Fix error checking in in6_gif_ctlinput().

if_gif.c:r1.133 introduces gif_update_variant() which ensure ifp->if_flags
is set IFF_RUNNING when gif_softc->gif_var->gv_{psrc,pdst} are not null.
So, in6_gif_ctlinput() is not required IFF_RUNNING checking. In contrast,
it is required gv_{psrc,pdst} NULL checking.

(knakahara)

Remove Ic macro without effect.

(wiz)

add xorgproto srcdir.

(mrg)

update for libdrm 2.4.91.

(mrg)

merge libdrm 2.4.91

(mrg)

regenerate these for libxcb 1.13.

(mrg)

merge libxcb 1.13.

(mrg)

fix compile error on evbarm/EXYNOS. platform.h may be included from *.S

(ryo)

build Tekparse.hin VTparse.hin normally.

(mrg)

merge xterm 330.  remove files we'll build now.

(mrg)

merge xterm 330.

(mrg)

Update to describe module aliases.

(pgoyette)

Make do_openat()'s handling of path=NULL modular

(pgoyette)

Add new ATF tests: kernel/t_zombie

New tests attempting to kill, stop, drop or revive a zombie:
- signal1 (SIGKILL)
- signal2 (SIGSTOP)
- signal3 (SIGABRT)
- signal4 (SIGHUP)
- signal5 (SIGCONT)

New test race1 verifying whether there are any kernel races when processing
signals to zombies, executing in a loop for 5 seconds.

These tests were inspired by a kernel unexpected behavior when a lookup
of a dying process could result in two detected entities once as an alive
process and once as a zombie.

race1 is similar to t_ptrace_wait* race1, however without ptrace(2) involved.

Sponsored by <The NetBSD Foundation>

(kamil)

Try to improve markup in the Built-ins section.
Mostly sprinkle missing .Ic and .Ar

(uwe)

Properly detect 'compat handler for SWAP_STATSxx not present' and return
EINVAL as we would for any other unsupported command.

(pgoyette)

Try to improve markup in the Parameter Expansion section.

(uwe)

Try to improve markup of the redirections definitions.

(uwe)

Fix horrendous markup abuse in the here-document example.
Consistently spell "here-document" in full.

(uwe)

Spell "here-document" with a hyphen, don't mark it up as a command.

(uwe)

Mark up "in" (of the "for" command) appropriately.

(uwe)

Use \(or not \*(Ba when discussing case patterns.

(uwe)

Use \(em for em-dash

(uwe)

Standalone | means \[ba] while we want \[or] so add \& protection to
the few places where it was missing.

(uwe)

.Dl is a a single line .Bd -literal -offset indent so don't abuse
multiple consecutive .Dl and use proper .Bd instead.

(uwe)

.Bd expects the display type to come first, so move -compact to the end.

(uwe)

Add missing word.

(uwe)

1516, 1518-1520, 1522, 1532-1538

(snj)

1518-1520, 1532, 1535, 1536

(snj)

1518-1520, 1532, 1535, 1536

(snj)

Pull up following revision(s) (requested by sevan in ticket #1538):
share/man/man4/altq.4: 1.3
Update URL for the cited paper

(snj)

Pull up following revision(s) (requested by msaitoh in ticket #1537):
sys/dev/ppbus/if_plip.c: 1.28
spl leak, found by Mootja

(snj)

Pull up following revision(s) (requested by maxv in ticket #1536):
sys/netipsec/ipsec_input.c: 1.57-1.58
Extend these #ifdef notyet. The m_copydata's in these branches are wrong,
we are not guaranteed to have enough room for another struct ip, and we
may crash here. Triggerable remotely, but after authentication, by sending
an AH packet that has a one-byte-sized IPIP payload.
--
Argh, in my previous commit in this file I forgot to fix the IPv6
entry point; apply the same fix there.

(snj)

Pull up following revision(s) (requested by maxv in ticket #1536):
sys/netipsec/ipsec_input.c: 1.57-1.58
Extend these #ifdef notyet. The m_copydata's in these branches are wrong,
we are not guaranteed to have enough room for another struct ip, and we
may crash here. Triggerable remotely, but after authentication, by sending
an AH packet that has a one-byte-sized IPIP payload.
--
Argh, in my previous commit in this file I forgot to fix the IPv6
entry point; apply the same fix there.

(snj)

Pull up following revision(s) (requested by maxv in ticket #1536):
sys/netipsec/ipsec_input.c: 1.57-1.58
Extend these #ifdef notyet. The m_copydata's in these branches are wrong,
we are not guaranteed to have enough room for another struct ip, and we
may crash here. Triggerable remotely, but after authentication, by sending
an AH packet that has a one-byte-sized IPIP payload.
--
Argh, in my previous commit in this file I forgot to fix the IPv6
entry point; apply the same fix there.

