CVS log for src/sys/arch/amd64/include/param.h

Up to [cvs.NetBSD.org] / src / sys / arch / amd64 / include

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

increase UPAGES (used for lwp kernel stack) for SVS so the the
amount of actually usable kernel stack is the same for SVS and
non-SVS kernels (currently 12 KiB)

discussed with maxv@, part of investigation for PR kern/S55402

Mostly merge changes from HEAD upto 20200411

Add a redzone between the pcb and the stack. Sent to port-amd64@.

Sync with head.

Retire KLEAK.

KLEAK was a nice feature and served its purpose; it allowed us to detect
dozens of info leaks on the kernel->userland boundary, and thanks to it we
tackled a good part of the infoleak problem 1.5 years ago.

Nowadays however, we have kMSan, which can detect uninitialized memory in
the kernel. kMSan supersedes KLEAK: it can detect what KLEAK was able to
detect, but in addition, (1) it operates in all of the kernel and not just
the kernel->userland boundary, (2) it requires no user interaction, and (3)
it is deterministic and not statistical.

That makes kMSan the feature of choice to detect info leaks nowadays;
people interested in detecting info leaks should boot a kMSan kernel and
just wait for the magic to happen.

KLEAK was a good ride, and a fun project, but now is time for it to go.

Discussed with several people, including Thomas Barabosch.

Sync with head.

Move the UBC defaults into vmparam.h

Sync with head.

Bump UBC_WINSHIFT & UBC_NWINS to more reasonable values for amd64.

Pull up following revision(s) (requested by riastradh in ticket #505):

	common/lib/libc/hash/murmurhash/murmurhash.c: revision 1.7
	common/lib/libc/hash/murmurhash/murmurhash.c: revision 1.8
	sys/sys/param.h: revision 1.610
	sys/arch/amd64/include/param.h: revision 1.31
	sys/arch/i386/include/param.h: revision 1.85

New macro ALIGNED_POINTER_LOAD.

To be used with ALIGNED_POINTER(p,t) instead of writing *(const t *)p
directly.  This way, on machines without strict alignment, we can use
memcpy to pacify sanitizers, while getting the same compiled code in
the end with a single (say) MOV instruction.

Fix byte order bug in murmurhash and pacify sanitizers.
add now required includes for memcpy prototypes analogue to other hash functions
(fix the build)

Add support for Kernel Memory Sanitizer (kMSan). It detects uninitialized
memory used by the kernel at run time, and just like kASan and kCSan, it
is an excellent feature. It has already detected 38 uninitialized variables
in the kernel during my testing, which I have since discreetly fixed.

We use two shadows:
 - "shad", to track uninitialized memory with a bit granularity (1:1).
   Each bit set to 1 in the shad corresponds to one uninitialized bit of
   real kernel memory.
 - "orig", to track the origin of the memory with a 4-byte granularity
   (1:1). Each uint32_t cell in the orig indicates the origin of the
   associated uint32_t of real kernel memory.

The memory consumption of these shadows is consequent, so at least 4GB of
RAM is recommended to run kMSan.

The compiler inserts calls to specific __msan_* functions on each memory
access, to manage both the shad and the orig and detect uninitialized
memory accesses that change the execution flow (like an "if" on an
uninitialized variable).

We mark as uninit several types of memory buffers (stack, pools, kmem,
malloc, uvm_km), and check each buffer passed to copyout, copyoutstr,
bwrite, if_transmit_lock and DMA operations, to detect uninitialized memory
that leaves the system. This allows us to detect kernel info leaks in a way
that is more efficient and also more user-friendly than KLEAK.

Contrary to kASan, kMSan requires comprehensive coverage, ie we cannot
tolerate having one non-instrumented function, because this could cause
false positives. kMSan cannot instrument ASM functions, so I converted
most of them to __asm__ inlines, which kMSan is able to instrument. Those
that remain receive special treatment.

