xref: /freebsd/sys/kern/kern_shutdown.c (revision 6137b5f7b8c183ee8806d79b3f1d8e5e3ddb3df3)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1986, 1988, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  */
36 
37 #include <sys/cdefs.h>
38 #include "opt_ddb.h"
39 #include "opt_ekcd.h"
40 #include "opt_kdb.h"
41 #include "opt_panic.h"
42 #include "opt_printf.h"
43 #include "opt_sched.h"
44 #include "opt_watchdog.h"
45 
46 #include <sys/param.h>
47 #include <sys/systm.h>
48 #include <sys/bio.h>
49 #include <sys/boottrace.h>
50 #include <sys/buf.h>
51 #include <sys/conf.h>
52 #include <sys/compressor.h>
53 #include <sys/cons.h>
54 #include <sys/disk.h>
55 #include <sys/eventhandler.h>
56 #include <sys/filedesc.h>
57 #include <sys/jail.h>
58 #include <sys/kdb.h>
59 #include <sys/kernel.h>
60 #include <sys/kerneldump.h>
61 #include <sys/kthread.h>
62 #include <sys/ktr.h>
63 #include <sys/malloc.h>
64 #include <sys/mbuf.h>
65 #include <sys/mount.h>
66 #include <sys/priv.h>
67 #include <sys/proc.h>
68 #include <sys/reboot.h>
69 #include <sys/resourcevar.h>
70 #include <sys/rwlock.h>
71 #include <sys/sbuf.h>
72 #include <sys/sched.h>
73 #include <sys/smp.h>
74 #include <sys/sysctl.h>
75 #include <sys/sysproto.h>
76 #include <sys/taskqueue.h>
77 #include <sys/vnode.h>
78 #include <sys/watchdog.h>
79 
80 #include <crypto/chacha20/chacha.h>
81 #include <crypto/rijndael/rijndael-api-fst.h>
82 #include <crypto/sha2/sha256.h>
83 
84 #include <ddb/ddb.h>
85 
86 #include <machine/cpu.h>
87 #include <machine/dump.h>
88 #include <machine/pcb.h>
89 #include <machine/smp.h>
90 
91 #include <security/mac/mac_framework.h>
92 
93 #include <vm/vm.h>
94 #include <vm/vm_object.h>
95 #include <vm/vm_page.h>
96 #include <vm/vm_pager.h>
97 #include <vm/swap_pager.h>
98 
99 #include <sys/signalvar.h>
100 
101 static MALLOC_DEFINE(M_DUMPER, "dumper", "dumper block buffer");
102 
103 #ifndef PANIC_REBOOT_WAIT_TIME
104 #define PANIC_REBOOT_WAIT_TIME 15 /* default to 15 seconds */
105 #endif
106 static int panic_reboot_wait_time = PANIC_REBOOT_WAIT_TIME;
107 SYSCTL_INT(_kern, OID_AUTO, panic_reboot_wait_time, CTLFLAG_RWTUN,
108     &panic_reboot_wait_time, 0,
109     "Seconds to wait before rebooting after a panic");
110 static int reboot_wait_time = 0;
111 SYSCTL_INT(_kern, OID_AUTO, reboot_wait_time, CTLFLAG_RWTUN,
112     &reboot_wait_time, 0,
113     "Seconds to wait before rebooting");
114 
115 /*
116  * Note that stdarg.h and the ANSI style va_start macro is used for both
117  * ANSI and traditional C compilers.
118  */
119 #include <machine/stdarg.h>
120 
121 #ifdef KDB
122 #ifdef KDB_UNATTENDED
123 int debugger_on_panic = 0;
124 #else
125 int debugger_on_panic = 1;
126 #endif
127 SYSCTL_INT(_debug, OID_AUTO, debugger_on_panic,
128     CTLFLAG_RWTUN, &debugger_on_panic, 0,
129     "Run debugger on kernel panic");
130 
131 static bool debugger_on_recursive_panic = false;
132 SYSCTL_BOOL(_debug, OID_AUTO, debugger_on_recursive_panic,
133     CTLFLAG_RWTUN, &debugger_on_recursive_panic, 0,
134     "Run debugger on recursive kernel panic");
135 
136 int debugger_on_trap = 0;
137 SYSCTL_INT(_debug, OID_AUTO, debugger_on_trap,
138     CTLFLAG_RWTUN, &debugger_on_trap, 0,
139     "Run debugger on kernel trap before panic");
140 
141 #ifdef KDB_TRACE
142 static int trace_on_panic = 1;
143 static bool trace_all_panics = true;
144 #else
145 static int trace_on_panic = 0;
146 static bool trace_all_panics = false;
147 #endif
148 SYSCTL_INT(_debug, OID_AUTO, trace_on_panic,
149     CTLFLAG_RWTUN | CTLFLAG_SECURE,
150     &trace_on_panic, 0, "Print stack trace on kernel panic");
151 SYSCTL_BOOL(_debug, OID_AUTO, trace_all_panics, CTLFLAG_RWTUN,
152     &trace_all_panics, 0, "Print stack traces on secondary kernel panics");
153 #endif /* KDB */
154 
155 static int sync_on_panic = 0;
156 SYSCTL_INT(_kern, OID_AUTO, sync_on_panic, CTLFLAG_RWTUN,
157 	&sync_on_panic, 0, "Do a sync before rebooting from a panic");
158 
159 static bool poweroff_on_panic = 0;
160 SYSCTL_BOOL(_kern, OID_AUTO, poweroff_on_panic, CTLFLAG_RWTUN,
161 	&poweroff_on_panic, 0, "Do a power off instead of a reboot on a panic");
162 
163 static bool powercycle_on_panic = 0;
164 SYSCTL_BOOL(_kern, OID_AUTO, powercycle_on_panic, CTLFLAG_RWTUN,
165 	&powercycle_on_panic, 0, "Do a power cycle instead of a reboot on a panic");
166 
167 static SYSCTL_NODE(_kern, OID_AUTO, shutdown, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
168     "Shutdown environment");
169 
170 #ifndef DIAGNOSTIC
171 static int show_busybufs;
172 #else
173 static int show_busybufs = 1;
174 #endif
175 SYSCTL_INT(_kern_shutdown, OID_AUTO, show_busybufs, CTLFLAG_RW,
176     &show_busybufs, 0,
177     "Show busy buffers during shutdown");
178 
179 int suspend_blocked = 0;
180 SYSCTL_INT(_kern, OID_AUTO, suspend_blocked, CTLFLAG_RW,
181 	&suspend_blocked, 0, "Block suspend due to a pending shutdown");
182 
183 #ifdef EKCD
184 FEATURE(ekcd, "Encrypted kernel crash dumps support");
185 
186 MALLOC_DEFINE(M_EKCD, "ekcd", "Encrypted kernel crash dumps data");
187 
188 struct kerneldumpcrypto {
189 	uint8_t			kdc_encryption;
190 	uint8_t			kdc_iv[KERNELDUMP_IV_MAX_SIZE];
191 	union {
192 		struct {
193 			keyInstance	aes_ki;
194 			cipherInstance	aes_ci;
195 		} u_aes;
196 		struct chacha_ctx	u_chacha;
197 	} u;
198 #define	kdc_ki	u.u_aes.aes_ki
199 #define	kdc_ci	u.u_aes.aes_ci
200 #define	kdc_chacha	u.u_chacha
201 	uint32_t		kdc_dumpkeysize;
202 	struct kerneldumpkey	kdc_dumpkey[];
203 };
204 #endif
205 
206 struct kerneldumpcomp {
207 	uint8_t			kdc_format;
208 	struct compressor	*kdc_stream;
209 	uint8_t			*kdc_buf;
210 	size_t			kdc_resid;
211 };
212 
213 static struct kerneldumpcomp *kerneldumpcomp_create(struct dumperinfo *di,
214 		    uint8_t compression);
215 static void	kerneldumpcomp_destroy(struct dumperinfo *di);
216 static int	kerneldumpcomp_write_cb(void *base, size_t len, off_t off, void *arg);
217 
218 static int kerneldump_gzlevel = 6;
219 SYSCTL_INT(_kern, OID_AUTO, kerneldump_gzlevel, CTLFLAG_RWTUN,
220     &kerneldump_gzlevel, 0,
221     "Kernel crash dump compression level");
222 
223 /*
224  * Variable panicstr contains argument to first call to panic; used as flag
225  * to indicate that the kernel has already called panic.
226  */
227 const char *panicstr;
228 bool __read_frequently panicked;
229 
230 int __read_mostly dumping;		/* system is dumping */
231 int rebooting;				/* system is rebooting */
232 /*
233  * Used to serialize between sysctl kern.shutdown.dumpdevname and list
234  * modifications via ioctl.
