o Merge FreeBSD-SA-06:14.fpu.

Approved by:	so (cperciva)

Makefile.inc1

@@ -531,7 +531,7 @@ update:
 	@echo "--------------------------------------------------------------"
 	@echo ">>> Updating ${.CURDIR} from cvs repository" ${CVSROOT}
 	@echo "--------------------------------------------------------------"
-	cd ${.CURDIR}; cvs -q update -rRELENG_4 -P -d
+	cd ${.CURDIR}; cvs -q update -rRELENG_4_9 -P -d
 .endif
 
 #

UPDATING

@@ -8,6 +8,129 @@ A reverse chronology since 4.0 was released is included, followed by
 the common items quick how-tos, followed by entries for versions of
 -current prior to 4.0 Release.
 
+This is for the 4.9 release branch.  All entries since 4.9 are an
+itemized list of commits to this branch, numbered from the beginning.
+
+The security advisories related to various patches contain information
+on how to build/install a minimal set of binaries and start/stop a
+minimal number of processes, if possible, for that patch.  For those
+updates that don't have an advisory, or to be safe, you can do a full
+build and install as described in the COMMON ITEMS section.
+
+20060421:	p25	FreeBSD-SA-06:14.fpu
+	Correct a local information leakage bug affecting AMD FPUs.
+
+20060323:	p24	FreeBSD-SA-06:11.ipsec, FreeBSD-SA-06:12.opie
+	Add missing code needed for the detection of IPSec packet
+	replays. [06:11]
+
+	Correctly identify the user running opiepasswd(1) when the login
+	name differs from the account name. [06:12]
+
+20060302:	p23	FreeBSD-SA-06:10.nfs
+	Correct a remote kernel panic when processing zero-length RPC
+	records via TCP.
+
+20060118:	p22	FreeBSD-SA-06:01.texindex, FreeBSD-SA-06:02.ee,
+			FreeBSD-SA-06:03.cpio
+	Correct insecure temporary file usage in texindex. [06:01]
+
+	Correct insecure temporary file usage in ee. [06:02]
+
+	Correct a race condition when setting file permissions,
+	sanitize file names by default, and fix a buffer overflow
+	when handling files larger than 4GB in cpio. [06:03]
+
+20051013:	p21	FreeBSD-SA-05:21.openssl
+	Correct a man-in-the-middle SSL version rollback vulnerability.
+
+20050910:	p20	FreeBSD-SA-05:20.cvsbug
+	Correct insecure temporary file usage.
+
+20050702:	p19	FreeBSD-SA-05:14.bzip2, FreeBSD-SA-05:15.tcp
+	Correct bzip2 denial of service and permission race vulnerabilities.
+
+	Correct TCP connection stall denial of service vulnerabilities.
+
+20050610:	p18	FreeBSD-SA-05:11.gzip
+	Correct directory traversal and race condition vulnerabilities in gzip.
+
+20050512:	p17	FreeBSD-SA-05:06.iir, FreeBSD-SA-05:07.ldt,
+    			FreeBSD-SA-05:08.kmem
+	Correct overly liberal permissions on /dev/iir.
+
+	Correctly validate inputs to the i386_get_ldt syscall.
+
+	Correct several local kernel memory disclosure bugs.
+
+20050426:	p16	FreeBSD-SA-05:05.cvs
+	Correct several vulnerabilities in CVS.
+
+20050421:	p15	FreeBSD-SA-05:04.ifconf
+	Zero a buffer in ifconf() in order to avoid accidental
+	disclosure of kernel memory to userland.
+
+20050408:	p14	FreeBSD-SA-04:17.procfs, FreeBSD-SA-05:01.telnet,
+    			FreeBSD-SA-05:02.sendfile
+	Fix a tainted pointer dereference in procfs(5) and linprocfs(5)
+	which could allow a local attacker to panic a system and/or read
+	from kernel memory.
+
+	Correct buffer overflows in telnet(1).
+
+	Correct kernel memory disclosure bug in sendfile(2).
+
+20041118:	p13	FreeBSD-SA-04:16.fetch
+	Correct a buffer overflow in fetch(1) which could allow a
+	mallicious server to execute arbitrary code on the client.
+
+20040919:	p12	FreeBSD-SA-04:14.cvs
+	Correct several vulnerabilities in CVS (CAN-2004-0414,
+	CAN-2004-0416, CAN-2004-0417, CAN-2004-0418, CAN-2004-0778).
+
+20040630:	p11	FreeBSD-SA-04:13.linux
+	Correct an input validation error in the linux binary
+	compatibility code.
+
+20040607:	p10	FreeBSD-SA-04:12.jailroute
+	Correct a user validation error which could allow a jailed
+	super-user to manipulate routing tables.
+
+20040526:	p9	FreeBSD-SA-04:11.msync
+	Fix a bug in msync(2) which could cause it to discard dirty
+	pages.
+
+	NOTE: In some cases involving NFS, the incorrect behaviour may
+	actually be preferrable.  Setting the vm.old_msync sysctl
+	variable to 1 will revert msync(2) to its old behaviour.
+
+20040519:       p8	FreeBSD-SA-04:10.cvs
+	Correct a heap overflow in cvs's pserver protocol parser.
+
+20040505:	p7	FreeBSD-SA-04:09.kadmind
+	Correct a heap buffer overflow in k5admind's Kerberos IV support.
+
+20040505:	p6	FreeBSD-SA-04:08.heimdal
+	Correctly validate the transited field in Kerberos tickets.
+
+20040415:       p5      FreeBSD-SA-04:07.cvs
+	Correct some path validation errors in CVS.
+
+20040317:	p4	FreeBSD-SA-04:05.openssl
+	Correct a denial-of-service vulnerability in OpenSSL.
+
+20040302:	p3	FreeBSD-SA-04:04.tcp
+	Limit TCP segment reassembly queue size.
+
+20040205:	p2	FreeBSD-SA-04:02.shmat
+	Correct a reference counting bug in shmat(2).
+
+20031126:	p1	FreeBSD-SA-03:19.bind
+	Corrected remote denial-of-service vulnerability in named(8).
+
+20031028:
+	FreeBSD 4.9-RELEASE.
+
 20031022:
 	Support for HyperThread logical CPUs has now been enabled by
 	default.  As a result, the HTT kernel option no longer exists.

contrib/bind/Version

@@ -1 +1 @@
-8.3.6-REL
+8.3.6-REL-p1

contrib/bind/bin/named/ns_resp.c

@@ -271,7 +271,7 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 	int soacount;
 	u_int qtype, qclass;
 	int validanswer, dbflags;
-	int cname, lastwascname, externalcname;
+	int cname, lastwascname, externalcname, cachenegative;
 	int count, founddata, foundname;
 	int buflen;
 	int newmsglen;
@@ -911,6 +911,7 @@ tcp_retry:
 	cname = 0;
 	lastwascname = 0;
 	externalcname = 0;
+	cachenegative = 1;
 	strcpy(aname, qname);
 
 	if (count) {
@@ -980,6 +981,7 @@ tcp_retry:
 						 name);
 				db_detach(&dp);
 				validanswer = 0;
+				cachenegative = 0;
 				continue;
 			}
 			if (type == T_CNAME &&
@@ -1014,6 +1016,7 @@ tcp_retry:
 				 "last was cname, ignoring auth. and add.");
 				db_detach(&dp);
 				validanswer = 0;
+				cachenegative = 0;
 				break;
 			}
 			if (i < arfirst) {
@@ -1029,6 +1032,7 @@ tcp_retry:
 							sin_ntoa(from));
 						db_detach(&dp);
 						validanswer = 0;
+						cachenegative = 0;
 						continue;
 					} else if (!ns_samedomain(name,
 							       qp->q_domain)) {
@@ -1042,6 +1046,7 @@ tcp_retry:
 							 sin_ntoa(from));
 						db_detach(&dp);
 						validanswer = 0;
+						cachenegative = 0;
 						continue;
 					}
 					if (type == T_NS) {
@@ -1205,8 +1210,9 @@ tcp_retry:
 	     )
 	    )
 	{
-		cache_n_resp(msg, msglen, from, qp->q_name,
-			     qp->q_class, qp->q_type);
+		if (cachenegative)
+			cache_n_resp(msg, msglen, from, qp->q_name,
+				     qp->q_class, qp->q_type);
 
 		if (!qp->q_cmsglen && validanswer) {
 			ns_debug(ns_log_default, 3,

contrib/bzip2/bzip2.c

@@ -312,6 +312,7 @@ static void    compressedStreamEOF   ( void )    NORETURN;
 
 static void    copyFileName ( Char*, Char* );
 static void*   myMalloc     ( Int32 );
+static int     applySavedFileAttrToOutputFile ( int fd );
 
 
 
@@ -457,6 +458,10 @@ void compressStream ( FILE *stream, FILE *zStream )
    ret = fflush ( zStream );
    if (ret == EOF) goto errhandler_io;
    if (zStream != stdout) {
+      int fd = fileno ( zStream );
+      if (fd < 0) goto errhandler_io;
+      ret = applySavedFileAttrToOutputFile ( fd );
+      if (ret != 0) goto errhandler_io;
       ret = fclose ( zStream );
       outputHandleJustInCase = NULL;
       if (ret == EOF) goto errhandler_io;
@@ -525,6 +530,7 @@ Bool uncompressStream ( FILE *zStream, FILE *stream )
    UChar   obuf[5000];
    UChar   unused[BZ_MAX_UNUSED];
    Int32   nUnused;
+   void*   unusedTmpV;
    UChar*  unusedTmp;
 
    nUnused = 0;
@@ -554,9 +560,10 @@ Bool uncompressStream ( FILE *zStream, FILE *stream )
       }
       if (bzerr != BZ_STREAM_END) goto errhandler;
 
-      BZ2_bzReadGetUnused ( &bzerr, bzf, (void**)(&unusedTmp), &nUnused );
+      BZ2_bzReadGetUnused ( &bzerr, bzf, &unusedTmpV, &nUnused );
       if (bzerr != BZ_OK) panic ( "decompress:bzReadGetUnused" );
 
+      unusedTmp = (UChar*)unusedTmpV;
       for (i = 0; i < nUnused; i++) unused[i] = unusedTmp[i];
 
       BZ2_bzReadClose ( &bzerr, bzf );
@@ -567,6 +574,12 @@ Bool uncompressStream ( FILE *zStream, FILE *stream )
 
    closeok:
    if (ferror(zStream)) goto errhandler_io;
+   if ( stream != stdout) {
+      int fd = fileno ( stream );
+      if (fd < 0) goto errhandler_io;
+      ret = applySavedFileAttrToOutputFile ( fd );
+      if (ret != 0) goto errhandler_io;
+   }
    ret = fclose ( zStream );
    if (ret == EOF) goto errhandler_io;
 
@@ -639,6 +652,7 @@ Bool testStream ( FILE *zStream )
    UChar   obuf[5000];
    UChar   unused[BZ_MAX_UNUSED];
    Int32   nUnused;
+   void*   unusedTmpV;
    UChar*  unusedTmp;
 
    nUnused = 0;
@@ -662,9 +676,10 @@ Bool testStream ( FILE *zStream )
       }
       if (bzerr != BZ_STREAM_END) goto errhandler;
 
-      BZ2_bzReadGetUnused ( &bzerr, bzf, (void**)(&unusedTmp), &nUnused );
+      BZ2_bzReadGetUnused ( &bzerr, bzf, &unusedTmpV, &nUnused );
       if (bzerr != BZ_OK) panic ( "test:bzReadGetUnused" );
 
+      unusedTmp = (UChar*)unusedTmpV;
       for (i = 0; i < nUnused; i++) unused[i] = unusedTmp[i];
 
       BZ2_bzReadClose ( &bzerr, bzf );
@@ -1125,7 +1140,7 @@ void saveInputFileMetaInfo ( Char *srcName )
 
 
 static 
-void applySavedMetaInfoToOutputFile ( Char *dstName )
+void applySavedTimeInfoToOutputFile ( Char *dstName )
 {
 #  if BZ_UNIX
    IntNative      retVal;
@@ -1134,16 +1149,26 @@ void applySavedMetaInfoToOutputFile ( Char *dstName )
    uTimBuf.actime = fileMetaInfo.st_atime;
    uTimBuf.modtime = fileMetaInfo.st_mtime;
 
-   retVal = chmod ( dstName, fileMetaInfo.st_mode );
-   ERROR_IF_NOT_ZERO ( retVal );
-
    retVal = utime ( dstName, &uTimBuf );
    ERROR_IF_NOT_ZERO ( retVal );
+#  endif
+}
 
-   retVal = chown ( dstName, fileMetaInfo.st_uid, fileMetaInfo.st_gid );
+static 
+int applySavedFileAttrToOutputFile ( int fd )
+{
+#  if BZ_UNIX
+   IntNative      retVal;
+
+   retVal = fchmod ( fd, fileMetaInfo.st_mode );
+   if (retVal != 0)
+       return retVal;
+
+   (void) fchown ( fd, fileMetaInfo.st_uid, fileMetaInfo.st_gid );
    /* chown() will in many cases return with EPERM, which can
       be safely ignored.
    */
+   return 0;
 #  endif
 }
 
@@ -1366,7 +1391,7 @@ void compress ( Char *name )
 
    /*--- If there was an I/O error, we won't get here. ---*/
    if ( srcMode == SM_F2F ) {
-      applySavedMetaInfoToOutputFile ( outName );
+      applySavedTimeInfoToOutputFile ( outName );
       deleteOutputOnInterrupt = False;
       if ( !keepInputFiles ) {
          IntNative retVal = remove ( inName );
@@ -1544,7 +1569,7 @@ void uncompress ( Char *name )
    /*--- If there was an I/O error, we won't get here. ---*/
    if ( magicNumberOK ) {
       if ( srcMode == SM_F2F ) {
-         applySavedMetaInfoToOutputFile ( outName );
+         applySavedTimeInfoToOutputFile ( outName );
          deleteOutputOnInterrupt = False;
          if ( !keepInputFiles ) {
             IntNative retVal = remove ( inName );

contrib/bzip2/bzlib.c

@@ -574,8 +574,11 @@ int BZ_API(BZ2_bzDecompressInit)
 
