Restore the initial state at the end of line.
This matters for stateful encodings like iso-2022-jp.
Fix taken from yamt via nvi2.

(rin)

PR bin/52715

Correct a (relatively harmless) use after free in prompt expansion
processing [detected by asan.]

Relatively harmless: as (while incorrect) the way the data is (was)
used more or less guaranteed that the buffer contents would be
unaltered until well after they are (were) no longer wanted (this
is the expanded prompt string, it is just output (or copied into
libedit internal storage) and forgotten.

This should make no visible difference to anyone (not using asan or
similar.)

XXX pullup -8

(kre)

make the checkok test stricter to avoid races, and use O_REGULAR.

(christos)

Change the behavior of join command in accordance with nvi-m17n, as proposed on
tech-userlevel@; when the last and first chars in joined lines are multi-width,
do not insert a white space.

(rin)

- Fix cursor position when a multiwidth char does not fit within a line.
- Put cursor on the leftmost column of a multiwidth char, instead of
  the rightmost one. Otherwise, some terminal emulators do not focus on
  the entire of the char.

Logic taken from nvi-m17n by itojun.

(rin)

PR bin/52716 fix buffer overrun found by libasan

(rin)

Implement memcpy, the builtin version does not work with variable sizes.

(maxv)

Add cpuid and rdseed.

(maxv)

Use psref instead of pserialize because that code is sleepable

(ozaki-r)

Use psref instead of pserialize because that code is sleepable

(ozaki-r)

Fix a deadlock between a route update and lltable

It happens because rtalloc1 is called from lltable with holding
IF_AFDATA_WLOCK.

If a route update is in action, rtalloc1 would wait for its completion with
holding IF_AFDATA_WLOCK. At the same moment, a softint (e.g., arpintr) may try
to take IF_AFDATA_WLOCK and get stuck on it. Unfortunately the stuck softint
prevents the route update from progressing because the route update calls
psref_target_destroy that needs the softint to complete.

A resource allocation graph of the senario looks like this:
    route update =(psref_target_destroy)=> softint => IF_AFDATA_WLOCK
    =(rt_update_wait)=> route update

Fix the deadlock by pulling rtalloc1 out of the lltable codes inside
IF_AFDATA_WLOCK.

Note that the deadlock happens only if NET_MPSAFE is enabled.

(ozaki-r)

Remove redundant KASSERTMSG

The function is static, has just one caller and the caller does the same check.

(ozaki-r)

Allwinner NAND Flash Controller driver. Work in progress.

(jmcneill)

Do not emit a meaningless message when lid open/close from valz(4)

(ryoon)

Assert KM_SLEEP xor KM_NOSLEEP in all kmem allocation.

(riastradh)

Add assertions that either PR_WAITOK or PR_NOWAIT are set.

(christos)

panic ex nihilo -- PR_NOWAITing for zerot

(riastradh)

use PR_NOWAIT instead of 0

(christos)

Don't use 0 for PR_NOWAIT

(christos)

use PR_NOWAIT.

(christos)

use PR_WAITOK everywhere.

(christos)

Guess pool_cache_get(pc, 0) means PR_WAITOK here.

Earlier on in the same context we use kmem_alloc(sz, KM_SLEEP).

(riastradh)

don't pass 0 to the pool flags

(christos)

add NAND module clock

(jmcneill)

Add support for decoding legacy Toshiba TC58NVG2S0H NAND chip params.

(jmcneill)

ul is not 64-bit on all platforms, use ull when calculating planesize

(jmcneill)

Trailing whitespcae

(skrll)

trailing whitespace

(skrll)

Trailing whitespace

(skrll)

Trailing whitespace

(skrll)

Trailing whitespace

(skrll)

Add O_REGULAR to enforce opening of only regular files
(like we have O_DIRECTORY for directories).
This is better than open(, O_NONBLOCK), fstat()+S_ISREG() because opening
devices can have side effects.

(christos)

Only open regular files.

(christos)

Handle the ERESTART case from pool_grow()

(christos)

Define utility functions as inlines in prekern.h.

(maxv)

make the KASSERTMSG/panic strings consistent as '%s: [%s], __func__, wchan'

(christos)

Use another ld script for kaslr kernels, in which there are no alignment
directives. They don't matter since the bootloader overwrites them.

But, normally we still need to make sure .data.read_mostly is aligned.
Unfortunately I couldn't find any way to force sh_addralign to be 64, so
I'm leaving the alignment there as a useless reminder.