235  */
236 static struct mtx dumpconf_list_lk;
237 MTX_SYSINIT(dumper_configs, &dumpconf_list_lk, "dumper config list", MTX_DEF);
238 
239 /* Our selected dumper(s). */
240 static TAILQ_HEAD(dumpconflist, dumperinfo) dumper_configs =
241     TAILQ_HEAD_INITIALIZER(dumper_configs);
242 
243 /* Context information for dump-debuggers, saved by the dump_savectx() macro. */
244 struct pcb dumppcb;			/* Registers. */
245 lwpid_t dumptid;			/* Thread ID. */
246 
247 static struct cdevsw reroot_cdevsw = {
248      .d_version = D_VERSION,
249      .d_name    = "reroot",
250 };
251 
252 static void poweroff_wait(void *, int);
253 static void shutdown_halt(void *junk, int howto);
254 static void shutdown_panic(void *junk, int howto);
255 static void shutdown_reset(void *junk, int howto);
256 static int kern_reroot(void);
257 
258 /* register various local shutdown events */
259 static void
260 shutdown_conf(void *unused)
261 {
262 
263 	EVENTHANDLER_REGISTER(shutdown_final, poweroff_wait, NULL,
264 	    SHUTDOWN_PRI_FIRST);
265 	EVENTHANDLER_REGISTER(shutdown_final, shutdown_halt, NULL,
266 	    SHUTDOWN_PRI_LAST + 100);
267 	EVENTHANDLER_REGISTER(shutdown_final, shutdown_panic, NULL,
268 	    SHUTDOWN_PRI_LAST + 100);
269 }
270 
271 SYSINIT(shutdown_conf, SI_SUB_INTRINSIC, SI_ORDER_ANY, shutdown_conf, NULL);
272 
273 /*
274  * The only reason this exists is to create the /dev/reroot/ directory,
275  * used by reroot code in init(8) as a mountpoint for tmpfs.
276  */
277 static void
278 reroot_conf(void *unused)
279 {
280 	int error;
281 	struct cdev *cdev;
282 
283 	error = make_dev_p(MAKEDEV_CHECKNAME | MAKEDEV_WAITOK, &cdev,
284 	    &reroot_cdevsw, NULL, UID_ROOT, GID_WHEEL, 0600, "reroot/reroot");
285 	if (error != 0) {
286 		printf("%s: failed to create device node, error %d",
287 		    __func__, error);
288 	}
289 }
290 
291 SYSINIT(reroot_conf, SI_SUB_DEVFS, SI_ORDER_ANY, reroot_conf, NULL);
292 
293 /*
294  * The system call that results in a reboot.
295  */
296 /* ARGSUSED */
297 int
298 sys_reboot(struct thread *td, struct reboot_args *uap)
299 {
300 	int error;
301 
302 	error = 0;
303 #ifdef MAC
304 	error = mac_system_check_reboot(td->td_ucred, uap->opt);
305 #endif
306 	if (error == 0)
307 		error = priv_check(td, PRIV_REBOOT);
308 	if (error == 0) {
309 		if (uap->opt & RB_REROOT)
310 			error = kern_reroot();
311 		else
312 			kern_reboot(uap->opt);
313 	}
314 	return (error);
315 }
316 
317 static void
318 shutdown_nice_task_fn(void *arg, int pending __unused)
319 {
320 	int howto;
321 
322 	howto = (uintptr_t)arg;
323 	/* Send a signal to init(8) and have it shutdown the world. */
324 	PROC_LOCK(initproc);
325 	if ((howto & RB_POWEROFF) != 0) {
326 		BOOTTRACE("SIGUSR2 to init(8)");
327 		kern_psignal(initproc, SIGUSR2);
328 	} else if ((howto & RB_POWERCYCLE) != 0) {
329 		BOOTTRACE("SIGWINCH to init(8)");
330 		kern_psignal(initproc, SIGWINCH);
331 	} else if ((howto & RB_HALT) != 0) {
332 		BOOTTRACE("SIGUSR1 to init(8)");
333 		kern_psignal(initproc, SIGUSR1);
334 	} else {
335 		BOOTTRACE("SIGINT to init(8)");
336 		kern_psignal(initproc, SIGINT);
337 	}
338 	PROC_UNLOCK(initproc);
339 }
340 
341 static struct task shutdown_nice_task = TASK_INITIALIZER(0,
342     &shutdown_nice_task_fn, NULL);
343 
344 /*
345  * Called by events that want to shut down.. e.g  <CTL><ALT><DEL> on a PC
346  */
347 void
348 shutdown_nice(int howto)
349 {
350 
351 	if (initproc != NULL && !SCHEDULER_STOPPED()) {
352 		BOOTTRACE("shutdown initiated");
353 		shutdown_nice_task.ta_context = (void *)(uintptr_t)howto;
354 		taskqueue_enqueue(taskqueue_fast, &shutdown_nice_task);
355 	} else {
356 		/*
357 		 * No init(8) running, or scheduler would not allow it
358 		 * to run, so simply reboot.
359 		 */
360 		kern_reboot(howto | RB_NOSYNC);
361 	}
362 }
363 
364 static void
365 print_uptime(void)
366 {
367 	int f;
368 	struct timespec ts;
369 
370 	getnanouptime(&ts);
371 	printf("Uptime: ");
372 	f = 0;
373 	if (ts.tv_sec >= 86400) {
374 		printf("%ldd", (long)ts.tv_sec / 86400);
375 		ts.tv_sec %= 86400;
376 		f = 1;
377 	}
378 	if (f || ts.tv_sec >= 3600) {
379 		printf("%ldh", (long)ts.tv_sec / 3600);
380 		ts.tv_sec %= 3600;
381 		f = 1;
382 	}
383 	if (f || ts.tv_sec >= 60) {
384 		printf("%ldm", (long)ts.tv_sec / 60);
385 		ts.tv_sec %= 60;
386 		f = 1;
387 	}
388 	printf("%lds\n", (long)ts.tv_sec);
389 }
390 
391 int
392 doadump(boolean_t textdump)
393 {
394 	boolean_t coredump;
395 	int error;
396 
397 	error = 0;
398 	if (dumping)
399 		return (EBUSY);
400 	if (TAILQ_EMPTY(&dumper_configs))
401 		return (ENXIO);
402 
403 	dump_savectx();
404 	dumping++;
405 
406 	coredump = TRUE;
407 #ifdef DDB
408 	if (textdump && textdump_pending) {
409 		coredump = FALSE;
410 		textdump_dumpsys(TAILQ_FIRST(&dumper_configs));
411 	}
412 #endif
413 	if (coredump) {
414 		struct dumperinfo *di;
415 
416 		TAILQ_FOREACH(di, &dumper_configs, di_next) {
417 			error = dumpsys(di);
418 			if (error == 0)
419 				break;
420 		}
421 	}
422 
423 	dumping--;
424 	return (error);
425 }
426 
427 /*
428  * Trace the shutdown reason.
429  */
430 static void
431 reboottrace(int howto)
432 {
433 	if ((howto & RB_DUMP) != 0) {
434 		if ((howto & RB_HALT) != 0)
435 			BOOTTRACE("system panic: halting...");
436 		if ((howto & RB_POWEROFF) != 0)
437 			BOOTTRACE("system panic: powering off...");
438 		if ((howto & (RB_HALT|RB_POWEROFF)) == 0)
439 			BOOTTRACE("system panic: rebooting...");
440 	} else {
441 		if ((howto & RB_HALT) != 0)
442 			BOOTTRACE("system halting...");
443 		if ((howto & RB_POWEROFF) != 0)
444 			BOOTTRACE("system powering off...");
445 		if ((howto & (RB_HALT|RB_POWEROFF)) == 0)
446 			BOOTTRACE("system rebooting...");
447 	}
448 }
449 
450 /*
451  * kern_reboot(9): Shut down the system cleanly to prepare for reboot, halt, or
452  * power off.
453  */
454 void
455 kern_reboot(int howto)
456 {
457 	static int once = 0;
458 
459 	if (initproc != NULL && curproc != initproc)
460 		BOOTTRACE("kernel shutdown (dirty) started");
461 	else
462 		BOOTTRACE("kernel shutdown (clean) started");
463 
464 	/*
465 	 * Normal paths here don't hold Giant, but we can wind up here
466 	 * unexpectedly with it held.  Drop it now so we don't have to
467 	 * drop and pick it up elsewhere. The paths it is locking will
468 	 * never be returned to, and it is preferable to preclude
469 	 * deadlock than to lock against code that won't ever
470 	 * continue.