(snj)

Pull up following revision(s) (requested by uwe in ticket #1534):
sys/net/if_mpls.c: 1.31-1.33 via patch
sys/netmpls/mpls_ttl.c: 1.9 via patch
Style, and fix several bugs:
- ip4_check(), mpls_unlabel_inet() and mpls_unlabel_inet6() perform
  pullups, so we need to pass the updated pointers back
- in mpls_lse() the route is not always freed
Looks a little better now.
--
Kick MPLS packets earlier.
--
Several changes:
* In mpls_unlabel_inet, copy the label locally. It's not incorrect to
  keep a pointer on the mbuf, but it's bug-friendly.
* In mpls_label_inetX, fix the length check. Meanwhile add an XXX: we
  just want to make sure that m_copydata won't fail, but if we were
  guaranteed that m has M_PKTHDR set, we could simply check the length
  against m->m_pkthdr.len.

(snj)

Pull up following revision(s) (requested by uwe in ticket #1534):
sys/net/if_mpls.c: 1.31-1.33 via patch
sys/netmpls/mpls_ttl.c: 1.9 via patch
Style, and fix several bugs:
- ip4_check(), mpls_unlabel_inet() and mpls_unlabel_inet6() perform
  pullups, so we need to pass the updated pointers back
- in mpls_lse() the route is not always freed
Looks a little better now.
--
Kick MPLS packets earlier.
--
Several changes:
* In mpls_unlabel_inet, copy the label locally. It's not incorrect to
  keep a pointer on the mbuf, but it's bug-friendly.
* In mpls_label_inetX, fix the length check. Meanwhile add an XXX: we
  just want to make sure that m_copydata won't fail, but if we were
  guaranteed that m has M_PKTHDR set, we could simply check the length
  against m->m_pkthdr.len.

(snj)

Pull up following revision(s) (requested by uwe in ticket #1534):
sys/net/if_mpls.c: 1.31-1.33 via patch
sys/netmpls/mpls_ttl.c: 1.9 via patch
Style, and fix several bugs:
- ip4_check(), mpls_unlabel_inet() and mpls_unlabel_inet6() perform
  pullups, so we need to pass the updated pointers back
- in mpls_lse() the route is not always freed
Looks a little better now.
--
Kick MPLS packets earlier.
--
Several changes:
* In mpls_unlabel_inet, copy the label locally. It's not incorrect to
  keep a pointer on the mbuf, but it's bug-friendly.
* In mpls_label_inetX, fix the length check. Meanwhile add an XXX: we
  just want to make sure that m_copydata won't fail, but if we were
  guaranteed that m has M_PKTHDR set, we could simply check the length
  against m->m_pkthdr.len.

(snj)

Pull up following revision(s) (requested by uwe in ticket #1534):
lib/libc/arch/powerpc/genassym.cf: 1.5 via patch
lib/libc/arch/powerpc/gen/swapcontext.S: 1.8 via patch
PIC code clobbers %r30 so we need to update the saved oucp with
caller's %r30 manually.  Makes old context happy when it needs to do
more function calls after restore.

(snj)

Pull up following revision(s) (requested by msaitoh in ticket #1533):
sys/dev/sbus/be.c: 1.86
spl leak, found by Mootja a long time ago

(snj)

Pull up following revision(s) (requested by maxv in ticket #1532):
sys/netipsec/xform_ah.c: 1.77 via patch
sys/netipsec/xform_esp.c: 1.73 via patch
sys/netipsec/xform_ipip.c: 1.56-1.57 via patch
Reinforce and clarify.
--
Add missing NULL check. Normally that's not triggerable remotely, since we
are guaranteed that 8 bytes are valid at mbuf+skip.
--
Fix use-after-free. There is a path where the mbuf gets pulled up without
a proper mtod afterwards:
218    ipo = mtod(m, struct ip *);
281    m = m_pullup(m, hlen);
232    ipo->ip_src.s_addr
Found by Mootja.
Meanwhile it seems to me that 'ipo' should be set to NULL if the inner
packet is IPv6, but I'll revisit that later.
--
As I said in my last commit in this file, ipo should be set to NULL;
otherwise the 'local address spoofing' check below is always wrong on
IPv6.

(snj)

Pull up following revision(s) (requested by maxv in ticket #1532):
sys/netipsec/xform_ah.c: 1.77 via patch
sys/netipsec/xform_esp.c: 1.73 via patch
sys/netipsec/xform_ipip.c: 1.56-1.57 via patch
Reinforce and clarify.
--
Add missing NULL check. Normally that's not triggerable remotely, since we
are guaranteed that 8 bytes are valid at mbuf+skip.
--
Fix use-after-free. There is a path where the mbuf gets pulled up without
a proper mtod afterwards:
218    ipo = mtod(m, struct ip *);
281    m = m_pullup(m, hlen);
232    ipo->ip_src.s_addr
Found by Mootja.
Meanwhile it seems to me that 'ipo' should be set to NULL if the inner
packet is IPv6, but I'll revisit that later.
--
As I said in my last commit in this file, ipo should be set to NULL;
otherwise the 'local address spoofing' check below is always wrong on
IPv6.