(maxv)

Since pr_lock is now used to wait for two things now (PR_GROWING and
PR_WANTED) we need to loop for the condition we wanted.

(christos)

Fill in the page padding. Only .text is pre-filled by the ld script, but
this will change in the future.

(maxv)

Don't get stuck reading named pipes; only try to read plain files in
order to send mail.

(christos)

added booted_method

(christos)

Wait 1ms first. Existing Intel xHCI requies 1ms delay to prevent system hang
(Errata).

XXX pullup-[78]

(msaitoh)

On device which has SFP(+) cage and a module is inserted, hw->phy.id is not
MII PHY id but SFF 8024 ID. So checking hw->phy.id with 0 doesn't work.
Print PHY ID only for copper PHY.

(msaitoh)

fix typo. (does not affect actual operation, but confuses reader...)

The function is called when racoon receives SADB_X_MIGRATE pfkey message,
however the message is not used now. It was compatible code for KAME.

(knakahara)

- Add imxusbphy driver for i.MX6.
- Clean up CCM (Clock driver).
  Add imx6_ccm_analog_read/write() functions.

(hkenken)

Dedup some checks

And the change a bit optimizes checks of SA expirations, which
may shorten testing time.

(ozaki-r)

"Mark key_timehandler_ch callout as MP-safe" change needs one more sec to make lifetime tests stable

(ozaki-r)

Regen.

(msaitoh)

Add PEX 8605 4port 4lane PCIe Gen 2 switch.

(msaitoh)

Initialize boot_catalog_entry's entry_type properly.

This had been missing but the type was used in cd9660_setup_boot().

From OpenBSD usr.sbin/makefs/cd9660/cd9660_eltorito.c r1.10.

(nonaka)

add a "booted_method" string to aid in debugging double boot matches.

(christos)

add "prekern" to the string list.

(christos)

349, 350

(snj)

Pull up following revision(s) (requested by ozaki-r in ticket #350):
sys/netinet6/icmp6.c: revision 1.214
sys/netinet6/raw_ip6.c: revision 1.158
Fix usages of ipsec_used
If IPsec isn't used, we must go back to the normal path.
PR kern/52659

(snj)

Pull up following revision(s) (requested by ozaki-r in ticket #349):
sys/net/if_l2tp.c: revision 1.14
sys/net/if_tap.c: revision 1.101
sys/net/if_tun.c: revision 1.141
sys/net/if_vlan.c: revision 1.106
Set IFEF_NO_LINK_STATE_CHANGE flag to pseudo devices that don't use
if_link_state_change

(snj)

add wskbd at gpiokeys

(jmcneill)

1056, 1068, 1390

(snj)

1056, 1068, 1390

(snj)

Pull up following revision(s) (requested by skrll in ticket #1390):
sys/arch/mips/mips/pmap.c: 1.221-1.223
Fix a bug introduced by me in 1.214 where unmanaged mappings would be
affected by calls to pmap_page_protect which is wrong.  Now PV_KENTER
mappings are left intact.
Thanks to chuq for spotting my mistake and reviewing this diff.
Thanks to everyone who tested it as well.
Fix PR/51288 reproducable panic on evbmips64-eb (erlite)
pmap_page_remove from the previous change neglected to terminate the pv
list correctly when it started with an initial unmanaged mapping and
subsequent managed mappings.  Fix this.
Fix MIPS3_NO_PV_UNCACHED alias handling by looping through the pv_list
looking for bad aliases and removing the bad entries.  That is, revert
to the code before the matt-mips64 merge.
Additionally, fix the pmap_update call to not use the (recently
  removed/freed) pv for the pmap_t.
Fixes the following two PRs
PR/49903: Panic during installation on WorkPad Z50 (hpcmips) whilst uncompressing base.tgz
PR/51226: Install bug for hpcmips NetBSD V7 using FTP Full installation

(snj)

Pull up following revision(s) (requested by skrll in ticket #1390):
sys/arch/mips/mips/pmap.c: 1.221-1.223
Fix a bug introduced by me in 1.214 where unmanaged mappings would be
affected by calls to pmap_page_protect which is wrong.  Now PV_KENTER
mappings are left intact.
Thanks to chuq for spotting my mistake and reviewing this diff.
Thanks to everyone who tested it as well.
Fix PR/51288 reproducable panic on evbmips64-eb (erlite)
pmap_page_remove from the previous change neglected to terminate the pv
list correctly when it started with an initial unmanaged mapping and
subsequent managed mappings.  Fix this.
Fix MIPS3_NO_PV_UNCACHED alias handling by looping through the pv_list
looking for bad aliases and removing the bad entries.  That is, revert
to the code before the matt-mips64 merge.
Additionally, fix the pmap_update call to not use the (recently
  removed/freed) pv for the pmap_t.
Fixes the following two PRs
PR/49903: Panic during installation on WorkPad Z50 (hpcmips) whilst uncompressing base.tgz
PR/51226: Install bug for hpcmips NetBSD V7 using FTP Full installation