 
 /*---------------------------------------------------*/
+/* Return  True iff data corruption is discovered.
+   Returns False if there is no problem.
+*/
 static
-void unRLE_obuf_to_output_FAST ( DState* s )
+Bool unRLE_obuf_to_output_FAST ( DState* s )
 {
    UChar k1;
 
@@ -584,7 +587,7 @@ void unRLE_obuf_to_output_FAST ( DState* s )
       while (True) {
          /* try to finish existing run */
          while (True) {
-            if (s->strm->avail_out == 0) return;
+            if (s->strm->avail_out == 0) return False;
             if (s->state_out_len == 0) break;
             *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
             BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
@@ -594,10 +597,13 @@ void unRLE_obuf_to_output_FAST ( DState* s )
             s->strm->total_out_lo32++;
             if (s->strm->total_out_lo32 == 0) s->strm->total_out_hi32++;
          }
-   
+
          /* can a new run be started? */
-         if (s->nblock_used == s->save_nblock+1) return;
+         if (s->nblock_used == s->save_nblock+1) return False;
                
+         /* Only caused by corrupt data stream? */
+         if (s->nblock_used > s->save_nblock+1)
+            return True;
    
          s->state_out_len = 1;
          s->state_out_ch = s->k0;
@@ -667,6 +673,10 @@ void unRLE_obuf_to_output_FAST ( DState* s )
                cs_avail_out--;
             }
          }   
+         /* Only caused by corrupt data stream? */
+         if (c_nblock_used > s_save_nblockPP)
+            return True;
+
          /* can a new run be started? */
          if (c_nblock_used == s_save_nblockPP) {
             c_state_out_len = 0; goto return_notr;
@@ -712,6 +722,7 @@ void unRLE_obuf_to_output_FAST ( DState* s )
       s->strm->avail_out    = cs_avail_out;
       /* end save */
    }
+   return False;
 }
 
 
@@ -732,8 +743,11 @@ __inline__ Int32 BZ2_indexIntoF ( Int32 indx, Int32 *cftab )
 
 
 /*---------------------------------------------------*/
+/* Return  True iff data corruption is discovered.
+   Returns False if there is no problem.
+*/
 static
-void unRLE_obuf_to_output_SMALL ( DState* s )
+Bool unRLE_obuf_to_output_SMALL ( DState* s )
 {
    UChar k1;
 
@@ -742,7 +756,7 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
       while (True) {
          /* try to finish existing run */
          while (True) {
-            if (s->strm->avail_out == 0) return;
+            if (s->strm->avail_out == 0) return False;
             if (s->state_out_len == 0) break;
             *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
             BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
@@ -754,8 +768,11 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
          }
    
          /* can a new run be started? */
-         if (s->nblock_used == s->save_nblock+1) return;
-               
+         if (s->nblock_used == s->save_nblock+1) return False;
+
+         /* Only caused by corrupt data stream? */
+         if (s->nblock_used > s->save_nblock+1)
+            return True;
    
          s->state_out_len = 1;
          s->state_out_ch = s->k0;
@@ -788,7 +805,7 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
       while (True) {
          /* try to finish existing run */
          while (True) {
-            if (s->strm->avail_out == 0) return;
+            if (s->strm->avail_out == 0) return False;
             if (s->state_out_len == 0) break;
             *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
             BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
@@ -800,7 +817,11 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
          }
    
          /* can a new run be started? */
-         if (s->nblock_used == s->save_nblock+1) return;
+         if (s->nblock_used == s->save_nblock+1) return False;
+
+         /* Only caused by corrupt data stream? */
+         if (s->nblock_used > s->save_nblock+1)
+            return True;
    
          s->state_out_len = 1;
          s->state_out_ch = s->k0;
@@ -830,6 +851,7 @@ void unRLE_obuf_to_output_SMALL ( DState* s )
 /*---------------------------------------------------*/
 int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
 {
+   Bool    corrupt;
    DState* s;
    if (strm == NULL) return BZ_PARAM_ERROR;
    s = strm->state;
@@ -840,12 +862,13 @@ int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
       if (s->state == BZ_X_IDLE) return BZ_SEQUENCE_ERROR;
       if (s->state == BZ_X_OUTPUT) {
          if (s->smallDecompress)
-            unRLE_obuf_to_output_SMALL ( s ); else
-            unRLE_obuf_to_output_FAST  ( s );
+            corrupt = unRLE_obuf_to_output_SMALL ( s ); else
+            corrupt = unRLE_obuf_to_output_FAST  ( s );
+         if (corrupt) return BZ_DATA_ERROR;
          if (s->nblock_used == s->save_nblock+1 && s->state_out_len == 0) {
             BZ_FINALISE_CRC ( s->calculatedBlockCRC );
             if (s->verbosity >= 3) 
-               VPrintf2 ( " {0x%x, 0x%x}", s->storedBlockCRC, 
+               VPrintf2 ( " {0x%08x, 0x%08x}", s->storedBlockCRC, 
                           s->calculatedBlockCRC );
             if (s->verbosity >= 2) VPrintf0 ( "]" );
             if (s->calculatedBlockCRC != s->storedBlockCRC)
@@ -863,7 +886,7 @@ int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
          Int32 r = BZ2_decompress ( s );
          if (r == BZ_STREAM_END) {
             if (s->verbosity >= 3)
-               VPrintf2 ( "\n    combined CRCs: stored = 0x%x, computed = 0x%x", 
+               VPrintf2 ( "\n    combined CRCs: stored = 0x%08x, computed = 0x%08x", 
                           s->storedCombinedCRC, s->calculatedCombinedCRC );
             if (s->calculatedCombinedCRC != s->storedCombinedCRC)
                return BZ_DATA_ERROR;

contrib/bzip2/compress.c

@@ -488,9 +488,11 @@ void sendMTFValues ( EState* s )
       /*--
         Recompute the tables based on the accumulated frequencies.
       --*/
+      /* maxLen was changed from 20 to 17 in bzip2-1.0.3.  See 
+         comment in huffman.c for details. */
       for (t = 0; t < nGroups; t++)
          BZ2_hbMakeCodeLengths ( &(s->len[t][0]), &(s->rfreq[t][0]), 
-                                 alphaSize, 20 );
+                                 alphaSize, 17 /*20*/ );
    }
 
 
@@ -527,7 +529,7 @@ void sendMTFValues ( EState* s )
          if (s->len[t][i] > maxLen) maxLen = s->len[t][i];
          if (s->len[t][i] < minLen) minLen = s->len[t][i];
       }
-      AssertH ( !(maxLen > 20), 3004 );
+      AssertH ( !(maxLen > 17 /*20*/ ), 3004 );
       AssertH ( !(minLen < 1),  3005 );
       BZ2_hbAssignCodes ( &(s->code[t][0]), &(s->len[t][0]), 
                           minLen, maxLen, alphaSize );
@@ -651,8 +653,8 @@ void BZ2_compressBlock ( EState* s, Bool is_last_block )
       if (s->blockNo > 1) s->numZ = 0;
 
       if (s->verbosity >= 2)
-         VPrintf4( "    block %d: crc = 0x%8x, "
-                   "combined CRC = 0x%8x, size = %d\n",
+         VPrintf4( "    block %d: crc = 0x%08x, "
+                   "combined CRC = 0x%08x, size = %d\n",
                    s->blockNo, s->blockCRC, s->combinedCRC, s->nblock );
 
       BZ2_blockSort ( s );
@@ -703,7 +705,7 @@ void BZ2_compressBlock ( EState* s, Bool is_last_block )
       bsPutUChar ( s, 0x50 ); bsPutUChar ( s, 0x90 );
       bsPutUInt32 ( s, s->combinedCRC );
       if (s->verbosity >= 2)
-         VPrintf1( "    final combined CRC = 0x%x\n   ", s->combinedCRC );
+         VPrintf1( "    final combined CRC = 0x%08x\n   ", s->combinedCRC );
       bsFinishWrite ( s );
    }
 }

contrib/bzip2/decompress.c

@@ -524,17 +524,23 @@ Int32 BZ2_decompress ( DState* s )
       if (s->origPtr < 0 || s->origPtr >= nblock)
          RETURN(BZ_DATA_ERROR);
 
+      /*-- Set up cftab to facilitate generation of T^(-1) --*/
+      s->cftab[0] = 0;
+      for (i = 1; i <= 256; i++) s->cftab[i] = s->unzftab[i-1];
+      for (i = 1; i <= 256; i++) s->cftab[i] += s->cftab[i-1];
+      for (i = 0; i <= 256; i++) {
+         if (s->cftab[i] < 0 || s->cftab[i] > nblock) {
+            /* s->cftab[i] can legitimately be == nblock */
+            RETURN(BZ_DATA_ERROR);
+         }
+      }
+
       s->state_out_len = 0;
       s->state_out_ch  = 0;
       BZ_INITIALISE_CRC ( s->calculatedBlockCRC );
       s->state = BZ_X_OUTPUT;
       if (s->verbosity >= 2) VPrintf0 ( "rt+rld" );
 
-      /*-- Set up cftab to facilitate generation of T^(-1) --*/
-      s->cftab[0] = 0;
-      for (i = 1; i <= 256; i++) s->cftab[i] = s->unzftab[i-1];
-      for (i = 1; i <= 256; i++) s->cftab[i] += s->cftab[i-1];
-
       if (s->smallDecompress) {
 
          /*-- Make a copy of cftab, used in generation of T --*/

contrib/bzip2/huffman.c

@@ -162,7 +162,24 @@ void BZ2_hbMakeCodeLengths ( UChar *len,
       
       if (! tooLong) break;
 
-      for (i = 1; i < alphaSize; i++) {
+      /* 17 Oct 04: keep-going condition for the following loop used
+         to be 'i < alphaSize', which missed the last element,
+         theoretically leading to the possibility of the compressor
+         looping.  However, this count-scaling step is only needed if
+         one of the generated Huffman code words is longer than
+         maxLen, which up to and including version 1.0.2 was 20 bits,
+         which is extremely unlikely.  In version 1.0.3 maxLen was
+         changed to 17 bits, which has minimal effect on compression
+         ratio, but does mean this scaling step is used from time to
+         time, enough to verify that it works.
+
+         This means that bzip2-1.0.3 and later will only produce
+         Huffman codes with a maximum length of 17 bits.  However, in
+         order to preserve backwards compatibility with bitstreams
+         produced by versions pre-1.0.3, the decompressor must still
+         handle lengths of up to 20. */
+
+      for (i = 1; i <= alphaSize; i++) {
          j = weight[i] >> 8;
          j = 1 + (j / 2);
          weight[i] = j << 8;

contrib/cpio/copyin.c

@@ -46,6 +46,19 @@ $FreeBSD$
 #define lchown chown
 #endif
 
+# ifndef DIRECTORY_SEPARATOR
+#  define DIRECTORY_SEPARATOR '/'
+# endif
+
+# ifndef ISSLASH
+#  define ISSLASH(C) ((C) == DIRECTORY_SEPARATOR)
+# endif
+
+# ifndef FILE_SYSTEM_PREFIX_LEN
+#  define FILE_SYSTEM_PREFIX_LEN(Filename) 0
+# endif
+
+
 static void read_pattern_file ();
 static void tape_skip_padding ();
 static void defer_copyin ();
@@ -376,6 +389,54 @@ swab_array (ptr, count)
 /* Current time for verbose table.  */
 static time_t current_time;
 
+/* Return a safer suffix of FILE_NAME, or "." if it has no safer
+   suffix.  Check for fully specified file names and other atrocities.  */
+
+static const char *
+safer_name_suffix (char const *file_name)
+{
+  char const *p;
+
+  /* Skip file system prefixes, leading file name components that contain
+     "..", and leading slashes.  */
+
+  size_t prefix_len = FILE_SYSTEM_PREFIX_LEN (file_name);
+
+  for (p = file_name + prefix_len; *p;)
+    {
+      if (p[0] == '.' && p[1] == '.' && (ISSLASH (p[2]) || !p[2]))
+       prefix_len = p + 2 - file_name;
+
+      do
+       {
+         char c = *p++;
+         if (ISSLASH (c))
+           break;
+       }
+      while (*p);
+    }
+
+  for (p = file_name + prefix_len; ISSLASH (*p); p++)
+    continue;
+  prefix_len = p - file_name;
+
+  if (prefix_len)
+    {
+      char *prefix = alloca (prefix_len + 1);
+      memcpy (prefix, file_name, prefix_len);
+      prefix[prefix_len] = '\0';
+
+
+      error (0, 0, "Removing leading `%s' from member names", prefix);
+    }
+
+  if (!*p)
+    p = ".";
+
+  return p;
+}
+
+
 /* Read the collection from standard input and create files
    in the file system.  */
 
@@ -396,6 +457,7 @@ process_copy_in ()
   int in_file_des;		/* Input file descriptor.  */
   char skip_file;		/* Flag for use with patterns.  */
   int existing_dir;		/* True if file is a dir & already exists.  */
+  mode_t existing_mode;
   int i;			/* Loop index variable.  */
   char *link_name = NULL;	/* Name of hard and symbolic links.  */
 #ifdef HPUX_CDF
@@ -494,18 +556,11 @@ process_copy_in ()
 
       /* Do we have to ignore absolute paths, and if so, does the filename
          have an absolute path?  */
-      if (no_abs_paths_flag && file_hdr.c_name && file_hdr.c_name [0] == '/')
+      if (!abs_paths_flag && file_hdr.c_name && file_hdr.c_name[0])
 	{
-	  char *p;
+	  const char *p = safer_name_suffix (file_hdr.c_name);
 
-	  p = file_hdr.c_name;
-	  while (*p == '/')
-	    ++p;
-	  if (*p == '\0')
-	    {
-	      strcpy (file_hdr.c_name, ".");
-	    }
-	  else
+	  if (p != file_hdr.c_name)
 	    {
 	      char *non_abs_name;
 