Contrary to kASan again, kMSan uses a TLS, so we must context-switch this
TLS during interrupts. We use different contexts depending on the interrupt
level.

The orig tracks precisely the origin of a buffer. We use a special encoding
for the orig values, and pack together in each uint32_t cell of the orig:
 - a code designating the type of memory (Stack, Pool, etc), and
 - a compressed pointer, which points either (1) to a string containing
   the name of the variable associated with the cell, or (2) to an area
   in the kernel .text section which we resolve to a symbol name + offset.

This encoding allows us not to consume extra memory for associating
information with each cell, and produces a precise output, that can tell
for example the name of an uninitialized variable on the stack, the
function in which it was pushed on the stack, and the function where we
accessed this uninitialized variable.

kMSan is available with LLVM, but not with GCC.

The code is organized in a way that is similar to kASan and kCSan, so it
means that other architectures than amd64 can be supported.

remove local version of mstohz() now that <sys/param.h> provides it.

New macro ALIGNED_POINTER_LOAD.

To be used with ALIGNED_POINTER(p,t) instead of writing *(const t *)p
directly.  This way, on machines without strict alignment, we can use
memcpy to pacify sanitizers, while getting the same compiled code in
the end with a single (say) MOV instruction.

Sync with HEAD

Pull up following revision(s) (requested by rin in ticket #1687):
	sys/arch/amd64/include/param.h: revision 1.30
Bump STACK_ALIGNBYTES to (16 - 1) to satisfy requirement by AMD64
System V ABI in kernel level. This is because
(1) for LLDB, we want to bypass libc/csu (and therefore manual stack
     alignment in _start), and
(2) rtld in glibc >= 2.23 for Linux/x86_64 requires it.
Fix SEGV for Linux/x86_64 binaries with glibc >= 2.23, reported as
PR port-amd64/54052.

Pull up following revision(s) (requested by rin in ticket #1220):

	sys/arch/amd64/include/param.h: revision 1.30

Bump STACK_ALIGNBYTES to (16 - 1) to satisfy requirement by AMD64
System V ABI in kernel level. This is because

(1) for LLDB, we want to bypass libc/csu (and therefore manual stack
     alignment in _start), and
(2) rtld in glibc >= 2.23 for Linux/x86_64 requires it.

Fix SEGV for Linux/x86_64 binaries with glibc >= 2.23, reported as

PR port-amd64/54052.

Bump STACK_ALIGNBYTES to (16 - 1) to satisfy requirement by AMD64
System V ABI in kernel level. This is because

(1) for LLDB, we want to bypass libc/csu (and therefore manual stack
    alignment in _start), and

(2) rtld in glibc >= 2.23 for Linux/x86_64 requires it.

Fix SEGV for Linux/x86_64 binaries with glibc >= 2.23, reported as
PR port-amd64/54052.

We reorganise definitions for XEN source support as follows:

XEN - common sources required for baseline XEN support.
XENPV - sources required for support of XEN in PV mode.
XENPVHVM - sources required for support for XEN in HVM mode.
XENPVH - sources required for support for XEN in PVH mode.

Synch with HEAD

move DEV_BSIZE, DEV_BSHIFT out of MD param.h, they are same on all ports

also move BLKDEV_IOSIZE, MAXPHYS, but allow override since some ports
have different value (powerpc uses NBPG for BLKDEV_IOSIZE, sun2/sun3
have lower MAXPHYS)

Sync with HEAD, resolve a few conflicts

Introduce KLEAK, a new feature that can detect kernel information leaks.

It works by tainting memory sources with marker values, letting the data
travel through the kernel, and scanning the kernel<->user frontier for
these marker values. Combined with compiler instrumentation and rotation
of the markers, it is able to yield relevant results with little effort.

We taint the pools and the stack, and scan copyout/copyoutstr. KLEAK is
supported on amd64 only for now, but it is not complicated to add more
architectures (just a matter of having the address of .text, and a stack
unwinder).

