CVS log for src/sys/arch/i386/include/segments.h

Up to [cvs.NetBSD.org] / src / sys / arch / i386 / include

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

fix typos in word "access" and it derivatives, mainly in comments.

Introduce per-cpu IDTs

This is realized by following modifications:
- Add IDT pages and its allocation maps for each cpu in "struct cpu_info"
- Load per-cpu IDTs at cpu_init_idt(struct cpu_info*)
- Copy the IDT entries for cpu0 to other CPUs at attach
   - These are, for example, exceptions, db, system calls, etc.

And, added a kernel option named PCPU_IDT to enable the feature.

Sync with HEAD

We reorganise definitions for XEN source support as follows:

XEN - common sources required for baseline XEN support.
XENPV - sources required for support of XEN in PV mode.
XENPVHVM - sources required for support for XEN in HVM mode.
XENPVH - sources required for support for XEN in PVH mode.

Ssync with HEAD

Fix for i386, functionality intended in:
http://mail-index.netbsd.org/source-changes/2018/09/23/msg099357.html

This should fix the build for both GENERIC and XEN3PAE_DOM0

This has not been boot tested on native or xen3pae

Notes: pmap_changeprot_local() seems to be x86_64 only.
I was a bit surprised by this initially, but I suspect that the table
protections are enforced via ring0/ring1 fencing rather than page protections

the gdt registration code in i386 is still messy. I will leave it as is
for now - to avoid a rabbit hole.

Summary: Remove older and now conflicting type declaration for global
variable 'idt'.

This should fix the i386 build failure now.

Make XEN use the same api as native, for idt vector allocation
and registration.

lidt() placed in xenfunc() on maxv@ suggestion.

There should be no functional change due to this commit.

Tested on amd64 native and XEN.

Pull up following revision(s) (requested by maxv in ticket #1517):
	sys/arch/amd64/amd64/machdep.c: 1.280 via patch
	sys/arch/amd64/include/segments.h: 1.34 via patch
	sys/arch/i386/i386/machdep.c: 1.800
	sys/arch/i386/include/segments.h: 1.64
	sys/arch/x86/x86/vm_machdep.c: 1.30
Fix a huge privilege separation vulnerability in Xen-amd64.
On amd64 the kernel runs in ring3, like userland, and therefore SEL_KPL
equals SEL_UPL. While Xen can make a distinction between usermode and
kernelmode in %cs, it can't when it comes to iopl. Since we set SEL_KPL
in iopl, Xen sees SEL_UPL, and allows (unprivileged) userland processes
to read and write to the CPU ports.
It is easy, then, to completely escalate privileges; by reprogramming the
PIC, by reading the ATA disks, by intercepting the keyboard interrupts
(keylogger), etc.
Declare IOPL_KPL, set to 1 on Xen-amd64, which allows the kernel to use
the ports but not userland. I didn't test this change on i386, but it
seems fine enough.

Pull up following revision(s) (requested by maxv in ticket #1517):
	sys/arch/amd64/amd64/machdep.c: 1.280 via patch
	sys/arch/amd64/include/segments.h: 1.34 via patch
	sys/arch/i386/i386/machdep.c: 1.800
	sys/arch/i386/include/segments.h: 1.64
	sys/arch/x86/x86/vm_machdep.c: 1.30
Fix a huge privilege separation vulnerability in Xen-amd64.
On amd64 the kernel runs in ring3, like userland, and therefore SEL_KPL
equals SEL_UPL. While Xen can make a distinction between usermode and
kernelmode in %cs, it can't when it comes to iopl. Since we set SEL_KPL
in iopl, Xen sees SEL_UPL, and allows (unprivileged) userland processes
to read and write to the CPU ports.
It is easy, then, to completely escalate privileges; by reprogramming the
PIC, by reading the ATA disks, by intercepting the keyboard interrupts
(keylogger), etc.
Declare IOPL_KPL, set to 1 on Xen-amd64, which allows the kernel to use
the ports but not userland. I didn't test this change on i386, but it
seems fine enough.

Pull up following revision(s) (requested by maxv in ticket #1517):
	sys/arch/amd64/amd64/machdep.c: 1.280 via patch
	sys/arch/amd64/include/segments.h: 1.34 via patch
	sys/arch/i386/i386/machdep.c: 1.800
	sys/arch/i386/include/segments.h: 1.64
	sys/arch/x86/x86/vm_machdep.c: 1.30
Fix a huge privilege separation vulnerability in Xen-amd64.
On amd64 the kernel runs in ring3, like userland, and therefore SEL_KPL
equals SEL_UPL. While Xen can make a distinction between usermode and
kernelmode in %cs, it can't when it comes to iopl. Since we set SEL_KPL
in iopl, Xen sees SEL_UPL, and allows (unprivileged) userland processes
to read and write to the CPU ports.
It is easy, then, to completely escalate privileges; by reprogramming the
PIC, by reading the ATA disks, by intercepting the keyboard interrupts
(keylogger), etc.
Declare IOPL_KPL, set to 1 on Xen-amd64, which allows the kernel to use
the ports but not userland. I didn't test this change on i386, but it
seems fine enough.