(snj)

Pull up following revision(s) (requested by skrll in ticket #1068):
sys/arch/mips/include/pmap.h: revision 1.63
sys/arch/mips/mips/pmap.c: revision 1.214
sys/arch/mips/mips/pmap_segtab.c: revision 1.8
Deal with incompatible cache aliases. Specifically,
- always flush an ephemeral page on unmap
- track unmanaged mappings (mappings entered via pmap_kenter_pa) for
    aliases where required and handle appropriately (via pmap_enter_pv)
Hopefully this (finally) addresses the instability reported in the
following PRs:
PR/44900 - R5000/Rm5200 mips ports are broken
PR/46890 - upcoming NetBSD 6.0 release is very unstable / unusable on cobalt qube 2
PR/48628 - cobalt and hpcmips ports are dead

(snj)

Pull up following revision(s) (requested by skrll in ticket #1068):
sys/arch/mips/include/pmap.h: revision 1.63
sys/arch/mips/mips/pmap.c: revision 1.214
sys/arch/mips/mips/pmap_segtab.c: revision 1.8
Deal with incompatible cache aliases. Specifically,
- always flush an ephemeral page on unmap
- track unmanaged mappings (mappings entered via pmap_kenter_pa) for
    aliases where required and handle appropriately (via pmap_enter_pv)
Hopefully this (finally) addresses the instability reported in the
following PRs:
PR/44900 - R5000/Rm5200 mips ports are broken
PR/46890 - upcoming NetBSD 6.0 release is very unstable / unusable on cobalt qube 2
PR/48628 - cobalt and hpcmips ports are dead

(snj)

Pull up following revision(s) (requested by skrll in ticket #1056):
sys/arch/mips/mips/pmap.c: revision 1.210-1.213
sys/arch/mips/mips/vm_machdep.c: revision 1.143
Fix a logic inversion introduced with the matt-nb5-mips64 for
pmap_{zero,copy}_page cache alias handing. The check previously used
PG_MD_UNCACHED_P, where it now uses PG_MD_CACHED_P, when considering if
a cache invalidation is required.
Additionally flush the cache for the uarea va to avoid potential (future)
cache aliases in cpu_uarea_free when handing pages back to uvm for later
use.
ok matt@
Hopefully this addresses the instability reported in the following PRs:
PR/44900 - R5000/Rm5200 mips ports are broken
PR/46170 - NetBSD/cobalt 6.0_BETA does not boot
PR/46890 - upcoming NetBSD 6.0 release is very unstable / unusable on cobalt qube 2
PR/48628 - cobalt and hpcmips ports are dead
Grab pv_list lock in pmap_unmap_ephemeral_page only when needed.
Make PARANOIADIAG compile.
Use pmap_tlb_asid_check to reduce code c&p.

(snj)

Pull up following revision(s) (requested by skrll in ticket #1056):
sys/arch/mips/mips/pmap.c: revision 1.210-1.213
sys/arch/mips/mips/vm_machdep.c: revision 1.143
Fix a logic inversion introduced with the matt-nb5-mips64 for
pmap_{zero,copy}_page cache alias handing. The check previously used
PG_MD_UNCACHED_P, where it now uses PG_MD_CACHED_P, when considering if
a cache invalidation is required.
Additionally flush the cache for the uarea va to avoid potential (future)
cache aliases in cpu_uarea_free when handing pages back to uvm for later
use.
ok matt@
Hopefully this addresses the instability reported in the following PRs:
PR/44900 - R5000/Rm5200 mips ports are broken
PR/46170 - NetBSD/cobalt 6.0_BETA does not boot
PR/46890 - upcoming NetBSD 6.0 release is very unstable / unusable on cobalt qube 2
PR/48628 - cobalt and hpcmips ports are dead
Grab pv_list lock in pmap_unmap_ephemeral_page only when needed.
Make PARANOIADIAG compile.
Use pmap_tlb_asid_check to reduce code c&p.