@@ -642,6 +697,7 @@ process_copy_in ()
 		     we are trying to create, don't complain about
 		     it.  */
 		  existing_dir = TRUE;
+		  existing_mode = file_stat.st_mode;
 		}
 	      else if (!unconditional_flag
 		       && file_hdr.c_mtime <= file_stat.st_mtime)
@@ -778,8 +834,6 @@ process_copy_in ()
 		    }
 		  copy_files_tape_to_disk (in_file_des, out_file_des, file_hdr.c_filesize);
 		  disk_empty_output_buffer (out_file_des);
-		  if (close (out_file_des) < 0)
-		    error (0, errno, "%s", file_hdr.c_name);
 
 		  if (archive_format == arf_crcascii)
 		    {
@@ -789,13 +843,15 @@ process_copy_in ()
 		    }
 		  /* File is now copied; set attributes.  */
 		  if (!no_chown_flag)
-		    if ((chown (file_hdr.c_name,
+		    if ((fchown (out_file_des,
 				set_owner_flag ? set_owner : file_hdr.c_uid,
 			   set_group_flag ? set_group : file_hdr.c_gid) < 0)
 			&& errno != EPERM)
 		      error (0, errno, "%s", file_hdr.c_name);
 		  /* chown may have turned off some permissions we wanted. */
-		  if (chmod (file_hdr.c_name, (int) file_hdr.c_mode) < 0)
+		  if (fchmod (out_file_des, (int) file_hdr.c_mode) < 0)
+		    error (0, errno, "%s", file_hdr.c_name);
+		  if (close (out_file_des) < 0)
 		    error (0, errno, "%s", file_hdr.c_name);
 		  if (retain_time_flag)
 		    {
@@ -847,14 +903,23 @@ process_copy_in ()
 		      cdf_flag = 1;
 		    }
 #endif
-		  res = mkdir (file_hdr.c_name, file_hdr.c_mode);
+		  res = mkdir (file_hdr.c_name, file_hdr.c_mode & ~077);
 		}
 	      else
-		res = 0;
+		{
+		  if (!no_chown_flag && (existing_mode & 077) != 0
+		     && chmod (file_hdr.c_name, existing_mode & 07700) < 0)
+		   {
+		     error (0, errno, "%s: chmod", file_hdr.c_name);
+		     return;
+		   }
+		   res = 0;
+		}
+
 	      if (res < 0 && create_dir_flag)
 		{
 		  create_all_directories (file_hdr.c_name);
-		  res = mkdir (file_hdr.c_name, file_hdr.c_mode);
+		  res = mkdir (file_hdr.c_name, file_hdr.c_mode & ~077);
 		}
 	      if (res < 0)
 		{
@@ -936,20 +1001,20 @@ process_copy_in ()
 	      
 #ifdef CP_IFIFO
 	      if ((file_hdr.c_mode & CP_IFMT) == CP_IFIFO)
-		res = mkfifo (file_hdr.c_name, file_hdr.c_mode);
+		res = mkfifo (file_hdr.c_name, file_hdr.c_mode & ~077);
 	      else
 #endif
-		res = mknod (file_hdr.c_name, file_hdr.c_mode,
+		res = mknod (file_hdr.c_name, file_hdr.c_mode & ~077,
 		      makedev (file_hdr.c_rdev_maj, file_hdr.c_rdev_min));
 	      if (res < 0 && create_dir_flag)
 		{
 		  create_all_directories (file_hdr.c_name);
 #ifdef CP_IFIFO
 		  if ((file_hdr.c_mode & CP_IFMT) == CP_IFIFO)
-		    res = mkfifo (file_hdr.c_name, file_hdr.c_mode);
+		    res = mkfifo (file_hdr.c_name, file_hdr.c_mode & ~077);
 		  else
 #endif
-		    res = mknod (file_hdr.c_name, file_hdr.c_mode,
+		    res = mknod (file_hdr.c_name, file_hdr.c_mode & ~077,
 				 makedev (file_hdr.c_rdev_maj,
 					  file_hdr.c_rdev_min));
 		}
@@ -1376,18 +1441,18 @@ create_final_defers ()
 	  continue;
 	}
 
-      if (close (out_file_des) < 0)
-	error (0, errno, "%s", d->header.c_name);
-
+  
       /* File is now copied; set attributes.  */
       if (!no_chown_flag)
-	if ((chown (d->header.c_name,
+	if ((fchown (out_file_des,
 		    set_owner_flag ? set_owner : d->header.c_uid,
 	       set_group_flag ? set_group : d->header.c_gid) < 0)
 	    && errno != EPERM)
 	  error (0, errno, "%s", d->header.c_name);
       /* chown may have turned off some permissions we wanted. */
-      if (chmod (d->header.c_name, (int) d->header.c_mode) < 0)
+      if (fchmod (out_file_des, (int) d->header.c_mode) < 0)
+	error (0, errno, "%s", d->header.c_name);
+      if (close (out_file_des) < 0)
 	error (0, errno, "%s", d->header.c_name);
       if (retain_time_flag)
 	{

contrib/cpio/copyout.c

@@ -49,12 +49,13 @@ write_out_header (file_hdr, out_des)
     {
       char ascii_header[112];
       char *magic_string;
+      int ret;
 
       if (archive_format == arf_crcascii)
 	magic_string = "070702";
       else
 	magic_string = "070701";
-      sprintf (ascii_header,
+      ret = snprintf (ascii_header, sizeof(ascii_header),
 	       "%6s%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx",
 	       magic_string,
 	       file_hdr->c_ino, file_hdr->c_mode, file_hdr->c_uid,
@@ -62,6 +63,10 @@ write_out_header (file_hdr, out_des)
 	     file_hdr->c_filesize, file_hdr->c_dev_maj, file_hdr->c_dev_min,
 	   file_hdr->c_rdev_maj, file_hdr->c_rdev_min, file_hdr->c_namesize,
 	       file_hdr->c_chksum);
+      if (ret >= sizeof(ascii_header)) {
+	fprintf(stderr, "Internal overflow, aborting\n");
+	exit (1);
+      }
       tape_buffered_write (ascii_header, out_des, 110L);
 
       /* Write file name to output.  */
@@ -71,6 +76,7 @@ write_out_header (file_hdr, out_des)
   else if (archive_format == arf_oldascii || archive_format == arf_hpoldascii)
     {
       char ascii_header[78];
+      int ret;
 #ifndef __MSDOS__
       dev_t dev;
       dev_t rdev;
@@ -112,7 +118,7 @@ write_out_header (file_hdr, out_des)
       if ((file_hdr->c_ino >> 16) != 0)
 	error (0, 0, "%s: truncating inode number", file_hdr->c_name);
 
-      sprintf (ascii_header,
+      ret = snprintf (ascii_header, sizeof(ascii_header),
 	       "%06o%06o%06lo%06lo%06lo%06lo%06lo%06o%011lo%06lo%011lo",
 	       file_hdr->c_magic & 0xFFFF, dev & 0xFFFF,
 	       file_hdr->c_ino & 0xFFFF, file_hdr->c_mode & 0xFFFF,
@@ -120,6 +126,10 @@ write_out_header (file_hdr, out_des)
 	       file_hdr->c_nlink & 0xFFFF, rdev & 0xFFFF,
 	       file_hdr->c_mtime, file_hdr->c_namesize & 0xFFFF,
 	       file_hdr->c_filesize);
+      if (ret >= sizeof(ascii_header)) {
+	fprintf(stderr, "Internal overflow, aborting\n");
+	exit (1);
+      }
       tape_buffered_write (ascii_header, out_des, 76L);
 
       /* Write file name to output.  */
@@ -258,6 +268,14 @@ process_copy_out ()
 	  file_hdr.c_dev_maj = major (file_stat.st_dev);
 	  file_hdr.c_dev_min = minor (file_stat.st_dev);
 	  file_hdr.c_ino = file_stat.st_ino;
+
+	  /* Skip files larger than 4GB which will cause problems on
+	     64bit platforms (and just not work on 32bit). */
+	  if (file_stat.st_size > 0xffffffff) {
+	    error (0, 0, "%s: skipping >4GB file", input_name.ds_string);
+	    continue;
+	  }
+
 	  /* For POSIX systems that don't define the S_IF macros,
 	     we can't assume that S_ISfoo means the standard Unix
 	     S_IFfoo bit(s) are set.  So do it manually, with a

contrib/cpio/copypass.c

@@ -173,18 +173,18 @@ process_copy_pass ()
 	      disk_empty_output_buffer (out_file_des);
 	      if (close (in_file_des) < 0)
 		error (0, errno, "%s", input_name.ds_string);
-	      if (close (out_file_des) < 0)
-		error (0, errno, "%s", output_name.ds_string);
 
 	      /* Set the attributes of the new file.  */
 	      if (!no_chown_flag)
-		if ((chown (output_name.ds_string,
+		if ((fchown (out_file_des,
 			    set_owner_flag ? set_owner : in_file_stat.st_uid,
 		      set_group_flag ? set_group : in_file_stat.st_gid) < 0)
 		    && errno != EPERM)
 		  error (0, errno, "%s", output_name.ds_string);
 	      /* chown may have turned off some permissions we wanted. */
-	      if (chmod (output_name.ds_string, in_file_stat.st_mode) < 0)
+	      if (fchmod (out_file_des, in_file_stat.st_mode) < 0)
+		error (0, errno, "%s", output_name.ds_string);
+	      if (close (out_file_des) < 0)
 		error (0, errno, "%s", output_name.ds_string);
 	      if (reset_time_flag)
 		{
@@ -223,15 +223,24 @@ process_copy_pass ()
 		  cdf_flag = 1;
 		}
 #endif
-	      res = mkdir (output_name.ds_string, in_file_stat.st_mode);
+	      res = mkdir (output_name.ds_string, in_file_stat.st_mode & ~077);
 
 	    }
 	  else
-	    res = 0;
+            {
+              if (!no_chown_flag && (out_file_stat.st_mode & 077) != 0
+                  && chmod (output_name.ds_string, out_file_stat.st_mode & 07700) < 0)
+                {
+                  error (0, errno, "%s: chmod", output_name.ds_string);
+                  continue;
+                }
+              res = 0;
+            }
+
 	  if (res < 0 && create_dir_flag)
 	    {
 	      create_all_directories (output_name.ds_string);
-	      res = mkdir (output_name.ds_string, in_file_stat.st_mode);
+	      res = mkdir (output_name.ds_string, in_file_stat.st_mode & ~077);
 	    }
 	  if (res < 0)
 	    {
@@ -297,20 +306,20 @@ process_copy_pass ()
 	    {
 #ifdef S_ISFIFO
 	      if (S_ISFIFO (in_file_stat.st_mode))
-		res = mkfifo (output_name.ds_string, in_file_stat.st_mode);
+		res = mkfifo (output_name.ds_string, in_file_stat.st_mode & ~077);
 	      else
 #endif
-		res = mknod (output_name.ds_string, in_file_stat.st_mode,
+		res = mknod (output_name.ds_string, in_file_stat.st_mode & ~077,
 			     in_file_stat.st_rdev);
 	      if (res < 0 && create_dir_flag)
 		{
 		  create_all_directories (output_name.ds_string);
 #ifdef S_ISFIFO
 		  if (S_ISFIFO (in_file_stat.st_mode))
-		    res = mkfifo (output_name.ds_string, in_file_stat.st_mode);
+		    res = mkfifo (output_name.ds_string, in_file_stat.st_mode & ~077);
 		  else
 #endif
-		    res = mknod (output_name.ds_string, in_file_stat.st_mode,
+		    res = mknod (output_name.ds_string, in_file_stat.st_mode & ~077,
 				 in_file_stat.st_rdev);
 		}
 	      if (res < 0)

contrib/cpio/cpio.1

@@ -19,7 +19,7 @@ cpio \- copy files to and from archives
 [\-\-unconditional] [\-\-verbose] [\-\-block-size=blocks] [\-\-swap-halfwords]
 [\-\-io-size=bytes] [\-\-pattern-file=file] [\-\-format=format]
 [\-\-owner=[user][:.][group]] [\-\-no-preserve-owner] [\-\-message=message]
-[\-\-force\-local] [\-\-no\-absolute\-filenames] [\-\-sparse] [\-\-only\-verify\-crc]
+[\-\-force\-local] [\-\-absolute\-filenames] [\-\-sparse] [\-\-only\-verify\-crc]
 [\-\-quiet] [\-\-help] [\-\-version] [pattern...] [< archive]
 
 .B cpio
@@ -251,9 +251,9 @@ current volume number (starting at 1).
 In the verbose table of contents listing, show numeric UID and GID
 instead of translating them into names.
 .TP
-.I " \-\-no-absolute-filenames"
-In copy-in mode, create all files relative to the current directory,
-even if they have an absolute file name in the archive.
+.I " \-\-absolute-filenames"
+Do not strip leading file name components that contain ".."
+and leading slashes from file names in copy-in mode
 .TP
 .I " \-\-no-preserve-owner"
 In copy-in mode and copy-pass mode, do not change the ownership of the

contrib/cpio/extern.h

@@ -46,7 +46,7 @@ extern int no_chown_flag;
 extern int sparse_flag;
 extern int quiet_flag;
 extern int only_verify_crc_flag;
-extern int no_abs_paths_flag;
+extern int abs_paths_flag;
 
 extern int last_header_start;
 extern int copy_matching_files;

contrib/cpio/global.c

@@ -98,8 +98,8 @@ int quiet_flag = FALSE;
    actually extract the files. */
 int only_verify_crc_flag = FALSE;
 
-/* If TRUE, don't use any absolute paths, prefix them by `./'.  */
-int no_abs_paths_flag = FALSE;
+/* If TRUE, allow any absolute paths */
+int abs_paths_flag = FALSE;
 
 #ifdef DEBUG_CPIO
 /* If TRUE, print debugging information.  */

contrib/cpio/main.c

@@ -56,7 +56,7 @@ struct option long_opts[] =
   {"list", 0, &table_flag, TRUE},
   {"make-directories", 0, &create_dir_flag, TRUE},
   {"message", 1, 0, 'M'},
-  {"no-absolute-filenames", 0, 0, 136},
+  {"absolute-filenames", 0, 0, 136},
   {"no-preserve-owner", 0, 0, 134},
   {"nonmatching", 0, &copy_matching_files, FALSE},
   {"numeric-uid-gid", 0, &numeric_uid, TRUE},
@@ -105,7 +105,7 @@ Usage: %s {-o|--create} [-0acvABLV] [-C bytes] [-H format] [-M message]\n\
        [--unconditional] [--verbose] [--block-size=blocks] [--swap-halfwords]\n\
        [--io-size=bytes] [--pattern-file=file] [--format=format]\n\
        [--owner=[user][:.][group]] [--no-preserve-owner] [--message=message]\n\
-       [--force-local] [--no-absolute-filenames] [--sparse] [--only-verify-crc]\n\
+       [--force-local] [--absolute-filenames] [--sparse] [--only-verify-crc]\n\
        [--quiet] [--help] [--version] [pattern...] [< archive]\n",
 	   program_name);
   fprintf (fp, "\
@@ -266,8 +266,8 @@ crc newc odc bin ustar tar (all-caps also recognized)", optarg);
 	  numeric_uid = TRUE;
 	  break;
 