471 	 */
472 	while (!SCHEDULER_STOPPED() && mtx_owned(&Giant))
473 		mtx_unlock(&Giant);
474 
475 #if defined(SMP)
476 	/*
477 	 * Bind us to the first CPU so that all shutdown code runs there.  Some
478 	 * systems don't shutdown properly (i.e., ACPI power off) if we
479 	 * run on another processor.
480 	 */
481 	if (!SCHEDULER_STOPPED()) {
482 		thread_lock(curthread);
483 		sched_bind(curthread, CPU_FIRST());
484 		thread_unlock(curthread);
485 		KASSERT(PCPU_GET(cpuid) == CPU_FIRST(),
486 		    ("%s: not running on cpu 0", __func__));
487 	}
488 #endif
489 	/* We're in the process of rebooting. */
490 	rebooting = 1;
491 	reboottrace(howto);
492 
493 	/*
494 	 * Do any callouts that should be done BEFORE syncing the filesystems.
495 	 */
496 	EVENTHANDLER_INVOKE(shutdown_pre_sync, howto);
497 	BOOTTRACE("shutdown pre sync complete");
498 
499 	/*
500 	 * Now sync filesystems
501 	 */
502 	if (!cold && (howto & RB_NOSYNC) == 0 && once == 0) {
503 		once = 1;
504 		BOOTTRACE("bufshutdown begin");
505 		bufshutdown(show_busybufs);
506 		BOOTTRACE("bufshutdown end");
507 	}
508 
509 	print_uptime();
510 
511 	cngrab();
512 
513 	/*
514 	 * Ok, now do things that assume all filesystem activity has
515 	 * been completed.
516 	 */
517 	EVENTHANDLER_INVOKE(shutdown_post_sync, howto);
518 	BOOTTRACE("shutdown post sync complete");
519 
520 	if ((howto & (RB_HALT|RB_DUMP)) == RB_DUMP && !cold && !dumping)
521 		doadump(TRUE);
522 
523 	/* Now that we're going to really halt the system... */
524 	BOOTTRACE("shutdown final begin");
525 
526 	if (shutdown_trace)
527 		boottrace_dump_console();
528 
529 	EVENTHANDLER_INVOKE(shutdown_final, howto);
530 
531 	/*
532 	 * Call this directly so that reset is attempted even if shutdown
533 	 * handlers are not yet registered.
534 	 */
535 	shutdown_reset(NULL, howto);
536 
537 	for(;;) ;	/* safety against shutdown_reset not working */
538 	/* NOTREACHED */
539 }
540 
541 /*
542  * The system call that results in changing the rootfs.
543  */
544 static int
545 kern_reroot(void)
546 {
547 	struct vnode *oldrootvnode, *vp;
548 	struct mount *mp, *devmp;
549 	int error;
550 
551 	if (curproc != initproc)
552 		return (EPERM);
553 
554 	/*
555 	 * Mark the filesystem containing currently-running executable
556 	 * (the temporary copy of init(8)) busy.
557 	 */
558 	vp = curproc->p_textvp;
559 	error = vn_lock(vp, LK_SHARED);
560 	if (error != 0)
561 		return (error);
562 	mp = vp->v_mount;
563 	error = vfs_busy(mp, MBF_NOWAIT);
564 	if (error != 0) {
565 		vfs_ref(mp);
566 		VOP_UNLOCK(vp);
567 		error = vfs_busy(mp, 0);
568 		vn_lock(vp, LK_SHARED | LK_RETRY);
569 		vfs_rel(mp);
570 		if (error != 0) {
571 			VOP_UNLOCK(vp);
572 			return (ENOENT);
573 		}
574 		if (VN_IS_DOOMED(vp)) {
575 			VOP_UNLOCK(vp);
576 			vfs_unbusy(mp);
577 			return (ENOENT);
578 		}
579 	}
580 	VOP_UNLOCK(vp);
581 
582 	/*
583 	 * Remove the filesystem containing currently-running executable
584 	 * from the mount list, to prevent it from being unmounted
585 	 * by vfs_unmountall(), and to avoid confusing vfs_mountroot().
586 	 *
587 	 * Also preserve /dev - forcibly unmounting it could cause driver
588 	 * reinitialization.
589 	 */
590 
591 	vfs_ref(rootdevmp);
592 	devmp = rootdevmp;
593 	rootdevmp = NULL;
594 
595 	mtx_lock(&mountlist_mtx);
596 	TAILQ_REMOVE(&mountlist, mp, mnt_list);
597 	TAILQ_REMOVE(&mountlist, devmp, mnt_list);
598 	mtx_unlock(&mountlist_mtx);
599 
600 	oldrootvnode = rootvnode;
601 
602 	/*
603 	 * Unmount everything except for the two filesystems preserved above.
604 	 */
605 	vfs_unmountall();
606 
607 	/*
608 	 * Add /dev back; vfs_mountroot() will move it into its new place.
609 	 */
610 	mtx_lock(&mountlist_mtx);
611 	TAILQ_INSERT_HEAD(&mountlist, devmp, mnt_list);
612 	mtx_unlock(&mountlist_mtx);
613 	rootdevmp = devmp;
614 	vfs_rel(rootdevmp);
615 
616 	/*
617 	 * Mount the new rootfs.
618 	 */
619 	vfs_mountroot();
620 
621 	/*
622 	 * Update all references to the old rootvnode.
623 	 */
624 	mountcheckdirs(oldrootvnode, rootvnode);
625 
626 	/*
627 	 * Add the temporary filesystem back and unbusy it.
628 	 */
629 	mtx_lock(&mountlist_mtx);
630 	TAILQ_INSERT_TAIL(&mountlist, mp, mnt_list);
631 	mtx_unlock(&mountlist_mtx);
632 	vfs_unbusy(mp);
633 
634 	return (0);
635 }
636 
637 /*
638  * If the shutdown was a clean halt, behave accordingly.
639  */
640 static void
641 shutdown_halt(void *junk, int howto)
642 {
643 
644 	if (howto & RB_HALT) {
645 		printf("\n");
646 		printf("The operating system has halted.\n");
647 		printf("Please press any key to reboot.\n\n");
648 
649 		wdog_kern_pat(WD_TO_NEVER);
650 
651 		switch (cngetc()) {
652 		case -1:		/* No console, just die */
653 			cpu_halt();
654 			/* NOTREACHED */
655 		default:
656 			break;
657 		}
658 	}
659 }
660 
661 /*
662  * Check to see if the system panicked, pause and then reboot
663  * according to the specified delay.
664  */
665 static void
666 shutdown_panic(void *junk, int howto)
667 {
668 	int loop;
669 
670 	if (howto & RB_DUMP) {
671 		if (panic_reboot_wait_time != 0) {
672 			if (panic_reboot_wait_time != -1) {
673 				printf("Automatic reboot in %d seconds - "
674 				       "press a key on the console to abort\n",
675 					panic_reboot_wait_time);
676 				for (loop = panic_reboot_wait_time * 10;
677 				     loop > 0; --loop) {
678 					DELAY(1000 * 100); /* 1/10th second */
679 					/* Did user type a key? */
680 					if (cncheckc() != -1)
681 						break;
682 				}
683 				if (!loop)
684 					return;
685 			}
686 		} else { /* zero time specified - reboot NOW */
687 			return;
688 		}
689 		printf("--> Press a key on the console to reboot,\n");
690 		printf("--> or switch off the system now.\n");
691 		cngetc();
692 	}
693 }
694 
695 /*
696  * Everything done, now reset
697  */
698 static void
699 shutdown_reset(void *junk, int howto)
700 {
701 
702 	printf("Rebooting...\n");
703 	DELAY(reboot_wait_time * 1000000);
704 
705 	/*
706 	 * Acquiring smp_ipi_mtx here has a double effect:
707 	 * - it disables interrupts avoiding CPU0 preemption
708 	 *   by fast handlers (thus deadlocking  against other CPUs)
709 	 * - it avoids deadlocks against smp_rendezvous() or, more
710 	 *   generally, threads busy-waiting, with this spinlock held,
711 	 *   and waiting for responses by threads on other CPUs
712 	 *   (ie. smp_tlb_shootdown()).
713 	 *
714 	 * For the !SMP case it just needs to handle the former problem.