(snj)

Add matt-nb8-mediatek branch

(matt)

Use genassym.cf instead of #include <arch/arm/sunxi/sunxi_platform.h>

(skrll)

Add pkboot in "help".

(maxv)

Don't fall through.

(maxv)

remove vestige

(maxv)

Call fpuinit_mxcsr_mask in cpu_init, after cr4 is initialized, but before
touching xcr0. Then use clts/stts instead of modifying cr0, and enable the
mxcsr_mask detection on Xen.

(maxv)

Mark key_timehandler_ch callout as MP-safe (just forgot to do so)

(ozaki-r)

Fix a bug that Denverton which uses firmware don't linkup if the media is
forced to 100baseTX-FDX or 10baseT-FDX. As I wrote in ixgbe_phy.c rev. 1.13,
popular switches and OSes don't use auto-negotiation if the media is forced to
100BASE-TX or 10BASE-T. Do the same thing. But, if we don't set
FW_PHY_ACT_SETUP_LINK_AN in ixgbe_setup_fw_link(), the firmware wrongly set
BMCR register. Two problems are observed:

a) FDX may not be set.
b) BMCR_SPEED1 (bit 6) is always cleard.

+ -------+------+-----------+-----+
|request | BMCR | BMCR spd | BMCR |
|        | (HEX)| (in bits)|  FDX |
+--------+------+----------+------+
|  10M  | 0000 |  10M(00) |    0 |
|  10M  | 2100 | 100M(01) |    1 |
|  100M  | 0000 |  10M(00) |    0 |
|  100M  | 0100 |  10M(00) |    1 |
+--------------------------+------+

To avoid this problem, after sending request to firmware, check BMCR register
and fix the setting if it's required.

Before this change:

+------------------+---------------------------------------------+
|                  |                    denverton                |
|                  +---------+--------+---------+----------------+
|                  |  auto  | 1G FDX | 100 FDX |        10 FDX |
+---------+--------+---------+--------+---------+----------------+
|        |  auto |  1G FDX | 1G FDX | 100 FDX | 10FDX/down(NG) |
|        +--------+---------+--------+---------+----------------+
|        | 1G FDX |  1G FDX | 1G FDX |    down |          down |
| link    +--------+---------+--------+---------+----------------+
| partner |100 FDX | down(*1)|  down | down(NG)|          down |
|        +--------+---------+--------+---------+----------------+
|        | 10 FDX | down(*1)|  down |    down |      down(NG) |
+---------+--------+---------+--------+---------+----------------+
(Observed on: NVM Image Version 0.05 ID 0x8, NVM Map version 1.16,
OEM NVM Image version 0.06, ETrackID 8000087c)

After this change:

+------------------+---------------------------------------------+
|                  |                    denverton                |
|                  +---------+--------+---------+----------------+
|                  |  auto  | 1G FDX | 100 FDX |        10 FDX |
+---------+--------+---------+--------+---------+----------------+
|        |  auto |  1G FDX | 1G FDX | 100 FDX |        10 FDX |
|        +--------+---------+--------+---------+----------------+
|        | 1G FDX |  1G FDX | 1G FDX |    down |          down |
| link    +--------+---------+--------+---------+----------------+
| partner |100 FDX | down(*1)|  down | 100 FDX |          down |
|        +--------+---------+--------+---------+----------------+
|        | 10 FDX | down(*1)|  down |    down |        10 FDX |
+---------+--------+---------+--------+---------+----------------+
*1): may be correct because ixg doesn't support half duplex.

(msaitoh)

fix locking, remove error(1) comments.

(christos)

use p->p_path, remove unused code.

(christos)

remove both timestamp and static pie

(christos)

not ready for static pie either.

(christos)

remove tstamp.h, this is for a different time.

(christos)

hack around namei problem.

(christos)

Store full executable path in p->p_path as discussed in tech-kern.
This means that the full executable path is always available.

- exec_elf.c: use p->path to set AT_SUN_EXECNAME, and since this is
  always set, do so unconditionally.
- kern_exec.c: simplify pathexec, use kmem_strfree where appropriate
  and set p->p_path
- kern_exit.c: free p->p_path
- kern_fork.c: set p->p_path for the child.
- kern_proc.c: use p->p_path to return the executable pathname; the
  NULL check for p->p_path, should be a KASSERT?
- exec.h: gc ep_path, it is not used anymore
- param.h: bump version, 'struct proc' size change

TODO:
1. reference count the path string, to save copy at fork and free
  just before exec?
2. canonicalize the pathname by changing namei() to LOCKPARENT
  vnode and then using getcwd() on the parent directory?

