remove prototypes with no matching function; ok miod@

with empty body loops, put final semicolon on a new line for readability
ok bluhm@ jca@

Remove copystr(9), unless used internally by copy{in,out}str.

Simplfity setregs() by passing it the ps_strings and switching
sys_execve() to return EJUSTRETURN.

setregs() is the MD routine used by sys_execve() to set up the
thread's trapframe and PCB such that, on 'return' to userspace, it
has the register values defined by the ABI and otherwise zero. It
had to set the syscall retval[] values previously because the normal
syscall return path overwrites a couple registers with the retval[]
values. By instead returning EJUSTRETURN that and some complexity
with program-counter handling on m88k and sparc64 goes away.

Also, give setregs() add a 'struct ps_strings *arginfo' argument
so powerpc, powerpc64, and sh can directly get argc/argv/envp
values for registers instead of copyin()ing the one in userspace.

Improvements from miod@ and millert@
Testing assistance miod@, kettenis@, and aoyama@
ok miod@ kettenis@

match other archs use %s for version printf

Change sendsig() interface so that the MD code does not need to access
data from struct process anymore. This changes how siginfo and onstack
are accessed and make sendsig() more MP friendly.
With and OK semarie@ OK kettenis@

spelling

"encoding of diag instructions is hard, let's go shopping"

Clean up things a bit, adding documentation about the source of the
information about these instructions.

From miod@

In case of failure, call sigexit() from trapsignal instead of sensig().

Simplify MD code and reduce the amount of recursion into the signal code
which helps when dealing with locks.

ok cheloha@, deraadt@

hppa also has a similar to arm64: copyout(9), copyinstr(9) and
copyoutstr(9) should bail out properly if they are called with a
length of 0.
ok kettenis@

Implement cpu_rnd_messybits() as a read of the cycle counter register.
ok dlg@ deraadt@

introduce "cpu_rnd_messybits" for use instead of nanotime in dev/rnd.c.

rnd.c uses nanotime to get access to some bits that change quickly
between events that it can mix into the entropy pool. it doesn't
use nanotime to get a monotonically increasing set or ordered and
accurate timestamps, it just wants something with bits that change.

there's been discussions for years about letting rnd use a clock
that's super fast to read, but not necessarily accurate, but it
wasn't until recently that i figured out it wasn't interested in
time at all, so things like keeping a fast clock coherent between
cpu cores or correct according to ntp is unecessary. this means we
can just let rnd read the cycle counters on cpus and things will
be fine. cpus with cycle counters that vary in their speed and
arent kept consistent between cores may even be desirable in this
context.

so this is the first step in converting rnd.c to reading cycle
counter. it copies the nanotime backend to each arch, and they can
replace it with something MD as a second step later on.

djm@ suggested rnd_messybytes, but we landed on cpu_rnd_messybits.
thanks to visa for his eyes.
ok deraadt@ visa@
deraadt@ says he will help handle any MD fallout that occurs.

Make inittodr() and resettodr() MI.

ok deraadt@, mpi@, visa@
ok cheloha@ as well (would have preferred in new file for this code)

Initialize the timeval passed to todr_gettime() with the base time from
the file system such that implementations can use it to guess the right
century.

ok mpi@

Use the same inittodr()/resettodr() implementation as on
amd64/arm64/armv7/i386/sparc64 and move it to the end of machdep.c. Rework the
actual implementation for the MC14818 compatible RTC into something that can
be used as a todr_handle just like on amd64.

ok mpi@

fast track ddb> reboot command to skip anything which might panic again.
ok deraadt

Missed a 'ksi' -> '*ksip' change in previous commit

Move from sendsig() to its callers the initsiginfo() calls and
instead of passing sendsig() the code+type+val, pass a siginfo_t*
to copy from. Eliminate the indirection through struct emul for
sendsig(); we no longer have a SunOS4-compat version of sendsig()

ok deraadt@

Delete antique sigdebug definitions

ok kettenis@

Implement MAP_STACK option for mmap(). Synchronous faults (pagefault and
syscall) confirm the stack register points at MAP_STACK memory, otherwise
SIGSEGV is delivered. sigaltstack() and pthread_attr_setstack() are modified
to create a MAP_STACK sub-region which satisfies alignment requirements.
Observe that MAP_STACK can only be set/cleared by mmap(), which zeroes the
contents of the region -- there is no mprotect() equivalent operation, so
there is no MAP_STACK-adding gadget.
This opportunistic software-emulation of a stack protection bit makes
stack-pivot operations during ROPchain fragile (kind of like removing a
tool from the toolbox).
original discussion with tedu, uvm work by stefan, testing by mortimer
ok kettenis

Delete unnecessary <sys/file.h> includes

ok millert@ krw@

In uvm Chuck decided backing store would not be allocated proactively
for blocks re-fetchable from the filesystem. However at reboot time,
filesystems are unmounted, and since processes lack backing store they
are killed. Since the scheduler is still running, in some cases init is
killed... which drops us to ddb [noted by bluhm]. Solution is to convert
filesystems to read-only [proposed by kettenis]. The tale follows:
sys_reboot() should pass proc * to MD boot() to vfs_shutdown() which
completes current IO with vfs_busy VB_WRITE|VB_WAIT, then calls VFS_MOUNT()
with MNT_UPDATE | MNT_RDONLY, soon teaching us that *fs_mount() calls a
copyin() late... so store the sizes in vfsconflist[] and move the copyin()
to sys_mount()... and notice nfs_mount copyin() is size-variant, so kill
legacy struct nfs_args3. Next we learn ffs_mount()'s MNT_UPDATE code is
sharp and rusty especially wrt softdep, so fix some bugs adn add
~MNT_SOFTDEP to the downgrade. Some vnodes need a little more help,
so tie them to &dead_vnops.

ffs_mount calling DIOCCACHESYNC is causing a bit of grief still but
this issue is seperate and will be dealt with in time.
couple hundred reboots by bluhm and myself, advice from guenther and
others at the hut

Implement copyin32(9).

"your chicken scratches look fine to me" deraadt@

Apply consistency to forever loops with continue and NOTREACHED

Same thought from kettenis@, ok krw@ phessler@ millert@

all pools have their ipl set via pool_setipl, so fold it into pool_init.

the ioff argument to pool_init() is unused and has been for many
years, so this replaces it with an ipl argument. because the ipl
will be set on init we no longer need pool_setipl.

most of these changes have been done with coccinelle using the spatch
below. cocci sucks at formatting code though, so i fixed that by hand.

the manpage and subr_pool.c bits i did myself.

ok tedu@ jmatthew@

@ipl@
expression pp;
expression ipl;
expression s, a, o, f, m, p;
@@
-pool_init(pp, s, a, o, f, m, p);
-pool_setipl(pp, ipl);
+pool_init(pp, s, a, ipl, f, m, p);

hand-massage sendsig() and sys_sigreturn() to be much more similar.
ok guenther kettenis

SROP mitigation. sendsig() stores a (per-process ^ &sigcontext) cookie
inside the sigcontext. sigreturn(2) checks syscall entry was from the
exact PC addr in the (per-process ASLR) sigtramp, verifies the cookie,
and clears it to prevent sigcontext reuse.
not yet tested on landisk, sparc, *88k, socppc.
ok kettenis

pool_setipl for floating point context things

ok kettenis@

Do not call uvm_swap_finicrypt_all() a second time in dumpsys().

ok tedu@, deraadt@, miod@

Move ps_strings "after" the random stackgap. This makes its location a
per-process value, and therefpore turns the VM_PSSTRINGS sysctl into a
per-process one as well. This gets rid of a pointer to the bottom of the
stack at a fixed location. Also clears the road for unmapping the stackgap.

ok deraadt@

retire shutdown hooks; ok deraadt, krw

Remove vmmap; it isn't used.

ok jsing@

Correctly set up the HPMC trap entry: according to the PA-RISC Firmware
Architecture Reference Specification, the sum of the 8 trap entry words
*and* of the payload which address and length are to be set at well-known
positions in the aforementioned trap entry, needs to be zero; the existing
code was only enforcing that the sum of the trap entry words is zero.