-	case 136:		/* --no-absolute-filenames */
-	  no_abs_paths_flag = TRUE;
+	case 136:		/* --absolute-filenames */
+	  abs_paths_flag = TRUE;
 	  break;
 	
 	case 134:		/* --no-preserve-owner */
@@ -414,7 +414,7 @@ crc newc odc bin ustar tar (all-caps also recognized)", optarg);
 	  || retain_time_flag || no_chown_flag || set_owner_flag
 	  || set_group_flag || swap_bytes_flag || swap_halfwords_flag
 	  || (append_flag && !(archive_name || output_archive_name))
-	  || rename_batch_file || no_abs_paths_flag
+	  || rename_batch_file || abs_paths_flag
 	  || input_archive_name || (archive_name && output_archive_name))
 	usage (stderr, 2);
       if (archive_format == arf_unknown)
@@ -429,7 +429,7 @@ crc newc odc bin ustar tar (all-caps also recognized)", optarg);
       if (argc - 1 != optind || archive_format != arf_unknown
 	  || swap_bytes_flag || swap_halfwords_flag
 	  || table_flag || rename_flag || append_flag
-	  || rename_batch_file || no_abs_paths_flag)
+	  || rename_batch_file || abs_paths_flag)
 	usage (stderr, 2);
       directory_name = argv[optind];
     }

contrib/cvs/lib/xsize.h

@@ -0,0 +1,110 @@
+/* xsize.h -- Checked size_t computations.
+
+   Copyright (C) 2003 Free Software Foundation, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software Foundation,
+   Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
+
+#ifndef _XSIZE_H
+#define _XSIZE_H
+
+/* Get size_t.  */
+#include <stddef.h>
+
+/* Get SIZE_MAX.  */
+#include <limits.h>
+#if HAVE_STDINT_H
+# include <stdint.h>
+#else
+#define SIZE_MAX UINT_MAX /* XXX */
+#endif
+
+/* The size of memory objects is often computed through expressions of
+   type size_t. Example:
+      void* p = malloc (header_size + n * element_size).
+   These computations can lead to overflow.  When this happens, malloc()
+   returns a piece of memory that is way too small, and the program then
+   crashes while attempting to fill the memory.
+   To avoid this, the functions and macros in this file check for overflow.
+   The convention is that SIZE_MAX represents overflow.
+   malloc (SIZE_MAX) is not guaranteed to fail -- think of a malloc
+   implementation that uses mmap --, it's recommended to use size_overflow_p()
+   or size_in_bounds_p() before invoking malloc().
+   The example thus becomes:
+      size_t size = xsum (header_size, xtimes (n, element_size));
+      void *p = (size_in_bounds_p (size) ? malloc (size) : NULL);
+*/
+
+/* Convert an arbitrary value >= 0 to type size_t.  */
+#define xcast_size_t(N) \
+  ((N) <= SIZE_MAX ? (size_t) (N) : SIZE_MAX)
+
+/* Sum of two sizes, with overflow check.  */
+static inline size_t
+#if __GNUC__ >= 3
+__attribute__ ((__pure__))
+#endif
+xsum (size_t size1, size_t size2)
+{
+  size_t sum = size1 + size2;
+  return (sum >= size1 ? sum : SIZE_MAX);
+}
+
+/* Sum of three sizes, with overflow check.  */
+static inline size_t
+#if __GNUC__ >= 3
+__attribute__ ((__pure__))
+#endif
+xsum3 (size_t size1, size_t size2, size_t size3)
+{
+  return xsum (xsum (size1, size2), size3);
+}
+
+/* Sum of four sizes, with overflow check.  */
+static inline size_t
+#if __GNUC__ >= 3
+__attribute__ ((__pure__))
+#endif
+xsum4 (size_t size1, size_t size2, size_t size3, size_t size4)
+{
+  return xsum (xsum (xsum (size1, size2), size3), size4);
+}
+
+/* Maximum of two sizes, with overflow check.  */
+static inline size_t
+#if __GNUC__ >= 3
+__attribute__ ((__pure__))
+#endif
+xmax (size_t size1, size_t size2)
+{
+  /* No explicit check is needed here, because for any n:
+     max (SIZE_MAX, n) == SIZE_MAX and max (n, SIZE_MAX) == SIZE_MAX.  */
+  return (size1 >= size2 ? size1 : size2);
+}
+
+/* Multiplication of a count with an element size, with overflow check.
+   The count must be >= 0 and the element size must be > 0.
+   This is a macro, not an inline function, so that it works correctly even
+   when N is of a wider tupe and N > SIZE_MAX.  */
+#define xtimes(N, ELSIZE) \
+  ((N) <= SIZE_MAX / (ELSIZE) ? (size_t) (N) * (ELSIZE) : SIZE_MAX)
+
+/* Check for overflow.  */
+#define size_overflow_p(SIZE) \
+  ((SIZE) == SIZE_MAX)
+/* Check against overflow.  */
+#define size_in_bounds_p(SIZE) \
+  ((SIZE) != SIZE_MAX)
+
+#endif /* _XSIZE_H */

contrib/cvs/src/client.c

@@ -1054,6 +1054,19 @@ call_in_directory (pathname, func, data)
     char *rdirp;
     int reposdirname_absolute;
 
+    /* For security reasons, if PATHNAME is absolute or attemps to ascend
+     * outside of the current sanbbox, we abort.  The server should not send us
+     * anything but relative paths which remain inside the sandbox here.
+     * Anything less means a trojan CVS server could create and edit arbitrary
+     * files on the client.
+     */
+    if (isabsolute (pathname) || pathname_levels (pathname) > 0)
+    {
+	error (0, 0,
+		"Server attempted to update a file via an invalid pathname:");
+	error (1, 0, "`%s'.", pathname);
+    }
+
     reposname = NULL;
     read_line (&reposname);
     assert (reposname != NULL);

contrib/cvs/src/commit.c

@@ -481,7 +481,12 @@ commit (argc, argv)
 	   operate on, and only work with those files in the future.
 	   This saves time--we don't want to search the file system
 	   of the working directory twice.  */
-	find_args.argv = (char **) xmalloc (find_args.argc * sizeof (char **));
+	if (size_overflow_p (xtimes (find_args.argc, sizeof (char **))))
+	{
+	    find_args.argc = 0;
+	    return 0;
+	}
+	find_args.argv = xmalloc (xtimes (find_args.argc, sizeof (char **)));
 	find_args.argc = 0;
 	walklist (find_args.ulist, copy_ulist, &find_args);
 

contrib/cvs/src/cvs.h

@@ -41,6 +41,10 @@
 #include "popen.h"
 #endif
 
+/* Begin GNULIB headers.  */
+#include "xsize.h"
+/* End GNULIB headers.  */
+
 #ifdef STDC_HEADERS
 #include <stdlib.h>
 #else

contrib/cvs/src/cvsbug.in

@@ -85,9 +85,9 @@ fi
 
 [ -z "$TMPDIR" ] && TMPDIR=/tmp
 
-TEMP=$TMPDIR/p$$
-BAD=$TMPDIR/pbad$$
-REF=$TMPDIR/pf$$
+TEMP="`/usr/bin/mktemp $TMPDIR/p.XXXXXX`"
+BAD="`/usr/bin/mktemp $TMPDIR/pbad.XXXXXX`"
+REF="`/usr/bin/mktemp $TMPDIR/pf.XXXXXX`"
 
 if [ -z "$LOGNAME" -a -n "$USER" ]; then
   LOGNAME=$USER
@@ -108,14 +108,12 @@ elif [ -f /bin/domainname ]; then
     /usr/bin/ypcat passwd 2>/dev/null | cat - /etc/passwd | grep "^$LOGNAME:" |
       cut -f5 -d':' | sed -e 's/,.*//' > $TEMP
     ORIGINATOR="`cat $TEMP`"
-    rm -f $TEMP
   fi
 fi
 
 if [ "$ORIGINATOR" = "" ]; then
   grep "^$LOGNAME:" /etc/passwd | cut -f5 -d':' | sed -e 's/,.*//' > $TEMP
   ORIGINATOR="`cat $TEMP`"
-  rm -f $TEMP
 fi
 
 if [ -n "$ORGANIZATION" ]; then

contrib/cvs/src/filesubr.c

@@ -988,8 +988,14 @@ expand_wild (argc, argv, pargc, pargv)
     char ***pargv;
 {
     int i;
+    if (size_overflow_p (xtimes (argc, sizeof (char *)))) {
+	*pargc = 0;
+	*pargv = NULL;
+	error (0, 0, "expand_wild: too many arguments");
+	return;
+    }
     *pargc = argc;
-    *pargv = (char **) xmalloc (argc * sizeof (char *));
+    *pargv = xmalloc (xtimes (argc, sizeof (char *)));
     for (i = 0; i < argc; ++i)
 	(*pargv)[i] = xstrdup (argv[i]);
 }

contrib/cvs/src/history.c

@@ -414,8 +414,11 @@ history (argc, argv)
 		working = 1;
 		break;
 	    case 'X':			/* Undocumented debugging flag */
+#ifdef DEBUG
 		histfile = optarg;
+#endif
 		break;
+
 	    case 'D':			/* Since specified date */
 		if (*since_rev || *since_tag || *backto)
 		{
@@ -890,9 +893,13 @@ save_user (name)
 {
     if (user_count == user_max)
     {
-	user_max += USER_INCREMENT;
-	user_list = (char **) xrealloc ((char *) user_list,
-					(int) user_max * sizeof (char *));
+	user_max = xsum (user_max, USER_INCREMENT);
+	if (size_overflow_p (xtimes (user_max, sizeof (char *))))
+	{
+	    error (0, 0, "save_user: too many users");
+	    return;
+	}
+	user_list = xrealloc (user_list, xtimes (user_max, sizeof (char *)));
     }
     user_list[user_count++] = xstrdup (name);
 }
@@ -920,9 +927,13 @@ save_file (dir, name, module)
 
     if (file_count == file_max)
     {
-	file_max += FILE_INCREMENT;
-	file_list = (struct file_list_str *) xrealloc ((char *) file_list,
-						   file_max * sizeof (*fl));
+	file_max = xsum (file_max, FILE_INCREMENT);
+	if (size_overflow_p (xtimes (file_max, sizeof (*fl))))
+	{
+	    error (0, 0, "save_file: too many files");
+	    return;
+	}
+	file_list = xrealloc (file_list, xtimes (file_max, sizeof (*fl)));
     }
     fl = &file_list[file_count++];
     fl->l_file = cp = xmalloc (strlen (dir) + strlen (name) + 2);
@@ -961,9 +972,13 @@ save_module (module)
 {
     if (mod_count == mod_max)
     {
-	mod_max += MODULE_INCREMENT;
-	mod_list = (char **) xrealloc ((char *) mod_list,
-				       mod_max * sizeof (char *));
+	mod_max = xsum (mod_max, MODULE_INCREMENT);
+	if (size_overflow_p (xtimes (mod_max, sizeof (char *))))
+	{
+	    error (0, 0, "save_module: too many modules");
+	    return;
+	}
+	mod_list = xrealloc (mod_list, xtimes (mod_max, sizeof (char *)));
     }
     mod_list[mod_count++] = xstrdup (module);
 }

contrib/cvs/src/login.c

@@ -125,7 +125,7 @@ password_entry_parseline (cvsroot_canonical, warn, linenumber, linebuf)
 
 	if (isspace(*(linebuf + 1)))
 	    /* special case since strtoul ignores leading white space */
-	    entry_version = 0;
+	    q = linebuf + 1;
 	else
 	    entry_version = strtoul (linebuf + 1, &q, 10);
 

contrib/cvs/src/modules.c

@@ -159,6 +159,32 @@ do_module (db, mname, m_type, msg, callback_proc, where, shorten,
     }
 #endif
 
+    /* Similarly for directories that attempt to step above the root of the
+     * repository.
+     */
+    if (pathname_levels (mname) > 0)
+	error (1, 0, "up-level in module reference (`..') invalid: `%s'.",
+		mname);
+
+
+    /* Don't process absolute directories.  Anything else could be a security
+     * problem.  Before this check was put in place:
+     *
+     *   $ cvs -d:fork:/cvsroot co /foo
+     *   cvs server: warning: cannot make directory CVS in /: Permission denied
+     *   cvs [server aborted]: cannot make directory /foo: Permission denied
+     *   $
+     */
+    if (isabsolute (mname))
+	error (1, 0, "Absolute module reference invalid: `%s'", mname);
+
+    /* Similarly for directories that attempt to step above the root of the
+     * repository.
+     */
+    if (pathname_levels (mname) > 0)
+	error (1, 0, "up-level in module reference (`..') invalid: `%s'.",
+		mname);
+
     /* if this is a directory to ignore, add it to that list */
     if (mname[0] == '!' && mname[1] != '\0')
     {

contrib/cvs/src/patch.c

@@ -375,6 +375,7 @@ patch_fileproc (callerdat, finfo)
     struct utimbuf t;
     char *vers_tag, *vers_head;
     char *rcs = NULL;
+    char *rcs_orig = NULL;
     RCSNode *rcsfile;
     FILE *fp1, *fp2, *fp3;
     int ret = 0;
@@ -404,7 +405,7 @@ patch_fileproc (callerdat, finfo)
     if ((rcsfile->flags & VALID) && (rcsfile->flags & INATTIC))
 	isattic = 1;
 
-    rcs = xmalloc (strlen (finfo->file) + sizeof (RCSEXT) + 5);
+    rcs_orig = rcs = xmalloc (strlen (finfo->file) + sizeof (RCSEXT) + 5);
     (void) sprintf (rcs, "%s%s", finfo->file, RCSEXT);
 