(christos)

kmem_str{dupsize,free} man pages.

(christos)

document kmem_strdupsize/kmem_strdupfree

(christos)

Add two utility functions to help use kmem with strings: kmem_strdupsize,
kmem_strfree.

(christos)

Add driver for Broadcom 802.11a/b/g/n/ac SDIO wireless devices, based on
the OpenBSD bwfm(4) driver.

I could not test this on any hardware yet, as it does not attach as-is on
my Raspberry PI 3.

(khorben)

We computed the length of the string already, so use it...

(christos)

Don't define ELFSIZE

(christos)

Don't define ELFSIZE

(christos)

Return res in non-synaptics case like before. Fix ALPS case

(ryoon)

Use mixring blocksizes in the right places when mixer is enabled.

This means that x68k's vs audio works once again with sysctl usemixer=1.

Tested with xm6i.

(nat)

Stop using bpfjit

Because most architectures don't support it and npf still works without it.

(ozaki-r)

on RPI2, fix compile failure without options MULTIPROCESSOR.

(ryo)

Fix the "wait for any pending transmission to finish" - doesn't really
matter at the moment as the fifo is disabled.

(skrll)

Trailing whitespace

(skrll)

Fix a bug that X550T(1) didn't linkup if it forces 100BaseTX-FDX.
Popular switches and OSes don't use auto-negotiation if the media is
100BASE-TX (and 10BASE-T). Do the same thig.

Another fix is required for Denverton's _T device which use firmware.

(msaitoh)

Define bit definitions of MDIO_PMAPMD_CTRL1 and MDIO_AN_CTRL1.

(msaitoh)

Make wddone poll all drives of a channel again.

(mlelstv)

Let rtadvd not use syslog for logging

Thanks to christos@ now rtadvd can log via stderr instead of syslog
by -D option.

Address PR bin/52701

(ozaki-r)

Remove 24 bit in a 32 bit container filters.

At present this filter did not work well and has caused problems with
the audio mixer disabled for hdaudio(4).

These filters may return when they are fixed.

(nat)

A sysctl is now available to disable the in kernel mixer.
sysctl -w hw.hdafg0.usemixer=0

There currently is a problem draining the last block with the mixer
disabled.  I will fix this in a follow up commit.

AFAIK there will be a problem wiht vs(4) on x68k with the mixer disabled
as the filters for mulaw, alaw and unsigned linear have been removed post
audio mixing changes.

Documentation for this sysctl variable will be made to audio.4 in a follow
up commit.

Ok christos@.

(nat)

In the fopen_regular and fopen_symlink tests, when (that is, if) a
failure occurs, distinguish in the failure message the cases where the
open succeeded (and should not have), and where it failed, but not for
the expected reason (the "wrong errno" case not tested, would require
manufacturing a broken kernel...).

Add O_NOFOLLOW ('l' mode modifier) tests to the fopen_mode test case
(tests that are intended to open the file) and also add a few missing
commas which were causing a few of the sub-tests to be skipped, and
others to be not quite testing exactly what was intended.

(kre)

Bump date for previous. New sentence, new line. Fix typos.
Add missing word.

(wiz)

init/fini for the main program is handled by crt0.o, so ifunc handling
is skipped right now as it iterates the same list. Don't repeat that
mistake and explicitly take care of it in the dynamic linker.

(joerg)

Add documentation for clickpad mouse button emulation.

(blymn)

Add two finger support and middle/right button emulation.

(blymn)

Add support for NextThing GR8.

(jmcneill)

handle ppc64

(christos)

Handle 64 bit kernels.

(christos)

Mark expandm as preserving format strings.

(joerg)

Assert that pool_get failure happens only with PR_NOWAIT.

This would have caught the mistake I made last week leading to null
pointer dereferences all over the place, a mistake which I evidently
poorly scheduled alongside maxv's change to the panic message on x86
for null pointer dereferences.

(riastradh)

Since _RUMPKERNEL is really userland code it needs ARCH_ELFSIZE,
not KERN_ELFSIZE, make it so!

(christos)

add a symlink test

(christos)

Switch XEN drivers to use intr_establish_xname()/intr_disestablish()

This completes the API transition.

(cherry)

Summary: xen/x86/intr.c has been retired. Don't try to build it.

(cherry)

Change the meaning of the 'D' flag to print errors to stderr instead of
syslog(3) and exit if poll(2) fails (intended to be used with unit-tests).