This matches what Linux and NetBSD do.

ok kettenis@

Revert limiting physmem to 2GB; the culprit was likely in uvm and uvm has
changed a lot in the last 5 years; verified to work on a 3GB system, in
snapshots for a few weeks already.

implement atomic_{cas,swap}_{uint,ulong,ptr} and
atomic_{add,sub}_{int,long}_nv. sys/atomic.h turns these into the
rest of the atomic api.

on uniprocessor hppa systems "atomic" operations are implemented
as a non-interruptable sequence by disabling all interrupts on the
cpu, doing the operation, and then restoring the interrupt mask.

this isnt enough on MP systems, so we added a global atomic memory
mutex that is taken inside the interrupt disabling above to coordinate
operations between cpus.

this is a lot of overhead though cos mutexes dance around with ipls,
which is unecessary in our case because of the interrupt disabling
that is already done. also, hppa spinlocks are implemented with
ldcw which requires the word it operates on to be 16 byte aligned.
mutexes arent guaranteed to have this alignment so they compensate
by having lots of words inside themselves so they can hit the
appropriate one to use for the ldcw op.

with this in mind, this change pulls __cpu_simple_locks, which are
simply ldcw spinlocks with a 16 byte aligned word, out of
src/sys/arch/hppa/include/lock.h into src/sys/arch/hppa/include/atomic.h
so atomic.h can use them. lock.h includes atomic.h, so it still
gets and provides the same functionality as before.

finally, this also pulls the rwlock cas implementation apart. cas
ops now share the same serialising lock on MP systems as the other
memory operations, and rw_cas is defined as a wrapper around
atomic_cas_uint.

ok kettenis@

Use config_suspend_all(9).

dont rely on mbuf.h to provide pool.h.

ok miod@, who has offerred to help with any MD fallout
ok guenther@

boot(9): Reduce diffs between hppa & hppa64 (& others)

boot(9): Reduce annoying style diffs

- Always use either: ((x & RB_XXX) != 0) or ((x & RB_XXX) == 0) in boolean
context (mostly if (x), or x ? y : z)
- prom_halt() in alpha is confirmed to take int as boolean

Converted by coccinelle. No functional change intended.

boot(9): Cosmetic changes to improve diff'ability.

Cosmetic changes to reduce diffs.

These still need <sys/reboot.h> for the RB_ constants.

reboot(9), panic(9): Call panic(9) for unrecoverable MD H/W errors (NMIs)

Some architectures have ability to detect hardware sanity and notify system
(NMI, firmware callback, etc.). Handle these hardware severe errors, same
as software errors, with panic(9).

According to miod@, SGI IP27 NMI is triggered by pushing some "hidden" button,
which "usual" users/admins don't know. Pushing such a button is "RB_USERREQ"
(human-triggered) in that the button is pushed by a human, but not "RB_USERREQ"
in that no user intervention in system (== no command input) is done. miod@
agreed that changing these from RB_USERREQ to !RB_USERREQ (== panic(9)) is
not a big problem.

OK miod@ kettenis@

boot(9), reboot(9): Migrate MD callers of boot(9) to reboot(9)

I have found that some ports call boot(9) from machine-dependent code to
reboot system. These should be changed to either:

- Sending signal to init(8) to trigger it to shutdown system cleanly, like
acpi(4) does, in cases where found problems don't prevent system from working
immediately, or

- Just doing panic(9) if the situation is severely broken.

For now, just rewrite boot() to reboot(). Actual fixes follow.

Discussed with & OK from kettenis@

Set cold to 1 before executing the DVACT_POWERDOWN handlers when halting or
rebooting a machine, like it is done in the hibernate case.

At least some USB host controller drivers rely on this to busy way instead
of sleeping. Avoid a panic on macppc with an uhci(4) cardbus plugged in.

ok deraadt@, uebayashi@

boot(9): Remove comments about RB_*, "cold", and savectx()

Again remove slightly different comments to reduce diffs. These will be
re-added once boot() become MI and its specification is clearly re-defined.

OK miod@

boot(): Remove comments about RB_TIMEBAD to reduce diffs

RB_TIMEBAD is documented well enough that the comment is not needed. sparc64
does slightly different and its comment is left with XXX.

OK deraadt@ miod@

boot(): Unify declarations

OK deraadt@

Revert previous diff setting cold to 1 on shutdown because it breaks machine
with softraid(4) disks.

softraid(4) is the last real consumer of the doshutdownhooks(9) API and it is
not trivial to convert its hook to a DVACT_POWERDOWN handler since the latter
does not allow to sleep.

Set cold to 1 before executing the DVACT_POWERDOWN handlers when halting or
rebooting a machine, like it is done in the hibernate case.

At least some USB host controller drivers rely on this to busy way instead
of sleeping. Avoid a panic on macppc with an uhci(4) cardbus plugged in.

ok deraadt@, uebayashi@

Format string fixes and removal of -Wno-format for hppa kernels.

Less <uvm/uvm.h>

If the PDC_COPROC call fails, and we are running on a PA 1.1 system, assume
the usual 1.1 coprocessor mask, instead of using zero and having every
userland process dying with signal 4.

The circumstances under which this call fails are unclear and could be
tied to specific PROM version (I have tried overzealous stack alignment and
other tricks, to no avail). Interestingly enough, the 715/75 system which
hits this problem, only triggers it when booting from disk, and never when
booting from network.

This diff is an ugly bandaid until the problem is better understood. Or maybe
it is not worth investigating, seeing that Linux hardcodes the coprocessor
mask and never issues PDC_COPROC calls; I wonder what HP/UX does.

In my tree for over 18 months; "Looks like a nice hack" deraadt@
715/75 system provided by Sebastiaan Indesteege, thanks!

It's been a quarter century: we can assume volatile is present with that name.

ok dlg@ mpi@ deraadt@

Move p_emul and p_sigcode from proc to process.
Tweak the handling of ktrace EMUL when changing ktracing: only
generate one per process (not one per thread) and pass the correct
proc pointer down to the VFS layer. Permit generating of NAMI and
CSW records inside ktrace(2) itself.

ok deraadt@ millert@

Move p_sigacts from struct proc to struct process.

testing help mpi@

get rid of the assumption that the head of the alldevs list is the
"mainbus" device. this breaks when mpath is enabled because it
attaches before mainbus and therefore takes the head position.

have autoconf provide device_mainbus() which looks up mainbus_cd,
and use that instead.

discussed with deraadt who just wants mpath stuff to move forward
despite there being many ways to shine this particular turd.

Run doshutdownhooks() and config_suspend() even when boot() is called while
cold != 0. Indent and make hppa/hppa64 boot() closer to others.

OK kettenis@

In boot(), do not iterate over alldevs if it's empty (i.e. halting from ddb
with ddb entered early with boot -d or from UKC).

final removal of daddr64_t. daddr_t has been 64 bit for a long enough
test period; i think 3 years ago the last bugs fell out.
ok otto beck others

Determine whether we're currently on the alternative signal stack
dynamically, by comparing the stack pointer against the altstack
base and size, so that you get the correct answer if you longjmp
out of the signal handler, as tested by regress/sys/kern/stackjmp/.
Also, fix alt stack handling on vax, where it was completely broken.

Testing and corrections by miod@, krw@, tobiasu@, pirofti@

Properly clear trap frame in setregs() to avoid leaking registers across exec.

ok jsing@

Revamp the sequences for suspend/hibernate -> resume so that the code
paths are reflexive. It is now possible to fail part-way through a
suspend sequence, and recover along the resume code path.
Split DVACT_SUSPEND by adding a new DVACT_POWERDOWN method is used
after hibernate (and suspend too) to finish the job. Some drivers
must be converted at the same time to use this instead of shutdown hooks
(the others will follow at a later time)
ok kettenis mlarkin

Align the stack on a 64-byte boundary as required by "The 32-bit PA-RISC
Run-time Architecture Document". GCC relies on this to properly align
stack variables.

ok guenther@, beck@

__tfork() needs to set the stack address of the new thread in the kernel,
so that it can't get a signal while still running on the parent thread's
stack. Also, pass in sizeof(struct __tfork) to provide forward compat
when more members are added. This is an ABI change, so switch syscall
numbers and bump lib majors this time.

ok deraadt@ matthew@

Clear RB_POWERDOWN early in boot() on systems which can not powerdown and
which firmware does not send spin up commands to the disks, in case the
operator changes his mind and reboots instead of manually powering down
after the system has halted.
ok kettenis@

Recommit the reverted sigacts change now that the NFS use-after-free
problem has been tracked down. This fixes the sharing of the signal
handling state: shared bits go in sigacts, per-rthread bits goes in
struct proc.

ok deraadt@

if_downall() cannot be done MI in sys_reboot() because vfs_shutdown()
might need network (ie. nfs). Move the call to the MD boot() routines.
This cause for boot hangs diagnosed by kettenis.