     /* if vers_head is NULL, may have been removed from the release */
@@ -743,8 +744,8 @@ failed to read diff file header %s for %s: end of file", tmpfile3, rcs);
 	free (vers_tag);
     if (vers_head != NULL)
 	free (vers_head);
-    if (rcs != NULL)
-	free (rcs);
+    if (rcs_orig)
+	free (rcs_orig);
     return (ret);
 }
 

contrib/cvs/src/rcs.c

@@ -3034,8 +3034,7 @@ RCS_getdate (rcs, date, force_tag_match)
     if (retval != NULL)
 	return (retval);
 
-    if (!force_tag_match ||
-	(vers != NULL && RCS_datecmp (vers->date, date) <= 0))
+    if (vers && (!force_tag_match || RCS_datecmp (vers->date, date) <= 0))
 	return (xstrdup (vers->version));
     else
 	return (NULL);
@@ -4118,7 +4117,7 @@ RCS_checkout (rcs, workfile, rev, nametag, options, sout, pfn, callerdat)
     size_t len;
     int free_value = 0;
     char *log = NULL;
-    size_t loglen;
+    size_t loglen = 0;
     Node *vp = NULL;
 #ifdef PRESERVE_PERMISSIONS_SUPPORT
     uid_t rcs_owner = (uid_t) -1;
@@ -7398,7 +7397,7 @@ RCS_deltas (rcs, fp, rcsbuf, version, op, text, len, log, loglen)
 
 		for (ln = 0; ln < headlines.nlines; ++ln)
 		{
-		    char buf[80];
+		    char *buf;
 		    /* Period which separates year from month in date.  */
 		    char *ym;
 		    /* Period which separates month from day in date.  */
@@ -7409,10 +7408,12 @@ RCS_deltas (rcs, fp, rcsbuf, version, op, text, len, log, loglen)
 		    if (prvers == NULL)
 			prvers = vers;
 
+		    buf = xmalloc (strlen (prvers->version) + 24);
 		    sprintf (buf, "%-12s (%-8.8s ",
 			     prvers->version,
 			     prvers->author);
 		    cvs_output (buf, 0);
+		    free (buf);
 
 		    /* Now output the date.  */
 		    ym = strchr (prvers->date, '.');

contrib/cvs/src/server.c

@@ -927,7 +927,7 @@ serve_max_dotdot (arg)
     int i;
     char *p;
 
-    if (lim < 0)
+    if (lim < 0 || lim > 10000)
 	return;
     p = xmalloc (strlen (server_temp_dir) + 2 * lim + 10);
     if (p == NULL)
@@ -1647,9 +1647,28 @@ serve_unchanged (arg)
 	    && strlen (arg) == cp - name
 	    && strncmp (arg, name, cp - name) == 0)
 	{
-	    timefield = strchr (cp + 1, '/') + 1;
-	    if (*timefield != '=')
+	    if (!(timefield = strchr (cp + 1, '/')) || *++timefield == '\0')
 	    {
+		/* We didn't find the record separator or it is followed by
+		 * the end of the string, so just exit.
+		 */
+		if (alloc_pending (80))
+		    sprintf (pending_error_text,
+		             "E Malformed Entry encountered.");
+		return;
+	    }
+	    /* If the time field is not currently empty, then one of
+	     * serve_modified, serve_is_modified, & serve_unchanged were
+	     * already called for this file.  We would like to ignore the
+	     * reinvocation silently or, better yet, exit with an error
+	     * message, but we just avoid the copy-forward and overwrite the
+	     * value from the last invocation instead.  See the comment below
+	     * for more.
+	     */
+	    if (*timefield == '/')
+	    {
+		/* Copy forward one character.  Space was allocated for this
+		 * already in serve_entry().  */
 		cp = timefield + strlen (timefield);
 		cp[1] = '\0';
 		while (cp > timefield)
@@ -1657,8 +1676,17 @@ serve_unchanged (arg)
 		    *cp = cp[-1];
 		    --cp;
 		}
-		*timefield = '=';
 	    }
+	    /* If *TIMEFIELD wasn't "/", we assume that it was because of
+	     * multiple calls to Is-Modified & Unchanged by the client and
+	     * just overwrite the value from the last call.  Technically, we
+	     * should probably either ignore calls after the first or send the
+	     * client an error, since the client/server protocol specification
+	     * specifies that only one call to either Is-Modified or Unchanged
+	     * is allowed, but broken versions of WinCVS & TortoiseCVS rely on
+	     * this behavior.
+	     */
+	    *timefield = '=';
 	    break;
 	}
     }
@@ -1691,9 +1719,28 @@ serve_is_modified (arg)
 	    && strlen (arg) == cp - name
 	    && strncmp (arg, name, cp - name) == 0)
 	{
-	    timefield = strchr (cp + 1, '/') + 1;
-	    if (!(timefield[0] == 'M' && timefield[1] == '/'))
+	    if (!(timefield = strchr (cp + 1, '/')) || *++timefield == '\0')
 	    {
+		/* We didn't find the record separator or it is followed by
+		 * the end of the string, so just exit.
+		 */
+		if (alloc_pending (80))
+		    sprintf (pending_error_text,
+		             "E Malformed Entry encountered.");
+		return;
+	    }
+	    /* If the time field is not currently empty, then one of
+	     * serve_modified, serve_is_modified, & serve_unchanged were
+	     * already called for this file.  We would like to ignore the
+	     * reinvocation silently or, better yet, exit with an error
+	     * message, but we just avoid the copy-forward and overwrite the
+	     * value from the last invocation instead.  See the comment below
+	     * for more.
+	     */
+	    if (*timefield == '/')
+	    {
+		/* Copy forward one character.  Space was allocated for this
+		 * already in serve_entry().  */
 		cp = timefield + strlen (timefield);
 		cp[1] = '\0';
 		while (cp > timefield)
@@ -1701,8 +1748,17 @@ serve_is_modified (arg)
 		    *cp = cp[-1];
 		    --cp;
 		}
-		*timefield = 'M';
 	    }
+	    /* If *TIMEFIELD wasn't "/", we assume that it was because of
+	     * multiple calls to Is-Modified & Unchanged by the client and
+	     * just overwrite the value from the last call.  Technically, we
+	     * should probably either ignore calls after the first or send the
+	     * client an error, since the client/server protocol specification
+	     * specifies that only one call to either Is-Modified or Unchanged
+	     * is allowed, but broken versions of WinCVS & TortoiseCVS rely on
+	     * this behavior.
+	     */
+	    *timefield = 'M';
 	    if (kopt != NULL)
 	    {
 		if (alloc_pending (strlen (name) + 80))
@@ -1757,8 +1813,29 @@ serve_entry (arg)
 {
     struct an_entry *p;
     char *cp;
+    int i = 0;
     if (error_pending()) return;
-    p = (struct an_entry *) xmalloc (sizeof (struct an_entry));
+
+    /* Verify that the entry is well-formed.  This can avoid problems later.
+     * At the moment we only check that the Entry contains five slashes in
+     * approximately the correct locations since some of the code makes
+     * assumptions about this.
+     */
+    cp = arg;
+    if (*cp == 'D') cp++;
+    while (i++ < 5)
+    {
+	if (!cp || *cp != '/')
+	{
+	    if (alloc_pending (80))
+		sprintf (pending_error_text,
+			 "E protocol error: Malformed Entry");
+	    return;
+	}
+	cp = strchr (cp + 1, '/');
+    }
+
+    p = xmalloc (sizeof (struct an_entry));
     if (p == NULL)
     {
 	pending_error = ENOMEM;
@@ -1990,6 +2067,9 @@ serve_notify (arg)
     {
 	char *cp;
 
+	if (!data[0])
+	    goto error;
+
 	if (strchr (data, '+'))
 	    goto error;
 
@@ -2122,6 +2202,14 @@ serve_argument (arg)
 
     if (error_pending()) return;
 
+    if (argument_count >= 10000)
+    {
+	if (alloc_pending (80))
+	    sprintf (pending_error_text, 
+		     "E Protocol error: too many arguments");
+	return;
+    }
+
     if (argument_vector_size <= argument_count)
     {
 	argument_vector_size *= 2;
@@ -2152,6 +2240,14 @@ serve_argumentx (arg)
 
     if (error_pending()) return;
 
+    if (argument_count <= 1) 
+    {
+	if (alloc_pending (80))
+	    sprintf (pending_error_text,
+		     "E Protocol error: called argumentx without prior call to argument");
+	return;
+    }
+
     p = argument_vector[argument_count - 1];
     p = xrealloc (p, strlen (p) + 1 + strlen (arg) + 1);
     if (p == NULL)
@@ -2508,7 +2604,7 @@ check_command_legal_p (cmd_name)
                     save some code here...  -kff */
 
                  /* Chop newline by hand, for strcmp()'s sake. */
-                 if (linebuf[num_red - 1] == '\n')
+                 if (num_red > 0 && linebuf[num_red - 1] == '\n')
                      linebuf[num_red - 1] = '\0';
 
                  if (strcmp (linebuf, CVS_Username) == 0)
@@ -2563,7 +2659,7 @@ check_command_legal_p (cmd_name)
          while ((num_red = getline (&linebuf, &linebuf_len, fp)) >= 0)
          {
              /* Chop newline by hand, for strcmp()'s sake. */
-             if (linebuf[num_red - 1] == '\n')
+             if (num_red > 0 && linebuf[num_red - 1] == '\n')
                  linebuf[num_red - 1] = '\0';
 
              if (strcmp (linebuf, CVS_Username) == 0)

contrib/cvs/src/wrapper.c

@@ -238,6 +238,30 @@ wrap_unparse_rcs_options (line, first_call_p)
 }
 #endif /* SERVER_SUPPORT || CLIENT_SUPPORT */
 
+/*
+ * Remove fmt str specifier other than %% or %s. And allow
+ * only max_s %s specifiers
+ */
+wrap_clean_fmt_str(char *fmt, int max_s)
+{
+    while (*fmt) {
+	if (fmt[0] == '%' && fmt[1])
+	{
+	    if (fmt[1] == '%') 
+		fmt++;
+	    else
+		if (fmt[1] == 's' && max_s > 0)
+		{
+		    max_s--;
+		    fmt++;
+		} else 
+		    *fmt = ' ';
+	}
+	fmt++;
+    }
+    return;
+}
+
 /*
  * Open a file and read lines, feeding each line to a line parser. Arrange
  * for keeping a temporary list of wrappers at the end, if the "temp"
@@ -558,9 +582,8 @@ wrap_tocvs_process_file(fileName)
     args = xmalloc (strlen (e->tocvsFilter)
 		    + strlen (fileName)
 		    + strlen (buf));
-    /* FIXME: sprintf will blow up if the format string contains items other
-       than %s, or contains too many %s's.  We should instead be parsing
-       e->tocvsFilter ourselves and giving a real error.  */
+
+    wrap_clean_fmt_str(e->tocvsFilter, 2);
     sprintf (args, e->tocvsFilter, fileName, buf);
     run_setup (args);
     run_exec(RUN_TTY, RUN_TTY, RUN_TTY, RUN_NORMAL|RUN_REALLY );
@@ -592,9 +615,8 @@ wrap_fromcvs_process_file(fileName)
 
     args = xmalloc (strlen (e->fromcvsFilter)
 		    + strlen (fileName));
-    /* FIXME: sprintf will blow up if the format string contains items other
-       than %s, or contains too many %s's.  We should instead be parsing
-       e->fromcvsFilter ourselves and giving a real error.  */
+
+    wrap_clean_fmt_str(e->fromcvsFilter, 1);
     sprintf (args, e->fromcvsFilter, fileName);
     run_setup (args);
     run_exec(RUN_TTY, RUN_TTY, RUN_TTY, RUN_NORMAL );

contrib/opie/opiepasswd.c

@@ -118,11 +118,18 @@ int main FUNCTION((argc, argv), int argc AND char *argv[])
   struct opie opie;
   int rval, n = 499, i, mode = MODE_DEFAULT, force = 0;
   char seed[OPIE_SEED_MAX+1];
+  char *username;
+  uid_t ruid;
   struct passwd *pp;
 
   memset(seed, 0, sizeof(seed));
 
-  if (!(pp = getpwnam(getlogin()))) {
+  ruid = getuid();
+  username = getlogin();
+  pp = getpwnam(username);
+  if (username == NULL || pp == NULL || pp->pw_uid != ruid)
+    pp = getpwuid(ruid);
+  if (pp == NULL) {
     fprintf(stderr, "Who are you?");
     return 1;
   }

contrib/texinfo/util/texindex.c

@@ -386,6 +386,21 @@ For more information about these matters, see the files named COPYING.\n"),
     usage (1);
 }
 
+static char **tv;
+static int tv_alloc;
+static int tv_used;
+
+static int
+findtempname (char *tempname)
+{
+  int i;
+
+  for (i = 0; i < tv_used; i++)
+    if (strcmp (tv[i], tempname) == 0)
+	return (1);
+  return (0);
+}
+
 /* Return a name for temporary file COUNT. */
 
 static char *
@@ -393,11 +408,12 @@ maketempname (count)
      int count;
 {
   static char *tempbase = NULL;
+  char *tempname;
   char tempsuffix[10];
+  int fd;
 
   if (!tempbase)
     {
-      int fd;
       tempbase = concat (tempdir, "txidxXXXXXX");
 
       fd = mkstemp (tempbase);
@@ -406,7 +422,52 @@ maketempname (count)
     }
 
   sprintf (tempsuffix, ".%d", count);
-  return concat (tempbase, tempsuffix);
+  tempname = concat (tempbase, tempsuffix);
+  /*
+   * The open logic becomes a bit convoluted. If open(2) fails due to EEXIST,
+   * it's likely because somebody attempted to race us, or because we have
+   * already created this file.
+   */
+  fd = open (tempname, O_CREAT|O_EXCL|O_WRONLY, 0600);
+  if (fd == -1)
+    {
+	/*
+	 * If errno is not EEXIST, then open failed for some other reason, so
+	 * we should terminate. If errno == EEXIST AND we didn't create this
+	 * file, terminate. Otherwise, it's safe to say that errno == EEXIST
+	 * because we already created it, in this event, we can just return.
+	 */
+	if (errno != EEXIST ||
+	  (errno == EEXIST && findtempname (tempname) == 0))
+	  pfatal_with_name (tempname);
+	return (tempname);
+    }
+  else if (fd > 0)
+    {
+	close (fd);
+    }
+  if (tv == NULL)
+    {
+	tv_alloc = 16;
+	tv = calloc (tv_alloc, sizeof (char *));
+	if (tv == NULL)
+	  {
+	    fprintf (stderr, "calloc failed\n");
+	    exit (1);
+	  }
+    }
+  else if (tv_used == tv_alloc)
+    {
+	tv_alloc += 4;
+	tv = realloc (tv, tv_alloc * sizeof (char *));
+	if (tv == NULL)
+	  {
+	    fprintf (stderr, "realloc failed");
+	    exit (1);
+	  }
+    }
+  tv[tv_used++] = strdup (tempname);
+  return tempname;
 }
 
