VM_PROT_READ|VM_PROT_EXECUTE. The previous default (VM_PROT_ALL)
would cause the following scenario:
- someone attempts to write kernel text (my test was writing
to an offset of /dev/kmem which was known to be in the text
segment, while in single-user mode).
- enter trap() with MMU fault (because of RO pte).
- trap() calls vm_fault(), which looks up vm_map_entry for
fauling address.
- vm_fault interprets write fault and VM_PROT_WRITE (in VM_PROT_ALL)
as COW; new page allocated, data copied to new page, new page
mapped in at trunc_page(<faulting va>).
- wow, look at the fireworks!
Fixes two potential symptoms:
- kernacc() returns TRUE when checking for permission to write
an offset in kernel text, which is bogus, since the text has
been mapped RO by pmap_bootstrap().
- Handling of a stray pointer that attempted to scribble into
kernel text would not be executed properly.
don't do this, kernacc() will bogusly return TRUE for page 0, causing a
NULL pointer dereference in uiomove() when reading /dev/kmem.
Thanks to Scott Reynolds for noticing the problem.
Still untested on -1260/-1230, and hangs when enforcing SFAS_NO_DMA on 2060;
but works with DMA on the latter.
Still untested in a NetBSD-12A environment. (Sorry, don't have the hardware
myself.)
Thanks to Laurent Baroukh for being the guinea pig, and to Jerome Lovy
for forwarding the hardware information Phase V gave him, and to Phase
V for providing it.
- Rename EX_NOBLOB to EX_NOCOALESCE; it's much more descriptive of
what's going on.
- Use ALIGN(), rather than our homegrown EXTENT_ALIGN(), when dealing
with map overhead. Privatize the EXTENT_ALIGN() macro; there's no need
to export it.
- Implement EX_BOUNDZERO flag. This changes the boundary line policy in
extent_alloc() and extent_alloc_subregion(); boundary lines are
computed relative to 0, rather then the start of the extent.
- Add a new flag to specify that it's ok to wait for space in the
extent: EX_WAITSPACE.
- Add some whitespace in the function prototypes.
- Rename EX_NOBLOB to EX_NOCOALESCE; it's much more descriptive of
what's going on.
- In extent_free_region_descriptor(), if we're a fixed extent,
freeing a dynamically allocated region descriptor, and someone
is waiting on the freelist, let the waiter have it, rather than
free'ing it back to the system.
- Use ALIGN(), rather than our homegrown EXTENT_ALIGN(), when dealing
with map overhead. Privatize the EXTENT_ALIGN() macro; there's no need
to export it.
- Implement EX_BOUNDZERO flag. This changes the boundary line policy in
extent_alloc() and extent_alloc_subregion(); boundary lines are
computed relative to 0, rather then the start of the extent.
- Fix a nasty race between multiple participants doing region and
descriptor allocation.
- Add a new flag to specify that it's ok to wait for space in the
extent: EX_WAITSPACE.
- Blow away an unnecessary splhigh()/splx().
- Put a bunch of sanity code inside #ifdef DIAGNOSTIC/#endif.
- Fix up usage of MBD_ISPID(). (from Jason Thorpe)
- Be careful not to deref bad pointers in the MMU fault handler. (ditto)
- Ensure trap() never deals with a NULL proc, and if our proc has
no pcb, punt. (Suggested by Gordon Ross)
- Initialize proc0.p_addr just after setting up the kernel stack, to avoid
getting NULL pointers in trap(). Change suggested by Gordon Ross.
- Panic if main() returns.
prototypes, and suppress a bogus "might be used uninitialized" warning.