(snj)

Pull up following revision(s) (requested by maxv in ticket #1532):
sys/netipsec/xform_ah.c: 1.77 via patch
sys/netipsec/xform_esp.c: 1.73 via patch
sys/netipsec/xform_ipip.c: 1.56-1.57 via patch
Reinforce and clarify.
--
Add missing NULL check. Normally that's not triggerable remotely, since we
are guaranteed that 8 bytes are valid at mbuf+skip.
--
Fix use-after-free. There is a path where the mbuf gets pulled up without
a proper mtod afterwards:
218    ipo = mtod(m, struct ip *);
281    m = m_pullup(m, hlen);
232    ipo->ip_src.s_addr
Found by Mootja.
Meanwhile it seems to me that 'ipo' should be set to NULL if the inner
packet is IPv6, but I'll revisit that later.
--
As I said in my last commit in this file, ipo should be set to NULL;
otherwise the 'local address spoofing' check below is always wrong on
IPv6.

(snj)

Pull up following revision(s) (requested by sevan in ticket #1522):
sys/arch/macppc/dev/snapper.c: 1.42
Fix issue with audio being downpitched, thanks to <nat>
"it seems that snapper_init should be called before audio_attach_mi, as
snapper
init is setting the rate to 44100 after the hardware format has been
configured
by audio_attach_mi.
audio_attach_mi should be the last thing called during an attach of an audio
device so the audio device is ready to be configured when audio_attach_mi is
called."
Resolves PR port-macppc/52949

(snj)

Pull up following revision(s) (requested by maya in ticket #1520):
bin/ksh/history.c: 1.18
Use 0600 as the mode for histfile here too.
pointed out by John D. Baker in PR bin/52480

(snj)

Pull up following revision(s) (requested by maya in ticket #1520):
bin/ksh/history.c: 1.18
Use 0600 as the mode for histfile here too.
pointed out by John D. Baker in PR bin/52480

(snj)

Pull up following revision(s) (requested by maya in ticket #1520):
bin/ksh/history.c: 1.18
Use 0600 as the mode for histfile here too.
pointed out by John D. Baker in PR bin/52480

(snj)

Fix wrong order; first enable WP, then enable interrupts. Otherwise we
might get an interrupt before re-enabling WP, and be rescheduled as a
result. In practice it never happens, because the previous PSL always
has interrupts disabled too.

(maxv)

Pull up following revision(s) (requested by mrg in ticket #1519):
sys/arch/sparc/sparc/timer_sun4m.c: 1.33 1.34 1.31
sys/arch/sparc/sparc/timer.c: 1.33
sys/arch/sparc/sparc/timer.c: 1.33 1.34
sys/arch/sparc/sparc/timerreg.h: 1.33 1.34 1.31 1.10
fix time goes backwards problems on sparc.
there are a few things here:
- there's a race between reading the limit register (which clears
  the interrupt and the limit bit) and increasing the latest offset.
  this can happen easily if an interrupt comes between the read and
  the call to tickle_tc() that increases the offset (i obverved this
  actually happening.)
- in early boot, sometimes the counter can cycle twice before the
  tickle happens.
to handle these issues, add two workarounds:
- if the limit bit isn't set, but the counter value is less than
  the previous value, and the offset hasn't changed, use the same
  fixup as if the limit bit was set.  this handles the first case
  above.
- add a hard-workaround for never allowing returning a smaller
  value (except during 32 bit overflow): if the result is less than
  the last result, add fixups until it does (or until it would
  overflow.)
the first workaround fixes general run-time issues, and the second
fixes issues only seen during boot.
also expand some comments in timer_sun4m.c and re-enable the sun4m
sub-microsecond tmr_ustolim4m() support (but it's always called with
at least 'tick' microseconds, so the end result is the same.)
fix hang at 4B microseconds (1h12 or so), and simplify part of the previous

(snj)

Pull up following revision(s) (requested by mrg in ticket #1519):
sys/arch/sparc/sparc/timer_sun4m.c: 1.33 1.34 1.31
sys/arch/sparc/sparc/timer.c: 1.33
sys/arch/sparc/sparc/timer.c: 1.33 1.34
sys/arch/sparc/sparc/timerreg.h: 1.33 1.34 1.31 1.10
fix time goes backwards problems on sparc.
there are a few things here:
- there's a race between reading the limit register (which clears
  the interrupt and the limit bit) and increasing the latest offset.
  this can happen easily if an interrupt comes between the read and
  the call to tickle_tc() that increases the offset (i obverved this
  actually happening.)
- in early boot, sometimes the counter can cycle twice before the
  tickle happens.
to handle these issues, add two workarounds:
- if the limit bit isn't set, but the counter value is less than
  the previous value, and the offset hasn't changed, use the same
  fixup as if the limit bit was set.  this handles the first case
  above.
- add a hard-workaround for never allowing returning a smaller
  value (except during 32 bit overflow): if the result is less than
  the last result, add fixups until it does (or until it would
  overflow.)
the first workaround fixes general run-time issues, and the second
fixes issues only seen during boot.
also expand some comments in timer_sun4m.c and re-enable the sun4m
sub-microsecond tmr_ustolim4m() support (but it's always called with
at least 'tick' microseconds, so the end result is the same.)
fix hang at 4B microseconds (1h12 or so), and simplify part of the previous

(snj)