 

crypto/heimdal/appl/telnet/telnet/telnet.c

@@ -1294,6 +1294,7 @@ slc_check()
 
 
 unsigned char slc_reply[128];
+unsigned char const * const slc_reply_eom = &slc_reply[sizeof(slc_reply)];
 unsigned char *slc_replyp;
 
 void
@@ -1309,6 +1310,14 @@ slc_start_reply()
 void
 slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
 {
+	/* A sequence of up to 6 bytes my be written for this member of the SLC
+	 * suboption list by this function.  The end of negotiation command,
+	 * which is written by slc_end_reply(), will require 2 additional
+	 * bytes.  Do not proceed unless there is sufficient space for these
+	 * items.
+	 */
+	if (&slc_replyp[6+2] > slc_reply_eom)
+		return;
 	if ((*slc_replyp++ = func) == IAC)
 		*slc_replyp++ = IAC;
 	if ((*slc_replyp++ = flags) == IAC)
@@ -1322,6 +1331,9 @@ slc_end_reply()
 {
     int len;
 
+    /* The end of negotiation command requires 2 bytes. */
+    if (&slc_replyp[2] > slc_reply_eom)
+            return;
     *slc_replyp++ = IAC;
     *slc_replyp++ = SE;
     len = slc_replyp - slc_reply;
@@ -1415,8 +1427,8 @@ env_opt(unsigned char *buf, int len)
 	}
 }
 
-#define	OPT_REPLY_SIZE	256
-unsigned char *opt_reply;
+#define	OPT_REPLY_SIZE	(2 * SUBBUFSIZE)
+unsigned char *opt_reply = NULL;
 unsigned char *opt_replyp;
 unsigned char *opt_replyend;
 
@@ -1475,9 +1487,9 @@ env_opt_add(unsigned char *ep)
 		return;
 	}
 	vp = env_getvalue(ep);
-	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
-				strlen((char *)ep) + 6 > opt_replyend)
-	{
+        if (opt_replyp + (vp ? 2 * strlen((char *)vp) : 0) +
+                                2 * strlen((char *)ep) + 6 > opt_replyend)
+        {
 		int len;
 		void *tmp;
 		opt_replyend += OPT_REPLY_SIZE;
@@ -1503,6 +1515,8 @@ env_opt_add(unsigned char *ep)
 		*opt_replyp++ = ENV_USERVAR;
 	for (;;) {
 		while ((c = *ep++)) {
+			if (opt_replyp + (2 + 2) > opt_replyend)
+				return;
 			switch(c&0xff) {
 			case IAC:
 				*opt_replyp++ = IAC;
@@ -1517,6 +1531,8 @@ env_opt_add(unsigned char *ep)
 			*opt_replyp++ = c;
 		}
 		if ((ep = vp)) {
+			if (opt_replyp + (1 + 2 + 2) > opt_replyend)
+				return;
 #ifdef	OLD_ENVIRON
 			if (telopt_environ == TELOPT_OLD_ENVIRON)
 				*opt_replyp++ = old_env_value;
@@ -1547,7 +1563,9 @@ env_opt_end(int emptyok)
 {
 	int len;
 
-	len = opt_replyp - opt_reply + 2;
+	if (opt_replyp + 2 > opt_replyend)
+		return;
+	len = opt_replyp + 2 - opt_reply;
 	if (emptyok || len > 6) {
 		*opt_replyp++ = IAC;
 		*opt_replyp++ = SE;

crypto/heimdal/kadmin/version4.c

@@ -964,6 +964,8 @@ handle_v4(krb5_context context,
 	if(term_flag)
 	    exit(0);
 	if(first) {
+	    if (len < 2)
+		krb5_errx(context, 1, "received too short len (%d < 2)", len);
 	    /* first time around, we have already read len, and two
                bytes of the version string */
 	    krb5_data_alloc(&message, len);

crypto/heimdal/kdc/config.c

@@ -64,6 +64,8 @@ krb5_boolean encode_as_rep_as_tgs_rep; /* bug compatibility */
 krb5_boolean check_ticket_addresses;
 krb5_boolean allow_null_ticket_addresses;
 krb5_boolean allow_anonymous;
+int trpolicy;
+static const char *trpolicy_str;
 
 static struct getarg_strings addresses_str;	/* addresses to listen on */
 krb5_addresses explicit_addresses;
@@ -287,9 +289,8 @@ configure(int argc, char **argv)
 
     get_dbinfo();
     
-    if(max_request_str){
+    if(max_request_str)
 	max_request = parse_bytes(max_request_str, NULL);
-    }
 
     if(max_request == 0){
 	p = krb5_config_get_string (context,
@@ -352,6 +353,23 @@ configure(int argc, char **argv)
     allow_anonymous = 
 	krb5_config_get_bool(context, NULL, "kdc", 
 			     "allow-anonymous", NULL);
+    trpolicy_str = 
+	krb5_config_get_string_default(context, NULL, "always-check", "kdc", 
+				       "transited-policy", NULL);
+    if(strcasecmp(trpolicy_str, "always-check") == 0)
+	trpolicy = TRPOLICY_ALWAYS_CHECK;
+    else if(strcasecmp(trpolicy_str, "allow-per-principal") == 0)
+	trpolicy = TRPOLICY_ALLOW_PER_PRINCIPAL;
+    else if(strcasecmp(trpolicy_str, "always-honour-request") == 0)
+	trpolicy = TRPOLICY_ALWAYS_HONOUR_REQUEST;
+    else {
+	kdc_log(0, "unknown transited-policy: %s, reverting to always-check", 
+		trpolicy_str);
+	trpolicy = TRPOLICY_ALWAYS_CHECK;
+    }
+	
+	krb5_config_get_bool_default(context, NULL, TRUE, "kdc", 
+				     "enforce-transited-policy", NULL);
 #ifdef KRB4
     if(v4_realm == NULL){
 	p = krb5_config_get_string (context, NULL, 

crypto/heimdal/kdc/kdc.8

@@ -1,6 +1,6 @@
 .\" $Id: kdc.8,v 1.17 2002/08/28 21:09:05 joda Exp $
 .\"
-.Dd August 22, 2002
+.Dd October 22, 2003
 .Dt KDC 8
 .Os HEIMDAL
 .Sh NAME
@@ -128,6 +128,27 @@ Permit tickets with no addresses.  This option is only relevant when
 check-ticket-addresses is TRUE.
 .It Li allow-anonymous = Va boolean
 Permit anonymous tickets with no addresses.
+.It Li transited-policy = Xo
+.Li always-check \*(Ba
+.Li allow-per-principal |
+.Li always-honour-request
+.Xc
+This controls how KDC requests with the
+.Li disable-transited-check
+flag are handled. It can be one of:
+.Bl -tag -width "xxx" -offset indent
+.It Li always-check
+Always check transited encoding, this is the default.
+.It Li allow-per-principal
+Currently this is identical to
+.Li always-check .
+In a future release, it will be possible to mark a principal as able
+to handle unchecked requests.
+.It Li always-honour-request
+Always do what the client asked.
+In a future release, it will be possible to force a check per
+principal.
+.El
 .It encode_as_rep_as_tgs_rep = Va boolean
 Encode AS-Rep as TGS-Rep to be bug-compatible with old DCE code.  The
 Heimdal clients allow both.

crypto/heimdal/kdc/kdc_locl.h

@@ -62,6 +62,11 @@ extern krb5_boolean encode_as_rep_as_tgs_rep;
 extern krb5_boolean check_ticket_addresses;
 extern krb5_boolean allow_null_ticket_addresses;
 extern krb5_boolean allow_anonymous;
+enum { TRPOLICY_ALWAYS_CHECK,
+       TRPOLICY_ALLOW_PER_PRINCIPAL, 
+       TRPOLICY_ALWAYS_HONOUR_REQUEST };
+extern int trpolicy;
+extern int enable_v4_cross_realm;
 
 #ifdef KRB4
 extern char *v4_realm;

crypto/heimdal/kdc/kerberos5.c

@@ -355,10 +355,13 @@ get_pa_etype_info(METHOD_DATA *md, hdb_entry *client,
     
     if(n != pa.len) {
 	char *name;
-	krb5_unparse_name(context, client->principal, &name);
+	ret = krb5_unparse_name(context, client->principal, &name);
+	if (ret)
+	    name = "<unparse_name failed>";
 	kdc_log(0, "internal error in get_pa_etype_info(%s): %d != %d", 
 		name, n, pa.len);
-	free(name);
+	if (ret == 0)
+	    free(name);
 	pa.len = n;
     }
 
@@ -496,8 +499,8 @@ as_rep(KDC_REQ *req,
     krb5_enctype cetype, setype;
     EncTicketPart et;
     EncKDCRepPart ek;
-    krb5_principal client_princ, server_princ;
-    char *client_name, *server_name;
+    krb5_principal client_princ = NULL, server_princ = NULL;
+    char *client_name = NULL, *server_name = NULL;
     krb5_error_code ret = 0;
     const char *e_text = NULL;
     krb5_crypto crypto;
@@ -506,28 +509,32 @@ as_rep(KDC_REQ *req,
     memset(&rep, 0, sizeof(rep));
 
     if(b->sname == NULL){
-	server_name = "<unknown server>";
 	ret = KRB5KRB_ERR_GENERIC;
 	e_text = "No server in request";
     } else{
 	principalname2krb5_principal (&server_princ, *(b->sname), b->realm);
-	krb5_unparse_name(context, server_princ, &server_name);
+	ret = krb5_unparse_name(context, server_princ, &server_name);
+    }
+    if (ret) {
+	kdc_log(0, "AS-REQ malformed server name from %s", from);
+	goto out;
     }
     
     if(b->cname == NULL){
-	client_name = "<unknown client>";
 	ret = KRB5KRB_ERR_GENERIC;
 	e_text = "No client in request";
     } else {
 	principalname2krb5_principal (&client_princ, *(b->cname), b->realm);
-	krb5_unparse_name(context, client_princ, &client_name);
+	ret = krb5_unparse_name(context, client_princ, &client_name);
     }
+    if (ret) {
+	kdc_log(0, "AS-REQ malformed client name from %s", from);
+	goto out;
+    }
+
     kdc_log(0, "AS-REQ %s from %s for %s", 
 	    client_name, from, server_name);
 
-    if(ret)
-	goto out;
-
     ret = db_fetch(client_princ, &client);
     if(ret){
 	kdc_log(0, "UNKNOWN -- %s: %s", client_name,
@@ -559,7 +566,6 @@ as_rep(KDC_REQ *req,
 	while((pa = find_padata(req, &i, KRB5_PADATA_ENC_TIMESTAMP))){
 	    krb5_data ts_data;
 	    PA_ENC_TS_ENC p;
-	    time_t patime;
 	    size_t len;
 	    EncryptedData enc_data;
 	    Key *pa_key;
@@ -635,7 +641,6 @@ as_rep(KDC_REQ *req,
 			 client_name);
 		continue;
 	    }
-	    patime = p.patimestamp;
 	    free_PA_ENC_TS_ENC(&p);
 	    if (abs(kdc_time - p.patimestamp) > context->max_skew) {
 		ret = KRB5KDC_ERR_PREAUTH_FAILED;
@@ -716,9 +721,10 @@ as_rep(KDC_REQ *req,
 	    if (ret == 0) {
 		kdc_log(5, "Using %s/%s", cet, set);
 		free(set);
-	    } else
-		free(cet);
-	} else
+	    }
+	    free(cet);
+	}
+	if (ret != 0)
 	    kdc_log(5, "Using e-types %d/%d", cetype, setype);
     }
     
@@ -841,13 +847,8 @@ as_rep(KDC_REQ *req,
 	copy_HostAddresses(b->addresses, et.caddr);
     }
     
-    {
-	krb5_data empty_string;
-      
-	krb5_data_zero(&empty_string); 
-	et.transited.tr_type = DOMAIN_X500_COMPRESS;
-	et.transited.contents = empty_string;
-    }
+    et.transited.tr_type = DOMAIN_X500_COMPRESS;
+    krb5_data_zero(&et.transited.contents); 
      
     copy_EncryptionKey(&et.key, &ek.key);
 
