Simplify fix for PR toolchain/57146

Introduce ARCH_STRIP_SYMBOLS variable to centralize logic for debug
symbols from MD Makefile's to Makefile.kern.inc.

Fix kernel size inflation for arm and aarch64 (PR toolchain/57146)

For some conditions, SYSTEM_LD_TAIL is set for arm and aarch64.
Then, ctfmerge(1) in default SYSTEM_LD_TAIL is unintentionally
skipped, which results in the catastrophic kernel size inflation,
as reported in the PR.

Also, introduce and use OBJCOPY_STRIPFLAGS variable instead of
STRIPFLAGS, as strip(1) is replaced by objcopy(1) during MI
kernel build procedure.

XXX
For Makefile.{arm,aarch64}, weird logic is used to determine how
to handle debug symbols; MKDEBUG{,KERNEL} are taken into account
later in sys/conf/Makefile.kern.inc.

branches: 1.23.12;
In gcc10, -msign-return-address is no longer supported.
Instead, (LLVM-compatible) -mbranch-protection option is supported.

branches: 1.22.4; 1.22.6;
add support kernel profiling on aarch64

- add MCOUNT_ENTER, MCOUNT_EXIT macro
- __mcount() function should be aligned
- add "-fno-optimize-sibling-calls" option when PROF. for accurate profiling, it is better to suppress the tail call.

branches: 1.21.2;
"options ARMV83_PAC" is now supported for gcc as well.

- add "-msign-return-address=all" to CFLAGS for gcc when specified options ARMV83_PAC
- AARCH64REG_{READ,WRITE}_INLINE3 macro can now use the APIAKey registers in both gcc and llvm.
llvm requires asm(".arch armv8.3-a"), whereas gcc requires __attribute__((target("arch=armv8.3-a"))).
- use ".arch armv8.3-a" rather than ".arch armv8.3-a+pac" in *.S for llvm.

Add KASAN instrumentation on on-stack VLAs, same as amd64.

Add support for Branch Target Identification (BTI).

On the executable pages that have the GP (Guarded Page) bit, the semantic
of the "br" and "blr" instructions is changed: the CPU expects the first
instruction of the jump/call target to be "bti", and faults if it isn't.

We add the GP bit on the kernel .text pages (and incidentally the .rodata
pages, but we don't care). The compiler adds a "bti c" instruction at the
beginning of each C function. We modify the ENTRY() macros to manually add
"bti c" in the asm functions.

cpuswitch.S needs a specific change: with "br x27" the CPU expects "bti j",
which is bad because the functions begin with "bti c"; switch to "br x16",
for the CPU to accept "bti c".

BTI helps defend against JOP/COP. Tested on Qemu.

Add support for Pointer Authentication (PAC).

We use the "pac-ret" option, to sign the return instruction pointer on
function entry, and authenticate it on function exit. This acts as a
mitigation against ROP.

The authentication uses a per-lwp (secret) I-A key stored in the 128bit
APIAKey register and part of the lwp context. During lwp creation, the
kernel generates a random key, and during context switches, it installs
the key of the target lwp on the CPU.

Userland cannot read the APIAKey register directly. However, it can sign
its pointers with it, because the register is architecturally shared
between userland and the kernel. Although part of the CPU design, it is
a bit of an undesired behavior, because it allows to forge valid kernel
pointers from userland. To avoid that, we don't share the key with
userland, and rather switch it in EL0<->EL1 transitions. This means that
when userland executes, a different key is loaded in APIAKey than the one
the kernel uses. For now the userland key is a fixed 128bit zero value.

The DDB stack unwinder is changed to strip the authentication code from
the pointers in lr.

Two problems are known:

* Currently the idlelwps' keys are not really secret. This is because
the RNG is not yet available when we spawn these lwps. Not overly
important, but would be nice to fix with UEFI RNG.
* The key switching in EL0<->EL1 transitions is not the most optimized
code on the planet. Instead of checking aarch64_pac_enabled, it would
be better to hot-patch the code at boot time, but there currently is
no hot-patch support on aarch64.