Pull up following revision(s) (requested by mrg in ticket #1519):
sys/arch/sparc/sparc/timer_sun4m.c: 1.33 1.34 1.31
sys/arch/sparc/sparc/timer.c: 1.33
sys/arch/sparc/sparc/timer.c: 1.33 1.34
sys/arch/sparc/sparc/timerreg.h: 1.33 1.34 1.31 1.10
fix time goes backwards problems on sparc.
there are a few things here:
- there's a race between reading the limit register (which clears
  the interrupt and the limit bit) and increasing the latest offset.
  this can happen easily if an interrupt comes between the read and
  the call to tickle_tc() that increases the offset (i obverved this
  actually happening.)
- in early boot, sometimes the counter can cycle twice before the
  tickle happens.
to handle these issues, add two workarounds:
- if the limit bit isn't set, but the counter value is less than
  the previous value, and the offset hasn't changed, use the same
  fixup as if the limit bit was set.  this handles the first case
  above.
- add a hard-workaround for never allowing returning a smaller
  value (except during 32 bit overflow): if the result is less than
  the last result, add fixups until it does (or until it would
  overflow.)
the first workaround fixes general run-time issues, and the second
fixes issues only seen during boot.
also expand some comments in timer_sun4m.c and re-enable the sun4m
sub-microsecond tmr_ustolim4m() support (but it's always called with
at least 'tick' microseconds, so the end result is the same.)
fix hang at 4B microseconds (1h12 or so), and simplify part of the previous

(snj)

Mmh, add a missing x86_disable_intr(). My intention there was to ensure
interrupts were disabled before the barriers.

(maxv)

Pull up following revision(s) (requested by ozaki-r in ticket #1518):
sys/netinet6/ip6_forward.c: 1.89-1.90 via patch
Fix use-after-free of mbuf by ip6flow_create
This fixes recent failures of some ATF tests such as t_ipsec_tunnel_odd.
--
Fix use-after-free of mbuf by ip6flow_create (one more)

(snj)

Pull up following revision(s) (requested by ozaki-r in ticket #1518):
sys/netinet6/ip6_forward.c: 1.89-1.90 via patch
Fix use-after-free of mbuf by ip6flow_create
This fixes recent failures of some ATF tests such as t_ipsec_tunnel_odd.
--
Fix use-after-free of mbuf by ip6flow_create (one more)

(snj)

Pull up following revision(s) (requested by ozaki-r in ticket #1518):
sys/netinet6/ip6_forward.c: 1.89-1.90 via patch
Fix use-after-free of mbuf by ip6flow_create
This fixes recent failures of some ATF tests such as t_ipsec_tunnel_odd.
--
Fix use-after-free of mbuf by ip6flow_create (one more)

(snj)

Pull up following revision(s) (requested by hannken in ticket #1516):
sys/dev/fss.c: 1.101-1.103
Bounds check against media size for non-persistent snapshots.
--
Treat partial read from backing store as I/O error.
--
Pass residual back to b_resid for persistent snapshots.

(snj)

Mmh, put back the RFC6946 check (about dummy fragments), otherwise NPF
is not happy in npf_reassembly, because NPC_IPFRAG is again returned after
the packet was reassembled.

I'm wondering whether it would not be better to just remove the fragment
header in frag6_input directly.

(maxv)

Tickets #619 - #629

(martin)

Pullup the following revisions via patch, requested by maxv in ticket #629:

sys/arch/amd64/amd64/genassym.cf 1.63,1.64
sys/arch/amd64/amd64/locore.S 1.144
sys/arch/amd64/amd64/machdep.c 1.281-1.283
sys/arch/i386/i386/genassym.cf 1.105-1.106
sys/arch/i386/i386/locore.S 1.155
sys/arch/i386/i386/machdep.c 1.802 (adapted),1.803
sys/arch/x86/include/cpu.h 1.85
sys/arch/x86/x86/intr.c 1.115-1.116
sys/arch/x86/x86/pmap.c 1.275
sys/arch/x86/x86/sys_machdep.c 1.45
sys/arch/xen/x86/cpu.c 1.117

Stop sharing the double-fault stack.
Merge the TSS structures into one single cpu_tss structure, and
allocate it dynamically.

(martin)

Pull up following revision(s) (requested by ozaki-r in ticket #628):
sys/net/if_ethersubr.c: revision 1.250
sys/net/if_ethersubr.c: revision 1.251
sys/net/if_ethersubr.c: revision 1.252
sys/net/if_ethersubr.c: revision 1.248
Use kmem_alloc instead of kmem_intr_alloc in ether_addmulti

ether_addmulti is now not called in softint thanks to wqinput that
pulled input routines of ICMP out of softint.

style

Fix the net.ether.multicast sysctl. If there is no multicast address
don't kmem_alloc(0) (which panics the kernel), and if the number of
multicast addresses has decreased don't copyout uninitialized kernel
data.

Several fixes:
- Style and typos
- Use kmem_zalloc, in case there is a padding between the fields of
  the structures
- Use ETHER_ADDR_LEN instead of a hard-coded '6'
- kmem_alloc(KM_SLEEP) can't fail
- Simplify ether_aton_r
- Use mutex_obj_free, not to leak memory

(martin)

Pull up following revision(s) (requested by knakahara in ticket #627):
sys/netipsec/ipsecif.c: revision 1.5
tests/net/if_ipsec/t_ipsec.sh: revision 1.4
sys/net/if_ipsec.c: revision 1.7
Fix IPv6 ipsecif(4) ATF regression, sorry.
There must *not* be padding between the src sockaddr and the dst sockaddr
after struct sadb_x_policy.

