summaryrefslogtreecommitdiff
path: root/sys/arch/amd64
AgeCommit message (Collapse)Author
2018-08-19Add kcov(4), a kernel code coverage tracing driver. It's used in conjunctionanton
with the syzkaller kernel fuzzer. So far, 8 distinct panics have been found and fixed. This effort will continue. kcov is limited to architectures using Clang as their default compiler and is not enabled by default. With help from mpi@, thanks! ok kettenis@ mpi@ visa@
2018-08-19Add support for multiple PCI segments. Only really implemented for arm64Mark Kettenis
for now as amd64/i386 firmware still caters for legacy OSes that only support a single PCI segment. ok patrick@
2018-08-15add cpuid and msr bits fromJonathan Gray
'Deep Dive: CPUID Enumeration and Architectural MSRs' ok deraadt@
2018-08-14spelling errorTheo de Raadt
2018-08-10Bump boot loader versions for softraid passphrase handling change.Joel Sing
2018-08-10Retry on incorrect passphrase for softraid crypto boot.Joel Sing
Historically, the softraid crypto support in the boot loaders has only given one attempt to provide the correct passphrase. There were a few reasons for this, including the fact that pkcs5_pbkdf2() allows an empty passphrase and that returning EPERM allowed for another attempt. With the event of KARL and the need for bsd.booted with hibernate resumption, this becomes much more of an issue - if you get the passphrase wrong you fail to resume. There are also other situations like using /etc/boot.conf to switch serial console, but an incorrect passphrase results in the config not being read. Also, bcrypt_pbkdf() does not permit empty passphrases. This reworks the softraid crypto support in the boot loaders so that it loops requesting a valid passphrase until one is provided, or an empty passphrase is entered (at which point it will abort). ok mortimer@ tb@
2018-08-08Recognise 'Speculative Store Bypass Disable' support cpuid bit.Jonathan Gray
Documented in 'Speculative Execution Side Channel Mitigations' revision 2.0.
2018-08-03Add mue(4), a driver for Microchip LAN75xx/LAN78xx 10/100/1000 USB EthernetKevin Lo
adapters. "go ahead commit it" deraadt@
2018-08-01On AMD CPUs, If the LFENCE serialization MSR bit is already set, thenBryan Steele
we don't need to uncondtionally set it. Worksaround a suspected bug in newer Linux KVM, which may trigger a #GP fault on writes to this MSR. ok mlarkin@
2018-07-30When converting the bios memory map to memory clusters, clip segments atJonathan Matthew
the 512GB mark as the direct map cannot address memory past that point. ok kettenis@ (quite a while ago)
2018-07-27Use the MI interrupt enable/distable API instead of the MD one on amd64 andMark Kettenis
remove the MD API. ok guenther@, deraadt@, mpi@
2018-07-26Remove CPUID insn_length checkjob
Don't allow unprivileged users to crash things from ring 3 Thanks to William McCall for the patch! OK mlarkin@
2018-07-24Fix previous commit: the RSB refill bits change %rcx so it needed to bePhilip Guenther
given an input/output ASM constraint...but I made it output-only, so the compiler deleted the initialization. reported by many, starting with Edd Barrett (edd(at)theunixzoo.co.uk)
2018-07-24Also do RSB refilling when context switching, after vmexits, andPhilip Guenther
when vmlaunch or vmresume fails. Follow the lead of clang and the intel recommendation and do an lfence after the pause in the speculation-stop path for retpoline, RSB refill, and meltover ASM bits. ok kettenis@ deraadt@
2018-07-23Add "Mitigation G-2" per AMD's Whitepaper "Software Techniques forBryan Steele
Managing Speculation on AMD Processors" By setting MSR C001_1029[1]=1, LFENCE becomes a dispatch serializing instruction. Tested on AMD FX-4100 "Bulldozer", and Linux guest in SVM vmd(8) ok deraadt@ mlarkin@
2018-07-23Do "Return stack refilling", based on the "Return stack underflow" discussionPhilip Guenther
and its associated appendix at https://support.google.com/faqs/answer/7625886 This should address at least some cases of "SpectreRSB" and earlier Spectre variants; more commits to follow. The refilling is done in the enter-kernel-from-userspace and return-to-userspace-from-kernel paths, making sure to do it before unblocking interrupts so that a successive interrupt can't get the CPU to C code without doing this refill. Per the link above, it also does it immediately after mwait, apparently in case the low-power CPU states of idle-via-mwait flush the RSB. ok mlarkin@ deraadt@
2018-07-21Remove the "got meltdown?" conditional from INTRENTRY by doing itPhilip Guenther
unconditionally and codepatching it out on CPUs that don't need/do the mitigation. Align the from-{kernel,userspace} targets in INTRENTRY with _ALIGN_TRAPS Align x2apic_eoi using KUENTRY() instead of the artisinal segment+label+.globl bits it uses currently s/testq/testb/ for SEL_RPL checks ok kettenis@ mlarkin@
2018-07-13Disable codepatching infrastructure after bootStefan Fritsch
This way, it is not available for use in ROP attacks. This diff puts the codepatching code into a separate section and unmaps that section after boot. In the future, the memory could potentially be reused but that would require larger changes. ok pguenther@
2018-07-13repair inconsistanciesTheo de Raadt
2018-07-13zap some garbage that snuck in.Theo Buehler
spotted by kevlo
2018-07-12we will be toggling witness on/off a few times. when it is on, it raisesTheo de Raadt
awareness of problems. when it is off, development cycles are faster. let's do the faster cycle for a little while. discussion with naddy
2018-07-12zap an extra newlineMike Larkin
2018-07-12Unbreak the nmi handler (again): I placed INTR_CLEAR_GPRS in the wrongPhilip Guenther
place and GS.base was horked on return. Also, the frame passed to ddb didn't have the %rbp<-->tf_err swap, which would have confused backtraces. Now if we can just come up with a way to automate testing the NMI handler with qemu...