715 	 */
716 #ifdef SMP
717 	mtx_lock_spin(&smp_ipi_mtx);
718 #else
719 	spinlock_enter();
720 #endif
721 
722 	cpu_reset();
723 	/* NOTREACHED */ /* assuming reset worked */
724 }
725 
726 #if defined(WITNESS) || defined(INVARIANT_SUPPORT)
727 static int kassert_warn_only = 0;
728 #ifdef KDB
729 static int kassert_do_kdb = 0;
730 #endif
731 #ifdef KTR
732 static int kassert_do_ktr = 0;
733 #endif
734 static int kassert_do_log = 1;
735 static int kassert_log_pps_limit = 4;
736 static int kassert_log_mute_at = 0;
737 static int kassert_log_panic_at = 0;
738 static int kassert_suppress_in_panic = 0;
739 static int kassert_warnings = 0;
740 
741 SYSCTL_NODE(_debug, OID_AUTO, kassert, CTLFLAG_RW | CTLFLAG_MPSAFE, NULL,
742     "kassert options");
743 
744 #ifdef KASSERT_PANIC_OPTIONAL
745 #define KASSERT_RWTUN	CTLFLAG_RWTUN
746 #else
747 #define KASSERT_RWTUN	CTLFLAG_RDTUN
748 #endif
749 
750 SYSCTL_INT(_debug_kassert, OID_AUTO, warn_only, KASSERT_RWTUN,
751     &kassert_warn_only, 0,
752     "KASSERT triggers a panic (0) or just a warning (1)");
753 
754 #ifdef KDB
755 SYSCTL_INT(_debug_kassert, OID_AUTO, do_kdb, KASSERT_RWTUN,
756     &kassert_do_kdb, 0, "KASSERT will enter the debugger");
757 #endif
758 
759 #ifdef KTR
760 SYSCTL_UINT(_debug_kassert, OID_AUTO, do_ktr, KASSERT_RWTUN,
761     &kassert_do_ktr, 0,
762     "KASSERT does a KTR, set this to the KTRMASK you want");
763 #endif
764 
765 SYSCTL_INT(_debug_kassert, OID_AUTO, do_log, KASSERT_RWTUN,
766     &kassert_do_log, 0,
767     "If warn_only is enabled, log (1) or do not log (0) assertion violations");
768 
769 SYSCTL_INT(_debug_kassert, OID_AUTO, warnings, CTLFLAG_RD | CTLFLAG_STATS,
770     &kassert_warnings, 0, "number of KASSERTs that have been triggered");
771 
772 SYSCTL_INT(_debug_kassert, OID_AUTO, log_panic_at, KASSERT_RWTUN,
773     &kassert_log_panic_at, 0, "max number of KASSERTS before we will panic");
774 
775 SYSCTL_INT(_debug_kassert, OID_AUTO, log_pps_limit, KASSERT_RWTUN,
776     &kassert_log_pps_limit, 0, "limit number of log messages per second");
777 
778 SYSCTL_INT(_debug_kassert, OID_AUTO, log_mute_at, KASSERT_RWTUN,
779     &kassert_log_mute_at, 0, "max number of KASSERTS to log");
780 
781 SYSCTL_INT(_debug_kassert, OID_AUTO, suppress_in_panic, KASSERT_RWTUN,
782     &kassert_suppress_in_panic, 0,
783     "KASSERTs will be suppressed while handling a panic");
784 #undef KASSERT_RWTUN
785 
786 static int kassert_sysctl_kassert(SYSCTL_HANDLER_ARGS);
787 
788 SYSCTL_PROC(_debug_kassert, OID_AUTO, kassert,
789     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE | CTLFLAG_MPSAFE, NULL, 0,
790     kassert_sysctl_kassert, "I",
791     "set to trigger a test kassert");
792 
793 static int
794 kassert_sysctl_kassert(SYSCTL_HANDLER_ARGS)
795 {
796 	int error, i;
797 
798 	error = sysctl_wire_old_buffer(req, sizeof(int));
799 	if (error == 0) {
800 		i = 0;
801 		error = sysctl_handle_int(oidp, &i, 0, req);
802 	}
803 	if (error != 0 || req->newptr == NULL)
804 		return (error);
805 	KASSERT(0, ("kassert_sysctl_kassert triggered kassert %d", i));
806 	return (0);
807 }
808 
809 #ifdef KASSERT_PANIC_OPTIONAL
810 /*
811  * Called by KASSERT, this decides if we will panic
812  * or if we will log via printf and/or ktr.
813  */
814 void
815 kassert_panic(const char *fmt, ...)
816 {
817 	static char buf[256];
818 	va_list ap;
819 
820 	va_start(ap, fmt);
821 	(void)vsnprintf(buf, sizeof(buf), fmt, ap);
822 	va_end(ap);
823 
824 	/*
825 	 * If we are suppressing secondary panics, log the warning but do not
826 	 * re-enter panic/kdb.
827 	 */
828 	if (KERNEL_PANICKED() && kassert_suppress_in_panic) {
829 		if (kassert_do_log) {
830 			printf("KASSERT failed: %s\n", buf);
831 #ifdef KDB
832 			if (trace_all_panics && trace_on_panic)
833 				kdb_backtrace();
834 #endif
835 		}
836 		return;
837 	}
838 
839 	/*
840 	 * panic if we're not just warning, or if we've exceeded
841 	 * kassert_log_panic_at warnings.
842 	 */
843 	if (!kassert_warn_only ||
844 	    (kassert_log_panic_at > 0 &&
845 	     kassert_warnings >= kassert_log_panic_at)) {
846 		va_start(ap, fmt);
847 		vpanic(fmt, ap);
848 		/* NORETURN */
849 	}
850 #ifdef KTR
851 	if (kassert_do_ktr)
852 		CTR0(ktr_mask, buf);
853 #endif /* KTR */
854 	/*
855 	 * log if we've not yet met the mute limit.
856 	 */
857 	if (kassert_do_log &&
858 	    (kassert_log_mute_at == 0 ||
859 	     kassert_warnings < kassert_log_mute_at)) {
860 		static  struct timeval lasterr;
861 		static  int curerr;
862 
863 		if (ppsratecheck(&lasterr, &curerr, kassert_log_pps_limit)) {
864 			printf("KASSERT failed: %s\n", buf);
865 			kdb_backtrace();
866 		}
867 	}
868 #ifdef KDB
869 	if (kassert_do_kdb) {
870 		kdb_enter(KDB_WHY_KASSERT, buf);
871 	}
872 #endif
873 	atomic_add_int(&kassert_warnings, 1);
874 }
875 #endif /* KASSERT_PANIC_OPTIONAL */
876 #endif
877 
878 /*
879  * Panic is called on unresolvable fatal errors.  It prints "panic: mesg",
880  * and then reboots.  If we are called twice, then we avoid trying to sync
881  * the disks as this often leads to recursive panics.
882  */
883 void
884 panic(const char *fmt, ...)
885 {
886 	va_list ap;
887 
888 	va_start(ap, fmt);
889 	vpanic(fmt, ap);
890 }
891 
892 void
893 vpanic(const char *fmt, va_list ap)
894 {
895 #ifdef SMP
896 	cpuset_t other_cpus;
897 #endif
898 	struct thread *td = curthread;
899 	int bootopt, newpanic;
900 	static char buf[256];
901 
902 	spinlock_enter();
903 
904 #ifdef SMP
905 	/*
906 	 * stop_cpus_hard(other_cpus) should prevent multiple CPUs from
907 	 * concurrently entering panic.  Only the winner will proceed
908 	 * further.
909 	 */
910 	if (panicstr == NULL && !kdb_active) {
911 		other_cpus = all_cpus;
912 		CPU_CLR(PCPU_GET(cpuid), &other_cpus);
913 		stop_cpus_hard(other_cpus);
914 	}
915 #endif
916 
917 	/*
918 	 * Ensure that the scheduler is stopped while panicking, even if panic
919 	 * has been entered from kdb.
920 	 */
921 	td->td_stopsched = 1;
922 
923 	bootopt = RB_AUTOBOOT;
924 	newpanic = 0;
925 	if (KERNEL_PANICKED())
926 		bootopt |= RB_NOSYNC;
927 	else {
928 		bootopt |= RB_DUMP;
929 		panicstr = fmt;
930 		panicked = true;
931 		newpanic = 1;
932 	}
933 
934 	if (newpanic) {
935 		(void)vsnprintf(buf, sizeof(buf), fmt, ap);
936 		panicstr = buf;
937 		cngrab();
938 		printf("panic: %s\n", buf);
939 	} else {
940 		printf("panic: ");
941 		vprintf(fmt, ap);
942 		printf("\n");
943 	}
944 #ifdef SMP
945 	printf("cpuid = %d\n", PCPU_GET(cpuid));
946 #endif
947 	printf("time = %jd\n", (intmax_t )time_second);
948 #ifdef KDB
949 	if ((newpanic || trace_all_panics) && trace_on_panic)
950 		kdb_backtrace();
951 	if (debugger_on_panic)
952 		kdb_enter(KDB_WHY_PANIC, "panic");
953 	else if (!newpanic && debugger_on_recursive_panic)
954 		kdb_enter(KDB_WHY_PANIC, "re-panic");
955 #endif
956 	/*thread_lock(td); */
957 	td->td_flags |= TDF_INPANIC;
958 	/* thread_unlock(td); */
959 	if (!sync_on_panic)
960 		bootopt |= RB_NOSYNC;
961 	if (poweroff_on_panic)
962 		bootopt |= RB_POWEROFF;
963 	if (powercycle_on_panic)
964 		bootopt |= RB_POWERCYCLE;
965 	kern_reboot(bootopt);
966 }
967 
968 /*
969  * Support for poweroff delay.