Tested on Qemu.

branches: 1.17.2;
change kernel vm base address to use more than 256GB of memory. (up to 64TB)

also enlarge KSEG(direct map) region from 512GB to 64TB.
KASAN works ok.

Note: -fasan-shadow-offset=
KASAN_SHADOW_START - (CANONICAL_BASE >> 3) =
0xFFFF400000000000 - (0xFFFF000000000000 >> 3) =
0xDFFF600000000000

Fix alignment of .text section by changing load address to
0xffffffc000000000 and adding 64 bytes of padding before the entry point.

branches: 1.15.4;
Add KASAN use-after-scope detection in aarch64, tested by Ryo Shimizu,
thanks.

Track the stack with kASan on aarch64. Same principle as on amd64. Illegal
accesses occurring there are now detected.

Originally written by me, but reworked by ryo@, thanks.

Add kASan support for aarch64. Stack tracking needs more investigation
and will come in a separate commit.

Reviewed by ryo@ jmcneill@ skrll@.

- Determine KERN_AS automatically depending on whether OPT_MODULAR is
set or not, in the same way as libcompat.

- Specify OPT_MODULAR in the port Makefile instead of KERN_AS.

Now, KERN_AS=library is used for kernels without module(7) for all ports.

OK christos

s/A64/ARM/

no functional change

branches: 1.10.2;
locore.S is a MD_SFILES.

This keeps the dependency handling in the loop, so rebuilds after
changing options, say EARLYCONS, don't fail.

Add initial support for ARMv8 (AARCH64) (by nisimura@ and ryo@)

- sys/arch/evbarm64 is gone and integrated into sys/arch/evbarm. (by skrll@)
- add support fdt. evbarm/conf/GENERIC64 fdt (bcm2837,sunxi,tegra) based generic 64bit kernel config. (by skrll@, jmcneill@)

branches: 1.8.2;
- Allow multiple .BEGIN targets
- Make their protection consistent

Fix config(1) errors and warnings.

Set up arm headers for the build.

Define ${LINKSCRIPT} in one place.

Use ${KERNLDSCRIPT}.

branches: 1.4.2;
Use LINKSCRIPT.

branches: 1.3.2;
Reorganize symbol table embedding. The existing option SYMTAB_SPACE is
replaced by the make option COPY_SYMTAB set to any value. The copy of
the symbol table is no longer put into a buffer in kern_ksyms.o, but a
small helper object. This object is build first with a dummy size, then
the kernel is linked to compute the real dimension of the symbol table
buffer. After that, the helper object is rebuild and the kernel linked
again.

Use wildcards for stripping/preserving the mapping symbols on ARM and
AArch64. LLVM creates unique symbols in each file of the form $a.n etc.

branches: 1.1.2;
Preliminary files for AARCH64 (64-bit ARM) support.
Enough for a distribution build.

port-arm/58194: Resurrect vmt(4) from bitrot

On this architecture vmt(4) used to search for a node "/hypervisor" in the
FDT and probed the VMware hypervisor call only when the node was
found. However, things appear to have changed and VMware no longer provides
the FDT node.

Since vmt(4) doesn't actually need to read anything from FDT, and the
hypervisor call logically resides in virtual CPUs themselves, it would be
better to attach it directly to cpu, just like how it's probed on x86.

Change KDB to KGDB, including "sys/kgdb.h", which were likely meant to be defined.

Also comment out kgdb_machdep.c in files.aarch64, it doesn't exist yet.

Provide a shared pmap_devmap implementation and convert all pmap_devmap
arrays to use DEVMAP_ENTRY{,_END}

G/C

Provide MI PMAP support on AARCH64

MI PMAP EFI_RUNTIME support

Use "non-posted" instead of "strongly ordered" to describe nGnRnE mappings

Rename the following defines:
- _ARM_BUS_SPACE_MAP_STRONGLY_ORDERED to BUS_SPACE_MAP_NONPOSTED
- PMAP_DEV_SO to PMAP_DEV_NP
- LX_BLKPAG_ATTR_DEVICE_MEM_SO to LX_BLKPAG_ATTR_DEVICE_MEM_NP
Rename the following option:
- AARCH64_DEVICE_MEM_STRONGLY_ORDERED to AARCH64_DEVICE_MEM_NONPOSTED