Pull up following revision(s) (requested by maxv in ticket #1550):
	sys/arch/amd64/amd64/machdep.c: revision 1.280 via patch
	sys/arch/amd64/include/segments.h: revision 1.34 via patch
	sys/arch/i386/i386/machdep.c: revision 1.800 via patch
	sys/arch/i386/include/segments.h: revision 1.64 via patch
	sys/arch/x86/x86/vm_machdep.c: revision 1.30 via patch
Fix a huge privilege separation vulnerability in Xen-amd64.
On amd64 the kernel runs in ring3, like userland, and therefore SEL_KPL
equals SEL_UPL. While Xen can make a distinction between usermode and
kernelmode in %cs, it can't when it comes to iopl. Since we set SEL_KPL
in iopl, Xen sees SEL_UPL, and allows (unprivileged) userland processes
to read and write to the CPU ports.
It is easy, then, to completely escalate privileges; by reprogramming the
PIC, by reading the ATA disks, by intercepting the keyboard interrupts
(keylogger), etc.
Declare IOPL_KPL, set to 1 on Xen-amd64, which allows the kernel to use
the ports but not userland. I didn't test this change on i386, but it
seems fine enough.

Pull up following revision(s) (requested by maxv in ticket #1550):
	sys/arch/amd64/amd64/machdep.c: revision 1.280 via patch
	sys/arch/amd64/include/segments.h: revision 1.34 via patch
	sys/arch/i386/i386/machdep.c: revision 1.800 via patch
	sys/arch/i386/include/segments.h: revision 1.64 via patch
	sys/arch/x86/x86/vm_machdep.c: revision 1.30 via patch
Fix a huge privilege separation vulnerability in Xen-amd64.
On amd64 the kernel runs in ring3, like userland, and therefore SEL_KPL
equals SEL_UPL. While Xen can make a distinction between usermode and
kernelmode in %cs, it can't when it comes to iopl. Since we set SEL_KPL
in iopl, Xen sees SEL_UPL, and allows (unprivileged) userland processes
to read and write to the CPU ports.
It is easy, then, to completely escalate privileges; by reprogramming the
PIC, by reading the ATA disks, by intercepting the keyboard interrupts
(keylogger), etc.
Declare IOPL_KPL, set to 1 on Xen-amd64, which allows the kernel to use
the ports but not userland. I didn't test this change on i386, but it
seems fine enough.

Pull up following revision(s) (requested by maxv in ticket #1550):
	sys/arch/amd64/amd64/machdep.c: revision 1.280 via patch
	sys/arch/amd64/include/segments.h: revision 1.34 via patch
	sys/arch/i386/i386/machdep.c: revision 1.800 via patch
	sys/arch/i386/include/segments.h: revision 1.64 via patch
	sys/arch/x86/x86/vm_machdep.c: revision 1.30 via patch
Fix a huge privilege separation vulnerability in Xen-amd64.
On amd64 the kernel runs in ring3, like userland, and therefore SEL_KPL
equals SEL_UPL. While Xen can make a distinction between usermode and
kernelmode in %cs, it can't when it comes to iopl. Since we set SEL_KPL
in iopl, Xen sees SEL_UPL, and allows (unprivileged) userland processes
to read and write to the CPU ports.
It is easy, then, to completely escalate privileges; by reprogramming the
PIC, by reading the ATA disks, by intercepting the keyboard interrupts
(keylogger), etc.
Declare IOPL_KPL, set to 1 on Xen-amd64, which allows the kernel to use
the ports but not userland. I didn't test this change on i386, but it
seems fine enough.