A userland tool is provided, that allows to execute a command in rounds
and monitor the leaks generated all the while.

KLEAK already detected directly 12 kernel info leaks, and prompted changes
that in total fixed 25+ leaks.

Based on an idea developed jointly with Thomas Barabosch (of Fraunhofer
FKIE).

Sync with HEAD

Resolve a couple of conflicts (result of the uimin/uimax changes)

Add support for monitoring the stack with kASan. This allows us to detect
illegal memory accesses occuring there.

The compiler inlines a piece of code in each function that adds redzones
around the local variables and poisons them. The illegal accesses are then
detected using the usual kASan machinery.

The stack size is doubled, from 4 pages to 8 pages.

Several boot functions are marked with the __noasan flag, to prevent the
compiler from adding redzones in them (because we haven't yet initialized
kASan). The kasan_early_init function is called early at boot time to
quickly create the shadow for the current stack; after this is done, we
don't need __noasan anymore in the boot path.

We pass -fasan-shadow-offset=0xDFFF900000000000, because the compiler
wants to do
	shad = shadow-offset + (addr >> 3)
and we do, in kasan_addr_to_shad
	shad = KASAN_SHADOW_START + ((addr - CANONICAL_BASE) >> 3)
hence
	shad = KASAN_SHADOW_START + (addr >> 3) - (CANONICAL_BASE >> 3)
	     = [KASAN_SHADOW_START - (CANONICAL_BASE >> 3)] + (addr >> 3)
implies
	shadow-offset = KASAN_SHADOW_START - (CANONICAL_BASE >> 3)
	              = 0xFFFF800000000000 - (0xFFFF800000000000 >> 3)
	              = 0xDFFF900000000000

In UVM, we add a kasan_free (that is not preceded by a kasan_alloc). We
don't add poisoned redzones ourselves, but all the functions we execute
do, so we need to manually clear the poison before freeing the stack.

With the help of Kamil for the makefile stuff.

Pull up following revision(s) (requested by sborrill in ticket #736):

	sys/arch/i386/include/param.h: revision 1.83
	sys/arch/amd64/include/param.h: revision 1.24

Double size of MSGBUFSIZE as existing value is not big enough to hold
boot dmesg on modern server-class hardware with lots of CPUs, etc.

Pull up the following revisions, requested by maxv in ticket #652:

	sys/arch/amd64/amd64/amd64_trap.S	upto 1.39 (partial, patch)
	sys/arch/amd64/amd64/db_machdep.c	1.6 (patch)
	sys/arch/amd64/amd64/genassym.cf	1.65,1.66,1.67 (patch)
	sys/arch/amd64/amd64/locore.S		upto 1.159 (partial, patch)
	sys/arch/amd64/amd64/machdep.c		1.299-1.302 (patch)
	sys/arch/amd64/amd64/trap.c		upto 1.113 (partial, patch)
	sys/arch/amd64/amd64/amd64/vector.S	upto 1.61 (partial, patch)
	sys/arch/amd64/conf/GENERIC		1.477,1.478 (patch)
	sys/arch/amd64/conf/kern.ldscript	1.26 (patch)
	sys/arch/amd64/include/frameasm.h	upto 1.37 (partial, patch)
	sys/arch/amd64/include/param.h		1.25 (patch)
	sys/arch/amd64/include/pmap.h		1.41,1.43,1.44 (patch)
	sys/arch/x86/conf/files.x86		1.91,1.93 (patch)
	sys/arch/x86/include/cpu.h		1.88,1.89 (patch)
	sys/arch/x86/include/pmap.h		1.75 (patch)
	sys/arch/x86/x86/cpu.c			1.144,1.146,1.148,1.149 (patch)
	sys/arch/x86/x86/pmap.c			upto 1.289 (partial, patch)
	sys/arch/x86/x86/vm_machdep.c		1.31,1.32 (patch)
	sys/arch/x86/x86/x86_machdep.c		1.104,1.106,1.108 (patch)
	sys/arch/x86/x86/svs.c			1.1-1.14
	sys/arch/xen/conf/files.compat		1.30 (patch)

Backport SVS. Not enabled yet.