Remove GIC_SPLFUNCS.

add support Hardware updates to Access flag and Dirty state (FEAT_HAFDBS)

- The DBM bit of the PTE is now used to determine if it is writable, and
the AF bit is treated entirely as a reference bit. A valid PTE is always
treated as readable. There can be no valid PTE that is not readable.
- LX_BLKPAG_OS_{READ,WRITE} are used only for debugging purposes,
and has been superseded by LX_BLKPAG_AF and LX_BLKPAG_DBM.
- Improve comment

The need for reference/modify emulation has been eliminated,
and access/permission faults have been reduced, however,
there has been little change in overall performance.

add support COMPAT_LINUX32 for aarch64

Implement gic_splraise and the gic_splx fast path in asm (armv8).

Use sys/uvm/pmap/pmap_tlb.c on Aarch64 in the same way that some Arm, MIPS,
and some PPC kernels do. This removes the limitation of 256 processes on
CPUs with 8bit ASID field, e.g. Apple M1.

Additionally the following changes have been made

- removed a couple of unnecessary aarch64_tlbi_all calls
- removed any invalidation after freeing page tables due to
_pmap_sweep_pdp. This was never necessary afaict.
- all kernel mappings are marked global and userland mapping not-global.

Performance testing hasn't show a significant difference. The data here
is from building a kernel on an lx2k system with nvme.

before
1489.6u 400.4s 2:40.65 1176.5% 228+224k 0+32289io 57pf+0w
1482.6u 403.2s 2:38.49 1189.9% 228+222k 0+32274io 46pf+0w
1485.4u 402.2s 2:37.27 1200.2% 228+222k 0+32275io 12pf+0w

after
1493.9u 404.6s 2:37.50 1205.4% 227+221k 0+32265io 48pf+0w
1485.0u 408.0s 2:38.54 1194.0% 227+222k 0+32272io 36pf+0w
1484.3u 407.0s 2:35.88 1213.3% 228+224k 0+32268io 14pf+0w

>>> stats.ttest_ind([160.65,158.49,157.27], [157.5,158.54,155.88])
Ttest_indResult(statistic=1.1923622711296888, pvalue=0.2990182944606766)
>>>

add support COMPAT_LINUX for aarch64

Arm: Add support for SMC Calling Convention

Arm DEN0028 defines a calling mechanism used with Secure Monitor Call (SMC)
and Hypervisor Call (HVC) instructions. To discover SMCCC, we must:

1) Find the PSCI conduit (either via ACPI FADT, or Device Tree)
2) Use PSCI_VERSION to determine whether PSCI_FEATURES is supported
3) Call PSCI_FEATURES with SMCCC_VERSION to determine the implementation
version.

aarch64: Remove empty source file and references to it.

branches: 1.30.6;
make process_machdep.c included always since it provides register i/o used by
sys_process_getlwpstatus.c which is always included.

harmonize process_machdep.c inclusion.

Collapse all CPU_CORTEXA<n> options into CPU_CORTEX and do runtime
detection instead of ifdefs where required.

Part III of ad's performance improvements for aarch64

- Assembly language stubs for mutex_enter() and mutex_exit().

Implement ChaCha with NEON on ARM.

XXX Needs performance measurement.
XXX Needs adaptation to arm32 neon which has half the registers.

Add options PMAPBOOT_DEBUG to dump TTBR when pmapboot_enter().
Formerly DEBUG_MMU in locore.S, but there was a bit of confusion.

New permutation-based AES implementation using ARM NEON.

Also derived from Mike Hamburg's public-domain vpaes code.

Implement AES in kernel using ARMv8.0-AES on aarch64.