Pull up following revision(s) (requested by maxv in ticket #477):
	sys/arch/amd64/amd64/machdep.c: revision 1.280
	sys/arch/amd64/include/segments.h: revision 1.34
	sys/arch/i386/i386/machdep.c: revision 1.800
	sys/arch/i386/include/segments.h: revision 1.64 via patch
	sys/arch/x86/x86/vm_machdep.c: revision 1.30
Fix a huge privilege separation vulnerability in Xen-amd64.
On amd64 the kernel runs in ring3, like userland, and therefore SEL_KPL
equals SEL_UPL. While Xen can make a distinction between usermode and
kernelmode in %cs, it can't when it comes to iopl. Since we set SEL_KPL
in iopl, Xen sees SEL_UPL, and allows (unprivileged) userland processes
to read and write to the CPU ports.
It is easy, then, to completely escalate privileges; by reprogramming the
PIC, by reading the ATA disks, by intercepting the keyboard interrupts
(keylogger), etc.
Declare IOPL_KPL, set to 1 on Xen-amd64, which allows the kernel to use
the ports but not userland. I didn't test this change on i386, but it
seems fine enough.

Fix a huge privilege separation vulnerability in Xen-amd64.

On amd64 the kernel runs in ring3, like userland, and therefore SEL_KPL
equals SEL_UPL. While Xen can make a distinction between usermode and
kernelmode in %cs, it can't when it comes to iopl. Since we set SEL_KPL
in iopl, Xen sees SEL_UPL, and allows (unprivileged) userland processes
to read and write to the CPU ports.

It is easy, then, to completely escalate privileges; by reprogramming the
PIC, by reading the ATA disks, by intercepting the keyboard interrupts
(keylogger), etc.

Declare IOPL_KPL, set to 1 on Xen-amd64, which allows the kernel to use
the ports but not userland. I didn't test this change on i386, but it
seems fine enough.

update from HEAD

In XEN PV, the idt vector table is not required to be altered at
runtime, since only entries for exceptions/traps are registered with
the hypervisor and interrupts are managed via a completely different
mechanism.

This change uses the idt_vec_reserve() mechanism nevertheless,
modifying it slightly to only do namespace management in XEN, while on
native it will continue to do idt entry init as before.

Rationale: Consistent API usage and potential future merging of
XEN/non-XEN code.

There are no functional changes in this commit.

Remove the second argument from USERMODE and KERNELMODE, it is unused
now that we don't have vm86 anymore.

Sync with HEAD

Remove vm86.

Pass 4.

Use a bitmap-based allocator for i386, same as amd64. Several functions
are now identical - or nearly identical - on both sides. I couldn't test
this change on xen, because I'm having some unrelated issues with my VM
and I've spent enough time not understanding what's wrong with it.

Sync with HEAD

Sync with HEAD

Localify, add a comment and merge some others.

Rename ldt->ldtstore and gdt->gdtstore on i386. It reduces the diff with
amd64, and makes it easier to track down these variables on nxr - 'ldt'
and 'gdt' being common keywords.

Sync with HEAD

KNF, and give the structure sizes.

Remove idt_init.

Sync with HEAD

expose __vaddr_t for segments.h since it is a userland api.

Apply patch (requested by bouyer in ticket #1738).

Do not special-case XEN and always use the proper selectors for %fs and %gs
in buildcontext() and setregs(). The consequence was that signal handlers
would have the wrong %fs/%gs. Found by running atf tests under Xen/i386.

Sync with HEAD.

sync with head

Sync with head.

Remove Darwin, MACH and Mach-O support.

Sync with HEAD.

sync with head

Sync with HEAD.

on Xen the GDT has to be updated though HYPERVISOR_update_descriptor().
Export i386/i386/gdt.c:update_descriptor() and use it in x86_set_sdbase(),
as a direct write to the GDT will cause a kernel trap.
Fix PR port-xen/41401.

Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.

sync with head.

Sync with HEAD.

A couple more comments.

Add a comment.

Sync with HEAD.

Update haad-dm branch to haad-dm-base2.

Apply patch (requested by bouyer in ticket #65):
Add i386-specific COMPAT_30_PTHREAD option (enabled where COMPAT_30
is enabled), which restore binary compatibility with netbsd-3 libpthread.

use a macro to get to d_type.

Sync with HEAD.

sync with head.

idt_* are not implemented for Xen. So don't provide the prototypes for Xen.

sync with HEAD

Sync with HEAD.

sync with head

Merge the bouyer-xeni386 branch to head, at tag bouyer-xeni386-merge1 (the
branch is still active and will see i386PAE support developement).
Sumary of changes:
- switch xeni386 to the x86/x86/pmap.c, and the xen/x86/x86_xpmap.c
  pmap bootstrap.
- merge back most of xen/i386/ to i386/i386
- change the build to reduce diffs between i386 and amd64 in file locations
- remove include files that were identical to the i386/amd64 counterparts,
  the build will find them via the xen-ma/machine link.