970  *
971  * Please note that setting this delay too short might power off your machine
972  * before the write cache on your hard disk has been flushed, leading to
973  * soft-updates inconsistencies.
974  */
975 #ifndef POWEROFF_DELAY
976 # define POWEROFF_DELAY 5000
977 #endif
978 static int poweroff_delay = POWEROFF_DELAY;
979 
980 SYSCTL_INT(_kern_shutdown, OID_AUTO, poweroff_delay, CTLFLAG_RW,
981     &poweroff_delay, 0, "Delay before poweroff to write disk caches (msec)");
982 
983 static void
984 poweroff_wait(void *junk, int howto)
985 {
986 
987 	if ((howto & (RB_POWEROFF | RB_POWERCYCLE)) == 0 || poweroff_delay <= 0)
988 		return;
989 	DELAY(poweroff_delay * 1000);
990 }
991 
992 /*
993  * Some system processes (e.g. syncer) need to be stopped at appropriate
994  * points in their main loops prior to a system shutdown, so that they
995  * won't interfere with the shutdown process (e.g. by holding a disk buf
996  * to cause sync to fail).  For each of these system processes, register
997  * shutdown_kproc() as a handler for one of shutdown events.
998  */
999 static int kproc_shutdown_wait = 60;
1000 SYSCTL_INT(_kern_shutdown, OID_AUTO, kproc_shutdown_wait, CTLFLAG_RW,
1001     &kproc_shutdown_wait, 0, "Max wait time (sec) to stop for each process");
1002 
1003 void
1004 kproc_shutdown(void *arg, int howto)
1005 {
1006 	struct proc *p;
1007 	int error;
1008 
1009 	if (SCHEDULER_STOPPED())
1010 		return;
1011 
1012 	p = (struct proc *)arg;
1013 	printf("Waiting (max %d seconds) for system process `%s' to stop... ",
1014 	    kproc_shutdown_wait, p->p_comm);
1015 	error = kproc_suspend(p, kproc_shutdown_wait * hz);
1016 
1017 	if (error == EWOULDBLOCK)
1018 		printf("timed out\n");
1019 	else
1020 		printf("done\n");
1021 }
1022 
1023 void
1024 kthread_shutdown(void *arg, int howto)
1025 {
1026 	struct thread *td;
1027 	int error;
1028 
1029 	if (SCHEDULER_STOPPED())
1030 		return;
1031 
1032 	td = (struct thread *)arg;
1033 	printf("Waiting (max %d seconds) for system thread `%s' to stop... ",
1034 	    kproc_shutdown_wait, td->td_name);
1035 	error = kthread_suspend(td, kproc_shutdown_wait * hz);
1036 
1037 	if (error == EWOULDBLOCK)
1038 		printf("timed out\n");
1039 	else
1040 		printf("done\n");
1041 }
1042 
1043 static int
1044 dumpdevname_sysctl_handler(SYSCTL_HANDLER_ARGS)
1045 {
1046 	char buf[256];
1047 	struct dumperinfo *di;
1048 	struct sbuf sb;
1049 	int error;
1050 
1051 	error = sysctl_wire_old_buffer(req, 0);
1052 	if (error != 0)
1053 		return (error);
1054 
1055 	sbuf_new_for_sysctl(&sb, buf, sizeof(buf), req);
1056 
1057 	mtx_lock(&dumpconf_list_lk);
1058 	TAILQ_FOREACH(di, &dumper_configs, di_next) {
1059 		if (di != TAILQ_FIRST(&dumper_configs))
1060 			sbuf_putc(&sb, ',');
1061 		sbuf_cat(&sb, di->di_devname);
1062 	}
1063 	mtx_unlock(&dumpconf_list_lk);
1064 
1065 	error = sbuf_finish(&sb);
1066 	sbuf_delete(&sb);
1067 	return (error);
1068 }
1069 SYSCTL_PROC(_kern_shutdown, OID_AUTO, dumpdevname,
1070     CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE, &dumper_configs, 0,
1071     dumpdevname_sysctl_handler, "A",
1072     "Device(s) for kernel dumps");
1073 
1074 static int _dump_append(struct dumperinfo *di, void *virtual, size_t length);
1075 
1076 #ifdef EKCD
1077 static struct kerneldumpcrypto *
1078 kerneldumpcrypto_create(size_t blocksize, uint8_t encryption,
1079     const uint8_t *key, uint32_t encryptedkeysize, const uint8_t *encryptedkey)
1080 {
1081 	struct kerneldumpcrypto *kdc;
1082 	struct kerneldumpkey *kdk;
1083 	uint32_t dumpkeysize;
1084 
1085 	dumpkeysize = roundup2(sizeof(*kdk) + encryptedkeysize, blocksize);
1086 	kdc = malloc(sizeof(*kdc) + dumpkeysize, M_EKCD, M_WAITOK | M_ZERO);
1087 
1088 	arc4rand(kdc->kdc_iv, sizeof(kdc->kdc_iv), 0);
1089 
1090 	kdc->kdc_encryption = encryption;
1091 	switch (kdc->kdc_encryption) {
1092 	case KERNELDUMP_ENC_AES_256_CBC:
1093 		if (rijndael_makeKey(&kdc->kdc_ki, DIR_ENCRYPT, 256, key) <= 0)
1094 			goto failed;
1095 		break;
1096 	case KERNELDUMP_ENC_CHACHA20:
1097 		chacha_keysetup(&kdc->kdc_chacha, key, 256);
1098 		break;
1099 	default:
1100 		goto failed;
1101 	}
1102 
1103 	kdc->kdc_dumpkeysize = dumpkeysize;
1104 	kdk = kdc->kdc_dumpkey;
1105 	kdk->kdk_encryption = kdc->kdc_encryption;
1106 	memcpy(kdk->kdk_iv, kdc->kdc_iv, sizeof(kdk->kdk_iv));
1107 	kdk->kdk_encryptedkeysize = htod32(encryptedkeysize);
1108 	memcpy(kdk->kdk_encryptedkey, encryptedkey, encryptedkeysize);
1109 
1110 	return (kdc);
1111 failed:
1112 	zfree(kdc, M_EKCD);
1113 	return (NULL);
1114 }
1115 
1116 static int
1117 kerneldumpcrypto_init(struct kerneldumpcrypto *kdc)
1118 {
1119 	uint8_t hash[SHA256_DIGEST_LENGTH];
1120 	SHA256_CTX ctx;
1121 	struct kerneldumpkey *kdk;
1122 	int error;
1123 
1124 	error = 0;
1125 
1126 	if (kdc == NULL)
1127 		return (0);
1128 
1129 	/*
1130 	 * When a user enters ddb it can write a crash dump multiple times.
1131 	 * Each time it should be encrypted using a different IV.