(christos)

Assert that __cxa_atexit is not used with NULL as DSO. Don't use
__cxa_atexit directly from atexit, they have different behavior.

(joerg)

Kill rtadvd surely even if the tests fail in the middle

It may help PR bin/52701.

(ozaki-r)

338-341, 343, 344, 346-348

(snj)

Pull up following revision(s) (requested by martin in ticket #339):
sys/compat/netbsd32/netbsd32_conv.h: revision 1.33
PR kern/52681: fix msghdr conversion.

(snj)

Pull up following revision(s) (requested by martin in ticket #338):
sys/arch/sparc64/dev/sab.c: revision 1.55
sys/dev/ic/com.c: revision 1.345
sys/dev/ic/z8530tty.c: revision 1.132
sys/dev/sun/sunkbd.c: revision 1.30
sys/dev/sun/sunms.c: revision 1.33
sys/sys/tty.h: revision 1.94
As discussed on tech-kern: define a new tty internal state flag: TS_KERN_ONLY
Implement it in a few tty drivers. If this flag is set, the underlying
hardware is used by another driver and userland has no right to open
it. A few uses will appear soon in sys/dev/sun/sun{kbd,ms}.c.
--
PR port-sparc64/52622: mark the parent device as TS_KERN_ONLY,
so userland will not touch it (and change serial params w/o our
control).

(snj)

no more ssh1 code in openssh, so no use defining WITH_SSH1

(snj)

Pull up following revision(s) (requested by knakahara in ticket #341):
sys/net/if_l2tp.c: revision 1.12
fix l2tp panic when l2tp session id is changed (same as if_vlan.c:r1.104)
E.g. the following operation causes this panic.
    ====================
    # ifconfig l2tp0 create
    # ifconfig l2tp0 session 140 140
    # ifconfig l2tp1 create
    # ifconfig l2tp1 session 200 200
    # ifconfig l2tp1 session 300 300
    panic: kernel diagnostic assertion "new->ple_next == NULL" failed: file "/disk4/home/k-nakahara/repos/netbsd-src/sys/sys/pslist.h", line 118
    ====================
Pointed out by s-yamaguchi@IIJ, thanks.

(snj)

Pull up following revision(s) (requested by knahakara in ticket #340):
sys/net/if_vlan.c: revision 1.104
fix vlan panic when vlan is re-configured without destroy.
E.g. the following operation causes this panic.
    ====================
    # ifconfig vlan0 create
    # ifconfig vlan0 vlan 1 vlanif ixg3
    # ifconfig vlan1 create
    # ifconfig vlan1 vlan 1 vlanif ixg2
    # ifconfig vlan1 -vlanif
    # ifconfig vlan1 vlan 1 vlanif ixg2
    panic: kernel diagnostic assertion "new->ple_next == NULL" failed: file "/git/netbsd-src/sys/sys/pslist.h", line 118
    ====================
Pointed out and tested by msaitoh@n.o, fixed by s-yamaguchi@IIJ, thanks.

(snj)

Pull up following revision(s) (requested by pgoyette in ticket #343):
sys/kern/kern_history.c: revision 1.16
sys/sys/kernhist.h: revision 1.22
usr.bin/vmstat/vmstat.c: revision 1.220
Remove the ABI version-and-length check that was recently introduced;
sysctl(9) ABIs should be stable across versions.

(snj)

Pull up following revision(s) (requested by knakahara in ticket #348):
sys/dev/pci/if_wm.c: revision 1.542
sys/dev/pci/if_wmreg.h: revision 1.104
fix wm(4) vlan panic. Reported and tested by Tom Ivar Helbekkmo, thanks.
wm(4) used PRI bits and CFI bit as vlantag by mistake. It is found out
by if_ether.h:r1.67.

(snj)

Pull up following revision(s) (requested by jmcneill in ticket #347):
usr.bin/mkubootimage/mkubootimage.c: revision 1.22
add missing break after -m case

(snj)