It's clear from reading the logic of the function that produces the
warning that the variable will not be used uninitialized, but the
compiler just isn't smart enough, I guess. Marked XXX for future reference.
create an assembly label, and SYSCALLNUM to convert a syscall name into
the macro that's defined to be its number. Add a CALLSYS_NOERROR macro
which invokes the named system call. (CALLSYS_NOERROR is here since
it's used in locore, for sigcode.)
restart if we get multiple status interrupts before the softintr()
routine gets a chance to run. The fix is to determine and accumulate
status line changes at the H/W interrupt level, and then check and zero
the accumulated changes when the softint() finally runs. Many thanks
to Bill Studenmund <wrstuden@loki.stanford.edu> for finding and fixing.
* kill scc_tty[] and needs-count.
* Add usable-when-cold version of sccparam().
* Add pre-autconf() console initialization entrypoint.
* remove lint for gcc -Wall
* wbflush() -> tc_mb()
all but the last of which have been fed through cgd and committed to the
Alpha scc driver.
code as video memory must be reserved from main memory for the display.
In addition this adds generic support for using DRAM for video memory
on all machines. All video memory accessing should use the video_memory_t
structure.
Added support for the RC7500 motherboard. The RC7500 support includes a
replacement init_arm() function. This also supports the RC7500 prom debug
monitor for debugging the kernel boot.
dumps now work so call dumpsys() following a panic.
Added support for the SA110. This mainly consists of making sure the data
cache is cleaned when appropriate and that the instruction cache is
kept in sync during the bootstrap and when signal handlers are built on
the stack.
Use a larger UND32 mode stack if we are configured for KGDB.
Remove KERNEL_PT_KSTACK references as these should have died with the
removal of double mapped kstacks eons ago.
Make sure we call doshutdownhooks() if boot is called while we are still
cold.
Cleaned up prototypes declarations.
Sorted out comment indentation.
autoconfiguration. It clears the RPB's per-cpu-slot BIP flag and
sets up the RPB's restore_term and restart vectors, etc. add a
console_restart() function, which causes a panic and system dump,
that is invoked (indirectly) via those vectors.
eventually, the restart HWRPB vector), which calls console_restart. This
is invoked when the console halt switch is used and the user enters 'c'
at the console prompt, and eventually causes a system crash dump to be
generated.
clean and tlb flush code along with write buffer drains that are
dependant on the definition of CPU_SA110.
The memory reserved for the L1 pagetables is now wired into the memory map
during the pmap_init rather than at L1 pagetable allocation time.
The L1 pages tables are zeroed during initialisation and when they are
released rather than when they are allocated.
When searching for a free L1 page table start search at the page table
after the last one allocated rather than always starting from the first one.
Added some extra DIAGNOSTIC checks for invalidate page index numbers.
Removed some old debugging code that escaped the last clean up.
Idented comments in line with code.
The irq delivery code has been rewritten. On entry to the irq vector the
processor is switched to SVC32 mode so all interrupt routines now run
in SVC32 mode rather than IRQ32 mode. This fixes lots of irq re-enabling
problems.
Interrupt latency times are now vastly improved for high priority interrupts.
Cleaned up calling ast() before returning to USR32 mode (don't need to
mess about with trapframe copying.
Cleaned up all the comments and sorted out their indentation.
Rewritten the soft interrupt delivery code.
Added generic ARM7500 support rather than just RC7500 support.
of using it directly, use a local, and set that local to be curproc
if curproc is not NULL else a pointer to process 0's proc struct.
If syncing disks while handling a panic that occurred while 'curproc'
was NULL, the old code would dereference NULL and die.
ktrace context switch checking. If syncing disks while handling a panic
that occurred while 'curproc' was NULL, the old code would dereference
NULL and die. The (slight) reorganization was done so that space (one extra
splhigh()), rather than time (one extra comparison), would be wasted.
Added support for the SA110. This cpu does not need any register fix-ups
following a data abort.
Return valid signal code values on SEGV's. See machine/signal.h for
decoding SEGV signal codes.
required during pagemove() and vmapbuf() and vunmapbuf().
The kernel and undefined mode stack checks are now guarded with
#ifdef STACKCHECKS.
