process, the brand may provide an alternate
195 * stack pointer for signal delivery:
196 */
197 if (PROC_IS_BRANDED(p) && BROP(p)->b_sendsig_stack != NULL) {
198 /*
199 * Use the stack pointer value provided by the brand,
200 * accounting for the 128-byte reserved region.
201 */
202 newstack = 0;
203 fp = BROP(p)->b_sendsig_stack(sig) - STACK_RESERVE;
204 } else if (newstack) {
205 fp = (caddr_t)(SA((uintptr_t)lwp->lwp_sigaltstack.ss_sp) +
206 SA(lwp->lwp_sigaltstack.ss_size) - STACK_ALIGN);
207 } else {
208 /*
209 * Drop below the 128-byte reserved region of the stack frame
210 * we're interrupting.
211 */
212 fp = (caddr_t)rp->r_sp - STACK_RESERVE;
213 }
214
215 /*
216 * Force proper stack pointer alignment, even in the face of a
217 * misaligned stack pointer from user-level before the signal.
218 */
219 fp = (caddr_t)((uintptr_t)fp & ~(STACK_ENTRY_ALIGN - 1ul));
220
221 /*
222 * Most of the time during normal execution, the stack pointer
223 * is aligned on a STACK_ALIGN (i.e. 16 byte) boundary. However,
224 * (for example) just after a call instruction (which pushes
225 * the return address), the callers stack misaligns until the
226 * 'push %rbp' happens in the callee prolog. So while we should
227 * expect the stack pointer to be always at least STACK_ENTRY_ALIGN
228 * aligned, we should -not- expect it to always be STACK_ALIGN aligned.
229 * We now adjust to ensure that the new sp is aligned to
230 * STACK_ENTRY_ALIGN but not to STACK_ALIGN.
231 */
232 sp = fp - minstacksz;
233 if (((uintptr_t)sp & (STACK_ALIGN - 1ul)) == 0) {
234 sp -= STACK_ENTRY_ALIGN;
235 minstacksz = fp - sp;
236 }
237
238 /*
239 * Now, make sure the resulting signal frame address is sane
240 */
241 if (sp >= as->a_userlimit || fp >= as->a_userlimit) {
242 #ifdef DEBUG
243 printf("sendsig: bad signal stack cmd=%s, pid=%d, sig=%d\n",
244 PTOU(p)->u_comm, p->p_pid, sig);
245 printf("sigsp = 0x%p, action = 0x%p, upc = 0x%lx\n",
246 (void *)sp, (void *)hdlr, (uintptr_t)upc);
247 printf("sp above USERLIMIT\n");
248 #endif
249 return (0);
250 }
251
252 watched = watch_disable_addr((caddr_t)sp, minstacksz, S_WRITE);
253
254 if (on_fault(&ljb))
255 goto badstack;
256
257 if (sip != NULL) {
258 zoneid_t zoneid;
259
260 fp -= SA(sizeof (siginfo_t));
261 uzero(fp, sizeof (siginfo_t));
262 if (SI_FROMUSER(sip) &&
263 (zoneid = p->p_zone->zone_id) != GLOBAL_ZONEID &&
264 zoneid != sip->si_zoneid) {
265 k_siginfo_t sani_sip = *sip;
266
267 sani_sip.si_pid = p->p_zone->zone_zsched->p_pid;
268 sani_sip.si_uid = 0;
269 sani_sip.si_ctid = -1;
270 sani_sip.si_zoneid = zoneid;
271 copyout_noerr(&sani_sip, fp, sizeof (sani_sip));
272 } else
273 copyout_noerr(sip, fp, sizeof (*sip));
274 sip_addr = (siginfo_t *)fp;
275
276 if (sig == SIGPROF &&
277 curthread->t_rprof != NULL &&
278 curthread->t_rprof->rp_anystate) {
279 /*
280 * We stand on our head to deal with
281 * the real time profiling signal.
282 * Fill in the stuff that doesn't fit
283 * in a normal k_siginfo structure.
284 */
285 int i = sip->si_nsysarg;
286
287 while (--i >= 0)
288 sulword_noerr(
289 (ulong_t *)&(sip_addr->si_sysarg[i]),
290 (ulong_t)lwp->lwp_arg[i]);
291 copyout_noerr(curthread->t_rprof->rp_state,
292 sip_addr->si_mstate,
293 sizeof (curthread->t_rprof->rp_state));
294 }
295 } else
296 sip_addr = NULL;
297
298 /*
299 * save the current context on the user stack directly after the
300 * sigframe. Since sigframe is 8-byte-but-not-16-byte aligned,
301 * and since sizeof (struct sigframe) is 24, this guarantees
302 * 16-byte alignment for ucontext_t and its %xmm registers.