Pull up following revision(s) (requested by mrg in ticket #346):
external/mit/xorg-server.old/dist/Xext/panoramiX.c: 1.2
external/mit/xorg-server.old/dist/Xext/saver.c: 1.2
external/mit/xorg-server.old/dist/Xext/xvdisp.c: 1.2
external/mit/xorg-server.old/dist/Xi/xichangehierarchy.c: 1.2
external/mit/xorg-server.old/dist/dbe/dbe.c: 1.2
external/mit/xorg-server.old/dist/dix/dispatch.c: 1.2
external/mit/xorg-server.old/dist/hw/dmx/dmxpict.c: 1.2
external/mit/xorg-server.old/dist/hw/xfree86/dixmods/extmod/xf86dga2.c: 1.2
external/mit/xorg-server.old/dist/hw/xfree86/dri/xf86dri.c: 1.2
external/mit/xorg-server.old/dist/render/render.c: 1.2
external/mit/xorg-server.old/dist/xfixes/cursor.c: 1.2
external/mit/xorg-server.old/dist/xfixes/region.c: 1.2
external/mit/xorg-server.old/dist/xfixes/saveset.c: 1.2
external/mit/xorg-server.old/dist/xfixes/xfixes.c: 1.2
external/mit/xorg-server/dist/Xext/panoramiX.c: 1.2
external/mit/xorg-server/dist/Xext/saver.c: 1.2
external/mit/xorg-server/dist/Xext/vidmode.c: 1.2
external/mit/xorg-server/dist/Xext/xres.c: 1.2
external/mit/xorg-server/dist/Xext/xvdisp.c: 1.7
external/mit/xorg-server/dist/Xi/xibarriers.c: 1.2
external/mit/xorg-server/dist/Xi/xichangehierarchy.c: 1.4
external/mit/xorg-server/dist/dbe/dbe.c: 1.4
external/mit/xorg-server/dist/dix/dispatch.c: 1.4
external/mit/xorg-server/dist/hw/dmx/dmxpict.c: 1.2
external/mit/xorg-server/dist/hw/xfree86/common/xf86DGA.c: 1.2
external/mit/xorg-server/dist/hw/xfree86/dri/xf86dri.c: 1.2
external/mit/xorg-server/dist/pseudoramiX/pseudoramiX.c: 1.2
external/mit/xorg-server/dist/render/render.c: 1.4
external/mit/xorg-server/dist/xfixes/cursor.c: 1.2
external/mit/xorg-server/dist/xfixes/region.c: 1.2
external/mit/xorg-server/dist/xfixes/saveset.c: 1.2
external/mit/xorg-server/dist/xfixes/xfixes.c: 1.2
apply fixes for CVEs 2017-12176 to 2017-12187.
--
From 1b1d4c04695dced2463404174b50b3581dbd857b Mon Sep 17 00:00:00 2001
From: Nathan Kidd <nkidd%opentext.com@localhost>
Date: Sun, 21 Dec 2014 01:10:03 -0500
Subject: hw/xfree86: unvalidated lengths
This addresses:
CVE-2017-12180 in XFree86-VidModeExtension
CVE-2017-12181 in XFree86-DGA
CVE-2017-12182 in XFree86-DRI
--
From 211e05ac85a294ef361b9f80d689047fa52b9076 Mon Sep 17 00:00:00 2001
From: Michal Srb <msrb%suse.com@localhost>
Date: Fri, 7 Jul 2017 17:21:46 +0200
Subject: Xi: Test exact size of XIBarrierReleasePointer
Otherwise a client can send any value of num_barriers and cause reading or swapping of values on heap behind the receive buffer.
--
From 4ca68b878e851e2136c234f40a25008297d8d831 Mon Sep 17 00:00:00 2001
From: Nathan Kidd <nkidd%opentext.com@localhost>
Date: Fri, 9 Jan 2015 10:09:14 -0500
Subject: dbe: Unvalidated variable-length request in ProcDbeGetVisualInfo
(CVE-2017-12177)
v2: Protect against integer overflow (Alan Coopersmith)
--
From 55caa8b08c84af2b50fbc936cf334a5a93dd7db5 Mon Sep 17 00:00:00 2001
From: Nathan Kidd <nkidd%opentext.com@localhost>
Date: Fri, 9 Jan 2015 11:43:05 -0500
Subject: xfixes: unvalidated lengths (CVE-2017-12183)
v2: Use before swap (Jeremy Huddleston Sequoia)
v3: Fix wrong XFixesCopyRegion checks (Alan Coopersmith)
--
From 859b08d523307eebde7724fd1a0789c44813e821 Mon Sep 17 00:00:00 2001
From: Nathan Kidd <nkidd%opentext.com@localhost>
Date: Wed, 24 Dec 2014 16:22:18 -0500
Subject: Xi: fix wrong extra length check in ProcXIChangeHierarchy
(CVE-2017-12178)
--
From 9c23685009aa96f4b861dcc5d2e01dbee00c4dd9 Mon Sep 17 00:00:00 2001
From: Michal Srb <msrb%suse.com@localhost>
Date: Fri, 7 Jul 2017 17:04:03 +0200
Subject: os: Make sure big requests have sufficient length.
A client can send a big request where the 32B "length" field has value
0. When the big request header is removed and the length corrected,
the value will underflow to 0xFFFFFFFF.  Functions processing the
request later will think that the client sent much more data and may
touch memory beyond the receive buffer.
--
From b747da5e25be944337a9cd1415506fc06b70aa81 Mon Sep 17 00:00:00 2001
From: Nathan Kidd <nkidd%opentext.com@localhost>
Date: Fri, 9 Jan 2015 10:15:46 -0500
Subject: Unvalidated extra length in ProcEstablishConnection (CVE-2017-12176)

