Kernel stack overflows in MIPS call panic() directly from an assembly
handler after storing the interrupted context's registers in a
trapframe. Rather than inferring the location of ra, sp, and pc from
the instruction stream, recognize the pc of a kernel stack overflow
and pull the registers from the trapframe.
Sponsored by: DARPA / AFRL
- Honor PG_NODUMP by not dumping pages with this flag set.
- Pat the watchdog during dumps to avoid a watchdog reset while writing
out a dump.
- Reformat the output during a dump to update every 10% done rather than
every 2MB dumped.
- Include UMA small pages and pages holding PV entries in minidumps.
Sponsored by: DARPA / AFRL
dump_avail[] is supposed to be a superset of phys_avail[] that
describes all of the memory ranges that should be included in a full
dump. minidumps don't consider pages described by dump_avail[] to be
valid and thus they are excluded via the is_dumpable() function. Most
MIPS platforms (including MALTA) set dump_avail[] to be identical to
phys_avail[]. In particular, phys_avail[] doesn't include the kernel
itself, so pages for the kernel and it's global variables are not
considered dumpable and not included in the dump. Fix this by setting
dump_avail[0] to the first memory address (0) rather than the end of
the kernel.
Several other MIPS platforms have the same bug, though I am only able
to test malta in qemu. The correct fix is to set dump_avail[] to
describe RAM and in particular to not set dump_avail[0] to the end of
the kernel (kernel_kseg0_end).
Sponsored by: DARPA / AFRL
As cs is stored in a uint32_t, use the last bit to store the
active high flag as it's unlikely that we will have that much CS.
Reviewed by: loos
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D8614
When the kernel debugger is entered, makectx() is called to store
appropriate state from the trapframe for the debugger into a global
kdb_pcb used as the thread context of the thread entering the
debugger. Stack unwinders for DDB called via db_trace_thread() are
supposed to then use this saved context so that the stack trace for
the current thread starts at the location of the event that triggered
debugger entry.
MIPS was instead starting the stack trace of the current thread from
the context of db_trace_thread itself and unwinding back out through
the debugger to the original frame. Fix a couple of things to bring
MIPS inline with other platforms:
- Fix makectx() to store the PC, SP, and RA in the right portion of
the PCB used by db_trace_thread().
- Fix db_trace_thread() to always use kdb_thr_ctx() (and thus kdb_pcb
for the debugger thread).
- Move the logic for tracing curthread from within the current
function into db_trace_self() to match other architectures.
Sponsored by: DARPA / AFRL
This fixes backtraces from DDB in n32 kernels as uintptr_t is only a
uint32_t. In particular, the upper 32-bits of each register value were
treated as the register's value breaking both the output of register
values, but also the values of 'ra' and 'sp' required to walk up to the
previous frame.
Sponsored by: DARPA / AFRL
This commit corrects print of nomatch (newline was too early) and fix
unit number for new child in ar5315_spi (was 0, now is -1 to calculate it
according to actual system state)
Submitted by: Hiroki Mori <yamori813@yahoo.co.jp>
Reviewed by: ray, loos, mizhka
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D8749
Changes include modifications in kernel crash dump routines, dumpon(8) and
savecore(8). A new tool called decryptcore(8) was added.
A new DIOCSKERNELDUMP I/O control was added to send a kernel crash dump
configuration in the diocskerneldump_arg structure to the kernel.
The old DIOCSKERNELDUMP I/O control was renamed to DIOCSKERNELDUMP_FREEBSD11 for
backward ABI compatibility.
dumpon(8) generates an one-time random symmetric key and encrypts it using
an RSA public key in capability mode. Currently only AES-256-CBC is supported
but EKCD was designed to implement support for other algorithms in the future.
The public key is chosen using the -k flag. The dumpon rc(8) script can do this
automatically during startup using the dumppubkey rc.conf(5) variable. Once the
keys are calculated dumpon sends them to the kernel via DIOCSKERNELDUMP I/O
control.
When the kernel receives the DIOCSKERNELDUMP I/O control it generates a random
IV and sets up the key schedule for the specified algorithm. Each time the
kernel tries to write a crash dump to the dump device, the IV is replaced by
a SHA-256 hash of the previous value. This is intended to make a possible
differential cryptanalysis harder since it is possible to write multiple crash
dumps without reboot by repeating the following commands:
# sysctl debug.kdb.enter=1
db> call doadump(0)
db> continue
# savecore
A kernel dump key consists of an algorithm identifier, an IV and an encrypted
symmetric key. The kernel dump key size is included in a kernel dump header.