PMAP_DEBUG has been deleted on arm

Add KASAN-DMA support on aarch64, same as amd64. Discussed with skrll@.

branches: 1.20.4;
Various updates and improvements to cpu start up on arm/aarch64

- start sharing more code around the AP startup messaging.
- call arm_cpu_topology_set early so that ci_core_id is available for
drivers, e.g. bcm2835_intr.c
- both arm and aarch64 now have
- a static cpu_info_store array
- the same arm_cpu_{hatched,mbox}

add support pmap_pv(9)

Patch originally from jmcneill@. thanks

Small re-org. NFCI.

port the arm64 cpu topology setup for big.little to arm.

rename arm64 cpu_do_topology() to arm_cpu_do_topology() and
call it from both arm cpu_attach().

replace both aarch64_set_topology() inline code in arm
cpu_attach() with new arm_cpu_do_topology(), which is called
by the arm64 locore as well (possibly not needed, which would
allow it to become static.)

not yet tested on a real big.little armv7 system. tested
on rockpro64 and pinebook pro.

branches: 1.16.2;
Do not use Early Write Acknowledge for PCIe I/O and config space.

Enable early write acknowledge for device memory mappings.

Move all non-emulation-specific coredump code into the coredump module,
and remove all #ifdef COREDUMP conditional compilation. Now, the
coredump module is completely separated from the emulation modules, and
they can all be independently loaded and unloaded.

Welcome to 9.99.18 !

branches: 1.13.4;
Merge the [pgoyette-compat] branch

Add needs-flag to tprof_armv8.c

Split armv7/armv8 tprof backend config logic from the fdt bus glue.

Add CPU_THUNDERX which sets COHERENCY_UNIT and CACHE_LINE_SIZE to 128

Add support for EFI runtime services on aarch64.

Provide generic start code that assumes the MMU is off and caches are
disabled as per the linux booting protocol for ARMv6 and ARMv7 boards.
u-boot image type should be changed to 'linux' for correct behaviour.

The new start code builds a minimal "bootstrap" L1PT with cached access
disabled and uses the same table for all processors. AP startup is
performed in less steps and more code is written in C.

The bootstrap tables and stack are placed into an (orphaned) section
"_init_memory" which is given to uvm when it is no longer used.

Various kernels have been converted to use this code and tested. Some
boards were provided by TNF. Thanks!

The GENERIC kernel now boots on boards using the TEGRA, SUNXI and EXYNOS
kernels. The GENERIC kernel will also work on RPI2 using u-boot.

Thanks to martin@ and aymeric@ for testing on parallella and nanosoc
respectively

add initial support of COMPAT_NETBSD32 on AArch64.
arm ELF32 EABI binaries could be execute in AArch32 state on AArch64. A32 THUMB mode is not supported yet.

Whitespace

cleanup locore, and changed the way to map memories during boot.
- add functions bootpage_enter() and bootpage_alloc() to adapt various layout
of physical memory map. especially for 64bit physical memory layout.
pmapboot_alloc() allocates pagetable pages from _end[].
- changed to map only the required amount for PA=VA identity mapping
(kernel image, UART device, and FDT blob) with L2_BLOCK(2Mbyte).
- changing page permission for kernel image, and making KSEG mapping are done
at cpu_kernel_vm_init() instead of at locore.
- optimize PTE entries with PTE Contiguous bit. it is enabled on devmap only for now.

reviewed by skrll@, thanks.

catch up to files.arm's recent "opt_console.h" changes

branches: 1.3.2;
Add initial support for ARMv8 (AARCH64) (by nisimura@ and ryo@)

- sys/arch/evbarm64 is gone and integrated into sys/arch/evbarm. (by skrll@)
- add support fdt. evbarm/conf/GENERIC64 fdt (bcm2837,sunxi,tegra) based generic 64bit kernel config. (by skrll@, jmcneill@)

branches: 1.2.2;
retire copyinout.S and fusu.S

branches: 1.1.4; 1.1.6;
Preliminary files for AARCH64 (64-bit ARM) support.
Enough for a distribution build.

add support kernel profiling on aarch64

- add MCOUNT_ENTER, MCOUNT_EXIT macro
- __mcount() function should be aligned
- add "-fno-optimize-sibling-calls" option when PROF. for accurate profiling, it is better to suppress the tail call.

branches: 1.11.12;
Add kASan support for aarch64. Stack tracking needs more investigation
and will come in a separate commit.