@@ -914,8 +915,8 @@ as_rep(KDC_REQ *req,
 		       client->kvno, &ckey->key, &e_text, reply);
     free_EncTicketPart(&et);
     free_EncKDCRepPart(&ek);
-    free_AS_REP(&rep);
   out:
+    free_AS_REP(&rep);
     if(ret){
 	krb5_mk_error(context,
 		      ret,
@@ -929,9 +930,11 @@ as_rep(KDC_REQ *req,
 	ret = 0;
     }
   out2:
-    krb5_free_principal(context, client_princ);
+    if (client_princ)
+	krb5_free_principal(context, client_princ);
     free(client_name);
-    krb5_free_principal(context, server_princ);
+    if (server_princ)
+	krb5_free_principal(context, server_princ);
     free(server_name);
     if(client)
 	free_ent(client);
@@ -1054,33 +1057,35 @@ check_tgs_flags(KDC_REQ_BODY *b, EncTicketPart *tgt, EncTicketPart *et)
 }
 
 static krb5_error_code
-fix_transited_encoding(TransitedEncoding *tr, 
+fix_transited_encoding(krb5_boolean check_policy,
+		       TransitedEncoding *tr, 
+		       EncTicketPart *et, 
 		       const char *client_realm, 
 		       const char *server_realm, 
 		       const char *tgt_realm)
 {
     krb5_error_code ret = 0;
-    if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)){
-	char **realms = NULL, **tmp;
-	int num_realms = 0;
-	int i;
-	if(tr->tr_type && tr->contents.length != 0) {
-	    if(tr->tr_type != DOMAIN_X500_COMPRESS){
-		kdc_log(0, "Unknown transited type: %u", 
-			tr->tr_type);
-		return KRB5KDC_ERR_TRTYPE_NOSUPP;
-	    }
-	    ret = krb5_domain_x500_decode(context, 
-					  tr->contents,
-					  &realms, 
-					  &num_realms,
-					  client_realm,
-					  server_realm);
-	    if(ret){
-		krb5_warn(context, ret, "Decoding transited encoding");
-		return ret;
-	    }
-	}
+    char **realms, **tmp;
+    int num_realms;
+    int i;
+
+    if(tr->tr_type != DOMAIN_X500_COMPRESS) {
+	kdc_log(0, "Unknown transited type: %u", tr->tr_type);
+	return KRB5KDC_ERR_TRTYPE_NOSUPP;
+    }
+
+    ret = krb5_domain_x500_decode(context, 
+				  tr->contents,
+				  &realms, 
+				  &num_realms,
+				  client_realm,
+				  server_realm);
+    if(ret){
+	krb5_warn(context, ret, "Decoding transited encoding");
+	return ret;
+    }
+    if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)) {
+	/* not us, so add the previous realm to transited set */
 	if (num_realms < 0 || num_realms + 1 > UINT_MAX/sizeof(*realms)) {
 	    ret = ERANGE;
 	    goto free_realms;
@@ -1097,16 +1102,46 @@ fix_transited_encoding(TransitedEncoding *tr,
 	    goto free_realms;
 	}
 	num_realms++;
-	free_TransitedEncoding(tr);
-	tr->tr_type = DOMAIN_X500_COMPRESS;
-	ret = krb5_domain_x500_encode(realms, num_realms, &tr->contents);
-	if(ret)
-	    krb5_warn(context, ret, "Encoding transited encoding");
-    free_realms:
-	for(i = 0; i < num_realms; i++)
-	    free(realms[i]);
-	free(realms);
     }
+    if(num_realms == 0) {
+	if(strcmp(client_realm, server_realm)) 
+	    kdc_log(0, "cross-realm %s -> %s", client_realm, server_realm);
+    } else {
+	size_t l = 0;
+	char *rs;
+	for(i = 0; i < num_realms; i++)
+	    l += strlen(realms[i]) + 2;
+	rs = malloc(l);
+	if(rs != NULL) {
+	    *rs = '\0';
+	    for(i = 0; i < num_realms; i++) {
+		if(i > 0)
+		    strlcat(rs, ", ", l);
+		strlcat(rs, realms[i], l);
+	    }
+	    kdc_log(0, "cross-realm %s -> %s via [%s]", client_realm, server_realm, rs);
+	    free(rs);
+	}
+    }
+    if(check_policy) {
+	ret = krb5_check_transited(context, client_realm, 
+				   server_realm, 
+				   realms, num_realms, NULL);
+	if(ret) {
+	    krb5_warn(context, ret, "cross-realm %s -> %s", 
+		      client_realm, server_realm);
+	    goto free_realms;
+	}
+	et->flags.transited_policy_checked = 1;
+    }
+    et->transited.tr_type = DOMAIN_X500_COMPRESS;
+    ret = krb5_domain_x500_encode(realms, num_realms, &et->transited.contents);
+    if(ret)
+	krb5_warn(context, ret, "Encoding transited encoding");
+  free_realms:
+    for(i = 0; i < num_realms; i++)
+	free(realms[i]);
+    free(realms);
     return ret;
 }
 
@@ -1172,18 +1207,35 @@ tgs_make_reply(KDC_REQ_BODY *b,
     
     ret = check_tgs_flags(b, tgt, &et);
     if(ret)
-	return ret;
+	goto out;
 
-    copy_TransitedEncoding(&tgt->transited, &et.transited);
-    ret = fix_transited_encoding(&et.transited,
+    /* We should check the transited encoding if:
+       1) the request doesn't ask not to be checked
+       2) globally enforcing a check
+       3) principal requires checking
+       4) we allow non-check per-principal, but principal isn't marked as allowing this
+       5) we don't globally allow this
+    */
+
+#define GLOBAL_FORCE_TRANSITED_CHECK		(trpolicy == TRPOLICY_ALWAYS_CHECK)
+#define GLOBAL_ALLOW_PER_PRINCIPAL		(trpolicy == TRPOLICY_ALLOW_PER_PRINCIPAL)
+#define GLOBAL_ALLOW_DISABLE_TRANSITED_CHECK	(trpolicy == TRPOLICY_ALWAYS_HONOUR_REQUEST)
+/* these will consult the database in future release */
+#define PRINCIPAL_FORCE_TRANSITED_CHECK(P)		0
+#define PRINCIPAL_ALLOW_DISABLE_TRANSITED_CHECK(P)	0
+
+    ret = fix_transited_encoding(!f.disable_transited_check ||
+				 GLOBAL_FORCE_TRANSITED_CHECK ||
+				 PRINCIPAL_FORCE_TRANSITED_CHECK(server) ||
+				 !((GLOBAL_ALLOW_PER_PRINCIPAL && 
+				    PRINCIPAL_ALLOW_DISABLE_TRANSITED_CHECK(server)) ||
+				   GLOBAL_ALLOW_DISABLE_TRANSITED_CHECK),
+				 &tgt->transited, &et,
 				 *krb5_princ_realm(context, client_principal),
 				 *krb5_princ_realm(context, server->principal),
 				 *krb5_princ_realm(context, krbtgt->principal));
-    if(ret){
-	free_TransitedEncoding(&et.transited);
-	return ret;
-    }
-
+    if(ret)
+	goto out;
 
     copy_Realm(krb5_princ_realm(context, server->principal), 
 	       &rep.ticket.realm);
@@ -1278,7 +1330,7 @@ tgs_make_reply(KDC_REQ_BODY *b,
        DES3? */
     ret = encode_reply(&rep, &et, &ek, etype, adtkt ? 0 : server->kvno, ekey,
 		       0, &tgt->key, e_text, reply);
-out:
+  out:
     free_TGS_REP(&rep);
     free_TransitedEncoding(&et.transited);
     if(et.starttime)
@@ -1380,13 +1432,13 @@ get_krbtgt_realm(const PrincipalName *p)
 }
 
 static Realm
-find_rpath(Realm r)
+find_rpath(Realm crealm, Realm srealm)
 {
     const char *new_realm = krb5_config_get_string(context,
 						   NULL,
-						   "libdefaults", 
-						   "capath", 
-						   r, 
+						   "capaths", 
+						   crealm,
+						   srealm,
 						   NULL);
     return (Realm)new_realm;
 }
@@ -1456,10 +1508,14 @@ tgs_rep2(KDC_REQ_BODY *b,
 
     if(ret) {
 	char *p;
-	krb5_unparse_name(context, princ, &p);
+	ret = krb5_unparse_name(context, princ, &p);
+	if (ret != 0)
+	    p = "<unparse_name failed>";
+	krb5_free_principal(context, princ);
 	kdc_log(0, "Ticket-granting ticket not found in database: %s: %s",
 		p, krb5_get_err_text(context, ret));
-	free(p);
+	if (ret == 0)
+	    free(p);
 	ret = KRB5KRB_AP_ERR_NOT_US;
 	goto out2;
     }
@@ -1468,12 +1524,16 @@ tgs_rep2(KDC_REQ_BODY *b,
        *ap_req.ticket.enc_part.kvno != krbtgt->kvno){
 	char *p;
 
-	krb5_unparse_name (context, princ, &p);
+	ret = krb5_unparse_name (context, princ, &p);
+	krb5_free_principal(context, princ);
+	if (ret != 0)
+	    p = "<unparse_name failed>";
 	kdc_log(0, "Ticket kvno = %d, DB kvno = %d (%s)", 
 		*ap_req.ticket.enc_part.kvno,
 		krbtgt->kvno,
 		p);
-	free (p);
+	if (ret == 0)
+	    free (p);
 	ret = KRB5KRB_AP_ERR_BADKEYVER;
 	goto out2;
     }
@@ -1657,9 +1717,13 @@ tgs_rep2(KDC_REQ_BODY *b,
 	}
 
 	principalname2krb5_principal(&sp, *s, r);
-	krb5_unparse_name(context, sp, &spn);	
+	ret = krb5_unparse_name(context, sp, &spn);	
+	if (ret)
+	    goto out;
 	principalname2krb5_principal(&cp, tgt->cname, tgt->crealm);
-	krb5_unparse_name(context, cp, &cpn);
+	ret = krb5_unparse_name(context, cp, &cpn);
+	if (ret)
+	    goto out;
 	unparse_flags (KDCOptions2int(b->kdc_options), KDCOptions_units,
 		       opt_str, sizeof(opt_str));
 	if(*opt_str)
@@ -1676,7 +1740,7 @@ tgs_rep2(KDC_REQ_BODY *b,
 
 	    if ((req_rlm = get_krbtgt_realm(&sp->name)) != NULL) {
 		if(loop++ < 2) {
-		    new_rlm = find_rpath(req_rlm);
+		    new_rlm = find_rpath(tgt->crealm, req_rlm);
 		    if(new_rlm) {
 			kdc_log(5, "krbtgt for realm %s not found, trying %s", 
 				req_rlm, new_rlm);
@@ -1684,7 +1748,9 @@ tgs_rep2(KDC_REQ_BODY *b,
 			free(spn);
 			krb5_make_principal(context, &sp, r, 
 					    KRB5_TGS_NAME, new_rlm, NULL);
-			krb5_unparse_name(context, sp, &spn);	
+			ret = krb5_unparse_name(context, sp, &spn);	
+			if (ret)
+			    goto out;
 			goto server_lookup;
 		    }
 		}
@@ -1697,7 +1763,9 @@ tgs_rep2(KDC_REQ_BODY *b,
 		    free(spn);
 		    krb5_make_principal(context, &sp, r, KRB5_TGS_NAME,
 					realms[0], NULL);
-		    krb5_unparse_name(context, sp, &spn);
+		    ret = krb5_unparse_name(context, sp, &spn);
+		    if (ret)
+			goto out;
 		    krb5_free_host_realm(context, realms);
 		    goto server_lookup;
 		}
@@ -1725,6 +1793,18 @@ tgs_rep2(KDC_REQ_BODY *b,
 	}
 #endif
 
+	if(strcmp(krb5_principal_get_realm(context, sp),
+		  krb5_principal_get_comp_string(context, krbtgt->principal, 1)) != 0) {
+	    char *tpn;
+	    ret = krb5_unparse_name(context, krbtgt->principal, &tpn);
+	    kdc_log(0, "Request with wrong krbtgt: %s", (ret == 0) ? tpn : "<unknown>");
+	    if(ret == 0)
+		free(tpn);
+	    ret = KRB5KRB_AP_ERR_NOT_US;
+	    goto out;
+	    
+	}
+
 	ret = check_flags(client, cpn, server, spn, FALSE);
 	if(ret)
 	    goto out;

crypto/heimdal/lib/krb5/krb5-protos.h

@@ -520,6 +520,15 @@ krb5_change_password (
 	krb5_data */*result_code_string*/,
 	krb5_data */*result_string*/);
 
+krb5_error_code
+krb5_check_transited (
+	krb5_context /*context*/,
+	krb5_const_realm /*client_realm*/,
+	krb5_const_realm /*server_realm*/,
+	krb5_realm */*realms*/,
+	int /*num_realms*/,
+	int */*bad_realm*/);
+
 krb5_error_code
 krb5_check_transited_realms (
 	krb5_context /*context*/,

crypto/heimdal/lib/krb5/rd_req.c

@@ -129,6 +129,32 @@ krb5_decode_ap_req(krb5_context context,
     return 0;
 }
 
+static krb5_error_code
+check_transited(krb5_context context, Ticket *ticket, EncTicketPart *enc)
+{
+    char **realms;
+    int num_realms;
+    krb5_error_code ret;
+	    
+    if(enc->transited.tr_type != DOMAIN_X500_COMPRESS)
+	return KRB5KDC_ERR_TRTYPE_NOSUPP;
+
+    if(enc->transited.contents.length == 0)
+	return 0;
+
+    ret = krb5_domain_x500_decode(context, enc->transited.contents, 
+				  &realms, &num_realms, 
+				  enc->crealm,
+				  ticket->realm);
+    if(ret)
+	return ret;
+    ret = krb5_check_transited(context, enc->crealm, 
+			       ticket->realm, 
+			       realms, num_realms, NULL);
+    free(realms);
+    return ret;
+}
+
 krb5_error_code
 krb5_decrypt_ticket(krb5_context context,
 		    Ticket *ticket,
@@ -161,6 +187,14 @@ krb5_decrypt_ticket(krb5_context context,
 	    krb5_clear_error_string (context);
 	    return KRB5KRB_AP_ERR_TKT_EXPIRED;
 	}
+	
+	if(!t.flags.transited_policy_checked) {
+	    ret = check_transited(context, ticket, &t);
+	    if(ret) {
+		free_EncTicketPart(&t);
+		return ret;
+	    }
+	}
     }
     
     if(out)
@@ -209,29 +243,6 @@ out:
     return ret;
 }
 
-#if 0
-static krb5_error_code
-check_transited(krb5_context context,
-		krb5_ticket *ticket)
-{
-    char **realms;
-    int num_realms;
-    krb5_error_code ret;
-
-    if(ticket->ticket.transited.tr_type != DOMAIN_X500_COMPRESS)
-	return KRB5KDC_ERR_TRTYPE_NOSUPP;
-
-    ret = krb5_domain_x500_decode(ticket->ticket.transited.contents, 
-				  &realms, &num_realms, 
-				  ticket->client->realm,
-				  ticket->server->realm);
-    if(ret)
-	return ret;
-    ret = krb5_check_transited_realms(context, realms, num_realms, NULL);
-    free(realms);
-    return ret;
-}
-#endif
 
 krb5_error_code
 krb5_verify_ap_req(krb5_context context,

crypto/heimdal/lib/krb5/transited.c

@@ -304,6 +304,12 @@ krb5_domain_x500_decode(krb5_context context,
     struct tr_realm *p, **q;
     int ret;
     