Move the bufcachepercent setting code to MI locations -- set it to 42%
for now; that is unlikely to hit some of the remaining starvation bugs.
Repair the bufpages calculation too; i386 was doing it ahead of time
(incorrectly) and then re-calculating it.
ok thib

Revert the sigacts diff: NFS can apparently retain pointers to processes
until they're zombies and then send them signals (for intr mounts). Until
that is untangled, the sigacts change is unsafe. sthen@ was the victim
for this one

Correct the sharing of the signal handling state: stuff that should
be shared (p_sigignore, p_sigcatch, P_NOCLDSTOP, P_NOCLDWAIT) moves
to struct sigacts, wihle stuff that should be per rthread (ps_oldmask,
SAS_OLDMASK, ps_sigstk) moves to struct proc. Treat the coredumping
state bits (ps_sig, ps_code, ps_type, ps_sigval) as per-rthread
until our locking around coredumping is better.

Oh, and remove the old SunOS-compat ps_usertramp member.

"I like the sound of this" tedu@

Halt secondary CPUs when shutting down or rebooting. This should prevent
occasional hangs during reboot.

ok kettenis@

- de-register. no binary change.

ok jsing@

Move setting cpu_hzticks to the clock initialization function, like
other ports (e.g. hppa64) do.

ok jsing@ kettenis@

- ansify

ok jsing@ kettenis@

Turn signotify() into a function that also calls cpu_unidle().

ok kettenis@

This is a first step towards getting rid of avail_start and avail_end in the
kernel, currently limited to low-hanging fruit: these variables were used
by bus_dma to specify the range in which to allocate memory, back when
uvm_pglistalloc() was stupid and would not walk the vm_physseg[].

Nowadays, except on some platforms for early initialization, these variables
are not used, or do not need to be global variables. Therefore:
- remove `extern' declarations of avail_start and avail_end (or close cousins,
such as arm physical_start and physical_end) from files which no longer need
to use them.
- make them local variables whenever possible.
- remove them when they are assigned to but no longer used.

Create a struct to store FP state and include a pointer to the CPU that
currently holds the FPU context for this process. This will be soon used
to implement FPU shootdowns on multiprocessor kernels.

ok kettenis@

Remove COMPAT_HPUX. No one wanted to support it and its fewmets were
blocking other cleanups
ok miod@

Factor out code used to save and flushe process FPU context.

ok kettenis@

Store pointer to process FPU state in struct cpu_info.

ok kettenis@

uvm constraints. Add two mandatory MD symbols, uvm_md_constraints
which contains the constraints for DMA/memory allocation for each
architecture, and dma_constraints which contains the range of addresses
that are dma accessable by the system.

This is based on ariane@'s physcontig diff, with lots of bugfixes and
additions the following additions by my self:

Introduce a new function pool_set_constraints() which sets the address
range for which we allocate pages for the pool from, this is now used
for the mbuf/mbuf cluster pools to keep them dma accessible.

The !direct archs no longer stuff pages into the kernel object in
uvm_km_getpage_pla but rather do a pmap_extract() in uvm_km_putpages.

Tested heavily by my self on i386, amd64 and sparc64. Some tests on
alpha and SGI.

"commit it" beck, art, oga, deraadt
"i like the diff" deraadt

Use a mutex to make atomic operations atomic on multiprocessor kernels.

ok kettenis@

Declare safepri at the MD level on each platform, so that the kern_synch.c
does not have to deal with it as a common. Some platforms may be missed
by this commit... if you spot one, fix it the same way.
ok miod

Move declaration of cn_tab from dev/cons.c to dev/cninit.c, or appropriate
md files for ports which do not use dev/cninit.c. This gets rid of a common
at kernel link time.
feedback drahn@ ok deraadt@

Add missing prototypes
ok jsing kettenis

Prevent "taken branch" exceptions from kernel space by clearing the PSL_T
bit before we enter a signal handler.

"if you say so" miod@, "seems to make sense" jsing@

Properly initialize the members of `struct mdproc' that deal with
single-stepping when we fork and reset them upon exec.

ok miod@

Avoid null-pointer dereference by giving proc0 a place to store its
floating-point registers. Pointed out by Nick Hudson.

ok miod@, jsing@

Make the Processor Status Word (PSW) a per-CPU value.

ok kettenis@

Allow for multiple CPUs by moving to an array of cpu_info.

ok kettenis@

Make cpl and cpu_inintr per CPU variables. For locore.S, cpl becomes an
offset within cpu_primary_info - this will need to be revisited shortly.

ok kettenis@

Do not bother initializing bufpages in the md code if the computation is
exactly the same the mi could will use if bufinit() is invoked with
bufpages == 0.

With the SysV memory allocation changes, allocsys() doesn't do anything
anymore. Get rid of it completely.

Rototill system V message queues.

No longer allocate a static amount of memory for messages in MD
boot path; message queues, message metadata, and message data now
all use dynamic memory, which means that runtime sysctls should now
be trivial to implement.

Since I'm going to be around all week to fix any breakage, this should
probably just go in now.

Dynamic buffer cache support - a re-commit of what was backed out
after c2k9

allows buffer cache to be extended and grow/shrink dynamically

tested by many, ok oga@, "why not just commit it" deraadt@

Get rid of non-equivalent aliases of the pcb by moving the fpu state out
of the pcb and using the p_addr member of 'struct proc' to calculate the
address of the kernel stack when switching to virtual mode after taking a trap.
Remove the now unecessary cache flushes; they're actually harmful since they
create non-equivalent aliases. This seems to fix the memory corruption we
have been observing from time to time.

This diff does not rename fpu_curpcb, which is now somewhat incorrectly named.
I hope to change things back again as soon as we are able to map the pcb 1:1.

Back out all the buffer cache changes I committed during c2k9. This reverts three
commits:

1) The sysctl allowing bufcachepercent to be changed at boot time.
2) The change moving the buffer cache hash chains to a red-black tree
3) The dynamic buffer cache (Which depended on the earlier too).

ok on the backout from marco and todd

add kern.bufcachepercent sysctl to allow adjusting the buffer cache
size on a running system.
ok art@, oga@

Limit the amount of physical memory to 2GB. Using more causes memory
corruption on PA-RISC 2.0 systems (and there are very few PA-RISC 1.1
systems that support more than 2GB).

ok miod@

On systems with split BTLB, do not bother trying to insert DBTLB entries,
as PDC will lie to us pretending it did while it didn't.

ok kettenis@

Unify memory size reports a bit more: always report size in MB, and report
reserved memory on alpha and hppa on its own line (as done on sgi).

Be sure to propagate PSL_O in psw on PCXU* processors to userland processes
and signal handlers.
ok kettenis@

Clear swap encryption keys before dumping a kernel image.

Add new stub uvm_shutdown() and call it from the right place in MD boot()

replace even more ctob and btoc with ptoa and atop respectively plus
uvm_extern.h where needed

Move hppa to __HAVE_TIMECOUNTERS.

Give hppa the blink_led API from sparc64, and the associated machdep.led_blink
sysctl.

Delay switching to the real serial console until we attach the serial device.
The variety of different serial devices is just too big to make a decision up
front. This should make the second serial port on four-digit B/C/J-class
workstation work as a serial console too.

ok miod@

Make sigreturn(2) set the proper space ID for the instruction queue. Fixes
a few more pthreads regression tests.

ok miod@

Don't trust the privilige level in the sigcontext passed to sigreturn(2).

ok miod@

Crank initial storage for extents a bit. We really should allocate extents
using malloc once vm is initialised, but this will do for now.

ok deraadt@

now that all partition size/offsets are potentially 64-bit, change the
type of all variables to daddr64_t. this includes the APIs for XXsize()
and XXdump(), all range checks inside bio drivers, internal variables
for disklabel handling, and even uvm's swap offsets. re-read numerous
times by otto, miod, krw, thib to look for errors

Make sure the minaddr hint for uvm_km_suballoc() calls is always initialized.
ok pedro@

Dynamic buffer cache. Initial diff from mickey@, okay art@ beck@ toby@
deraadt@ dlg@.

Add support for 8700/pcxw2 cpu.

Ask firmware for reset before trying ourselves; needed for four-digit b/c/j
workstations.

tested by otto@, krw@; ok deraadt@

Limit hppa buffer cache to 30%. It used to be 70% because stack garbage
that was used for minaddr instead of the proper vm_map_min(kernel_map)
(fixed in this diff).