Merge Xen support back to i386/i386/vector.S

sync with HEAD

Sync with HEAD

Move Xen support to i386/i386/machdep.c. two less files in xen/ :)

i386:
	- make tss per-cpu.  this considerably speeds up context switch for,
	  at least, pentium4, where ltr instruction seems very slow.
i386, xen:
	- kill cpu_maxproc.
kvm86:
	- adapt to per-cpu tss.
	- cleanup and simplify.
	- move kvm86_mp_lock to more meaningful place.
	- disable preemption during a call.

Sync with HEAD

Sync with head.

- share idt entry allocation code among x86.
- introduce a function to reserve an idt entry and use it instead of
  manipulating idt_allocmap directly.
- rename idt to xen_idt for amd64 xen.  add missing #ifdef XEN.

Convert many of the uses of __attribute__ to equivalent
__packed, __unused and __dead macros from cdefs.h

Sync with HEAD.

Sync with HEAD.

sync with head.

Sync with HEAD

Sync with HEAD.

- When computing the TSC frequency, call i8254_delay() and not DELAY().
- Use atomics to adjust the pmap reference count, instead of taking locks.
- Implement I386_{SET,GET}_{FS,GS}BASE, allowing %fs and %gs to be used
  as per-thread registers. This is compatible with FreeBSD.
- Run patches after we have attached CPUs, since we then know if the
  system is uniprocessor or not. Eliminates a lot of #ifdef MULTIPROCESSOR
  and makes running MP kernels on UP systems cheaper.
- Patch out many of the 'lock' prefixes to nops if uniprocessor.
- Do a wbinvd after patching to ensure that the trace/instruction cache
  is up to date.

sync with HEAD

sync with head.

Sync with HEAD.

Follow the merge of pmap.c on i386 and amd64 and move
pmap_init_tmp_pgtbl into arch/x86/x86/pmap.c. Modify the ACPI wakeup
code to restore CR4 before jumping back into kernel space as the large
page option might cover that.

Sync with HEAD.

Sync with head.

merge yamt-x86pmap branch.

- reduce differences between amd64 and i386.  notably, share pmap.c
  between them.  it makes several i386 pmap improvements available to
  amd64, including tlb shootdown reduction and bug fixes from Stephan Uphoff.
- implement deferred pmap switching for amd64.
- remove LARGEPAGES option.  always use large pages if available.
  also, make it work on amd64.

reduce #ifdef.

sync with head.

Sync with HEAD.

Shuffle the descriptor slots slightly to make the layout match what
sysenter/sysexit require. As far as I can tell this will not introduce
any incompatibility.

Fix the sync with head I botched.

Sync with HEAD.

Sync with HEAD

Drop trailing spaces.

Uppercase CPU, plural is CPUs.

Nuke __P().

add support for non-executable mappings (where the hardware allows this)
and make the stack and heap non-executable by default.  the changes
fall into two basic catagories:

 - pmap and trap-handler changes.  these are all MD:
   = alpha: we already track per-page execute permission with the (software)
	PG_EXEC bit, so just have the trap handler pay attention to it.
   = i386: use a new GDT segment for %cs for processes that have no
	executable mappings above a certain threshold (currently the
	bottom of the stack).  track per-page execute permission with
	the last unused PTE bit.
   = powerpc/ibm4xx: just use the hardware exec bit.
   = powerpc/oea: we already track per-page exec bits, but the hardware only
	implements non-exec mappings at the segment level.  so track the
	number of executable mappings in each segment and turn on the no-exec
	segment bit iff the count is 0.  adjust the trap handler to deal.
   = sparc (sun4m): fix our use of the hardware protection bits.
	fix the trap handler to recognize text faults.
   = sparc64: split the existing unified TSB into data and instruction TSBs,
	and only load TTEs into the appropriate TSB(s) for the permissions.
	fix the trap handler to check for execute permission.
   = not yet implemented: amd64, hppa, sh5

 - changes in all the emulations that put a signal trampoline on the stack.
   instead, we now put the trampoline into a uvm_aobj and map that into
   the process separately.

originally from openbsd, adapted for netbsd by me.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22364, verified by myself.

The IDT only contains gate descriptors, so define it as such.

Catch up to -current.

sync kqueue with -current; this includes merge of gehenna-devsw branch,
merge of i386 MP branch, and part of autoconf rototil work

Change setgate() prototype.
Define GDT entries for DDB and double fault TSS.

Merge Bill Sommerfeld's i386 MP branch. This code has some known
caveats, but works quite well in a lot of MP cases, and all
UP cases that I have tested. Parts of this will hopefully be
reworked in the not-too-distant future.

Catch up to -current.

Sync w/ -current.

Yet Another mergeup with -current.