303 */
304 uc = (ucontext_t *)(sp + sizeof (struct sigframe));
305 tuc = kmem_alloc(sizeof (*tuc), KM_SLEEP);
306 no_fault();
307 savecontext(tuc, &lwp->lwp_sigoldmask);
308 if (on_fault(&ljb))
309 goto badstack;
310 copyout_noerr(tuc, uc, sizeof (*tuc));
311 kmem_free(tuc, sizeof (*tuc));
312 tuc = NULL;
313
314 DTRACE_PROBE3(oldcontext__set, klwp_t *, lwp,
315 uintptr_t, lwp->lwp_oldcontext, uintptr_t, (uintptr_t)uc);
316 lwp->lwp_oldcontext = (uintptr_t)uc;
317
318 if (newstack) {
319 lwp->lwp_sigaltstack.ss_flags |= SS_ONSTACK;
320 if (lwp->lwp_ustack)
321 copyout_noerr(&lwp->lwp_sigaltstack,
322 (stack_t *)lwp->lwp_ustack, sizeof (stack_t));
323 }
324
325 /*
326 * Set up signal handler return and stack linkage
327 */
328 {
329 struct sigframe frame;
330
331 /*
332 * ensure we never return "normally"
333 */
334 frame.retaddr = (caddr_t)(uintptr_t)-1L;
335 frame.signo = sig;
336 frame.sip = sip_addr;
337 copyout_noerr(&frame, sp, sizeof (frame));
338 }
339
340 no_fault();
341 if (watched)
342 watch_enable_addr((caddr_t)sp, minstacksz, S_WRITE);
343
344 /*
345 * Set up user registers for execution of signal handler.
346 */
347 rp->r_sp = (greg_t)sp;
348 rp->r_pc = (greg_t)hdlr;
349 rp->r_ps = PSL_USER | (rp->r_ps & PS_IOPL);
350
351 rp->r_rdi = sig;
352 rp->r_rsi = (uintptr_t)sip_addr;
353 rp->r_rdx = (uintptr_t)uc;
354
355 if ((rp->r_cs & 0xffff) != UCS_SEL ||
356 (rp->r_ss & 0xffff) != UDS_SEL) {
357 /*
358 * Try our best to deliver the signal.
359 */
360 rp->r_cs = UCS_SEL;
361 rp->r_ss = UDS_SEL;
362 }
363
364 /*
365 * Allow the brand to perform additional book-keeping once the signal
366 * handling frame has been fully assembled:
367 */
368 if (PROC_IS_BRANDED(p) && BROP(p)->b_sendsig != NULL) {
369 BROP(p)->b_sendsig(sig);
370 }
371
372 /*
373 * Don't set lwp_eosys here. sendsig() is called via psig() after
374 * lwp_eosys is handled, so setting it here would affect the next
375 * system call.
376 */
377 return (1);
378
379 badstack:
380 no_fault();
381 if (watched)
382 watch_enable_addr((caddr_t)sp, minstacksz, S_WRITE);
383 if (tuc)
384 kmem_free(tuc, sizeof (*tuc));
385 #ifdef DEBUG
386 printf("sendsig: bad signal stack cmd=%s, pid=%d, sig=%d\n",
387 PTOU(p)->u_comm, p->p_pid, sig);
388 printf("on fault, sigsp = 0x%p, action = 0x%p, upc = 0x%lx\n",
389 (void *)sp, (void *)hdlr, (uintptr_t)upc);
390 #endif
391 return (0);
392 }
393
394 #ifdef _SYSCALL32_IMPL
395
396 /*
397 * An i386 SVR4/ABI signal frame looks like this on the stack:
398 *
399 * old %esp:
400 * <a siginfo32_t [optional]>
401 * <a ucontext32_t>
402 * <pointer to that ucontext32_t>
403 * <pointer to that siginfo32_t>
404 * <signo>
405 * new %esp: <return address (deliberately invalid)>
406 */
407 struct sigframe32 {
408 caddr32_t retaddr;
409 uint32_t signo;
410 caddr32_t sip;
411 caddr32_t ucp;
412 };
413
414 int
415 sendsig32(int sig, k_siginfo_t *sip, void (*hdlr)())
416 {
417 volatile int minstacksz;
418 int newstack;
419 label_t ljb;
420 volatile caddr_t sp;
421 caddr_t fp;
422 volatile struct regs *rp;
423 volatile greg_t upc;
424 volatile proc_t *p = ttoproc(curthread);
425 klwp_t *lwp = ttolwp(curthread);
426 ucontext32_t *volatile tuc = NULL;
427 ucontext32_t *uc;
428 siginfo32_t *sip_addr;
429 volatile int watched;
430
431 rp = lwptoregs(lwp);
432 upc = rp->r_pc;
433
434 minstacksz = SA32(sizeof (struct sigframe32)) + SA32(sizeof (*uc));
435 if (sip != NULL)
436 minstacksz += SA32(sizeof (siginfo32_t));
437 ASSERT((minstacksz & (STACK_ALIGN32 - 1)) == 0);
438
439 /*
440 * Figure out whether we will be handling this signal on
441 * an alternate stack specified by the user. Then allocate
442 * and validate the stack requirements for the signal handler
443 * context. on_fault will catch any faults.