From mickey. art@ ok

move hppa to __HAVE_CPUINFO

input from miod@, ok kettenis@

minor nit, use CPU ID instead of FPU ID for BTLB parameters after passing
all kludges

make warning about missing HPT support DEBUG for now

ok mickey@

no more hppa_round_page() and hppa_trunc_page() macros

ok mickey@

We do not need a char machine_arch[] constant.
ok deraadt@

align some stupid comments

set pcsq in case we get signal delivery once interrupted from the gateway page; from chs

do not do some of the initmsgbuf()s job

on some machines it's possible to limit the amount of physmem initialised dring post so having msgbuf at the end of memory shall work

64bit-friendly pdc.h and iomod.h and correspondent changes elsewhere

md parts for hpux_compa code; some problems w/ signals delivery still exist

do not even ask for btlb on 8k cpus as pdc pretends there is some but then it does not work; found w/ Moritz Kiese <mbk@mytum.de> on c180; add a debug print and fix pcxu entry

print real/avail/bufcache sizes as unsigned

disable sid hashing on pcxu and above

a bit larger delays during boot() to let msgs appear

turn totalphysmem into physmem and name old physmem into smth it really is

oops

add pcxu tlb handlers and cpu probing
add u2/uturn ioa driver in dumb mode now
enable pcxu/pcxw support

store fpu version for later use. make sure to proper store/clear fpu state in fork/exec/exit/sendsig

error out from btlb_insert() if there is none

have separate insn and data cache all-flushers

allow forced fpu emulation through a sysctl

8ks do not have hvt

much easier tlb handler branch patching

do not engage HPT on PCXT' (yet)

repair pcxs/t confoosion

update copyright; miod@ is fine w/ files where he holds it too

Ensure that we obey a user's ddb> boot reboot command even if the system
is cold (during startup).

This adds RB_USERREQ to sys/reboot.h, uses it in the ddb commands, and
ensures that */*/machdep.c:boot() won't set RB_HALT when cold if this
flag is set.

ok deraadt@

Simplify hw.{cpuspeed,setperf} api moving all the sysctl stuff
from the underlying callbacks.

Testing hppa mickey@, ppc drahn@
Ok markus@ tedu@

kill debugging code that is not needed anymore

provide cpuspeed fluff

Don't let microtime() return a struct timeval with exactly 1000000 microseconds.

spls do not protect cpu_itmr and thus time might jump back sometimes due to cpu_itmr modified to a higher value than a read itmr; found and testing by miod@

in the real mem print do not include reserved for prom into used by openbsd

for unaligned btlb mapping attempts -- just fail

experimental support for HVT as a 2nd level tlb

less global name space pollution

reload the itmr as soon as we get the intr to avoid lagging on slower machines

some pcxl2 do not report fpus -- assume it's there

a better cpu identification; testing by miod

pdc_model needs to be visible from cpu.c

missing nl in debugging prontf

dead proto

first allocate space on stack then copyout signal shits. add a DEBUG check for a whacky user pc (as impossible due to the recent trap.c change)

clear branch and nullify bits in psw on sending a signal

deduce the leds address from the model number and thus make some more use of that lichtenblinkenschmutz on some more machinens

imprecision in delay_init()

save the fpu state for the signal handler. this is essential
as the fpu regs can be used by the gcc even for non-fpu
means and data copying.
rearrange the sigcontext a bit to include only the general
registers that are needed restoring upon return and thus
less waste of space and make up some space for the fpu regs.

ALL software that used the signal context on the stack
needs at least rebuilding now. a new snap has bin built as well.

string cleaning; krw ok

s/HP9000/HP 9000/; from weissmanndude

knf; mickey ok

How uncommon... hppa only has one common: msgbufmapped (decl'd in /sys/kern)

only align the first stack frame onto the minimal required alignment

fix pcs and pcxt recognition. from weissmanndude

consistantly use uvm_prot_* vs vm_prot_* evewrhere

fix cutnpaste in the cpu table for the itlbna field; from herr weissmanndude

need pdc_hwtlb always; pt out by herr weissmanndude

fix the logic in hvt probing

Remove fetch(9) and store(9) functions from the kernel, and replace the few
remaining instances of them with appropriate copy(9) usage.

ok art@, tested on all arches unless my memory is non-ECC

setregs: put the whole frame setup into one place

level 0x16 is really an l2

Make SysV-style shared memory and semaphore limits sysctl'able.
Instead of allocating a static amount of memory for the data
structures via valloc() in allocsys(), allocate things dynamically
using pool(9) when possible and malloc(9) when not. The various
members of struct seminfo and struct shminfo are in kern.seminfo
and kern.shminfo respectively (not all members of kern.seminfo are
changable).

The data structures used still leave something to be desired but
things are not made worse in that respect by this commit.

no wrapper arounf hardclock(), use CPU_CLOCKUPDATE, real microtime; miod ok

Don't uvm_useracc the user sigcontext in sys_sigreturn and then access
the user addresses directly from the kernel. copyin is faster and can
correctly deal properly with mappings that uvm_useracc thinks are
correct but will fault anyway (to figure out how to generate such
mappings is left as en excercise for the reader).

add a missing delay after printf on halt[-p], proper arg for a cold hook

do not force single-user; pt out by fries@

missing initmsgbuf(), noticed by miod@

track the end of physmem for use in dmmem_alloc

s/PSW_/PSL_/ to match other archs

proper terminate the user stack on signal

on implementations w/ fpu included unimplemented instructions
are signaled through the exception trap w/ invalid opcode marked
instruction in the exception registers, not through the emulation
trap (as long as the fpu is enabled, of course).
parse emulation from the exception trap as well as the emulation
trap and fix the dispatcher into usable condition.
parse invalid op exception on trap and signal the user appropriately.
reset the exception on exec and for child on fork.
the later is appropriate since exceptions are delayed until next
fpu instruction, which was in the parent indeed, let him get it.
save parent's fpu context on fork before cipying it, if the
parent owned the fpu.

parisc level 0x10 is just an overclocked 0xe

handle fpu exceptions properly, might use a regress, i guess

provide a convinient reset label

stack grows the other way, but the frame is the other way to that. hehe

set up the frame flags and a user frame better on exec

rework boot() w/o a goto

missing arg in the call to the pdc_call since some old times

kcopy is a space-to-space copy from kernel space, to guess where, -- to the same kernel space, just error on fault

Instead of copying out the signal trampoline on top of the stack, create
an uvm aobj, copy out the signal trampoline into it and share that page
among all processes for the same emulation.

This also requires us to actually be able to tell signal code where the
trampoline is located, so introduce a new field in struct proc - p_sigcode
that is a pointer to sigcode. This allows us to remove all the ugly
calculations of the signal trampoline address done in every sendsig
function in the tree (that's why so many files are changed).

Tested by various people. ok deraadt@

disable sid hashing while still in real mode, alos print the parisc arch once and not per each cpu since they are not intermixable architecture-wise

ldi-ldo whatever was in the table, be that much clever

print parisc level w/ the the parisc version, not for each cpu

kill debugging printfski

no longer batc the data, only the code.
this removes a constraint and an ld.script dependancy
for the .data and the dynamically allocated kernel
structures existed w/ batcing. also makes pmap_steal_memory
obsolete and replaced w/ the pmap_virtual_space.
implement batching for pmap_remove to avoid
zeroing out the pte entries if pde will be removed anyway.

better buf's mapping and less magic constants in checking for io space cachability

if cannot guess cpu model default to the lowest supported one

spelling

Add variables for config(8) -e time tweak of systemV shared memory
parameters.

Ok millert@, miod@, maja@

mtcpu seq requires a pre-sync, implement hpt init for pcxl

rewrite a pmap to use multilevel page tables.
lower 12 bits contain the perms, no unused bits left,
but a couple for off-tlb use (as the ref implemented now).
do not use the hvt, which might get some use later
if proven to speed thigs up, tlb handlers would po
another dozen of insns though, but if that's worth its...
move on the data seg and map kernel text rdonly (idea form fredette),
since all of the page0 mods done before that we are all fine
except for some viper fluff, but later w/ that.
this also picks up a bit more of ddb magic for bpt and ss.
tlb handlers can use a little bit more of attention,
but things, visually, seem to be much faster already, --
sorry, no benchmarks for now.

* effort sponsored in part by the `henry st. old ale house'
* and mr.pete and mr.lee in particular in thier generous entrirety.
* the proj took a little more that 72man*h as it was expected,
* but within murhy's law estimations.

First round of __P removal in sys

setup power failure handler (for sw-controlled power button), move toc handler

Patch from Daniel Lucq <daniel@lucq.org>

The patch allows you to change the value of NMBCLUSTERS, BUFCACHEPERCENT
and NKMEMPAGES using the config command, instead of recompiling the kernel.