Synch with HEAD, resolve conflicts

Pull up the following revisions (via patch), requested by maxv in #635:

	sys/arch/amd64/amd64/gdt.c		1.39-1.45 (patch)
	sys/arch/amd64/amd64/amd64/machdep.c	1.284,1.287,1.288 (patch)
	sys/arch/amd64/amd64/include/param.h	1.23 (patch)
	sys/arch/amd64/include/types.h		1.53 (patch)
	sys/arch/x86/include/cpu.h		1.87 (patch)
	sys/arch/x86/include/pmap.h		1.73,1.74 (patch)
	sys/arch/x86/x86/cpu.c			1.142 (patch)
	sys/arch/x86/x86/intr.c			1.117 (partial),1.120 (patch)
	sys/arch/x86/x86/pmap.c			1.276 (patch)

Initialize ist0 in cpu_init_tss.
Backport __HAVE_PCPU_AREA.

Add one more page for the stack, to compensate for the fact that SVS's
stack switching mechanism consumes approximately one page.

Double size of MSGBUFSIZE as existing value is not big enough to hold boot dmesg
on modern server-class hardware with lots of CPUs, etc.

Initialize ist0 in cpu_init_tss. On amd64 this is the DDB stack, and it has
nothing to do with ci_intrstack. While here, style, and don't forget to
pass UVM_KMF_ZERO in uvm_km_alloc.

update from HEAD

Sync with HEAD

Define MAXPHYSMEM globally.

Sync with HEAD

Pull up following revision(s) (requested by maya in ticket #1375):
	sys/arch/amd64/include/param.h: revision 1.20
	sys/arch/i386/include/param.h: revision 1.80
	sys/arch/x86/x86/bus_space.c: revision 1.39
increase max io mem on amd64. some devices need it.

Sync with HEAD

Sync with HEAD

Increase KERNTEXTOFF from 1MB to 2MB on amd64. [1MB; 2MB[ is now handled
by UVM, so there is no physical loss.

On amd64 we always remap the kernel text with 2MB pages, and because of the
1MB start address we were forced to map [0MB; 2MB[ inside the first large
page. The problem is, the lower half is used by UVM to allocate physical
pages, and it is possible that some of these could be used by userland. We
could end up with userland-controllable data mapped into the kernel text on
a privileged page, which is far from being a good idea from a security pov.

I am not fixing i386 yet, because the large page size depends on PAE, and
we probably don't want to have a text located at 4MB on low-memory systems.

(note: I didn't introduce this issue, it was already there when I came in)

increase max io mem on amd64. some devices need it.

Sync with HEAD (as of 26th Dec)

make sure MSGBUFSIZE can't expand strangely by using parens.

Initial snapshot of work to eliminate 64K MAXPHYS.  Basically works for
physio (I/O to raw devices); needs more doing to get it going with the
filesystems, but it shouldn't damage data.

All work's been done on amd64 so far.  Not hard to add support to other
ports.  If others want to pitch in, one very helpful thing would be to
sort out when and how IDE disks can do 128K or larger transfers, and
adjust the various PCI IDE (or at least ahcisata) drivers and wd.c
accordingly -- it would make testing much easier.  Another very helpful
thing would be to implement a smart minphys() for RAIDframe along the
lines detailed in the MAXPHYS-NOTES file.

sync with head.