Tidied up comments.
cache needs to be cleans and the instruction and data caches need to
be invalidate along with the instruction and data tlbs when
the TTB is reloaded during a context switch.
if CPU_SA110 is defined. Cache cleaning is different on the SA110 as
the cache is a write back virtual cache and is split for data and instruction.
Also the cache and tlb control instructions use different coprocessor #15
registers.
Removed suspect FPA probing code, instead use the ARM FPE to probe the FPA.
Neatened up the FPE attachment code.
Recognise StrongARM class of cpu.
Updated the fpa instruction bounce handler to expect a 4th argument
when called on an undefined trap to match recent changes made to
undefined handlers.
Add acknowledgement records to the buffer following origin or bounding
box changes.
Removed prototype for strncmp().
Added support for switch mouse reports between absolute and relative
positions.
This, in conjunction with the trap.c changes, solve the crashes when
referencing illegal addresses in the debugger. Thanks Jason for providing
the trigger and solution ;-)
- Re-write panictrap() so that faults generated by the debugger can be
handled by the debugger.
- Add a small bit of extra checking to the MMU_FAULT case, to make it more
robust against pieces of the proc-structure being NULL (Jason Thorpe)
- If p == NULL at the entry of trap(), assign proc0 to it. Fixes a *lot* of
NULL-pointer dereferences. (Gordon Ross)
immediately reasserted before we get a chance to process the interrupt,
we can inadvertantly get stuck with zs_tx_stopped set. Move the delta
detection to the hard zs interrupt handler; the softint handler
will notice that something has happened with CTS and restart the
transmitter if it's asserted.
brings us closer to basic operation.
- Verified/updated ROM vector entries for many systems, and new vector
table entries for LC 520, LC 575/577/578, and Quadra 950
- Implement a new machine class (MACH_CLASSQ2) for the LC 575 series
- Use the ptest040() helper function in get_physical().
Also, in straytrap(), only enter the debugger #ifdef DDB.
earlier stages of the NetBSD/arm32 development.
Added support for the architecture defined SWI's. Currently
The IMB and IMB-range architecture defined SWI's for the ARM810 are
currently recognised.
Various comments cleaned up.
Added the functions atmoic_set_bit() and atomic_clear_bit() that
can be used for setting and clearings bits atomically (need interrupts
to be turned off).
GPROF and PROFILE_ASM are defined.
Register usage has been changed to avoid using r11. This means we have
one less register to save during this function.
booting.
After assembling the post FP processing callback branch call
sync_icache() if CPU_SA110 is defined.
Return a valid signal code when raising a SIGFPE exception so
the cause of the SIGFPE can be determined.
Added the functions arm_fpe_getcontext() and arm_fpe_setcontext()
to obtain the FP context in a FPE independant form for the ptrace()
syscall.
In db_write_text() call sync_caches() after modifing the text area
if CPU_SA110 is defined.
Added a new machine command "frame" to print out a trapframe.
Trap the kernel break point instruction specifically and panic on
any other undefined instruction being executed in SVC mode.
motherboard.
Cleaned up a lot of code to match KNF.
When the device is attach the vidc refclk frequency is reported along
with the amount of video memory and the type.
go wrong when console blanking occurs while X is running.
The blanktime ioctl now allows blanking times to be set, force
immediate blanking or diable blanking on a per virtual console basis.
Updated the console version number to revision D.
number field and an core identity string pointer.
Labels are now defined for all the entry points in the core header
structure so that the linker can relocate the branches to the core.
The core entry points are now branch instructions relative to the
start of the core so the address of the core function does not have to
be calcuated are call time.
Define the two new fields added to the FPE core header in
the arm_fpe_mod_hdr_t structure.
Added prototypes for arm_fpe_getcontext() and arm_fpe_setcontext().
Updated the prototypes for arm_fpe_core_loadcontext() and
arm_fpe_core_savecontext() to pass a fp_context_frame pointer.