This is the kernel part of the patch. I have compiled it on i386, sparc64,
alpha and macppc. -moj ok art@ maja@

support 712's programmable power switch, no interrupt yet

small repairs to hpmc and toc handlers

disable fpu on csw, print fpu version on cpu line, if present

fix sigdebug cases; init sigcontext before it's used (;

implement signal delivery; based on fredette@'s work

restore hpt size computation, does not break things as i thought

fix 'physmem' usage

implement the rest of /dev/mem devices; from netbsd

move mb_map allocation to mbinit()

move definition of mb_map from zillions of machdep.c to uipc_mbuf.c

Don't include <sys/map.h> when you don't need what's in it.

branches: 1.47.2;
increase fixed extent storage

zap some typedefs.
vm_map_t -> struct vm_map *
vm_map_entry_t -> struct vm_map_entry *
simple_lock_data_t -> struct simplelock

(uvm not done yet, coming in the next commit)

Sync in more uvm changes from NetBSD.
This time we're getting rid of KERN_* and VM_PAGER_* error codes and
use errnos instead.

Harmonize boot() logic across arches:
- ensure RB_DUMP | RB_HALT will cause a dump
- or RB_HALT if (cold)
While there, honor RB_TIMEBAD on sparc64.

nswbuf hasn't been used for ages. gc.

Add an alignment argument to uvm_map that specifies an alignment hint
for the virtual address.

Replace inclusion of <vm/foo.h> with the correct <uvm/bar.h> when necessary.
(Look ma, I might have broken the tree)

merge vm/vm_kern.h into uvm/uvm_extern.h; art@ ok

mbutl no more

We can now move timeout_init into main().

Remove even more old timeout tentacles.

Change the pmap_enter interface to merge access_type and the wired boolean
and arbitrary flags into one argument.

One new flag is PMAP_CANFAIL that tells pmap_enter that it can fail if there
are not enough resources to satisfy the request. If this flag is not passed,
pmap_enter should panic as it should have done before this change (XXX - many
pmaps are still not doing that).

Only i386 and alpha implement CANFAIL for now.

Includes uvm updates from NetBSD.

Get rid of REAL_CLISTS. It was never implemented and the tentacles are
everywhhere.

convert mbuf and cluster allocation to pool, mostly from NetBSD
okay art@ miod@

Rename configure() to cpu_configure().
Move it from cpu_startup() to main().

Get rid of CLSIZE and all related stuff.
CLSIZE -> 1
CLBYTES -> PAGE_SIZE
OLOFSET -> PAGE_MASK
etc.
At the same time some archs needed some cleaning in vmparam.h so that
goes in at the same time.

cpudev_data.h here needed not

shuffle the tlb handlers a little,
make a new one for na data fault,
since those w/ hpt need it.

two btlb routines (i & d) for pcxs

expand per-cpu control routines switch

print btlb params w/ BTLBDEBUG; from Havard.Eidnes@runit.sintef.no

no bays for stinger

new cpu type switch code.
initializes tlb miss handlers correspondent to probed cpu features.
also btlb load routine.
versions written are for pcxl and others.
cpu-dep btlb loaders are missing, only generic for now.

New API for timeouts. Replaces the old timeout()/untimeout() API and
makes it the callers responsibility to allocate resources for the
timeouts.

This is a KISS implementation and does _not_ solve the problems of slow
handling of a large number of pending timeouts (this will be solved in
future work) (although hardclock is now guarateed to take constant time
for handling of timeouts).

Old timeout() and untimeout() are implemented as wrappers around the new
API and kept for compatibility. They will be removed as soon as all
subsystems are converted to use the new API.

Bring in some new UVM code from NetBSD (not current).

- Introduce a new type of map that are interrupt safe and never allow faults
in them. mb_map and kmem_map are made intrsafe.
- Add "access protection" to uvm_vslock (to be passed down to uvm_fault and
later to pmap_enter).
- madvise(2) now works.
- various cleanups.

blah, blah, blah, msgbuf

branches: 1.21.2;
heartbeat -- yeah we have a patch for that

better copy and zero inlines in locore;
proper setregs() in machedep;
start of hpmc handler;
some cleanup here and there;

remove unneeded stuff from setregs; force single-user for now, enable signal debug

s/fpu_curproc/fpu_curpcb/ which also points into physical.
move it's definition into locore (where it's used the most).
adjust fpu context switch and save on swapout accordingly.
fix context save (in switch).
add accounting for fpu context switches (since it differes
from proc switching, we might get provided w/ some usefull
numbers as to how effective this lazy switch technique is).
enable handling fpu/sfu exceptions.

don't bother about pidr3 and pidr4

fix the panic message for sti memory mapping

bus stuff is in mainbus now, the rest is rewritten many ways

fix uvm_pagealloc() call

Change the pmap_enter api to pass down an argument that indicates
the access type that caused this mapping. This is to simplify pmaps
with mod/ref emulation (none for the moment) and in some cases speed
up pmap_is_{referenced,modified}.
At the same time, clean up some mappings that had too high protection.

XXX - the access type is incorrect in old vm, it's only used by uvm and MD code.
The actual use of this in pmap_enter implementations is not in this commit.

proper debugging ifdefs

rewrite the tlb miss handler and tlb dirty handler.
optimize for HVT usage (when compiled for proper cpu type).
drop hpt_* global variables, use info from control registers instead.
there are still ways to improve the tlb handlers tho.
machdep also prints cache and tlb coherence states (not related to the above).
You eat greenish muffin. --More-- You write real code.

allocate 5% bufcache if <=16M memory installed

hppa_init() now takes an argument from locore,
meaning the start of available memory.
cleanup machdep somewhat.
fix vm_map.pmap vs vm_pmap isue; 10x art@

new swap stuff

group all theMD f;ags together, add interrupt recursion one

define fpu_curproc

do lazy blok mapping of io space in bus_*
add copy{in,out}*, kcopy, etc
boot routines
cpu-id-hpux-compat stuff
rest of scheduler and such
uvm

print pa-risc here as well, since, finally, cpu will have to print processor type

better cache handling in bus_space_barrier(), seem to work now

implement bus_space_{un,}map w/ extents

machdep; more work needed

with empty body loops, put final semicolon on a new line for readability
ok bluhm@ jca@

Remove copystr(9), unless used internally by copy{in,out}str.

Simplfity setregs() by passing it the ps_strings and switching
sys_execve() to return EJUSTRETURN.

setregs() is the MD routine used by sys_execve() to set up the
thread's trapframe and PCB such that, on 'return' to userspace, it
has the register values defined by the ABI and otherwise zero. It
had to set the syscall retval[] values previously because the normal
syscall return path overwrites a couple registers with the retval[]
values. By instead returning EJUSTRETURN that and some complexity
with program-counter handling on m88k and sparc64 goes away.

Also, give setregs() add a 'struct ps_strings *arginfo' argument
so powerpc, powerpc64, and sh can directly get argc/argv/envp
values for registers instead of copyin()ing the one in userspace.

Improvements from miod@ and millert@
Testing assistance miod@, kettenis@, and aoyama@
ok miod@ kettenis@

match other archs use %s for version printf

Change sendsig() interface so that the MD code does not need to access
data from struct process anymore. This changes how siginfo and onstack
are accessed and make sendsig() more MP friendly.
With and OK semarie@ OK kettenis@

spelling

"encoding of diag instructions is hard, let's go shopping"

Clean up things a bit, adding documentation about the source of the
information about these instructions.

From miod@

In case of failure, call sigexit() from trapsignal instead of sensig().

Simplify MD code and reduce the amount of recursion into the signal code
which helps when dealing with locks.

ok cheloha@, deraadt@

hppa also has a similar to arm64: copyout(9), copyinstr(9) and
copyoutstr(9) should bail out properly if they are called with a
length of 0.
ok kettenis@

Implement cpu_rnd_messybits() as a read of the cycle counter register.
ok dlg@ deraadt@

introduce "cpu_rnd_messybits" for use instead of nanotime in dev/rnd.c.

rnd.c uses nanotime to get access to some bits that change quickly
between events that it can mix into the entropy pool. it doesn't
use nanotime to get a monotonically increasing set or ordered and
accurate timestamps, it just wants something with bits that change.

there's been discussions for years about letting rnd use a clock
that's super fast to read, but not necessarily accurate, but it
wasn't until recently that i figured out it wasn't interested in
time at all, so things like keeping a fast clock coherent between
cpu cores or correct according to ntp is unecessary. this means we
can just let rnd read the cycle counters on cpus and things will
be fine. cpus with cycle counters that vary in their speed and
arent kept consistent between cores may even be desirable in this
context.

so this is the first step in converting rnd.c to reading cycle
counter. it copies the nanotime backend to each arch, and they can
replace it with something MD as a second step later on.

djm@ suggested rnd_messybytes, but we landed on cpu_rnd_messybits.
thanks to visa for his eyes.
ok deraadt@ visa@
deraadt@ says he will help handle any MD fallout that occurs.

