MFC 340020: Don't enter DDB for fatal traps before panic by default.

Add a new 'debugger_on_trap' knob separate from 'debugger_on_panic'
and make the calls to kdb_trap() in MD fatal trap handlers prior to
calling panic() conditional on this new knob instead of
'debugger_on_panic'. Disable the new knob by default. Developers who
wish to recover from a fatal fault by adjusting saved register state
and retrying the faulting instruction can still do so by enabling the
new knob. However, for the more common case this makes the user
experience for panics due to a fatal fault match the user experience
for other panics, e.g. 'c' in DDB will generate a crash dump and
reboot the system rather than being stuck in an infinite loop of fatal
fault messages and DDB prompts.

MFC r333667: followup to r332730/r332752: set kdb_why to "trap" for fatal traps

This change updates arm, arm64 and mips achitectures. Additionally, it
removes redundant checks for kdb_active where it already results in
kdb_reenter() and adds kdb_reenter() calls where they were missing.

Some architectures check the return value of kdb_trap(), but some don't.
I haven't changed any of that.

Some trap handling routines have a return code. I am not sure if I
provided correct ones for returns after kdb_reenter(). kdb_reenter
should never return unless kdb_jmpbufp is NULL for some reason.

MFC r328467:

Implement mitigation for Spectre version 2 attacks on ARMv7.

MFC r317055,r317056 (glebius): Include sys/vmmeter.h as included

r317055: All these files need sys/vmmeter.h, but now they got it implicitly
included via sys/pcpu.h.

r317056: Typo!

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Include machine/acle-compat.h in cdefs.h on arm if the compiler doesn't
have ACLE support built in. The ACLE (ARM C Language Extensions) defines
a set of standardized symbols which indicate the architecture version and
features available. ACLE support is built in to modern compilers (both
clang and gcc), but absent from gcc prior to 4.4.

ARM (the company) provides the acle-compat.h header file to define the
right symbols for older versions of gcc. Basically, acle-compat.h does
for arm about the same thing cdefs.h does for freebsd: defines
standardized macros that work no matter which compiler you use. If ARM
hadn't provided this file we would have ended up with a big #ifdef __arm__
section in cdefs.h with our own compatibility shims.

Remove #include <machine/acle-compat.h> from the zillion other places (an
ever-growing list) that it appears. Since style(9) requires sys/types.h
or sys/param.h early in the include list, and both of those lead to
including cdefs.h, only a couple special cases still need to include
acle-compat.h directly.

Loves it: imp

As <machine/vmparam.h> is included from <vm/vm_param.h>, there is no
need to include it explicitly when <vm/vm_param.h> is already included.

Suggested by: alc
Reviewed by: alc
Differential Revision: https://reviews.freebsd.org/D5379

ARM: Introduce new cpu-v4.h header and move all ARMv4 specific code
from cpu-v6.h to it.
Remove unneeded cpu-v6.h includes.

Replace broken implementation of fuswintr() and suswintr() by functions
which return -1 as well as on tier 1 archs. Remove block_userspace_access
used only in these implementations.

(1) These functions may be called in interrupt context and pcb_onfault
can be already set in this time. Thus, prior pcb_onfault must be saved
and restored afterwards.

(2) The check that an abort came either from nested interrupt or while
in critical section or holding not sleepable lock must be avoided for
this case.

These functions are called only for profiling reason, so there will be
only small gain by making the code more complex.

Small rearrangement of abort_handler().

(1) Move cnt.v_trap increment to the beginning. There is cnt.v_vm_faults
counter in vm_fault(), so a number of hardware emulation aborts may be
get roughly as difference.
(2) Move kdb_reenter() up to not be ignored if pmap_fault() has failed.
(3) Update comments.

ARM: remove old pmap-v6 code. The new pmap-v6 is mature enough, and
dual implementation is showstopper for major cleanup.

This patch only removes old code from tree. Cleanups will follow asap.

Make pmap_fault() return values vm subsystem compliant to
simplify their handling in abort_handler(). While here,
remove one extra initialization of pcb variable.

Introduce support for HW watchpoints and single stepping for ARMv6/v7

Allows for using hardware watchpoints for 1, 2, 4, 8 byte long addresses.
The default configuration of watchpoint is RW but code allows to select
RO or WO and X.
Since debugging registers are per-CPU (CP14) the watchpoint is set on
the CPU that was lucky (or not) to enter DDB.

HW breakpoints are used to perform single step in KDB.
When HW breakpoint is enabled all watchpoints are temporary disabled
to avoid recursive abort on both watchpoint and breakpoint.
In case of branch, the breakpoint is set to both - next instruction
and possible branch address. This requires at least 2 breakpoints
supported in the CPU however this is a must for ARMv6/v7 CPUs.

Reviewed by: imp
Submitted by: Zbigniew Bodek <zbb@semihalf.com>
Obtained from: Semihalf
Sponsored by: Juniper Networks Inc.
Differential Revision: https://reviews.freebsd.org/D4037

Move the check to see if we are tracing a function with the DTrace Function
Boundary Trace to assembly to reduce the overhead of these checks.

Submitted by: Howard Su <howard0su@gmail.com>
Relnotes: Yes
Differential Revision: https://reviews.freebsd.org/D4266

Add usermode variable to KTR output. Fix style.

Approved by: kib (mentor)

Make usermode variable the bool type. It's already used that way.

Suggested by: kib
Approved by: kib (mentor)

Set correct code for signal in abort_align() routine.
Remove superfluous printf() and both unnecessary and obsolete comments.

Approved by: kib (mentor)

Fix comment about unpriviledged instructions. Now, it matches with
current state after r289372.

While here, do some style and comment cleanups. No functional changes.

Approved by: kib (mentor)

Do not hold the process around the vm_fault() call from the trap()s.
The only operation which is prevented by the hold is the kernel stack
swapout for the faulted thread, which should be fine to allow.

Remove useless checks for NULL curproc or curproc->p_vmspace from the
trap_pfault() wrappers on x86 and powerpc.

Reviewed by: alc (previous version)
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks

Always send a SIGSEGV on a map failure. Use the code to tell the reason
for the signal.

Sponsored by: ABT Systems Ltd

Generalised support for copy-on-write structures shared by threads.

Thread credentials are maintained as follows: each thread has a pointer to
creds and a reference on them. The pointer is compared with proc's creds on
userspace<->kernel boundary and updated if needed.

This patch introduces a counter which can be compared instead, so that more
structures can use this scheme without adding more comparisons on the boundary.

Better handling of userland sysarch() requests to flush icache.

On armv6, cache maintenance can trigger page faults. Add handling so that
these turn into SIGSEGV that kills the process rather than panics that kill
the kernel.

Differential Revision: https://reviews.freebsd.org/D2035
Submitted by: Michal Meloun <meloun@miracle.cz>

Use cp15_ifar_get to get the instruction fault address. When using Thumb-2
the instruction may be over two pages so the program counter could point
to the wrong page.

Add last_fault_code used in pmap-v6.c if kernel is compiled with "option DEBUG"

Add a new trap-v6.c which has support for all armv7 exceptions. This
mostly paves the way for the new pmap code, and shouldn't result in any
noticible behavior differences.

Submitted by: Svatopluk Kraus <onwahe@gmail.com>,
Michal Meloun <meloun@miracle.cz