CPU_SA110 and CPU_LATE_ABORT.
Updated the CLKF_INTR() macro for changes made to the interrupt system.
Updated some of the CPU ID codes.
Added the CPU ID for the ARM8.
This is for an Acorn A7000 machine with an ARM7500 CPU and no VRAM.
This config should also work for other ARM7500 machines with an
architecture that matches Acorns.
Make fp_reg_t a typedef of fp_extended_precision_t.
Rename the fp_state structure to fpe_sp_state as it describes
the single precision FPE state held in the pcb and is internal to the
kernel.
Define a new fp_state structure that is for user access to the fp
state (e.g. via ptrace()).
the AMD AM53CF94 Enhanced SCSI Controller. The code is based on the
SFAS216 driver as these chips are very similar. There are several
differences but more will follow.
Use definitions from this file for match_podule() rather than hardcoded
values.
Added a routine asc_minphys() in preparation for driver changes when on
card DMA support is added.
Use definitions from this file for match_podule() rather than hardcoded
values.
Reset the interface following a bad packet. This fixes some jams when
the driver failed to recover properly after a bad packet.
podule_data.h instead.
Removed the dead function find_podule().
The 0xf5 entry in the podules chunck directory is now searched for and
the podule description associated with this entry is placed in the
description field of the podule structure.
Generally tidied up all the comments.
- Fix up usage of MBD_ISPID().
- Ensure that we never deal with a NULL proc, and if our proc has
no pcb, punt. Suggested by Gordon Ross.
- Eliminate some redundant NULL pointer checks in the T_MMUFLT cases;
proc0.p_addr is now initialized early, and we make a single test
for sanity at the top of trap() now.
- Initialize proc0.p_addr just after setting up the kernel stack, to avoid
getting NULL pointers in trap(). Change suggested by Gordon Ross.
- Panic if main() returns.
- Tidy up a couple of comments.
(remaps page read/write/cache-inhibit, does write, restores previous
mapping). Kernel text no longer needs to be read/write with DDB/KGDB
is in the kernel.
Based on a similar module written for the Sun3 port by Gordon Ross,
and modified somewhat by me.
- Offset kernel text one page. Stash the PA of this offset page for
use later.
- Add a few comments.
- Free up some registers earlier in the initialization process.
- Use a `prototc' to set the Translation Control register, rather
than relying on a2 pointing just past the MMU trampoline in the
high page. (Suggested by Charles Hannum.)
- Set VBR to the kernel vector table just before turning on the MMU.
- Just before rebooting, set VBR to 0, which is what the BOOTROM expects
it to be.
kernel setroot(). The device type for network boot is set like any
other device now. Also, call the punit entry point for device drivers
to properly set `bootdev'.
The "options GENERIC" entry in kernel config files is not longer necessary
for "swap generic" kernels. Uses new config constructs which work with
some glue in an old config environment. This code will support new config
with minimal changes.
an unrecognized keyboard produced garbage on keypresses in the kernel,
but worked in the boot program (which has this default). The bug is
that the keymap pointers are unitialized.
section. Patch come up with by Bob Baron <rvb+@cs.cmu.edu> and myself.
This entire bit of code (the code which sets daddr/dsize and taddr/tsize)
is very bogus, but it's not clear what the 'right' way to fix it is
and this patch fixes a problem preventing some ELF executables from
being run.
mips_r2000_, mips_R2000_ -> mips1_
mips_r4000_, mips_R4000_ -> mips3_
(which are also, for mnemonic reasons, consistent with gcc flag usage,
rather than using mipsI_ and mipsIII_).
Where CACHED_TO_HYS() is still needed for kernel-virtual-to-physical
or physical-to-uncached mapping (fb drivers), replace with
`#include <mips/cpuregs.h>'.