Re-arrange GDT entries somewhat so that: (1) I can reserve the 8th entry for
BIOS-bug-avoidance [fixes part of my own port-i386/11299], and (2) lets you
have APM and COMPAT_MACHO in the kernel at the same time.  Also comments on
the special 8th entry and what else changing some of these values affects.

OK'ed by Frank.

Set up per-cpu GDT.
Use %fs for per-cpu data access.

Catch up with -current.

update to -current

catch up with -current

Use global descriptor 7 for mach traps. Unfortunately this is already
used by apm 16 bit code segments so we cannot have both at the same time.

Catch up to -current.

checkpoint merge-in-progress from mainline.

use _KERNEL_OPT

Update thorpej_scsipi to -current as of a month ago
A i386 GENERIC kernel compiles without the siop, ahc and bha drivers
(will be updated later). i386 IDE/ATAPI and ncr work, as well as
sparc/esp_sbus. alpha should work as well (untested yet).
siop, ahc and bha will be updated once I've updated the branch to current
-current, as well as machine-dependant code.

Include functions for allocation and freeing of IDT slots.

Pull up to last week's -current.

Sync with -current

add GDT segments for pnpbios use

pull up rev 1.29 from trunk (christos)

Add an LDT for Solaris-2.6 syscalls [from Frank]

Some rearrangement of the startup code:
* Move some of the memory bootstrapping and the DDB startup earlier.
* Always put the IDT and the initial GDT and LDT in a separate page.
* Various minor changes.

Generate dependencies on the VM86 option.

Pull rev 1.26 up from trunk (mycroft)

Some general cleanup:
* Call gdt_init() earlier on.
* Don't bother to check for TSS and LDT descriptors in verr_gdt().
* Nuke the sti special case for trace and breakpoint traps.
* Move some variable declarations into more appropriate locations.

change APM to use new almost-generalized BIOS trampoline:

/*
 * void bioscall(int function, struct apmregs *regs):
 * 	call the BIOS interrupt "function" from real mode with
 *	registers as specified in "regs"
 *	(for the flags, though, only these flags are passed to the BIOS;
 *	the remainder come from the flags register at the time of the call:
 *	(PSL_C|PSL_PF|PSL_AF|PSL_Z|PSL_N|PSL_D|PSL_V)
 *
 *	Fills in *regs with registers as returned by BIOS.
 */

Thanks to Charles Hannum for complaining and inspiring me to hack this
together.

add Advanced Power Management driver
Includes bootstrap support from FreeBSD (Tatsumi HOSOKAWA and <ukai>)

LOCORE -> _LOCORE

Use #pragma only for 2.0 <= GCC < 2.7.

Use alternate structure packing method added in GCC 2.7.

Move the initialization of proc0's TSS and LDT to the end of cpu_startup(),
and switch to dynamically allocating the TSS.

file segments.h was added on branch netbsd-1-1 on 1995-10-12 17:57:02 +0000

Move the initialization of proc0's TSS and LDT to the end of cpu_startup(),
and switch to dynamically allocating the TSS.

Go back to statically allocating the GDT entries for proc0.

Remove reference to dead variable.

Various changes from John Kohl and me:
Map kernel stacks only at unique addresses.
Use one TSS per process.
Add sysarch calls for modifying IOPL and the I/O permission bitmap.
Add a compacting GDT entry allocator, for TSS and LDT selectors.
Enable modifying %fs and %gs with PT_SETREGS.
Sanitize various bits of code.

Add USERMODE() and KERNELMODE() macros, and use them.

Eliminate soft segment descriptors; instead use a functional interface for
creating segment descriptors.  Add the duplicate system call gate used by
BSD/OS 2.0 executables.  Prototype setsegment() and setgate(), and fix a bogon
caught by this.

Add a copy of the user code and data descriptors in the GDT.

Wrap NGDT and NLDT in parens.

Make this includable from locore.  Remove unused GDT and LDT slots.

Expose idt[] here.

KERNEL -> _KERNEL

pcb.h requires segments.h now.

Fully prototype ssdtosd() and sdtossd().

new RCS ID format.

Clean this up a little.

Cleanup and garbage collection; nothing significant.  From magnum branch.

file segments.h was added on branch magnum on 1993-12-20 05:25:44 +0000

Cleanup and garbage collection; nothing significant.  From magnum branch.

Merge changes from trunk.

Cleanup LDT/GDT defines

add rcsids to everything and clean up headers

added changes from Steven Reiz <sreiz@aie.nl> (based on
those by Poul-Henning Kamp <phk@data.fls.dk>) to get the kernel
to compile properly when gcc2.* is cc.  (should still work
when gcc1.39 is in use.)

initial import of 386bsd-0.1 sources

Initial revision