Reviewed by ryo@ jmcneill@ skrll@.

Don't use a magic number for COHERENCY_UNIT use COHERENCY_UNIT

reduce the battlefield

style, no functional change

set kernel rodata/data non-executable.
set rodata section on 2Mbytes aligned. (kernel image is mapped with 2Mbytes L2 block)

set kernel text/rodata readonly when not defined DDB.
set readonly segment on 2Mbytes aligned. (kernel image is mapped with 2Mbytes L2 block)

branches: 1.5.2;
Add initial support for ARMv8 (AARCH64) (by nisimura@ and ryo@)

- sys/arch/evbarm64 is gone and integrated into sys/arch/evbarm. (by skrll@)
- add support fdt. evbarm/conf/GENERIC64 fdt (bcm2837,sunxi,tegra) based generic 64bit kernel config. (by skrll@, jmcneill@)

branches: 1.4.2;
add more sence. now compilable

Don't mention stab and DWARF sections, because these (poorly mtaintained)
lists only help to make them harder to read.

If those sections are found in inputs, they simply appear in outputs as
orphaned sections, sorted by section types and attributes.

Indent with 2 spaces.

branches: 1.1.4; 1.1.6;
Preliminary files for AARCH64 (64-bit ARM) support.
Enough for a distribution build.

Remove uscanner(4) driver

This exists for compatibility with a Linux interface which was apparently
deprecated in Linux 2.6. There are various mailing list threads going
back to 2004 where the usefulness of this driver is discussed, but
the conclusion is that scanner software has all moved to using ugen(4)
instead, and enabling this driver will not help you scan things.

branches: 1.6.8;
mark nsmb major obsolete

remove urio(4), a driver for the Rio500 MP3 player.

At this point it is highly unlikely this 1999 device still has users,
but it still comes up in the context of maxv's USB-fuzzing (and any device
could pretend to be a urio(4)), so it's best to get rid of it.

Renamed all major entries to obsolete, as was done in previous removals.

This still requires an update to sanitizers, but they're located in
"external", perhaps it should be first committed upstream?

Proposed on tech-kern a month ago.

branches: 1.4.6;
Systematize handling of removed drivers.

- Every driver that was removed and whose number hasn't already been
reused is now listed with a commented-out "obsolete" line.
- The format of these has been systematized. Future format changes can
probably be safely done with a script.
- This does not include a few cases of assignments that only lasted a
couple days, or stuff from before major reorgs. Some of these may
be included nonetheless, because there was a lot of ground to cover
and therefore not a lot of time to dig into history in detail.

Note that the obsolete listings do not mean the major numbers can
never be reused; that's up to portmasters and/or core. It does mean
that they won't be reused by accident, however, which in some cases
(depending on the driver, how widely used it was, its family of device
nodes, their default permissions, etc.) can be quite dangerous.

Note that some of the things now explicitly listed as obsolete are
really ancient history. My scan went back as far as when the majors
files were added. (But not before that.)

Remove ISDN from the kernel. It has remained unmaintained for a long time,
is of poor quality, and is now an obstacle to MP-ification. It was removed
ten years ago from FreeBSD for the same reason.

This retires a big user of the mbuf API, and will ease maintenance of the
kernel.

branches: 1.2.16; 1.2.18;
Update device dependency information - the sysmon major device now depends on the sysmon module itself, not on the individual components.

branches: 1.1.4; 1.1.6;
Preliminary files for AARCH64 (64-bit ARM) support.
Enough for a distribution build.

Add initial support for ARMv8 (AARCH64) (by nisimura@ and ryo@)

- sys/arch/evbarm64 is gone and integrated into sys/arch/evbarm. (by skrll@)
- add support fdt. evbarm/conf/GENERIC64 fdt (bcm2837,sunxi,tegra) based generic 64bit kernel config. (by skrll@, jmcneill@)

branches: 1.2.16;
bump CHILD_MAX and OPEN_MAX defaults on several platforms, both to 1024.

branches: 1.1.2; 1.1.4; 1.1.6;
Preliminary files for AARCH64 (64-bit ARM) support.
Enough for a distribution build.