* dcparam() with normal tty t_param interface, which calls
* cold_dcparam() called with explicit dc7085 register address
and flags, which does the work and is also callable when cold,
to set up console (or kgdb) line parameters.
* use mips_round_page,mips_trunc_seg() instead of
pica_round_page(),pica_trunc_page().
* discard (unused) return value from TLBUpdate(), and delete
(unused) temporary variable used to hold it.
* Move mips-I pte (TLBlo) definitions from pmax/include/pte.h
to mips/include/mips1_pte.h
* Move mips-III pte (TLBlo) definitions from pica/include/pte.h
to mips/include/mips3_pte.h
* Add new mips/include/pte.h, which includes exactly one of
mips1_pte.h or mips3_pte.h (which still have namespace collisions),
depending on "options MIPS1" or "options MIPS3". (hack).
Move soft kvtopte(), ptetovk() definitions to mips/include/pte.h
* Add macro PTE_TO_PADDR() to hide the different hardware TLB formats
when mapping from pte to physical address.
* Add macro PTE_READONLY() to hide lack of SW read-only bit in mips-III
tlb. (mips1 pmap uses a sw bit in the PTE, mips3 looks up RO bit in
the kernel pmap.)
* Use macros (not direct TLB frobbing) in mips/trap.c, to make it
mips-1/mips-III indepenndet.
* Change {pmax,pica}/include/pte.h to just do #include <mips/pte.h>.
jump-table) locore entrypoints, so the stack traceback code can use
the end marker to handle entry points specially when doing tracebacks,
even if it doesn't know about them explicitly.
* fold in netBSD style changes:
``if (foo = bar)'' -> ``if ((foo = bar) != 0)''
* add mips1 vector as well as mips3 vector
* change vector names to make mips1 and mips3 locore entrpoints distinct
* add pmax additions (e.g., old fixes to ktrace code, kernel-TLB_miss
instrumentation)
* update stack traceback code to a newer version of the pmax code.
add catch-all case, with distinct mips1 and mips3 ranges for locore
entry points, cases to catch othewise-unknown locore entrypoints and
vector code (which have special entry sequences and require special
support to trace through). The relevant mips1 and mips3 functions are
of course now distinct.
NetBSD-current changes:
* change include paths to be relative to the kernel-source tree
(e.g., `/sys') instead of arch/pmax/conf.
* add explicit options for exec packages (EXEC_ELF32, EXEC_ECOFF
for COMPAT_ULTRIX)
* comment out references to still-unsuppoted MI scsi.
DEC dc503 cursor chip) into Decstation 2100,3100 cfattach front-end
and ``machine-independent'' back-end.
pm_ds.c: pmin/pmax cfattach front-end
pm.c: bt478, 503 back-end
pmvar.h: declarations of back-end normal and console attach
entry points.
- change uiomove() argument from caddr_t to void *; this was the last caddr_t
in systm.h.
- remove parameter names from the b*() routines to make them look like the
mem*() counterparts.
screen geometry.
- Re-arrange et_loadmode() and et_inittextmode() to write into shadow
register set instead of writing to the card-registers directly.
- provide et_hwsave()/et_hwrest() functions to transfer the card-registers
to and from the shadow set.
ELF_ROUND (round to higher alignment boundary), and use them properly.
Also, change a bit of code in elf_load_psection to use the next ELF_ROUND
macro. This fixes a bug found by Robert Baron <rvb+@cs.cmu.edu> where
elf_load_psection, if given a properly aligned address at which to load
the section, would round actually load it at the next highest alignment
boundary.
Scenario: If ip_insertoptions() prepends a new mbuf to the chain, the
bad: label's m_freem(m0) still would free only the original mbuf chain
if the transmission failed for, e.g., no route to host; resulting in
one lost mbuf per failed packet. (The original posting included a
demonstration program).
Original report of this bug was by jinmei@isl.rdc.toshiba.co.jp
(JINMEI Tatuya) on comp.bugs.4bsd.
is