Pull up following revision(s) (requested by rmind in ticket #202):
	sys/arch/x86/include/cpuvar.h: revision 1.46
	sys/arch/xen/include/xenpmap.h: revision 1.34
	sys/arch/i386/include/param.h: revision 1.77
	sys/arch/x86/x86/pmap_tlb.c: revision 1.5
	sys/arch/x86/x86/pmap_tlb.c: revision 1.6
	sys/arch/i386/i386/genassym.cf: revision 1.92
	sys/arch/xen/x86/cpu.c: revision 1.91
	sys/arch/x86/x86/pmap.c: revision 1.177
	sys/arch/xen/x86/xen_pmap.c: revision 1.21
	sys/arch/x86/acpi/acpi_wakeup.c: revision 1.31
	sys/kern/subr_kcpuset.c: revision 1.5
	sys/arch/amd64/include/param.h: revision 1.18
	sys/sys/kcpuset.h: revision 1.5
	sys/arch/x86/x86/mtrr_i686.c: revision 1.26
	sys/arch/x86/x86/mtrr_i686.c: revision 1.27
	sys/arch/xen/x86/x86_xpmap.c: revision 1.43
	sys/arch/x86/x86/cpu.c: revision 1.98
	sys/arch/amd64/amd64/mptramp.S: revision 1.14
	sys/kern/sys_sched.c: revision 1.42
	sys/arch/amd64/amd64/genassym.cf: revision 1.50
	sys/arch/i386/i386/mptramp.S: revision 1.24
	sys/arch/x86/include/pmap.h: revision 1.52
	sys/arch/x86/include/cpu.h: revision 1.50
- Convert x86 MD code, mainly pmap(9) e.g. TLB shootdown code, to use
  kcpuset(9) and thus replace hardcoded CPU bitmasks.  This removes the
  limitation of maximum CPUs.
- Support up to 256 CPUs on amd64 architecture by default.
Bug fixes, improvements, completion of Xen part and testing on 64-core
AMD Opteron(tm) Processor 6282 SE (also, as Xen HVM domU with 128 CPUs)
by Manuel Bouyer.
- pmap_tlb_shootdown: do not overwrite tp_cpumask with pm_cpus, but merge
  like pm_kernel_cpus.  Remove unecessary intersection with kcpuset_running.
  Do not reset tp_userpmap if pmap_kernel().
- Remove pmap_tlb_mailbox_t wrapping, which is pointless after recent changes.
- pmap_tlb_invalidate, pmap_tlb_intr: constify for packet structure.
i686_mtrr_init_first: handle the case when there are no variable-size MTRR
registers available (i686_mtrr_vcnt == 0).

sync to latest -current.

- Convert x86 MD code, mainly pmap(9) e.g. TLB shootdown code, to use
  kcpuset(9) and thus replace hardcoded CPU bitmasks.  This removes the
  limitation of maximum CPUs.

- Support up to 256 CPUs on amd64 architecture by default.

Bug fixes, improvements, completion of Xen part and testing on 64-core
AMD Opteron(tm) Processor 6282 SE (also, as Xen HVM domU with 128 CPUs)
by Manuel Bouyer.

sync with head

merge to -current.

improve sizing of kmem_arena now that more allocations are made from it
don't enforce limits if not required

ok: riz@

Use and define ALIGN() ALIGN_POINTER() and STACK_ALIGN() consistently,
and avoid definining them in 10 different places if not needed.

Change CMSG_SPACE and CMSG_LEN to provide Integer Constant Expressions
again. This was changed in sys/socket.h r1.51 to work around fallout
from the IPv6 aux data migration. It broke the historic ABI on some
platforms. This commit restores compatibility for netbsd32 code on such
platforms and provides a template for future changes to the CMSG_*
alignment. Revert PCC/Clang workarounds in postfix and tmux.

Sync with HEAD. Most notably: uvm/pmap work done by rmind@, and MP Xen
work of cherry@.

No regression observed on suspend/restore.

g/c round_pdr

Sync with HEAD

Sync with HEAD.

sync with head

Remove separate mb_map. The nmbclusters is computed at boot time based
on the amount of physical memory and limited by NMBCLUSTERS if present.
Architectures without direct mapping also limit it based on the kmem_map
size, which is used as backing store. On i386 and ARM, the maximum KVA
used for mbuf clusters is limited to 64MB by default.