Make inittodr() and resettodr() MI.

ok deraadt@, mpi@, visa@
ok cheloha@ as well (would have preferred in new file for this code)

Initialize the timeval passed to todr_gettime() with the base time from
the file system such that implementations can use it to guess the right
century.

ok mpi@

Use the same inittodr()/resettodr() implementation as on
amd64/arm64/armv7/i386/sparc64 and move it to the end of machdep.c. Rework the
actual implementation for the MC14818 compatible RTC into something that can
be used as a todr_handle just like on amd64.

ok mpi@

fast track ddb> reboot command to skip anything which might panic again.
ok deraadt

Missed a 'ksi' -> '*ksip' change in previous commit

Move from sendsig() to its callers the initsiginfo() calls and
instead of passing sendsig() the code+type+val, pass a siginfo_t*
to copy from. Eliminate the indirection through struct emul for
sendsig(); we no longer have a SunOS4-compat version of sendsig()

ok deraadt@

Delete antique sigdebug definitions

ok kettenis@

Implement MAP_STACK option for mmap(). Synchronous faults (pagefault and
syscall) confirm the stack register points at MAP_STACK memory, otherwise
SIGSEGV is delivered. sigaltstack() and pthread_attr_setstack() are modified
to create a MAP_STACK sub-region which satisfies alignment requirements.
Observe that MAP_STACK can only be set/cleared by mmap(), which zeroes the
contents of the region -- there is no mprotect() equivalent operation, so
there is no MAP_STACK-adding gadget.
This opportunistic software-emulation of a stack protection bit makes
stack-pivot operations during ROPchain fragile (kind of like removing a
tool from the toolbox).
original discussion with tedu, uvm work by stefan, testing by mortimer
ok kettenis

Delete unnecessary <sys/file.h> includes

ok millert@ krw@

In uvm Chuck decided backing store would not be allocated proactively
for blocks re-fetchable from the filesystem. However at reboot time,
filesystems are unmounted, and since processes lack backing store they
are killed. Since the scheduler is still running, in some cases init is
killed... which drops us to ddb [noted by bluhm]. Solution is to convert
filesystems to read-only [proposed by kettenis]. The tale follows:
sys_reboot() should pass proc * to MD boot() to vfs_shutdown() which
completes current IO with vfs_busy VB_WRITE|VB_WAIT, then calls VFS_MOUNT()
with MNT_UPDATE | MNT_RDONLY, soon teaching us that *fs_mount() calls a
copyin() late... so store the sizes in vfsconflist[] and move the copyin()
to sys_mount()... and notice nfs_mount copyin() is size-variant, so kill
legacy struct nfs_args3. Next we learn ffs_mount()'s MNT_UPDATE code is
sharp and rusty especially wrt softdep, so fix some bugs adn add
~MNT_SOFTDEP to the downgrade. Some vnodes need a little more help,
so tie them to &dead_vnops.

ffs_mount calling DIOCCACHESYNC is causing a bit of grief still but
this issue is seperate and will be dealt with in time.
couple hundred reboots by bluhm and myself, advice from guenther and
others at the hut

Implement copyin32(9).

"your chicken scratches look fine to me" deraadt@

Apply consistency to forever loops with continue and NOTREACHED

Same thought from kettenis@, ok krw@ phessler@ millert@

all pools have their ipl set via pool_setipl, so fold it into pool_init.

the ioff argument to pool_init() is unused and has been for many
years, so this replaces it with an ipl argument. because the ipl
will be set on init we no longer need pool_setipl.

most of these changes have been done with coccinelle using the spatch
below. cocci sucks at formatting code though, so i fixed that by hand.

the manpage and subr_pool.c bits i did myself.

ok tedu@ jmatthew@

@ipl@
expression pp;
expression ipl;
expression s, a, o, f, m, p;
@@
-pool_init(pp, s, a, o, f, m, p);
-pool_setipl(pp, ipl);
+pool_init(pp, s, a, ipl, f, m, p);

hand-massage sendsig() and sys_sigreturn() to be much more similar.
ok guenther kettenis

SROP mitigation. sendsig() stores a (per-process ^ &sigcontext) cookie
inside the sigcontext. sigreturn(2) checks syscall entry was from the
exact PC addr in the (per-process ASLR) sigtramp, verifies the cookie,
and clears it to prevent sigcontext reuse.
not yet tested on landisk, sparc, *88k, socppc.
ok kettenis

pool_setipl for floating point context things

ok kettenis@

Do not call uvm_swap_finicrypt_all() a second time in dumpsys().

ok tedu@, deraadt@, miod@

Move ps_strings "after" the random stackgap. This makes its location a
per-process value, and therefpore turns the VM_PSSTRINGS sysctl into a
per-process one as well. This gets rid of a pointer to the bottom of the
stack at a fixed location. Also clears the road for unmapping the stackgap.

ok deraadt@

retire shutdown hooks; ok deraadt, krw

Remove vmmap; it isn't used.

ok jsing@

Correctly set up the HPMC trap entry: according to the PA-RISC Firmware
Architecture Reference Specification, the sum of the 8 trap entry words
*and* of the payload which address and length are to be set at well-known
positions in the aforementioned trap entry, needs to be zero; the existing
code was only enforcing that the sum of the trap entry words is zero.

This matches what Linux and NetBSD do.

ok kettenis@

Revert limiting physmem to 2GB; the culprit was likely in uvm and uvm has
changed a lot in the last 5 years; verified to work on a 3GB system, in
snapshots for a few weeks already.

implement atomic_{cas,swap}_{uint,ulong,ptr} and
atomic_{add,sub}_{int,long}_nv. sys/atomic.h turns these into the
rest of the atomic api.

on uniprocessor hppa systems "atomic" operations are implemented
as a non-interruptable sequence by disabling all interrupts on the
cpu, doing the operation, and then restoring the interrupt mask.

this isnt enough on MP systems, so we added a global atomic memory
mutex that is taken inside the interrupt disabling above to coordinate
operations between cpus.

this is a lot of overhead though cos mutexes dance around with ipls,
which is unecessary in our case because of the interrupt disabling
that is already done. also, hppa spinlocks are implemented with
ldcw which requires the word it operates on to be 16 byte aligned.
mutexes arent guaranteed to have this alignment so they compensate
by having lots of words inside themselves so they can hit the
appropriate one to use for the ldcw op.

with this in mind, this change pulls __cpu_simple_locks, which are
simply ldcw spinlocks with a 16 byte aligned word, out of
src/sys/arch/hppa/include/lock.h into src/sys/arch/hppa/include/atomic.h
so atomic.h can use them. lock.h includes atomic.h, so it still
gets and provides the same functionality as before.

finally, this also pulls the rwlock cas implementation apart. cas
ops now share the same serialising lock on MP systems as the other
memory operations, and rw_cas is defined as a wrapper around
atomic_cas_uint.

ok kettenis@

Use config_suspend_all(9).

dont rely on mbuf.h to provide pool.h.

ok miod@, who has offerred to help with any MD fallout
ok guenther@

boot(9): Reduce diffs between hppa & hppa64 (& others)

boot(9): Reduce annoying style diffs

- Always use either: ((x & RB_XXX) != 0) or ((x & RB_XXX) == 0) in boolean
context (mostly if (x), or x ? y : z)
- prom_halt() in alpha is confirmed to take int as boolean

Converted by coccinelle. No functional change intended.

boot(9): Cosmetic changes to improve diff'ability.

Cosmetic changes to reduce diffs.

These still need <sys/reboot.h> for the RB_ constants.

reboot(9), panic(9): Call panic(9) for unrecoverable MD H/W errors (NMIs)

Some architectures have ability to detect hardware sanity and notify system
(NMI, firmware callback, etc.). Handle these hardware severe errors, same
as software errors, with panic(9).

According to miod@, SGI IP27 NMI is triggered by pushing some "hidden" button,
which "usual" users/admins don't know. Pushing such a button is "RB_USERREQ"
(human-triggered) in that the button is pushed by a human, but not "RB_USERREQ"
in that no user intervention in system (== no command input) is done. miod@
agreed that changing these from RB_USERREQ to !RB_USERREQ (== panic(9)) is
not a big problem.