Comment out confusing (and incorrect) code and add comment. Pointed out by maxv@n.o, thanks.

Enhance assertion ipsecif(4) ATF to avoid confusing setkey(8) error message.

When setkey(8) says "syntax error at [-E]", it must mean get_if_ipsec_unique()
failed.

(martin)

Pull up following revision(s) (requested by knakahara in ticket #620):
sys/netipsec/ipsecif.c: revision 1.4
sys/net/if_ipsec.c: revision 1.4
sys/net/if_ipsec.c: revision 1.5
sys/net/if_ipsec.c: revision 1.6
NAT-T src and dst port in ipsec_variant should be network byte order.
Fix missing sadb_x_ipsecrequest informations for PF_KEY message.
Functionalize duplicated code. No functional changes.
Fix ipsec(4) I/F esp_frag support.

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #626):
sys/dev/pci/ixgbe/ixgbe.c: revision 1.134
sys/dev/pci/ixgbe/ixgbe.h: revision 1.35
sys/dev/pci/ixgbe/ix_txrx.c: revision 1.35
sys/dev/pci/ixgbe/ixv.c: revision 1.87
  Make some event counters MP safe. Now all of the event counters are
MP safe.

(martin)

Pull up following revision(s) (requested by nonaka in ticket #625):
sys/arch/i386/stand/efiboot/efidisk.c: revision 1.2
sys/arch/i386/stand/efiboot/devopen.c: revision 1.2
sys/arch/i386/stand/efiboot/efidisk.h: revision 1.2
sys/arch/i386/stand/efiboot/boot.c: revision 1.6
sys/arch/i386/stand/efiboot/efidisk_ll.c: revision 1.2
sys/arch/i386/stand/efiboot/efidev.c: revision 1.1
sys/arch/i386/stand/lib/biosdisk_ll.h: revision 1.16
sys/arch/i386/stand/lib/biosdisk.h: revision 1.9
sys/lib/libsa/cd9660.c: revision 1.31
sys/arch/i386/stand/efiboot/efiboot.c: revision 1.5
sys/arch/i386/stand/efiboot/efiboot.h: revision 1.6
sys/arch/i386/stand/lib/biosdisk.c: revision 1.47
sys/arch/i386/stand/efiboot/Makefile.efiboot: revision 1.10
sys/arch/i386/stand/efiboot/TODO.efiboot: revision 1.4
efiboot: system can boot from CD/DVD-ROM media.

Add missed file in previous commit.

(martin)

ATF: Add new test race1 in t_ptrace_wait*

Reuse the attach1's test body for race1.

Add a new test race1:
  Assert that await_zombie() in attach1 always finds a single
  process and no other error is reported

race1 requires HAVE_PID in wait(2)-like function.

This test is executed in a loop for 5 seconds (16k iterations on Intel i7).
A buggy kernel was asserting an error within this timeframe almost always.

The bug in the kernel is now gone and this test is expected to pass
correctly.

Sponsored by <The NetBSD Foundation>

(kamil)

ATF t_ptrace_wait*: Disable debug messages in msg.h

msg.h is a dummy IPC interface.

Disable additional debugging logging here, especially wanted in race*
tests.

Sponsored by <The NetBSD Foundation>

(kamil)

Regen for ticket #624

(martin)

Pull up following revision(s) (requested by tsutsui in ticket #624):
sys/arch/atari/stand/xxboot/sdboot/milan/Makefile: revision 1.4
sys/arch/atari/dev/nvram.c: revision 1.21
sys/arch/atari/conf/MILAN.in: revision 1.28
sys/arch/atari/atari/pmap_bootstrap.c: revision 1.9
sys/dev/isa/fd.c: revision 1.111
sys/arch/atari/atari/bus.c: revision 1.60
sys/arch/atari/stand/xxboot/ahdi-xxboot/milan/Makefile: revision 1.4
sys/arch/atari/atari/locore.s: revision 1.111
sys/arch/atari/isa/isa_machdep.c: revision 1.41
distrib/sets/lists/base/md.atari: revision 1.55
sys/arch/atari/pci/pci_machdep.c: revision 1.55
sys/arch/atari/pci/pci_machdep.c: revision 1.56
sys/arch/atari/include/vmparam.h: revision 1.32
sys/arch/atari/isa/isa_milan.c: revision 1.15
sys/arch/atari/isa/isa_milan.c: revision 1.16
sys/arch/atari/atari/bus.c: revision 1.59
sys/arch/atari/atari/atari_init.c: revision 1.101
sys/arch/atari/pci/pci_milan.c: revision 1.15
Fix I/O access failures for regions allocated by bus_space_map(9) on Milan.