1132 	 */
1133 	SHA256_Init(&ctx);
1134 	SHA256_Update(&ctx, kdc->kdc_iv, sizeof(kdc->kdc_iv));
1135 	SHA256_Final(hash, &ctx);
1136 	bcopy(hash, kdc->kdc_iv, sizeof(kdc->kdc_iv));
1137 
1138 	switch (kdc->kdc_encryption) {
1139 	case KERNELDUMP_ENC_AES_256_CBC:
1140 		if (rijndael_cipherInit(&kdc->kdc_ci, MODE_CBC,
1141 		    kdc->kdc_iv) <= 0) {
1142 			error = EINVAL;
1143 			goto out;
1144 		}
1145 		break;
1146 	case KERNELDUMP_ENC_CHACHA20:
1147 		chacha_ivsetup(&kdc->kdc_chacha, kdc->kdc_iv, NULL);
1148 		break;
1149 	default:
1150 		error = EINVAL;
1151 		goto out;
1152 	}
1153 
1154 	kdk = kdc->kdc_dumpkey;
1155 	memcpy(kdk->kdk_iv, kdc->kdc_iv, sizeof(kdk->kdk_iv));
1156 out:
1157 	explicit_bzero(hash, sizeof(hash));
1158 	return (error);
1159 }
1160 
1161 static uint32_t
1162 kerneldumpcrypto_dumpkeysize(const struct kerneldumpcrypto *kdc)
1163 {
1164 
1165 	if (kdc == NULL)
1166 		return (0);
1167 	return (kdc->kdc_dumpkeysize);
1168 }
1169 #endif /* EKCD */
1170 
1171 static struct kerneldumpcomp *
1172 kerneldumpcomp_create(struct dumperinfo *di, uint8_t compression)
1173 {
1174 	struct kerneldumpcomp *kdcomp;
1175 	int format;
1176 
1177 	switch (compression) {
1178 	case KERNELDUMP_COMP_GZIP:
1179 		format = COMPRESS_GZIP;
1180 		break;
1181 	case KERNELDUMP_COMP_ZSTD:
1182 		format = COMPRESS_ZSTD;
1183 		break;
1184 	default:
1185 		return (NULL);
1186 	}
1187 
1188 	kdcomp = malloc(sizeof(*kdcomp), M_DUMPER, M_WAITOK | M_ZERO);
1189 	kdcomp->kdc_format = compression;
1190 	kdcomp->kdc_stream = compressor_init(kerneldumpcomp_write_cb,
1191 	    format, di->maxiosize, kerneldump_gzlevel, di);
1192 	if (kdcomp->kdc_stream == NULL) {
1193 		free(kdcomp, M_DUMPER);
1194 		return (NULL);
1195 	}
1196 	kdcomp->kdc_buf = malloc(di->maxiosize, M_DUMPER, M_WAITOK | M_NODUMP);
1197 	return (kdcomp);
1198 }
1199 
1200 static void
1201 kerneldumpcomp_destroy(struct dumperinfo *di)
1202 {
1203 	struct kerneldumpcomp *kdcomp;
1204 
1205 	kdcomp = di->kdcomp;
1206 	if (kdcomp == NULL)
1207 		return;
1208 	compressor_fini(kdcomp->kdc_stream);
1209 	zfree(kdcomp->kdc_buf, M_DUMPER);
1210 	free(kdcomp, M_DUMPER);
1211 }
1212 
1213 /*
1214  * Free a dumper. Must not be present on global list.
1215  */
1216 void
1217 dumper_destroy(struct dumperinfo *di)
1218 {
1219 
1220 	if (di == NULL)
1221 		return;
1222 
1223 	zfree(di->blockbuf, M_DUMPER);
1224 	kerneldumpcomp_destroy(di);
1225 #ifdef EKCD
1226 	zfree(di->kdcrypto, M_EKCD);
1227 #endif
1228 	zfree(di, M_DUMPER);
1229 }
1230 
1231 /*
1232  * Allocate and set up a new dumper from the provided template.
1233  */
1234 int
1235 dumper_create(const struct dumperinfo *di_template, const char *devname,
1236     const struct diocskerneldump_arg *kda, struct dumperinfo **dip)
1237 {
1238 	struct dumperinfo *newdi;
1239 	int error = 0;
1240 
1241 	if (dip == NULL)
1242 		return (EINVAL);
1243 
1244 	/* Allocate a new dumper */
1245 	newdi = malloc(sizeof(*newdi) + strlen(devname) + 1, M_DUMPER,
1246 	    M_WAITOK | M_ZERO);
1247 	memcpy(newdi, di_template, sizeof(*newdi));
1248 	newdi->blockbuf = NULL;
1249 	newdi->kdcrypto = NULL;
1250 	newdi->kdcomp = NULL;
1251 	strcpy(newdi->di_devname, devname);
1252 
1253 	if (kda->kda_encryption != KERNELDUMP_ENC_NONE) {
1254 #ifdef EKCD
1255 		newdi->kdcrypto = kerneldumpcrypto_create(newdi->blocksize,
1256 		    kda->kda_encryption, kda->kda_key,
1257 		    kda->kda_encryptedkeysize, kda->kda_encryptedkey);
1258 		if (newdi->kdcrypto == NULL) {
1259 			error = EINVAL;
1260 			goto cleanup;
1261 		}
1262 #else
1263 		error = EOPNOTSUPP;
1264 		goto cleanup;
1265 #endif
1266 	}
1267 	if (kda->kda_compression != KERNELDUMP_COMP_NONE) {
1268 #ifdef EKCD
1269 		/*
1270 		 * We can't support simultaneous unpadded block cipher
1271 		 * encryption and compression because there is no guarantee the
1272 		 * length of the compressed result is exactly a multiple of the
1273 		 * cipher block size.
1274 		 */
1275 		if (kda->kda_encryption == KERNELDUMP_ENC_AES_256_CBC) {
1276 			error = EOPNOTSUPP;
1277 			goto cleanup;
1278 		}
1279 #endif
1280 		newdi->kdcomp = kerneldumpcomp_create(newdi,
1281 		    kda->kda_compression);
1282 		if (newdi->kdcomp == NULL) {
1283 			error = EINVAL;
1284 			goto cleanup;
1285 		}
1286 	}
1287 	newdi->blockbuf = malloc(newdi->blocksize, M_DUMPER, M_WAITOK | M_ZERO);
1288 
1289 	*dip = newdi;
1290 	return (0);
1291 cleanup:
1292 	dumper_destroy(newdi);
1293 	return (error);
1294 }
1295 
1296 /*
1297  * Create a new dumper and register it in the global list.
1298  */
1299 int
1300 dumper_insert(const struct dumperinfo *di_template, const char *devname,
1301     const struct diocskerneldump_arg *kda)
1302 {
1303 	struct dumperinfo *newdi, *listdi;
1304 	bool inserted;
1305 	uint8_t index;
1306 	int error;
1307 
1308 	index = kda->kda_index;
1309 	MPASS(index != KDA_REMOVE && index != KDA_REMOVE_DEV &&
1310 	    index != KDA_REMOVE_ALL);
1311 
1312 	error = priv_check(curthread, PRIV_SETDUMPER);
1313 	if (error != 0)
1314 		return (error);
1315 
1316 	error = dumper_create(di_template, devname, kda, &newdi);
1317 	if (error != 0)
1318 		return (error);
1319 
1320 	/* Add the new configuration to the queue */
1321 	mtx_lock(&dumpconf_list_lk);
1322 	inserted = false;
1323 	TAILQ_FOREACH(listdi, &dumper_configs, di_next) {
1324 		if (index == 0) {
1325 			TAILQ_INSERT_BEFORE(listdi, newdi, di_next);
1326 			inserted = true;
1327 			break;
1328 		}
1329 		index--;
1330 	}
1331 	if (!inserted)
1332 		TAILQ_INSERT_TAIL(&dumper_configs, newdi, di_next);
1333 	mtx_unlock(&dumpconf_list_lk);
1334 
1335 	return (0);
1336 }
1337 
1338 #ifdef DDB
1339 void
1340 dumper_ddb_insert(struct dumperinfo *newdi)
1341 {
1342 	TAILQ_INSERT_HEAD(&dumper_configs, newdi, di_next);
1343 }
1344 
1345 void
1346 dumper_ddb_remove(struct dumperinfo *di)
1347 {
1348 	TAILQ_REMOVE(&dumper_configs, di, di_next);
1349 }
1350 #endif
1351 
1352 static bool
1353 dumper_config_match(const struct dumperinfo *di, const char *devname,
1354     const struct diocskerneldump_arg *kda)
1355 {
1356 	if (kda->kda_index == KDA_REMOVE_ALL)
1357 		return (true);
1358 
1359 	if (strcmp(di->di_devname, devname) != 0)
1360 		return (false);
1361 
1362 	/*
1363 	 * Allow wildcard removal of configs matching a device on g_dev_orphan.
1364 	 */
1365 	if (kda->kda_index == KDA_REMOVE_DEV)
1366 		return (true);
1367 
1368 	if (di->kdcomp != NULL) {
1369 		if (di->kdcomp->kdc_format != kda->kda_compression)
1370 			return (false);
1371 	} else if (kda->kda_compression != KERNELDUMP_COMP_NONE)
1372 		return (false);
1373 #ifdef EKCD
1374 	if (di->kdcrypto != NULL) {
1375 		if (di->kdcrypto->kdc_encryption != kda->kda_encryption)
1376 			return (false);
1377 		/*
1378 		 * Do we care to verify keys match to delete?  It seems weird
1379 		 * to expect multiple fallback dump configurations on the same
1380 		 * device that only differ in crypto key.