(snj)

Pull up following revision(s) (requested by spz in ticket #344):
external/bsd/nvi/usr.bin/recover/virecover: 1.2-1.3
external/bsd/nvi/dist/common/recover.c: 1.6-1.9
be more careful about opening recovery files... in particular deal with
people trying to get 'vi -r' stuck using named pipes, symlink attacks,
and coercing others opening recovery files they did not create.
- don't use command substitution to glob a pattern into a list of filenames;
  it is less efficient than doing it directly and does not handle whitespace
  in filenames properly.
- change test to [
- quote variables
Put back the tests for "no files matched" (in a different way than they
were written previously - but that's just style.)  This is not csh...
Use the correct test operator to test for an empty file (rather than
testing for an empty file name...)
Write test ('[') commands in a way that is defined to work, rather than
just happens to - we can afford the (negligible) performance hit here.
Deal safely with recovery mail files.
oops, accidendally committed an earlier non-working version; fixed.
Don't use popenve() for portability; forking an extra shell here is not an
issue.

(snj)

1385

(snj)

Pull up following revision(s) (requested by kardel in ticket #1385):
sys/dev/pci/if_wm.c: revision 1.497
PR kern/52039: use same safeguard as for the 82578

(snj)

kill another wrong ELFSIZE setting.

(christos)

remove more DB_ELFSIZE

(christos)

need to undef KERN_ELFSIZE too here...

(christos)

Use KERN_ELFSIZE if we are in the kernel.

(christos)

Define the ELFSIZE to be KERN_ELFSIZE, since these headers always refer
to kernel objects (even when included from userland).

(christos)

Cleanup and clarify the ELFSIZE mess:

We now have 2 variables automatically set in elf_machdep.h:

    ARCH_ELFSIZE: the size for userland binaries
    KERN_ELFSIZE: the size for the kernel binaries

DB_ELFSIZE has been deleted and KERN_ELFSIZE should have always the
same values DB_ELFSIZE used to have.

In sys/exec_elf.h, if ELFSIZE is not set, it is set to KERN_ELFSIZE
for the kernel and ARCH_ELFSIZE for userland. These defaults should
eliminate the need for most manual ELFSIZE setting.

(christos)

No need to compile in ip_*.c and ipc_*.c to nvi, although they are
necessary for generation of header files.

Reduce 5% of binary size on amd64.

(rin)

Introduce HAVE_XXX macros to where they should be.
No binary changes, but possibly improve portability for, e.g.,
sync with pkgsrc version in the near future.

(rin)

Entries of abbrev[] should be sorted for bsearch(3) to work.
Fix the problem that option abbreviation "fe" is neglected.

(rin)

Fix corruption in numbering of options without GTAGS compile-time option.
Now nvi works without GTAGS.

(rin)

No need to include ip_extern.h here.
No binary changes.

(rin)

Remove a hack which declares tigetstr(9) in cl_extern.h.
No binary changes.

(rin)

Fix bogus file location in percentage.

(rin)

Fix buffer overrun caused by lines longer than CONV_BUFFER_SIZE.
Take care of errno == E2BIG case of iconv(3) appropriately.

(rin)

Revive commented out DISKLABEL_EI option to kernel configuration files
that contain FFS_EI option.

(rin)

- fix "obsolete" skipping to handle obsolete entries that contain other
  variables
- skip files particular to other xserver versions than ours.

XXX: How does this build in the build farm?

(christos)

1519, 1520, 1522, 1523

(snj)

1519, 1520, 1522, 1523

(snj)

1520, 1522, 1523

(snj)

Apply patch (requested by mrg in ticket #1523):
apply fixes for CVEs 2017-12176 to 2017-12187

(snj)