444 */
445 newstack = sigismember(&PTOU(curproc)->u_sigonstack, sig) &&
446 !(lwp->lwp_sigaltstack.ss_flags & (SS_ONSTACK|SS_DISABLE));
447
448 /*
449 * If this is a branded process, the brand may provide an alternate
450 * stack pointer for signal delivery:
451 */
452 if (PROC_IS_BRANDED(p) && BROP(p)->b_sendsig_stack != NULL) {
453 /*
454 * Use the stack pointer value provided by the brand:
455 */
456 newstack = 0;
457 fp = BROP(p)->b_sendsig_stack(sig);
458 } else if (newstack) {
459 fp = (caddr_t)(SA32((uintptr_t)lwp->lwp_sigaltstack.ss_sp) +
460 SA32(lwp->lwp_sigaltstack.ss_size) - STACK_ALIGN32);
461 } else if ((rp->r_ss & 0xffff) != UDS_SEL) {
462 user_desc_t *ldt;
463 /*
464 * If the stack segment selector is -not- pointing at
465 * the UDS_SEL descriptor and we have an LDT entry for
466 * it instead, add the base address to find the effective va.
467 */
468 if ((ldt = p->p_ldt) != NULL)
469 fp = (caddr_t)rp->r_sp +
470 USEGD_GETBASE(&ldt[SELTOIDX(rp->r_ss)]);
471 else
472 fp = (caddr_t)rp->r_sp;
473 } else {
474 fp = (caddr_t)rp->r_sp;
475 }
476
477 /*
478 * Force proper stack pointer alignment, even in the face of a
479 * misaligned stack pointer from user-level before the signal.
480 * Don't use the SA32() macro because that rounds up, not down.
481 */
482 fp = (caddr_t)((uintptr_t)fp & ~(STACK_ALIGN32 - 1));
483 sp = fp - minstacksz;
484
485 /*
486 * Make sure lwp hasn't trashed its stack
487 */
488 if (sp >= (caddr_t)(uintptr_t)USERLIMIT32 ||
489 fp >= (caddr_t)(uintptr_t)USERLIMIT32) {
490 #ifdef DEBUG
491 printf("sendsig32: bad signal stack cmd=%s, pid=%d, sig=%d\n",
492 PTOU(p)->u_comm, p->p_pid, sig);
493 printf("sigsp = 0x%p, action = 0x%p, upc = 0x%lx\n",
494 (void *)sp, (void *)hdlr, (uintptr_t)upc);
495 printf("sp above USERLIMIT\n");
496 #endif
497 return (0);
498 }
499
500 watched = watch_disable_addr((caddr_t)sp, minstacksz, S_WRITE);
501
502 if (on_fault(&ljb))
503 goto badstack;
504
505 if (sip != NULL) {
506 siginfo32_t si32;
507 zoneid_t zoneid;
508
509 siginfo_kto32(sip, &si32);
510 if (SI_FROMUSER(sip) &&
511 (zoneid = p->p_zone->zone_id) != GLOBAL_ZONEID &&
512 zoneid != sip->si_zoneid) {
513 si32.si_pid = p->p_zone->zone_zsched->p_pid;
514 si32.si_uid = 0;
515 si32.si_ctid = -1;
516 si32.si_zoneid = zoneid;
517 }
518 fp -= SA32(sizeof (si32));
519 uzero(fp, sizeof (si32));
520 copyout_noerr(&si32, fp, sizeof (si32));
521 sip_addr = (siginfo32_t *)fp;
522
523 if (sig == SIGPROF &&
524 curthread->t_rprof != NULL &&
525 curthread->t_rprof->rp_anystate) {
526 /*
527 * We stand on our head to deal with
528 * the real-time profiling signal.