Passing to PMAP_WIRED against I/O spaces seems problematic,
probably after yamt-km branch merge, which was committed
between NetBSD 3.0 and NetBSD 4.0.
(i.e. ISA and PCI devices on Milan didn't work after 4.0 release)

XXX:
According to pmap(9) man page, the "flags" arg for pmap_enter(9)
doesn't take VM_PROT_READ and VM_PROT_WRITE, but pmap_enter()
implementation in sys/arch/m68k/m68k/pmap_motolora.c historically
checks them.

Fix silent hang during config_console() (before consinit()) on Milan.
config_console() was a dirty hack used by ancient m68k ports
to probe and initialize console devices before "real" configure(9),
using subset of configure(9) functions.

In that case, most device specific data (except I/O access method)
are not initialized so we must not access device specific device_t and
softc structures in config_console() cases.

Fix silent hang after isa_intr_establish() on Milan.
The problems (wrong macro replacements) were slipped in rev 1.107:
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/arch/atari/atari/locore.s#rev1.107
Handle yet another atari specific quirk in the MI ISA fdc(4)/fd(4) driver.
This makes fd(4) drive(s) (which is necessary for installation)
properly attached on Milan.
atari uses "fdcisa" and "fdisa" for ISA fdc to co-exist other fd(4)
drivers, on-board (atari/dev/fd.c) one and Hades (atari/dev/hdfd.c) one.

Use a proper PSL value to be passed to splx(9) functions.
This should have been changed on yamt-splraiseipl branch merge
back in 2006, which made MI IPL_xxx values independent from
m68k MD PSL values for the %sr register.

Restore piixide(4) for Milan and disable other pciide devices.
piixide was removed in rev 1.18 and the log message said
"because Intel IDE disk controllers only exist as part of
Intel chipsets for x86 systems" but the Milan actually has
the Intel 82371FB southbridge on its board.
Other pciide devices are unlikely necessary for the default
kernel for such a rare machine.
Also fix pasto in comment.

Skip NVRAM checksum check and re-initialization on Milan.
Milan's firmware seems to use different check method.

Ack EOI for IRQ_SLAVE of the master PIC after ack for IRQ of the slave PIC.
I'm not sure if there are possible races in the original code, but
this is what i8259_asm_ack2() in sys/arch/x86/include/i8259.h does
and it looks this change makes a Milan kernel a bit stable.
Replace CRTC register values with ones taken from sys/dev/ic/vga_subr.c.
This fixes noise around column 3 and 4 and makes screen output clearer
on Milan with S3 Trio64V.

Explicitly setup the secondary IDE interrupt of PIIX on Milan.
The secondary IDE interrupt is connected to MBIRQ0 on PIIX, but
the Milan's ROM bootloader (at least version 0.99.7) doesn't seem
to setup the MBIRQ0 register to route it to IRQ15.

On Milan, also explicitly disable MBIRQ1 on PIIX.
Milan's ROM bootloader v1.2 and v1.4 incorrectly set MBIRQ0 connected
to the secondary IDE to IRQ14 (not 15) and unused MBIRQ1 to IRQ15,
so both IDE channels don't work properly.

Add dumb memory probe routines for Milan to use all available memory.
Tested on Milan with 32Mx1, 32Mx4, 128MBx1, and 128MBx3.
(bootloader ROM fails to load TOS with 128MBx4)
No particular comment on port-atari@:
http://mail-index.netbsd.org/port-atari/2018/02/09/msg000580.html

Provide wdboot as a copy of sdboot for Milan.
It looks Milan's bootloader ROM emulates IDE disks as SCSI disks
so sdboot works for them, but atari's installboot checks a specified
device name and requires wdboot for wd(4) devices.

Fix another possible out of bounds.

Replace bus_dmamap_sync(9) op with a newer one taken from m68k/bus_dma.c.
This could fix memory corruption issue caused by PREREAD ops with regions
whose boundaries are not aligned at cacheline size.

(martin)

Add a new function in ATF t_ptrace_wait*: await_zombie_raw()

Add await_zombie_raw() that is the same as await_zombie(), whith an
addition of additional "useconds_t ms" parameter indicating delays between
new polling for a zombie process.

This new function will be used for testing a race condition that has been
observed occassionally crashing a test case -- returning duplicate entries
for KERN_PROC_PID.

Sponsored by <The NetBSD Foundation>

(kamil)

Pull up following revision(s) (requested by hans in ticket #623):
external/bsd/mdocml/dist/configure: revision 1.10
tools/mandoc/Makefile: revision 1.10
Honor HOST_CC.

(martin)

Pull up following revision(s) (requested by ozaki-r in ticket #622):
sys/netinet/if_arp.c: revision 1.270
sys/net/if_llatbl.c: revision 1.24 (patch)
sys/net/if_llatbl.c: revision 1.25
sys/net/if_llatbl.c: revision 1.26
sys/net/route.c: revision 1.204
sys/netinet6/in6.c: revision 1.261
sys/netinet6/in6.c: revision 1.262 (patch)
sys/netinet6/in6.c: revision 1.263
sys/netinet/in.c: revision 1.216
sys/netinet6/in6.c: revision 1.264
sys/netinet6/nd6.c: revision 1.246 (patch)
sys/netinet/if_arp.c: revision 1.269
sys/net/if_llatbl.h: revision 1.14
sys/netinet6/in6.c: revision 1.259
sys/netinet/in.c: revision 1.220
sys/netinet/in.c: revision 1.221 (patch)
sys/netinet/in.c: revision 1.222
sys/netinet/in.c: revision 1.223

Suppress noisy debugging outputs
Even if DEBUG they are too noisy under load.

