kernel: SIGINT user-handler delivery + sigreturn (PR 3/3)

[bboe]

Summary

Final PR in the SIGINT-handling stack: completes signal(SIGINT, handler) so user programs can register a ring-3 handler that's invoked on Ctrl+C, with a clean return path back to the interrupted instruction.

Stacks on:

• PR kernel: SIGINT default-kill on Ctrl+C (PR 1/3) #332 — default-kill on Ctrl+C (SIG_DFL, base main)
• PR kernel+libc: SIGINT SIG_IGN opt-out (PR 2/3) #333 — SIG_IGN opt-out + libc signal() shim (base sigint-1-default-kill)

What user-handler delivery means

When a user-virt address is registered via SYS_SYS_SIGNAL and Ctrl+C arrives at the IRET-to-user epilogue:

1. signal_dispatch_user builds a 48-byte sigcontext on the user stack capturing the interrupted EIP / EFLAGS / ESP / pushad slots (minus the pushad-ESP slot, which is the kernel ESP and meaningless).
2. The kernel rewrites the IRET frame so it enters the user handler at ring 3, with ESP pointing at the sigcontext.
3. in_sigint_handler is set + pending_sigint cleared so a Ctrl+C burst doesn't re-enter the handler.
4. The handler runs as a normal C function and ends with ret, popping the sigcontext's first dword (a vDSO trampoline address at user-virt 0x10450) into EIP.
5. The 7-byte vDSO trampoline executes mov ah, SYS_SYS_SIGRETURN; int 0x30.
6. signal_resume_after_handler validates the sigcontext, restores registers, sanitizes EFLAGS, and iretds back to the original interrupted EIP.

Security note: EFLAGS sanitization

The saved EFLAGS in the sigcontext lives on the user stack and is fully writable from ring 3. Without sanitization, a malicious handler could forge a sigcontext with IOPL=3 and gain ring-3 in/out, or set VM=1 to enter Virtual-8086 mode, etc.

SYS_SYS_SIGRETURN therefore masks the saved EFLAGS with USER_EFLAGS_MASK = 0xDD5 (whitelisting only CF/PF/AF/ZF/SF/TF/DF/OF) and OR's EFLAGS_IF_BIT = 0x200 so IF is always re-enabled. IOPL (bits 12-13), NT (14), RF (16), VM (17), AC (18), and VIF/VIP/ID (19-21) are all dropped. Mirrors Linux's restore_sigcontext FIX_EFLAGS rationale.

Macro restructure

SIGINT_TAIL_CHECK now runs before popad, so the pushad slots on the kernel stack are still readable when signal_dispatch_user captures them into the sigcontext. The CS check moves from [esp + 4] to [esp + 36] (4 + pushad's 32 bytes), and the macro itself owns the popad in the no-dispatch path.

Every IRQ + syscall handler that uses the macro loses its explicit popad — the macro now owns it. The IRQ 6 (FDC) handler is also upgraded from push eax / pop eax to pushad / popad so its dispatch frame matches the new macro contract.

Test plan

• ./make_os.sh clean
• ./tests/test_programs.py 30/30 (now includes sigint_test)
• ./tests/test_asm.py 20/20
• ./tests/test_bboefs.py 6/6
• tests/programs/sigint_test.c exercises register, handler runs, sigreturn restores state