2018-07-12Reorganize the Meltdown entry and exit trampolines for syscall andPhilip Guenther
traps so that the "mov %rax,%cr3" is followed by an infinite loop which is avoided because the mapping of the code being executed is changed. This means the sysretq/iretq isn't even present in that flow of instructions in the kernel mapping, so userspace code can't be speculatively reached on the kernel mapping and totally eliminates the conditional jump over the the %cr3 change that supported CPUs without the Meltdown vulnerability. The return paths were probably vulnerable to Spectre v1 (and v1.1/1.2) style attacks, speculatively executing user code post-system-call with the kernel mappings, thus creating cache/TLB/etc side-effects. Would like to apply this technique to the interrupt stubs too, but I'm hitting a bug in clang's assembler which misaligns the code and symbols. While here, when on a CPU not vulnerable to Meltdown, codepatch out the unnecessary bits in cpu_switchto(). Inspiration from sf@, refined over dinner with theo ok mlarkin@ deraadt@
2018-07-12Remove cases for 1-bit and 4-bit color depths in efifb_ioctl(), as weFrederic Cambus
basically can't run in those modes. OK kettenis@
2018-07-12Stop building rasops4 on amd64.Frederic Cambus
It was pulled in for efifb, but it is extremely unlikely an EFI system supporting only 4-bit color depth (16 colors) exists. Even if it existed though, on SMALL_KERNEL rasops4_putchar() simply returns EAGAIN so it would not be possible to install the system. For the record, we do not build rasops4 on i386 or on any of our other platforms either. OK kettenis@, mpi@
2018-07-12zap a blank lineMike Larkin
2018-07-12vmm(8)/vmm(4): send a copy of the guest register state to vmd on exit,Mike Larkin
avoiding multiple readregs ioctls back to vmm in case register content is needed subsequently. ok phessler
2018-07-11Declare cpu_meltdown in <machine/cpu.h>Philip Guenther
2018-07-11adding __func__ identifier to panic() calls in vmm.c for amd64 and i386Nayden Markatchev
ok mlarkin@
2018-07-11Detect vmm(4) in the bootloader and automatically switch to the serialMike Larkin
console at 115200 baud. tested by phessler and myself, ok deraadt
2018-07-11vmm(4): return proper cache topology for cpuid(0x4)Mike Larkin
Make the cache neighbor fields match the number of VCPUs present (currently 1) ok reyk
2018-07-11vmm(4): respect argument size when reading from undefined ports.Mike Larkin
2018-07-11vmm(4): small cleanup in vm_rwregs.Mike Larkin
Clarify error values and change a panic into a debug printf (which will in turn just kill the VM).
2018-07-10In asm.h ensure NENTRY uses the old-school nop-sled align, but change standardTheo de Raadt
ENTRY is a trapsled. Fix a few functions which fall-through into an ENTRY macro. amd64 binaries now are free of double+-nop sequences (except for one assember nit in aes-586.pl). Previous changes by guenther got us here. ok mortimer kettenis
2018-07-10vmm(4): remove a wrong commentMike Larkin
2018-07-10Drop the ignored selectors (tf_[defg]s) from the trap and interrupt frames.Philip Guenther
ok mlarkin@ deraadt@ mpi@ kettenis@
2018-07-10Move from sendsig() to its callers the initsiginfo() calls andPhilip Guenther
instead of passing sendsig() the code+type+val, pass a siginfo_t* to copy from. Eliminate the indirection through struct emul for sendsig(); we no longer have a SunOS4-compat version of sendsig() ok deraadt@
2018-07-09vmm(4): prohibit setting/clearing invalid bits in %cr0/%cr4. This wasMike Larkin
previously caught later but resulted in a guest termination, now we use #GP as the SDM recommends.
2018-07-09Mark the i8254 clock interrupt MPSAFE. It isn't, but it doesn't matterMark Kettenis
as it is impossoble to run an anything but a single-CPU machine with it. ok mpi@, guenther@
2018-07-09Delete the VM86 kernel option and i386_vm86(3) API: it's requiredPhilip Guenther
a custom kernel for over 20 years. testing mlarkin@ ok deraadt@ phessler@ jca@ matthieu@
2018-07-09vmm(4): inject #UD on vmx instructions, instead of dropping into theMike Larkin
unhandled exit function. ok phessler
2018-07-09Rest the FPU's fcw and mxcsr before initializing the "FPU reset state" areaPhilip Guenther
problem discovered on bluhm@'s old opteron ok deraadt@ kettenis@
2018-07-09Add retguard macros to aes_intel.mortimer
ok sthen@
2018-07-09Use a slightly more efficient zeroing idiom when clearing GPRsPhilip Guenther
ok mlarkin@ mortimer@
2018-07-06Fix efiboot not to panic when a serial which does not exist actuallyYASUOKA Masahiko
is specified as the console. Current implementation can't assume the given device is proved at the callback functions if the system has one serial device at least.
2018-07-06Split trap() into kerntrap() and usertrap(), with all the signal generationPhilip Guenther
in a compact block in the latter. ok deraadt@ mlarkin@
2018-07-05backout r1.11 "Add retguard macros for kernel asm", ok deraadtStuart Henderson
after starting iked kernel enters ddb with: Stopped at aesni_ctr_enc+0xd8: int $3
2018-07-05forgot to commit vmmvar.h needed by previous two commits, thanks ccardenasMike Larkin
for noticing.
2018-07-05vmm(4): print guest vcpu mode and cpl in debug output if VM crashesMike Larkin
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-24 04:29:30 +0000