Tweak sanity checks

Scheduling a timer of static entries is wrong.

Add assertions

We must not destroy llentries holding mbufs.

Fix reference leaks of llentry
callout_reset and callout_halt can cancel a pending callout without telling us.
Detect a cancel and remove a reference by using callout_pending and
callout_stop (it's a bit tricy though, we can detect it).
While here, we can remove remaining abuses of mutex_owned for softnet_lock.

Fix memory leaks on arp -d and ndp -d for static entries
We have to delete entries on in_lltable_delete and in6_lltable_delete
unconditionally.  Note that we don't need to worry about LLE_IFADDR because
there is no such entries now.

Use pool(9) for llentry allocations
llentry is easy to be leaked and pool suits for it because pool is usable to
detect leaks.

Also sweep unnecessary wrappers for llentry, in_llentry and in6_llentry.

(martin)

Pull up following revision(s) (requested by mrg in ticket #621):
sys/sys/bitops.h: revision 1.13
sys/sys/bitops.h: revision 1.14
use 1ul for a left shift that may be greater than int sized.
noticed by martin.
fixes PR#53081.

PR/53081: Fix size of the shift to depend on the type of the bitmap so that
we get the correct width.

(martin)

Pull up following revision(s) (requested by sevan in ticket #619):
share/man/man4/altq.4: revision 1.3
Update URL for the cited paper

(martin)

Move the swapstats compat code into the compat_netbsd module.

Without this, a kernel configured without COMPAT_13 and/or COMPAT_50
could not execute the compat swapstats code, even if the compat_netbsd
module had been loaded.

(pgoyette)

More clean-up of compat code interdependencies

(pgoyette)

Fix two consecutive mistakes.

The first mistake was npf_inet.c rev1.37:

"Don't reassemble ipv6 fragments, instead treat the first fragment
as a regular packet (subject to filtering rules), and pass
subsequent fragments in the same group unconditionally."

Doing this was entirely wrong, because then a packet just had to push
the L4 payload in a secondary fragment, and NPF wouldn't apply rules on
it - meaning any IPv6 packet could bypass >=L4 filtering. This mistake
was supposed to be a fix for the second mistake.

The second mistake was that ip6_reass_packet (in npf_reassembly) was
getting called with npc->npc_hlen. But npc_hlen pointed to the last
encountered header in the IPv6 chain, which was not necessarily the
fragment header. So ip6_reass_packet was given garbage, and would fail,
resulting in the packet getting kicked. So basically IPv6 was broken by
NPF.

The first mistake is reverted, and the second one is fixed by doing:

- hlen = sizeof(struct ip6_frag);
+ hlen = 0;

Now the iteration stops on the fragment header, and the call to
ip6_reass_packet is valid.

My npf_inet.c rev1.38 is partially reverted: we don't need to worry
about failing properly to advance; once the packet is reassembled
npf_cache_ip gets called again, and this time the whole chain should be
there.

Tested with a simple UDPv6 server - send a 3000-byte-sized buffer, the
packet gets correctly reassembled by NPF now.

(maxv)

Revert the COMPAT_AS sestting back to library, the documented default.

It doesn't really matter, since we no longer build the library in any
format, but best to make the code match the comments.

(pgoyette)

Add some more config dependencies between compat modules

(pgoyette)

fix compile error (variable set but not used)

(ryo)

fix build error. add options __HAVE_CPU_UAREA_ALLOC_IDLELWP for MULTIPROCESSOR

(ryo)

fix build error. need midi* for umidi

(ryo)

fix build error. if no usb, don't define USB_DEBUG

(ryo)

fix compile error (unused variables)

(ryo)

fix compile error

(ryo)

fix compile error (printf format)

(ryo)

fix compile error (printf format)

(ryo)

Use correct module name for dependency

(pgoyette)

Enhance assertion ipsecif(4) ATF to avoid confusing setkey(8) error message.

When setkey(8) says "syntax error at [-E]", it must mean get_if_ipsec_unique()
failed.

(knakahara)

fix the cleanfiles for hooks mechanism

(mrg)

add the generated prog.conf.5 to CLEANFILES.

(mrg)

add *template.x to CLEANFILES.

(mrg)

include bsd.clean.mk so that we actually clean up the attempted "params"

(mrg)

comment out confusing (and incorrect) code and add comment. Pointed out by maxv@n.o, thanks.

(knakahara)

use CLEANFILES+= not CLEANFILES= to avoid overriding what was already
setup before now.

(mrg)

Make sysctl_doeproc() more predictable

Swap the order of looking into zombie and all process lists, start now
with the zombie one. This prevents a race observed previously that the
same process could be detected on both lists during a single polling call.