1381 		 */
1382 	} else
1383 #endif
1384 		if (kda->kda_encryption != KERNELDUMP_ENC_NONE)
1385 			return (false);
1386 
1387 	return (true);
1388 }
1389 
1390 /*
1391  * Remove and free the requested dumper(s) from the global list.
1392  */
1393 int
1394 dumper_remove(const char *devname, const struct diocskerneldump_arg *kda)
1395 {
1396 	struct dumperinfo *di, *sdi;
1397 	bool found;
1398 	int error;
1399 
1400 	error = priv_check(curthread, PRIV_SETDUMPER);
1401 	if (error != 0)
1402 		return (error);
1403 
1404 	/*
1405 	 * Try to find a matching configuration, and kill it.
1406 	 *
1407 	 * NULL 'kda' indicates remove any configuration matching 'devname',
1408 	 * which may remove multiple configurations in atypical configurations.
1409 	 */
1410 	found = false;
1411 	mtx_lock(&dumpconf_list_lk);
1412 	TAILQ_FOREACH_SAFE(di, &dumper_configs, di_next, sdi) {
1413 		if (dumper_config_match(di, devname, kda)) {
1414 			found = true;
1415 			TAILQ_REMOVE(&dumper_configs, di, di_next);
1416 			dumper_destroy(di);
1417 		}
1418 	}
1419 	mtx_unlock(&dumpconf_list_lk);
1420 
1421 	/* Only produce ENOENT if a more targeted match didn't match. */
1422 	if (!found && kda->kda_index == KDA_REMOVE)
1423 		return (ENOENT);
1424 	return (0);
1425 }
1426 
1427 static int
1428 dump_check_bounds(struct dumperinfo *di, off_t offset, size_t length)
1429 {
1430 
1431 	if (di->mediasize > 0 && length != 0 && (offset < di->mediaoffset ||
1432 	    offset - di->mediaoffset + length > di->mediasize)) {
1433 		if (di->kdcomp != NULL && offset >= di->mediaoffset) {
1434 			printf(
1435 		    "Compressed dump failed to fit in device boundaries.\n");
1436 			return (E2BIG);
1437 		}
1438 
1439 		printf("Attempt to write outside dump device boundaries.\n"
1440 	    "offset(%jd), mediaoffset(%jd), length(%ju), mediasize(%jd).\n",
1441 		    (intmax_t)offset, (intmax_t)di->mediaoffset,
1442 		    (uintmax_t)length, (intmax_t)di->mediasize);
1443 		return (ENOSPC);
1444 	}
1445 	if (length % di->blocksize != 0) {
1446 		printf("Attempt to write partial block of length %ju.\n",
1447 		    (uintmax_t)length);
1448 		return (EINVAL);
1449 	}
1450 	if (offset % di->blocksize != 0) {
1451 		printf("Attempt to write at unaligned offset %jd.\n",
1452 		    (intmax_t)offset);
1453 		return (EINVAL);
1454 	}
1455 
1456 	return (0);
1457 }
1458 
1459 #ifdef EKCD
1460 static int
1461 dump_encrypt(struct kerneldumpcrypto *kdc, uint8_t *buf, size_t size)
1462 {
1463 
1464 	switch (kdc->kdc_encryption) {
1465 	case KERNELDUMP_ENC_AES_256_CBC:
1466 		if (rijndael_blockEncrypt(&kdc->kdc_ci, &kdc->kdc_ki, buf,
1467 		    8 * size, buf) <= 0) {
1468 			return (EIO);
1469 		}
1470 		if (rijndael_cipherInit(&kdc->kdc_ci, MODE_CBC,
1471 		    buf + size - 16 /* IV size for AES-256-CBC */) <= 0) {
1472 			return (EIO);
1473 		}
1474 		break;
1475 	case KERNELDUMP_ENC_CHACHA20:
1476 		chacha_encrypt_bytes(&kdc->kdc_chacha, buf, buf, size);
1477 		break;
1478 	default:
1479 		return (EINVAL);
1480 	}
1481 
1482 	return (0);
1483 }
1484 
1485 /* Encrypt data and call dumper. */
1486 static int
1487 dump_encrypted_write(struct dumperinfo *di, void *virtual, off_t offset,
1488     size_t length)
1489 {
1490 	static uint8_t buf[KERNELDUMP_BUFFER_SIZE];
1491 	struct kerneldumpcrypto *kdc;
1492 	int error;
1493 	size_t nbytes;
1494 
1495 	kdc = di->kdcrypto;
1496 
1497 	while (length > 0) {
1498 		nbytes = MIN(length, sizeof(buf));
1499 		bcopy(virtual, buf, nbytes);
1500 
1501 		if (dump_encrypt(kdc, buf, nbytes) != 0)
1502 			return (EIO);
1503 
1504 		error = dump_write(di, buf, offset, nbytes);
1505 		if (error != 0)
1506 			return (error);
1507 
1508 		offset += nbytes;
1509 		virtual = (void *)((uint8_t *)virtual + nbytes);
1510 		length -= nbytes;
1511 	}
1512 
1513 	return (0);
1514 }
1515 #endif /* EKCD */
1516 
1517 static int
1518 kerneldumpcomp_write_cb(void *base, size_t length, off_t offset, void *arg)
1519 {
1520 	struct dumperinfo *di;
1521 	size_t resid, rlength;
1522 	int error;
1523 
1524 	di = arg;
1525 
1526 	if (length % di->blocksize != 0) {
1527 		/*
1528 		 * This must be the final write after flushing the compression
1529 		 * stream. Write as many full blocks as possible and stash the
1530 		 * residual data in the dumper's block buffer. It will be
1531 		 * padded and written in dump_finish().
1532 		 */
1533 		rlength = rounddown(length, di->blocksize);
1534 		if (rlength != 0) {
1535 			error = _dump_append(di, base, rlength);
1536 			if (error != 0)
1537 				return (error);
1538 		}
1539 		resid = length - rlength;
1540 		memmove(di->blockbuf, (uint8_t *)base + rlength, resid);
1541 		bzero((uint8_t *)di->blockbuf + resid, di->blocksize - resid);
1542 		di->kdcomp->kdc_resid = resid;
1543 		return (EAGAIN);
1544 	}
1545 	return (_dump_append(di, base, length));
1546 }
1547 
1548 /*
1549  * Write kernel dump headers at the beginning and end of the dump extent.
1550  * Write the kernel dump encryption key after the leading header if we were
1551  * configured to do so.
1552  */
1553 static int
1554 dump_write_headers(struct dumperinfo *di, struct kerneldumpheader *kdh)
1555 {
1556 #ifdef EKCD
1557 	struct kerneldumpcrypto *kdc;
1558 #endif
1559 	void *buf;
1560 	size_t hdrsz;
1561 	uint64_t extent;
1562 	uint32_t keysize;
1563 	int error;
1564 
1565 	hdrsz = sizeof(*kdh);
1566 	if (hdrsz > di->blocksize)
1567 		return (ENOMEM);
1568 
1569 #ifdef EKCD
1570 	kdc = di->kdcrypto;
1571 	keysize = kerneldumpcrypto_dumpkeysize(kdc);
1572 #else
1573 	keysize = 0;
1574 #endif
1575 
1576 	/*
1577 	 * If the dump device has special handling for headers, let it take care
1578 	 * of writing them out.
1579 	 */
1580 	if (di->dumper_hdr != NULL)
1581 		return (di->dumper_hdr(di, kdh));
1582 
1583 	if (hdrsz == di->blocksize)
1584 		buf = kdh;
1585 	else {
1586 		buf = di->blockbuf;
1587 		memset(buf, 0, di->blocksize);
1588 		memcpy(buf, kdh, hdrsz);
1589 	}
1590 
1591 	extent = dtoh64(kdh->dumpextent);
1592 #ifdef EKCD
1593 	if (kdc != NULL) {
1594 		error = dump_write(di, kdc->kdc_dumpkey,
1595 		    di->mediaoffset + di->mediasize - di->blocksize - extent -
1596 		    keysize, keysize);
1597 		if (error != 0)
1598 			return (error);
1599 	}
1600 #endif
1601 
1602 	error = dump_write(di, buf,
1603 	    di->mediaoffset + di->mediasize - 2 * di->blocksize - extent -
1604 	    keysize, di->blocksize);
1605 	if (error == 0)
1606 		error = dump_write(di, buf, di->mediaoffset + di->mediasize -
1607 		    di->blocksize, di->blocksize);
1608 	return (error);
1609 }
1610 
1611 /*
1612  * Don't touch the first SIZEOF_METADATA bytes on the dump device.  This is to
1613  * protect us from metadata and metadata from us.