OK miod@ kettenis@

boot(9), reboot(9): Migrate MD callers of boot(9) to reboot(9)

I have found that some ports call boot(9) from machine-dependent code to
reboot system. These should be changed to either:

- Sending signal to init(8) to trigger it to shutdown system cleanly, like
acpi(4) does, in cases where found problems don't prevent system from working
immediately, or

- Just doing panic(9) if the situation is severely broken.

For now, just rewrite boot() to reboot(). Actual fixes follow.

Discussed with & OK from kettenis@

Set cold to 1 before executing the DVACT_POWERDOWN handlers when halting or
rebooting a machine, like it is done in the hibernate case.

At least some USB host controller drivers rely on this to busy way instead
of sleeping. Avoid a panic on macppc with an uhci(4) cardbus plugged in.

ok deraadt@, uebayashi@

boot(9): Remove comments about RB_*, "cold", and savectx()

Again remove slightly different comments to reduce diffs. These will be
re-added once boot() become MI and its specification is clearly re-defined.

OK miod@

boot(): Remove comments about RB_TIMEBAD to reduce diffs

RB_TIMEBAD is documented well enough that the comment is not needed. sparc64
does slightly different and its comment is left with XXX.

OK deraadt@ miod@

boot(): Unify declarations

OK deraadt@

Revert previous diff setting cold to 1 on shutdown because it breaks machine
with softraid(4) disks.

softraid(4) is the last real consumer of the doshutdownhooks(9) API and it is
not trivial to convert its hook to a DVACT_POWERDOWN handler since the latter
does not allow to sleep.

Set cold to 1 before executing the DVACT_POWERDOWN handlers when halting or
rebooting a machine, like it is done in the hibernate case.

At least some USB host controller drivers rely on this to busy way instead
of sleeping. Avoid a panic on macppc with an uhci(4) cardbus plugged in.

ok deraadt@, uebayashi@

Format string fixes and removal of -Wno-format for hppa kernels.

Less <uvm/uvm.h>

If the PDC_COPROC call fails, and we are running on a PA 1.1 system, assume
the usual 1.1 coprocessor mask, instead of using zero and having every
userland process dying with signal 4.

The circumstances under which this call fails are unclear and could be
tied to specific PROM version (I have tried overzealous stack alignment and
other tricks, to no avail). Interestingly enough, the 715/75 system which
hits this problem, only triggers it when booting from disk, and never when
booting from network.

This diff is an ugly bandaid until the problem is better understood. Or maybe
it is not worth investigating, seeing that Linux hardcodes the coprocessor
mask and never issues PDC_COPROC calls; I wonder what HP/UX does.

In my tree for over 18 months; "Looks like a nice hack" deraadt@
715/75 system provided by Sebastiaan Indesteege, thanks!

It's been a quarter century: we can assume volatile is present with that name.

ok dlg@ mpi@ deraadt@

Move p_emul and p_sigcode from proc to process.
Tweak the handling of ktrace EMUL when changing ktracing: only
generate one per process (not one per thread) and pass the correct
proc pointer down to the VFS layer. Permit generating of NAMI and
CSW records inside ktrace(2) itself.

ok deraadt@ millert@

Move p_sigacts from struct proc to struct process.

testing help mpi@

get rid of the assumption that the head of the alldevs list is the
"mainbus" device. this breaks when mpath is enabled because it
attaches before mainbus and therefore takes the head position.

have autoconf provide device_mainbus() which looks up mainbus_cd,
and use that instead.

discussed with deraadt who just wants mpath stuff to move forward
despite there being many ways to shine this particular turd.

Run doshutdownhooks() and config_suspend() even when boot() is called while
cold != 0. Indent and make hppa/hppa64 boot() closer to others.

OK kettenis@

In boot(), do not iterate over alldevs if it's empty (i.e. halting from ddb
with ddb entered early with boot -d or from UKC).

final removal of daddr64_t. daddr_t has been 64 bit for a long enough
test period; i think 3 years ago the last bugs fell out.
ok otto beck others

Determine whether we're currently on the alternative signal stack
dynamically, by comparing the stack pointer against the altstack
base and size, so that you get the correct answer if you longjmp
out of the signal handler, as tested by regress/sys/kern/stackjmp/.
Also, fix alt stack handling on vax, where it was completely broken.

Testing and corrections by miod@, krw@, tobiasu@, pirofti@

Properly clear trap frame in setregs() to avoid leaking registers across exec.

ok jsing@

Revamp the sequences for suspend/hibernate -> resume so that the code
paths are reflexive. It is now possible to fail part-way through a
suspend sequence, and recover along the resume code path.
Split DVACT_SUSPEND by adding a new DVACT_POWERDOWN method is used
after hibernate (and suspend too) to finish the job. Some drivers
must be converted at the same time to use this instead of shutdown hooks
(the others will follow at a later time)
ok kettenis mlarkin

Align the stack on a 64-byte boundary as required by "The 32-bit PA-RISC
Run-time Architecture Document". GCC relies on this to properly align
stack variables.

ok guenther@, beck@

__tfork() needs to set the stack address of the new thread in the kernel,
so that it can't get a signal while still running on the parent thread's
stack. Also, pass in sizeof(struct __tfork) to provide forward compat
when more members are added. This is an ABI change, so switch syscall
numbers and bump lib majors this time.

ok deraadt@ matthew@

Clear RB_POWERDOWN early in boot() on systems which can not powerdown and
which firmware does not send spin up commands to the disks, in case the
operator changes his mind and reboots instead of manually powering down
after the system has halted.
ok kettenis@

Recommit the reverted sigacts change now that the NFS use-after-free
problem has been tracked down. This fixes the sharing of the signal
handling state: shared bits go in sigacts, per-rthread bits goes in
struct proc.

ok deraadt@

if_downall() cannot be done MI in sys_reboot() because vfs_shutdown()
might need network (ie. nfs). Move the call to the MD boot() routines.
This cause for boot hangs diagnosed by kettenis.

Move the bufcachepercent setting code to MI locations -- set it to 42%
for now; that is unlikely to hit some of the remaining starvation bugs.
Repair the bufpages calculation too; i386 was doing it ahead of time
(incorrectly) and then re-calculating it.
ok thib

Revert the sigacts diff: NFS can apparently retain pointers to processes
until they're zombies and then send them signals (for intr mounts). Until
that is untangled, the sigacts change is unsafe. sthen@ was the victim
for this one

Correct the sharing of the signal handling state: stuff that should
be shared (p_sigignore, p_sigcatch, P_NOCLDSTOP, P_NOCLDWAIT) moves
to struct sigacts, wihle stuff that should be per rthread (ps_oldmask,
SAS_OLDMASK, ps_sigstk) moves to struct proc. Treat the coredumping
state bits (ps_sig, ps_code, ps_type, ps_sigval) as per-rthread
until our locking around coredumping is better.

Oh, and remove the old SunOS-compat ps_usertramp member.

"I like the sound of this" tedu@

Halt secondary CPUs when shutting down or rebooting. This should prevent
occasional hangs during reboot.

ok kettenis@

- de-register. no binary change.

ok jsing@

Move setting cpu_hzticks to the clock initialization function, like
other ports (e.g. hppa64) do.

ok jsing@ kettenis@

- ansify

ok jsing@ kettenis@

Turn signotify() into a function that also calls cpu_unidle().

ok kettenis@

This is a first step towards getting rid of avail_start and avail_end in the
kernel, currently limited to low-hanging fruit: these variables were used
by bus_dma to specify the range in which to allocate memory, back when
uvm_pglistalloc() was stupid and would not walk the vm_physseg[].

Nowadays, except on some platforms for early initialization, these variables
are not used, or do not need to be global variables. Therefore:
- remove `extern' declarations of avail_start and avail_end (or close cousins,
such as arm physical_start and physical_end) from files which no longer need
to use them.
- make them local variables whenever possible.
- remove them when they are assigned to but no longer used.

Create a struct to store FP state and include a pointer to the CPU that
currently holds the FPU context for this process. This will be soon used
to implement FPU shootdowns on multiprocessor kernels.

ok kettenis@

Remove COMPAT_HPUX. No one wanted to support it and its fewmets were
blocking other cleanups
ok miod@

Factor out code used to save and flushe process FPU context.

ok kettenis@

Store pointer to process FPU state in struct cpu_info.

ok kettenis@

uvm constraints. Add two mandatory MD symbols, uvm_md_constraints
which contains the constraints for DMA/memory allocation for each
architecture, and dma_constraints which contains the range of addresses
that are dma accessable by the system.