While there:
- Short-circuit break for KERN_PROC_PID, once a pid has been detected.
- Removal of redundant "if (kbuf)" and "if (marker)" checks.
- Update of comments regarding potential optimization, explaining why we
  don't want to it as of now. Performance gain from lookup call vs
  iteration over a list is neglible on a regular system.
- Return ESRCH when no results have been found. This allows more easily
  to implement a retry or abandon algorithm.

This corrects races observed in the existing ATF ptrace(2) tests, related
to await_zombie(). This function was expecting to check whether a process
has been transformed into a zombie, however it was causing occasional
crashes as it was overflowing the return buffer, returning the same pid
twice: once from allproc list and the second time from zombieproc one.

Fix suggested by <christos>
Short-circuit break suggested by <kre>

Discussed on tech-kern.

Sponsored by <The NetBSD Foundation>

(kamil)

add missing pcfwrite.c.

(mrg)

clean up CRUNCHBIN.map

(mrg)

Fix IPv6 ipsecif(4) ATF regression, sorry.

There must *not* be padding between the src sockaddr and the dst sockaddr
after struct sadb_x_policy.

(knakahara)

update for new amdgpu and radeon driver versions.

(mrg)

Remove dead branches, 'npc' can't be NULL (and it is dereferenced
earlier).

(maxv)

Remove exgtraneous comma

(pgoyette)

Remove Tn.

(wiz)

AMD L3 cache association bitfield is not 8bit but 4bit like others association
bitfields.

(msaitoh)

s/CLFUSH/CLFLUSH/
No functional change.

(msaitoh)

Add 3way and 6way of L2 cache or TLB on AMD CPU.

(msaitoh)

Remove "alias" entry from the To-Do list - it's already in the Done pile.

(pgoyette)

Update dependencies for modules when they are built-in.  Now we don't
(or at least, shouldn't) need reminders in the GENERIC config files
about which module options require other options.

Update branch status doc accordingly.

(pgoyette)

improve previous, use getprogname() to get the invocation name.

(christos)

Reflect the new name of vndconfig(8) in the usage screen

vnconfig(8) was renamed to vndconfig(8) in NetBSD 7. While the manual page
now defaults to vndconfig, the usage screen still referred to the old name.

(khorben)

Explicitly mention use of -- for format strings beginning with -,
per PR 21970.

(dholland)

Update module dependencies

(pgoyette)

sort, add missing lint file

(christos)

Remove another COMPAT option

(pgoyette)

If compat_ibcs2 is being built for i386, make sure we include support
for 32-bit executables

(pgoyette)

Stub out on platforms without ifunc support in the linker.

(joerg)

regen these files for xkeyboard-config 2.23.1.

(mrg)

merge xkeyboard-config 2.23.1.

(mrg)

merge xf86-video-ati 18.0.0.

(mrg)

merge xf86-video-amdgpu 18.0.0.

(mrg)

merge xf86-video-vesa 2.4.0.

(mrg)

undo previous; breaks the build. handle inside flex.

(christos)

don't need sys/cdefs.h if tool.

(christos)

Make a comment meaningful.  ie: s/Ditto/what it was copying/  (more or less)

That is, there was a comment "Ditto" - which once upon a time, was used
to indicate the the previous comment applied here as well.  Time passed,
and software mutated, and the previous comment was unfortunately sacrificed.

Poor little Ditto was left all alone.

Noticed while doing some software archaeology.

(kre)

deal with cvs meta-data directories not called CVS.

(christos)

Explain the TSC drift thing.

(maxv)

Add myself.

(tih)

Clean up the EXIST paths (module and/or alias already exists) and make
sure we always return a pointer to the duplicate.

(pgoyette)

mark fontcache files as obsolete.

(mrg)

20180311:
bdftopcf was updated and may need cleaning in the
src/external/mit/xorg/tools/bdftopcf subdirectory if there are
link errors.

(mrg)

move the src list from libXfont stuff to local stuff.

(mrg)

update for bdftopcf 1.4.0.

(mrg)

merge xinit 1.4.0.

(mrg)

merge libpciaccess 0.14.

(mrg)

fix libXfont2 sources list.  update for xfs 1.2.0.

(mrg)

Fix build of tools/lex on platforms lacking sys/cdefs.h by including
nbtool_config.h in tools/compat/regex.h. Tested on illumos.

(hans)

merge xfs 1.2.0.

(mrg)

merge xprop 1.2.3

(mrg)

define LIBXFONT2.

(mrg)

merge libXres 1.2.0.

(mrg)

build and install libXfont2.

(mrg)

Don't forget about validating/correcting compat module dependencies

(pgoyette)

config.h is needed for libXfont2.

(mrg)

use xorg-pkg-ver.mk.

(mrg)

use xorg-pkg-ver.mk

(mrg)

merge xsetroot 1.1.2, xwininfo 1.1.4 and xsm 1.0.4.

(mrg)

use xorg-pkg-ver.mk and define HAVE_USLEEP.

(mrg)

merge xload 1.1.3, xrdb 1.1.1 and xmessage 1.0.5.

(mrg)

Since we use pointer semantics when walking the alias lists, declare
the pointer variable accordingly.

(pgoyette)

look in man/ subdir for the manual

(mrg)