529 * Fill in the stuff that doesn't fit
530 * in a normal k_siginfo structure.
531 */
532 int i = sip->si_nsysarg;
533
534 while (--i >= 0)
535 suword32_noerr(&(sip_addr->si_sysarg[i]),
536 (uint32_t)lwp->lwp_arg[i]);
537 copyout_noerr(curthread->t_rprof->rp_state,
538 sip_addr->si_mstate,
539 sizeof (curthread->t_rprof->rp_state));
540 }
541 } else
542 sip_addr = NULL;
543
544 /* save the current context on the user stack */
545 fp -= SA32(sizeof (*tuc));
546 uc = (ucontext32_t *)fp;
547 tuc = kmem_alloc(sizeof (*tuc), KM_SLEEP);
548 no_fault();
549 savecontext32(tuc, &lwp->lwp_sigoldmask);
550 if (on_fault(&ljb))
551 goto badstack;
552 copyout_noerr(tuc, uc, sizeof (*tuc));
553 kmem_free(tuc, sizeof (*tuc));
554 tuc = NULL;
555
556 DTRACE_PROBE3(oldcontext__set, klwp_t *, lwp,
557 uintptr_t, lwp->lwp_oldcontext, uintptr_t, (uintptr_t)uc);
558 lwp->lwp_oldcontext = (uintptr_t)uc;
559
560 if (newstack) {
561 lwp->lwp_sigaltstack.ss_flags |= SS_ONSTACK;
562 if (lwp->lwp_ustack) {
563 stack32_t stk32;
564
565 stk32.ss_sp = (caddr32_t)(uintptr_t)
566 lwp->lwp_sigaltstack.ss_sp;
567 stk32.ss_size = (size32_t)
568 lwp->lwp_sigaltstack.ss_size;
569 stk32.ss_flags = (int32_t)
570 lwp->lwp_sigaltstack.ss_flags;
571 copyout_noerr(&stk32,
572 (stack32_t *)lwp->lwp_ustack, sizeof (stk32));
573 }
574 }
575
576 /*
577 * Set up signal handler arguments
578 */
579 {
580 struct sigframe32 frame32;
581
582 frame32.sip = (caddr32_t)(uintptr_t)sip_addr;
583 frame32.ucp = (caddr32_t)(uintptr_t)uc;
584 frame32.signo = sig;
585 frame32.retaddr = 0xffffffff; /* never return! */
586 copyout_noerr(&frame32, sp, sizeof (frame32));
587 }
588
589 no_fault();
590 if (watched)
591 watch_enable_addr((caddr_t)sp, minstacksz, S_WRITE);
592
593 rp->r_sp = (greg_t)(uintptr_t)sp;
594 rp->r_pc = (greg_t)(uintptr_t)hdlr;
595 rp->r_ps = PSL_USER | (rp->r_ps & PS_IOPL);
596
597 if ((rp->r_cs & 0xffff) != U32CS_SEL ||
598 (rp->r_ss & 0xffff) != UDS_SEL) {
599 /*
600 * Try our best to deliver the signal.
601 */
602 rp->r_cs = U32CS_SEL;
603 rp->r_ss = UDS_SEL;
604 }
605
606 /*
607 * Allow the brand to perform additional book-keeping once the signal
608 * handling frame has been fully assembled:
609 */
610 if (PROC_IS_BRANDED(p) && BROP(p)->b_sendsig != NULL) {
611 BROP(p)->b_sendsig(sig);
612 }
613
614 /*
615 * Don't set lwp_eosys here. sendsig() is called via psig() after
616 * lwp_eosys is handled, so setting it here would affect the next
617 * system call.
618 */
619 return (1);
620
621 badstack:
622 no_fault();
623 if (watched)
624 watch_enable_addr((caddr_t)sp, minstacksz, S_WRITE);
625 if (tuc)
626 kmem_free(tuc, sizeof (*tuc));
627 #ifdef DEBUG
628 printf("sendsig32: bad signal stack cmd=%s pid=%d, sig=%d\n",
629 PTOU(p)->u_comm, p->p_pid, sig);
630 printf("on fault, sigsp = 0x%p, action = 0x%p, upc = 0x%lx\n",
631 (void *)sp, (void *)hdlr, (uintptr_t)upc);
632 #endif
633 return (0);
634 }
635
636 #endif /* _SYSCALL32_IMPL */