1614  */
1615 #define	SIZEOF_METADATA		(64 * 1024)
1616 
1617 /*
1618  * Do some preliminary setup for a kernel dump: initialize state for encryption,
1619  * if requested, and make sure that we have enough space on the dump device.
1620  *
1621  * We set things up so that the dump ends before the last sector of the dump
1622  * device, at which the trailing header is written.
1623  *
1624  *     +-----------+------+-----+----------------------------+------+
1625  *     |           | lhdr | key |    ... kernel dump ...     | thdr |
1626  *     +-----------+------+-----+----------------------------+------+
1627  *                   1 blk  opt <------- dump extent --------> 1 blk
1628  *
1629  * Dumps written using dump_append() start at the beginning of the extent.
1630  * Uncompressed dumps will use the entire extent, but compressed dumps typically
1631  * will not. The true length of the dump is recorded in the leading and trailing
1632  * headers once the dump has been completed.
1633  *
1634  * The dump device may provide a callback, in which case it will initialize
1635  * dumpoff and take care of laying out the headers.
1636  */
1637 int
1638 dump_start(struct dumperinfo *di, struct kerneldumpheader *kdh)
1639 {
1640 #ifdef EKCD
1641 	struct kerneldumpcrypto *kdc;
1642 #endif
1643 	void *key;
1644 	uint64_t dumpextent, span;
1645 	uint32_t keysize;
1646 	int error;
1647 
1648 #ifdef EKCD
1649 	/* Send the key before the dump so a partial dump is still usable. */
1650 	kdc = di->kdcrypto;
1651 	error = kerneldumpcrypto_init(kdc);
1652 	if (error != 0)
1653 		return (error);
1654 	keysize = kerneldumpcrypto_dumpkeysize(kdc);
1655 	key = keysize > 0 ? kdc->kdc_dumpkey : NULL;
1656 #else
1657 	error = 0;
1658 	keysize = 0;
1659 	key = NULL;
1660 #endif
1661 
1662 	if (di->dumper_start != NULL) {
1663 		error = di->dumper_start(di, key, keysize);
1664 	} else {
1665 		dumpextent = dtoh64(kdh->dumpextent);
1666 		span = SIZEOF_METADATA + dumpextent + 2 * di->blocksize +
1667 		    keysize;
1668 		if (di->mediasize < span) {
1669 			if (di->kdcomp == NULL)
1670 				return (E2BIG);
1671 
1672 			/*
1673 			 * We don't yet know how much space the compressed dump
1674 			 * will occupy, so try to use the whole swap partition
1675 			 * (minus the first 64KB) in the hope that the
1676 			 * compressed dump will fit. If that doesn't turn out to
1677 			 * be enough, the bounds checking in dump_write()
1678 			 * will catch us and cause the dump to fail.
1679 			 */
1680 			dumpextent = di->mediasize - span + dumpextent;
1681 			kdh->dumpextent = htod64(dumpextent);
1682 		}
1683 
1684 		/*
1685 		 * The offset at which to begin writing the dump.
1686 		 */
1687 		di->dumpoff = di->mediaoffset + di->mediasize - di->blocksize -
1688 		    dumpextent;
1689 	}
1690 	di->origdumpoff = di->dumpoff;
1691 	return (error);
1692 }
1693 
1694 static int
1695 _dump_append(struct dumperinfo *di, void *virtual, size_t length)
1696 {
1697 	int error;
1698 
1699 #ifdef EKCD
1700 	if (di->kdcrypto != NULL)
1701 		error = dump_encrypted_write(di, virtual, di->dumpoff, length);
1702 	else
1703 #endif
1704 		error = dump_write(di, virtual, di->dumpoff, length);
1705 	if (error == 0)
1706 		di->dumpoff += length;
1707 	return (error);
1708 }
1709 
1710 /*
1711  * Write to the dump device starting at dumpoff. When compression is enabled,
1712  * writes to the device will be performed using a callback that gets invoked
1713  * when the compression stream's output buffer is full.
1714  */
1715 int
1716 dump_append(struct dumperinfo *di, void *virtual, size_t length)
1717 {
1718 	void *buf;
1719 
1720 	if (di->kdcomp != NULL) {
1721 		/* Bounce through a buffer to avoid CRC errors. */
1722 		if (length > di->maxiosize)
1723 			return (EINVAL);
1724 		buf = di->kdcomp->kdc_buf;
1725 		memmove(buf, virtual, length);
1726 		return (compressor_write(di->kdcomp->kdc_stream, buf, length));
1727 	}
1728 	return (_dump_append(di, virtual, length));
1729 }
1730 
1731 /*
1732  * Write to the dump device at the specified offset.
1733  */
1734 int
1735 dump_write(struct dumperinfo *di, void *virtual, off_t offset, size_t length)
1736 {
1737 	int error;
1738 
1739 	error = dump_check_bounds(di, offset, length);
1740 	if (error != 0)
1741 		return (error);
1742 	return (di->dumper(di->priv, virtual, offset, length));
1743 }
1744 
1745 /*
1746  * Perform kernel dump finalization: flush the compression stream, if necessary,
1747  * write the leading and trailing kernel dump headers now that we know the true
1748  * length of the dump, and optionally write the encryption key following the
1749  * leading header.
1750  */
1751 int
1752 dump_finish(struct dumperinfo *di, struct kerneldumpheader *kdh)
1753 {
1754 	int error;
1755 
1756 	if (di->kdcomp != NULL) {
1757 		error = compressor_flush(di->kdcomp->kdc_stream);
1758 		if (error == EAGAIN) {
1759 			/* We have residual data in di->blockbuf. */
1760 			error = _dump_append(di, di->blockbuf, di->blocksize);
1761 			if (error == 0)
1762 				/* Compensate for _dump_append()'s adjustment. */
1763 				di->dumpoff -= di->blocksize - di->kdcomp->kdc_resid;
1764 			di->kdcomp->kdc_resid = 0;
1765 		}
1766 		if (error != 0)
1767 			return (error);
1768 
1769 		/*
1770 		 * We now know the size of the compressed dump, so update the
1771 		 * header accordingly and recompute parity.
1772 		 */
1773 		kdh->dumplength = htod64(di->dumpoff - di->origdumpoff);
1774 		kdh->parity = 0;
1775 		kdh->parity = kerneldump_parity(kdh);
1776 
1777 		compressor_reset(di->kdcomp->kdc_stream);
1778 	}
1779 
1780 	error = dump_write_headers(di, kdh);
1781 	if (error != 0)
1782 		return (error);
1783 
1784 	(void)dump_write(di, NULL, 0, 0);
1785 	return (0);
1786 }
1787 
1788 void
1789 dump_init_header(const struct dumperinfo *di, struct kerneldumpheader *kdh,
1790     const char *magic, uint32_t archver, uint64_t dumplen)
1791 {
1792 	size_t dstsize;
1793 
1794 	bzero(kdh, sizeof(*kdh));
1795 	strlcpy(kdh->magic, magic, sizeof(kdh->magic));
1796 	strlcpy(kdh->architecture, MACHINE_ARCH, sizeof(kdh->architecture));
1797 	kdh->version = htod32(KERNELDUMPVERSION);
1798 	kdh->architectureversion = htod32(archver);
1799 	kdh->dumplength = htod64(dumplen);
1800 	kdh->dumpextent = kdh->dumplength;
1801 	kdh->dumptime = htod64(time_second);
1802 #ifdef EKCD
1803 	kdh->dumpkeysize = htod32(kerneldumpcrypto_dumpkeysize(di->kdcrypto));
1804 #else
1805 	kdh->dumpkeysize = 0;
1806 #endif
1807 	kdh->blocksize = htod32(di->blocksize);
1808 	strlcpy(kdh->hostname, prison0.pr_hostname, sizeof(kdh->hostname));
1809 	dstsize = sizeof(kdh->versionstring);
1810 	if (strlcpy(kdh->versionstring, version, dstsize) >= dstsize)
1811 		kdh->versionstring[dstsize - 2] = '\n';
1812 	if (panicstr != NULL)
1813 		strlcpy(kdh->panicstring, panicstr, sizeof(kdh->panicstring));
1814 	if (di->kdcomp != NULL)
1815 		kdh->compression = di->kdcomp->kdc_format;
1816 	kdh->parity = kerneldump_parity(kdh);
1817 }
1818 
1819 #ifdef DDB
1820 DB_SHOW_COMMAND_FLAGS(panic, db_show_panic, DB_CMD_MEMSAFE)
1821 {
1822 
1823 	if (panicstr == NULL)
1824 		db_printf("panicstr not set\n");
1825 	else
1826 		db_printf("panic: %s\n", panicstr);
1827 }
1828 #endif
1829