The size is an unsigned 32-bit integer and it is aligned to a block size.
The header structure has 512 bytes to match the block size so it was required to
make a panic string 4 bytes shorter to add a new field to the header structure.
If the kernel dump key size in the header is nonzero it is assumed that the
kernel dump key is placed after the first header on the dump device and the core
dump is encrypted.
Separate functions were implemented to write the kernel dump header and the
kernel dump key as they need to be unencrypted. The dump_write function encrypts
data if the kernel was compiled with the EKCD option. Encrypted kernel textdumps
are not supported due to the way they are constructed which makes it impossible
to use the CBC mode for encryption. It should be also noted that textdumps don't
contain sensitive data by design as a user decides what information should be
dumped.
savecore(8) writes the kernel dump key to a key.# file if its size in the header
is nonzero. # is the number of the current core dump.
decryptcore(8) decrypts the core dump using a private RSA key and the kernel
dump key. This is performed by a child process in capability mode.
If the decryption was not successful the parent process removes a partially
decrypted core dump.
Description on how to encrypt crash dumps was added to the decryptcore(8),
dumpon(8), rc.conf(5) and savecore(8) manual pages.
EKCD was tested on amd64 using bhyve and i386, mipsel and sparc64 using QEMU.
The feature still has to be tested on arm and arm64 as it wasn't possible to run
FreeBSD due to the problems with QEMU emulation and lack of hardware.
Designed by: def, pjd
Reviewed by: cem, oshogbo, pjd
Partial review: delphij, emaste, jhb, kib
Approved by: pjd (mentor)
Differential Revision: https://reviews.freebsd.org/D4712
- Defined an abstract NVRAM I/O API (bhnd_nvram_io), decoupling NVRAM/SPROM
parsing from the actual underlying NVRAM data provider (e.g. CFE firmware
devices).
- Defined an abstract NVRAM data API (bhnd_nvram_data), decoupling
higher-level NVRAM operations (indexed lookup, data conversion, etc) from
the underlying NVRAM file format parsing/serialization.
- Implemented a new high-level bhnd_nvram_store API, providing indexed
variable lookup, pending write tracking, etc on top of an arbitrary
bhnd_nvram_data instance.
- Migrated all bhnd(4) NVRAM device drivers to the common bhnd_nvram_store
API.
- Implemented a common bhnd_nvram_val API for parsing/encoding NVRAM
variable values, including applying format-specific behavior when
converting to/from the NVRAM string representations.
- Dropped the now unnecessary bhnd_nvram driver, and moved the
broadcom/mips-specific CFE NVRAM driver out into sys/mips/broadcom.
- Implemented a new nvram_map file format:
- Variable definitions are now defined separately from the SPROM
layout. This will also allow us to define CIS tuple NVRAM
mappings referencing the common NVRAM variable definitions.
- Variables can now be defined within arbitrary named groups.
- Textual descriptions and help information can be defined inline
for both variables and variable groups.
- Implemented a new, compact encoding of SPROM image layout
offsets.
- Source-level (but not build system) support for building the NVRAM file
format APIs (bhnd_nvram_io, bhnd_nvram_data, bhnd_nvram_store) as a
userspace library.
The new compact SPROM image layout encoding is loosely modeled on Apple
dyld compressed LINKEDIT symbol binding opcodes; it provides a compact
state-machine encoding of the mapping between NVRAM variables and the SPROM
image offset, mask, and shift instructions necessary to decode or encode
the SPROM variable data.
The compact encoding reduces the size of the generated SPROM layout data
from roughly 60KB to 3KB. The sequential nature SPROM layout opcode tables
also simplify iteration of the SPROM variables, as it's no longer
neccessary to iterate the full NVRAM variable definition table, but
instead simply scan the SPROM revision's layout opcode table.
Approved by: adrian (mentor)
Differential Revision: https://reviews.freebsd.org/D8645
It is required to proceed full cache flush before we can use wait
instruction on multicore, so use nop instead for now.
Submitted by: kan
Sponsored by: DARPA, AFRL
X1000 systems on chips.
Imgtec CI20 and Ingenic CANNA boards supported.
Submitted by: Alexander Kabaev <kan@FreeBSD.org>
Reviewed by: Ruslan Bukin <br@FreeBSD.org>
Sponsored by: DARPA, AFRL
Secondary data cache line size can be bigger than
primary data cache line size, so use biggest value
as a minimum alignment.
Submitted by: kan
Sponsored by: DARPA, AFRL
While there, make param.h guess proper MACHINE_ARCH on hardfloat targets
correctly as well, so tools like bmake can get their defaults right.