This is based on ariane@'s physcontig diff, with lots of bugfixes and
additions the following additions by my self:

Introduce a new function pool_set_constraints() which sets the address
range for which we allocate pages for the pool from, this is now used
for the mbuf/mbuf cluster pools to keep them dma accessible.

The !direct archs no longer stuff pages into the kernel object in
uvm_km_getpage_pla but rather do a pmap_extract() in uvm_km_putpages.

Tested heavily by my self on i386, amd64 and sparc64. Some tests on
alpha and SGI.

"commit it" beck, art, oga, deraadt
"i like the diff" deraadt

Use a mutex to make atomic operations atomic on multiprocessor kernels.

ok kettenis@

Declare safepri at the MD level on each platform, so that the kern_synch.c
does not have to deal with it as a common. Some platforms may be missed
by this commit... if you spot one, fix it the same way.
ok miod

Move declaration of cn_tab from dev/cons.c to dev/cninit.c, or appropriate
md files for ports which do not use dev/cninit.c. This gets rid of a common
at kernel link time.
feedback drahn@ ok deraadt@

Add missing prototypes
ok jsing kettenis

Prevent "taken branch" exceptions from kernel space by clearing the PSL_T
bit before we enter a signal handler.

"if you say so" miod@, "seems to make sense" jsing@

Properly initialize the members of `struct mdproc' that deal with
single-stepping when we fork and reset them upon exec.

ok miod@

Avoid null-pointer dereference by giving proc0 a place to store its
floating-point registers. Pointed out by Nick Hudson.

ok miod@, jsing@

Make the Processor Status Word (PSW) a per-CPU value.

ok kettenis@

Allow for multiple CPUs by moving to an array of cpu_info.

ok kettenis@

Make cpl and cpu_inintr per CPU variables. For locore.S, cpl becomes an
offset within cpu_primary_info - this will need to be revisited shortly.

ok kettenis@

Do not bother initializing bufpages in the md code if the computation is
exactly the same the mi could will use if bufinit() is invoked with
bufpages == 0.

With the SysV memory allocation changes, allocsys() doesn't do anything
anymore. Get rid of it completely.

Rototill system V message queues.

No longer allocate a static amount of memory for messages in MD
boot path; message queues, message metadata, and message data now
all use dynamic memory, which means that runtime sysctls should now
be trivial to implement.

Since I'm going to be around all week to fix any breakage, this should
probably just go in now.

Dynamic buffer cache support - a re-commit of what was backed out
after c2k9

allows buffer cache to be extended and grow/shrink dynamically

tested by many, ok oga@, "why not just commit it" deraadt@

Get rid of non-equivalent aliases of the pcb by moving the fpu state out
of the pcb and using the p_addr member of 'struct proc' to calculate the
address of the kernel stack when switching to virtual mode after taking a trap.
Remove the now unecessary cache flushes; they're actually harmful since they
create non-equivalent aliases. This seems to fix the memory corruption we
have been observing from time to time.

This diff does not rename fpu_curpcb, which is now somewhat incorrectly named.
I hope to change things back again as soon as we are able to map the pcb 1:1.

Back out all the buffer cache changes I committed during c2k9. This reverts three
commits:

1) The sysctl allowing bufcachepercent to be changed at boot time.
2) The change moving the buffer cache hash chains to a red-black tree
3) The dynamic buffer cache (Which depended on the earlier too).

ok on the backout from marco and todd

add kern.bufcachepercent sysctl to allow adjusting the buffer cache
size on a running system.
ok art@, oga@

Limit the amount of physical memory to 2GB. Using more causes memory
corruption on PA-RISC 2.0 systems (and there are very few PA-RISC 1.1
systems that support more than 2GB).

ok miod@

On systems with split BTLB, do not bother trying to insert DBTLB entries,
as PDC will lie to us pretending it did while it didn't.

ok kettenis@

Unify memory size reports a bit more: always report size in MB, and report
reserved memory on alpha and hppa on its own line (as done on sgi).

Be sure to propagate PSL_O in psw on PCXU* processors to userland processes
and signal handlers.
ok kettenis@

Clear swap encryption keys before dumping a kernel image.

Add new stub uvm_shutdown() and call it from the right place in MD boot()

replace even more ctob and btoc with ptoa and atop respectively plus
uvm_extern.h where needed

Move hppa to __HAVE_TIMECOUNTERS.

Give hppa the blink_led API from sparc64, and the associated machdep.led_blink
sysctl.

Delay switching to the real serial console until we attach the serial device.
The variety of different serial devices is just too big to make a decision up
front. This should make the second serial port on four-digit B/C/J-class
workstation work as a serial console too.

ok miod@

Make sigreturn(2) set the proper space ID for the instruction queue. Fixes
a few more pthreads regression tests.

ok miod@

Don't trust the privilige level in the sigcontext passed to sigreturn(2).

ok miod@

Crank initial storage for extents a bit. We really should allocate extents
using malloc once vm is initialised, but this will do for now.

ok deraadt@

now that all partition size/offsets are potentially 64-bit, change the
type of all variables to daddr64_t. this includes the APIs for XXsize()
and XXdump(), all range checks inside bio drivers, internal variables
for disklabel handling, and even uvm's swap offsets. re-read numerous
times by otto, miod, krw, thib to look for errors

Make sure the minaddr hint for uvm_km_suballoc() calls is always initialized.
ok pedro@

Dynamic buffer cache. Initial diff from mickey@, okay art@ beck@ toby@
deraadt@ dlg@.

Add support for 8700/pcxw2 cpu.

Ask firmware for reset before trying ourselves; needed for four-digit b/c/j
workstations.

tested by otto@, krw@; ok deraadt@

Limit hppa buffer cache to 30%. It used to be 70% because stack garbage
that was used for minaddr instead of the proper vm_map_min(kernel_map)
(fixed in this diff).

From mickey. art@ ok

move hppa to __HAVE_CPUINFO

input from miod@, ok kettenis@

minor nit, use CPU ID instead of FPU ID for BTLB parameters after passing
all kludges

make warning about missing HPT support DEBUG for now

ok mickey@

no more hppa_round_page() and hppa_trunc_page() macros

ok mickey@

We do not need a char machine_arch[] constant.
ok deraadt@

align some stupid comments

set pcsq in case we get signal delivery once interrupted from the gateway page; from chs

do not do some of the initmsgbuf()s job

on some machines it's possible to limit the amount of physmem initialised dring post so having msgbuf at the end of memory shall work

64bit-friendly pdc.h and iomod.h and correspondent changes elsewhere

md parts for hpux_compa code; some problems w/ signals delivery still exist

do not even ask for btlb on 8k cpus as pdc pretends there is some but then it does not work; found w/ Moritz Kiese <mbk@mytum.de> on c180; add a debug print and fix pcxu entry

print real/avail/bufcache sizes as unsigned

disable sid hashing on pcxu and above

a bit larger delays during boot() to let msgs appear

turn totalphysmem into physmem and name old physmem into smth it really is

oops

add pcxu tlb handlers and cpu probing
add u2/uturn ioa driver in dumb mode now
enable pcxu/pcxw support

store fpu version for later use. make sure to proper store/clear fpu state in fork/exec/exit/sendsig

error out from btlb_insert() if there is none

have separate insn and data cache all-flushers

allow forced fpu emulation through a sysctl

8ks do not have hvt

much easier tlb handler branch patching

do not engage HPT on PCXT' (yet)

repair pcxs/t confoosion

update copyright; miod@ is fine w/ files where he holds it too

Ensure that we obey a user's ddb> boot reboot command even if the system
is cold (during startup).

This adds RB_USERREQ to sys/reboot.h, uses it in the ddb commands, and
ensures that */*/machdep.c:boot() won't set RB_HALT when cold if this
flag is set.

ok deraadt@

Simplify hw.{cpuspeed,setperf} api moving all the sysctl stuff
from the underlying callbacks.

Testing hppa mickey@, ppc drahn@
Ok markus@ tedu@

kill debugging code that is not needed anymore

provide cpuspeed fluff

Don't let microtime() return a struct timeval with exactly 1000000 microseconds.

spls do not protect cpu_itmr and thus time might jump back sometimes due to cpu_itmr modified to a higher value than a read itmr; found and testing by miod@

in the real mem print do not include reserved for prom into used by openbsd

for unaligned btlb mapping attempts -- just fail

experimental support for HVT as a 2nd level tlb

less global name space pollution

reload the itmr as soon as we get the intr to avoid lagging on slower machines

some pcxl2 do not report fpus -- assume it's there