The old default limits and limits based on GATEWAY have been removed.
key_registered_sb_max is hard-wired to a value derived from 2048
clusters.

Reert change which was not meant to be comitted.

Build kernel modules with -mno-red-zone like kernel is build. This fixes
frequent panics in amd64 zfs module. This should also fix problem reported
by Nicolas Joly in:

http://mail-index.netbsd.org/port-amd64/2008/12/09/msg000646.html

Thanks to cube@ for his help with this.

sync with head.

Pull up following revision(s) (requested by ad in ticket #355):
	sys/arch/amd64/amd64/vm_machdep.c: revision 1.37
	sys/arch/amd64/include/param.h: revision 1.10
- Kill NOREDZONE.
- Make the redzone conditional on DIAGNOSTIC.
- Give amd64 an additional page for the uarea. 2 is not enough.

Sync with HEAD.

Sync with HEAD.

- Kill NOREDZONE.
- Make the redzone conditional on DIAGNOSTIC.
- Give amd64 an additional page for the uarea. 2 is not enough.

Update haad-dm branch to haad-dm-base2.

put the contents of these header files around #ifdef __x86_64__, and
#include the <i386/foo.h> in the #else clause, making these files
largely bit-size independant.

Sync with HEAD.

sync with head

sync with HEAD

Sync with HEAD

change the layout in u-area and reduce UPAGES.

- make amd64 use per-cpu tss.
- fix iopl syscall for amd64+xen.

sync with HEAD

sync with head.

Sync with HEAD.

Follow the merge of pmap.c on i386 and amd64 and move
pmap_init_tmp_pgtbl into arch/x86/x86/pmap.c. Modify the ACPI wakeup
code to restore CR4 before jumping back into kernel space as the large
page option might cover that.

Sync with HEAD.

Sync with head.

merge yamt-x86pmap branch.

- reduce differences between amd64 and i386.  notably, share pmap.c
  between them.  it makes several i386 pmap improvements available to
  amd64, including tlb shootdown reduction and bug fixes from Stephan Uphoff.
- implement deferred pmap switching for amd64.
- remove LARGEPAGES option.  always use large pages if available.
  also, make it work on amd64.

Merge the ppcoea-renovation branch to HEAD.

This branch was a major cleanup and rototill of many of the various OEA
cpu based PPC ports that focused on sharing as much code as possible
between the various ports to eliminate near-identical copies of files in
every tree.  Additionally there is a new PIC system that unifies the
interface to interrupt code for all different OEA ppc arches.  The work
for this branch was done by a variety of people, too long to list here.

TODO:
bebox still needs work to complete the transition to -renovation.
ofppc still needs a bunch of work, which I will be looking at.
ev64260 still needs to be renovated
amigappc was not attempted.

NOTES:
pmppc was removed as an arch, and moved to a evbppc target.

Sync with HEAD

sync with head.

Bump default size of the message buffer from 16 KB to 32 KB.
This is large enough that boot -v on most systems fits into the
message buffer, which makes it easier for debugging.

remove some #ifdef _LOCORE and use genassym instead.

sync with head.

sync with head

sync with head.

- remove unused bdbtofsb.
- move the following macros from MD headers to sys/param.h.
	ctod
	dtoc
	ctob
	btoc
	dbtob
	btodb

sync with head.

Sync with head.

sync with head.

Pull up following revision(s) (requested by chs in ticket #1166):
	sys/arch/amd64/include/param.h: revision 1.2
increase NKMEMPAGES_MAX_DEFAULT to 1 GB.
this allows lots more memory to be used for amaps, etc.

increase NKMEMPAGES_MAX_DEFAULT to 1 GB.
this allows lots more memory to be used for amaps, etc.

Rename the x86_64 port to amd64, as this is the actual name used for
the processor family now. x86_64 is kept as the MACHINE_ARCH value,
since it's already widely used (by e.g. the toolchain, etc), and
by other operating systems.