This does not help the kernel case, since we compile them with forced
-msoft-float and need to override an incorrect guess by param.h.
Reviewed by: br
Differential Revision: https://reviews.freebsd.org/D8574
This commit improves code styles like:
- removing commented code
- format comments as C-style
- add spaces after #define-s
It also bring ability to build kernel without INTRNG and remove RedBoot dependency.
Tested on FON2201
Submitted by: Hiroki Sato <yamori813@yahoo.co.jp>
Reviewed by: adrian, mizhka
Approved by: adrian(mentor)
Differential Revision: https://reviews.freebsd.org/D8557
Bit identifier of printf %b is octal integer, but not decimal. ULRI bit is
13-th bit (starting with 0) according to MIPS Architecture Volume III v.6.
In this case the bit identifier (starts with 1) should be \16.
Reviewed by: gonzo
Approved by: adrian(mentor)
Differential Revision: https://reviews.freebsd.org/D8516
Add an implementation for pmaps_sync_icache() on MIPS that sync's the
instruction cache on all CPUs via smp_rendezvous() after a debugger
inserts a breakpoint via ptrace(PT_IO).
Tested by: kan (on Creator CI20 running Ingenic JZ4780 SOC)
MFC after: 2 weeks
Sponsored by: DARPA / AFRL
Config7 contains useful fields, for instance, field AR indicating that the D-cache is configured to avoid cache aliases. This patch brings printing of config7 for MIPS 24K, 74K, 1004K.
Reviewed by: adrian
Approved by: adrian (mentor)
Differential Revision: https://reviews.freebsd.org/D8514
Add missing fields ('sr' and 'mc_tls') to 'struct sigcontext'.
The kernel doesn't use 'struct sigcontext' but instead uses 'ucontext_t'
which includes 'mcontext_t' in 'struct sigframe' to build the signal frame.
As a result, this change is not an ABI change but simply making
'struct sigcontext' correct. Note that 'struct sigcontext' is only used
for "Traditional BSD style" signal handlers.
While here, rename the 'xxx' field to '__spare__' to match 'mcontext_t'.
Sponsored by: DARPA, AFRL
All devices:
- add support for rate adaptation via ieee80211_amrr(9);
- use short preamble for transmitted frames when needed;
- multi-bss support:
* for RTL8821AU: 2 VAPs at the same time;
* other: 1 any VAP + 1 sta VAP.
RTL8188CE:
- fix IQ calibration bug (reason of significant speed degradation);
- add h/w crypto acceleration support.
USB:
- A-MPDU Tx support;
- short GI support;
Other:
- add support for RTL8812AU / RTL8821AU chipsets
(a/b/g/n only; no ac yet);
- split merged code into subparts:
* bus glue (usb/*, pci/*, rtl*/usb/*, rtl*/pci/*)
* common (if_rtwn*)
* chip-specific (rtl*/*)
- various other bugfixes.
Due to code reorganization, module names / requirements were changed too:
urtwn urtwnfw -> rtwn rtwn_usb rtwnfw
rtwn rtwnfw -> rtwn rtwn_pci rtwnfw
Tested with RTL8188CE, RTL8188CUS, RTL8188EU and RTL8821AU.
Tested by: kevlo, garga,
Peter Garshtja <peter.garshtja@ambient-md.com>,
Kevin McAleavey <kevin.mcaleavey@knosproject.com>,
Ilias-Dimitrios Vrachnis <id@vrachnis.com>,
<otacilio.neto@bsd.com.br>
Relnotes: yes
When detaching device trees parent devices must be detached prior to
detaching its children. This is because parent devices can have
pointers to the child devices in their softcs which are not
invalidated by device_delete_child(). This can cause use after free
issues and panic().
Device drivers implementing trees, must ensure its detach function
detaches or deletes all its children before returning.
While at it remove now redundant device_detach() calls before
device_delete_child() and device_delete_children(), mostly in
the USB controller drivers.
Tested by: Jan Henrik Sylvester <me@janh.de>
Reviewed by: jhb
Differential Revision: https://reviews.freebsd.org/D8070
MFC after: 2 weeks
with no creative content. Include "lost" changes from git:
o Use /dev/efi instead of /dev/efidev
o Remove redundant NULL checks.
Submitted by: kib@, dim@, zbb@, emaste@
As of r302092, pipe is a wrapper around pipe2 and the pipe syscall is no
longer used. It is included only with the COMPAT_FREEBSD10 kernel option.
Add the compat option to support upgrades from systems with an earlier
userland.
MFC after: 1 week