+    if(tr.length == 0) {
+	*realms = NULL;
+	*num_realms = 0;
+	return 0;
+    }
+
     /* split string in components */
     ret = decode_realms(context, tr.data, tr.length, &r);
     if(ret)
@@ -358,6 +364,9 @@ krb5_domain_x500_encode(char **realms, int num_realms, krb5_data *encoding)
     char *s = NULL;
     int len = 0;
     int i;
+    krb5_data_zero(encoding);
+    if (num_realms == 0)
+	return 0;
     for(i = 0; i < num_realms; i++){
 	len += strlen(realms[i]);
 	if(realms[i][0] == '/')
@@ -365,6 +374,8 @@ krb5_domain_x500_encode(char **realms, int num_realms, krb5_data *encoding)
     }
     len += num_realms - 1;
     s = malloc(len + 1);
+    if (s == NULL)
+	return ENOMEM;
     *s = '\0';
     for(i = 0; i < num_realms; i++){
 	if(i && i < num_realms - 1)
@@ -378,6 +389,44 @@ krb5_domain_x500_encode(char **realms, int num_realms, krb5_data *encoding)
     return 0;
 }
 
+krb5_error_code
+krb5_check_transited(krb5_context context,
+		     krb5_const_realm client_realm,
+		     krb5_const_realm server_realm,
+		     krb5_realm *realms,
+		     int num_realms,
+		     int *bad_realm)
+{
+    char **tr_realms;
+    char **p;
+    int i;
+
+    if(num_realms == 0)
+	return 0;
+    
+    tr_realms = krb5_config_get_strings(context, NULL, 
+					"capaths", 
+					client_realm, 
+					server_realm, 
+					NULL);
+    for(i = 0; i < num_realms; i++) {
+	for(p = tr_realms; p && *p; p++) {
+	    if(strcmp(*p, realms[i]) == 0)
+		break;
+	}
+	if(p == NULL || *p == NULL) {
+	    krb5_config_free_strings(tr_realms);
+	    krb5_set_error_string (context, "no transit through realm %s",
+				   realms[i]);
+	    if(bad_realm)
+		*bad_realm = i;
+	    return KRB5KRB_AP_ERR_ILL_CR_TKT;
+	}
+    }
+    krb5_config_free_strings(tr_realms);
+    return 0;
+}
+
 krb5_error_code
 krb5_check_transited_realms(krb5_context context,
 			    const char *const *realms, 

crypto/kerberosIV/appl/telnet/telnet/telnet.c

@@ -1285,6 +1285,7 @@ slc_check()
 
 
 unsigned char slc_reply[128];
+unsigned char const * const slc_reply_eom = &slc_reply[sizeof(slc_reply)];
 unsigned char *slc_replyp;
 
 void
@@ -1300,6 +1301,14 @@ slc_start_reply()
 void
 slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
 {
+	/* A sequence of up to 6 bytes my be written for this member of the SLC
+	 * suboption list by this function.  The end of negotiation command,
+	 * which is written by slc_end_reply(), will require 2 additional
+	 * bytes.  Do not proceed unless there is sufficient space for these
+	 * items.
+	 */
+	if (&slc_replyp[6+2] > slc_reply_eom)
+		return;
 	if ((*slc_replyp++ = func) == IAC)
 		*slc_replyp++ = IAC;
 	if ((*slc_replyp++ = flags) == IAC)
@@ -1313,6 +1322,9 @@ slc_end_reply()
 {
     int len;
 
+    /* The end of negotiation command requires 2 bytes. */
+    if (&slc_replyp[2] > slc_reply_eom)
+            return;
     *slc_replyp++ = IAC;
     *slc_replyp++ = SE;
     len = slc_replyp - slc_reply;
@@ -1406,8 +1418,8 @@ env_opt(unsigned char *buf, int len)
 	}
 }
 
-#define	OPT_REPLY_SIZE	256
-unsigned char *opt_reply;
+#define	OPT_REPLY_SIZE	(2 * SUBBUFSIZE)
+unsigned char *opt_reply = NULL;
 unsigned char *opt_replyp;
 unsigned char *opt_replyend;
 
@@ -1460,9 +1472,9 @@ env_opt_add(unsigned char *ep)
 		return;
 	}
 	vp = env_getvalue(ep);
-	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
-				strlen((char *)ep) + 6 > opt_replyend)
-	{
+        if (opt_replyp + (vp ? 2 * strlen((char *)vp) : 0) +
+                                2 * strlen((char *)ep) + 6 > opt_replyend)
+        {
 		int len;
 		opt_replyend += OPT_REPLY_SIZE;
 		len = opt_replyend - opt_reply;
@@ -1486,6 +1498,8 @@ env_opt_add(unsigned char *ep)
 		*opt_replyp++ = ENV_USERVAR;
 	for (;;) {
 		while ((c = *ep++)) {
+			if (opt_replyp + (2 + 2) > opt_replyend)
+				return;
 			switch(c&0xff) {
 			case IAC:
 				*opt_replyp++ = IAC;
@@ -1500,6 +1514,8 @@ env_opt_add(unsigned char *ep)
 			*opt_replyp++ = c;
 		}
 		if ((ep = vp)) {
+			if (opt_replyp + (1 + 2 + 2) > opt_replyend)
+				return;
 #ifdef	OLD_ENVIRON
 			if (telopt_environ == TELOPT_OLD_ENVIRON)
 				*opt_replyp++ = old_env_value;
@@ -1530,7 +1546,9 @@ env_opt_end(int emptyok)
 {
 	int len;
 
-	len = opt_replyp - opt_reply + 2;
+	if (opt_replyp + 2 > opt_replyend)
+		return;
+	len = opt_replyp + 2 - opt_reply;
 	if (emptyok || len > 6) {
 		*opt_replyp++ = IAC;
 		*opt_replyp++ = SE;

crypto/openssl/crypto/opensslv.h

@@ -26,7 +26,7 @@
  *  major minor fix final patch/beta)
  */
 #define OPENSSL_VERSION_NUMBER	0x0090703fL
-#define OPENSSL_VERSION_TEXT	"OpenSSL 0.9.7c 30 Sep 2003"
+#define OPENSSL_VERSION_TEXT	"OpenSSL 0.9.7c-p1 30 Sep 2003"
 #define OPENSSL_VERSION_PTEXT	" part of " OPENSSL_VERSION_TEXT
 
 

crypto/openssl/ssl/s23_srvr.c

@@ -268,9 +268,6 @@ int ssl23_get_client_hello(SSL *s)
 	int n=0,j;
 	int type=0;
 	int v[2];
-#ifndef OPENSSL_NO_RSA
-	int use_sslv2_strong=0;
-#endif
 
 	if (s->state ==	SSL23_ST_SR_CLNT_HELLO_A)
 		{
@@ -519,9 +516,7 @@ int ssl23_get_client_hello(SSL *s)
 			}
 
 		s->state=SSL2_ST_GET_CLIENT_HELLO_A;
-		if ((s->options & SSL_OP_MSIE_SSLV2_RSA_PADDING) ||
-			use_sslv2_strong ||
-			(s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3))
+		if (s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3)
 			s->s2->ssl2_rollback=0;
 		else
 			/* reject SSL 2.0 session if client supports SSL 3.0 or TLS 1.0

crypto/openssl/ssl/s3_pkt.c

@@ -1085,6 +1085,14 @@ start:
 			goto err;
 			}
 
+		/* Check we have a cipher to change to */
+		if (s->s3->tmp.new_cipher == NULL)
+			{
+			i=SSL_AD_UNEXPECTED_MESSAGE;
+			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
+			goto err;
+			}
+
 		rr->length=0;
 
 		if (s->msg_callback)

crypto/telnet/telnet/telnet.c

@@ -1318,6 +1318,7 @@ slc_check(void)
 }
 
 unsigned char slc_reply[128];
+unsigned char const * const slc_reply_eom = &slc_reply[sizeof(slc_reply)];
 unsigned char *slc_replyp;
 
 void
@@ -1333,6 +1334,14 @@ slc_start_reply(void)
 void
 slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
 {
+	/* A sequence of up to 6 bytes my be written for this member of the SLC
+	 * suboption list by this function.  The end of negotiation command,
+	 * which is written by slc_end_reply(), will require 2 additional
+	 * bytes.  Do not proceed unless there is sufficient space for these
+	 * items.
+	 */
+	if (&slc_replyp[6+2] > slc_reply_eom)
+		return;
 	if ((*slc_replyp++ = func) == IAC)
 		*slc_replyp++ = IAC;
 	if ((*slc_replyp++ = flags) == IAC)
@@ -1346,6 +1355,9 @@ slc_end_reply(void)
 {
     int len;
 
+    /* The end of negotiation command requires 2 bytes. */
+    if (&slc_replyp[2] > slc_reply_eom)
+            return;
     *slc_replyp++ = IAC;
     *slc_replyp++ = SE;
     len = slc_replyp - slc_reply;
@@ -1463,8 +1475,8 @@ env_opt(unsigned char *buf, int len)
 	}
 }
 
-#define	OPT_REPLY_SIZE	256
-unsigned char *opt_reply;
+#define	OPT_REPLY_SIZE	(2 * SUBBUFSIZE)
+unsigned char *opt_reply = NULL;
 unsigned char *opt_replyp;
 unsigned char *opt_replyend;
 
@@ -1517,9 +1529,9 @@ env_opt_add(unsigned char *ep)
 		return;
 	}
 	vp = env_getvalue(ep);
-	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
-				strlen((char *)ep) + 6 > opt_replyend)
-	{
+        if (opt_replyp + (vp ? 2 * strlen((char *)vp) : 0) +
+                                2 * strlen((char *)ep) + 6 > opt_replyend)
+        {
 		int len;
 		opt_replyend += OPT_REPLY_SIZE;
 		len = opt_replyend - opt_reply;
@@ -1543,6 +1555,8 @@ env_opt_add(unsigned char *ep)
 		*opt_replyp++ = ENV_USERVAR;
 	for (;;) {
 		while ((c = *ep++)) {
+			if (opt_replyp + (2 + 2) > opt_replyend)
+				return;
 			switch(c&0xff) {
 			case IAC:
 				*opt_replyp++ = IAC;
@@ -1557,6 +1571,8 @@ env_opt_add(unsigned char *ep)
 			*opt_replyp++ = c;
 		}
 		if ((ep = vp)) {
+			if (opt_replyp + (1 + 2 + 2) > opt_replyend)
+				return;
 #ifdef	OLD_ENVIRON
 			if (telopt_environ == TELOPT_OLD_ENVIRON)
 				*opt_replyp++ = old_env_value;
@@ -1587,7 +1603,9 @@ env_opt_end(int emptyok)
 {
 	int len;
 
-	len = opt_replyp - opt_reply + 2;
+	if (opt_replyp + 2 > opt_replyend)
+		return;
+	len = opt_replyp + 2 - opt_reply;
 	if (emptyok || len > 6) {
 		*opt_replyp++ = IAC;
 		*opt_replyp++ = SE;

etc/sendmail/freebsd.submit.mc

@@ -1,28 +0,0 @@
-divert(-1)
-#
-# Copyright (c) 2001-2003 Sendmail, Inc. and its suppliers.
-#	All rights reserved.
-#
-# By using this file, you agree to the terms and conditions set
-# forth in the LICENSE file which can be found at the top level of
-# the sendmail distribution.
-#
-#
-
-#
-#  This is the FreeBSD configuration for a set-group-ID sm-msp sendmail
-#  that acts as a initial mail submission program.
-#
-#
-
-divert(0)dnl
-VERSIONID(`$FreeBSD$')
-define(`confCF_VERSION', `Submit')dnl
-define(`__OSTYPE__',`')dnl dirty hack to keep proto.m4 from complaining
-define(`_USE_DECNET_SYNTAX_', `1')dnl support DECnet
-define(`confTIME_ZONE', `USE_TZ')dnl
-define(`confDONT_INIT_GROUPS', `True')dnl
-define(`confBIND_OPTS', `WorkAroundBrokenAAAA')dnl
-dnl
-dnl If you use IPv6 only, change [127.0.0.1] to [IPv6:::1]
-FEATURE(`msp', `[127.0.0.1]')dnl

games/fortune/datfiles/gerrold.limerick

@@ -1,823 +0,0 @@
-%% $FreeBSD$
-%% From The War Against The Chtorr,
-%% Copyright David Gerrold, 1984-2000, all rights reserved,
-%% used with permission of the author.
-%%
-%%© This is the copyright line.
-%%Eighty-nine is the year we assign.
-%%	These verses are caroled
-%%	by one David Gerrold.
-%%All rights are reserved. This is mine. *
-%%
-A limerick of classic proportion
-should have meter and rhyme and a portion
-	of humor quite lewd,
-	and a frightfully crude,
-impossible sexual contortion.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A limerick is best when it's lewd,
-gross, titillating and crude --
-	but this one is clean,
-	unless you are seen
-reading it aloud in the nude.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-I wanted to print here a medley
-of limericks so gross they were deadly,
-	but when the typesetter tried
-	to set them, he died;
-(not to mention my editor, Smedly.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-I have written some limericks quite fateful,
-malicious and vicious and hateful;
-	but I've torn up the jokes
-	that will sicken most folks,
-and humanity ought to be grateful.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young lady named Susie,
-Who everyone thought was a floozy.
-	She liked boy scout troops
-	and Shriners, in groups;
-"What the hell?" She replied. "I'm not choosy."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A fellow who lived in West Perkin
-was always a-jerkin' his gherkin.
-	Said he, "It's not fickle
-	to play with my pickle.
-At least my gherkin's a workin'."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A proctologist name of McGee
-once bent over double to see
-	an eyeball of glass
-	he had shoved up his ass,
-"-- so I can see one that looks back at me."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Bart has a singular penis
-for his wife who is built like a Venus.
-	He awoke with a fright
-	last Saturday night:
-"Hey! Something is coming between us!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady who lives in New Delhi
-has habits disgusting and smelhi.
-	She likes to eat feces
-	of various species.
-(The recipe is tattooed or her belhi.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A daisy chain isn't a riddle.
-just some folks who are happy to fiddle,
-	by twos and by threes,
-	on their backs or their knees,
-and it's fun getting caught in the middle!
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lad with a marvelous bend
-has no need of a lover or friend.
-	What he does to himself
-	would fill up a shelf,
-but alas, he has come to his end.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was an old witch, name of Jessie
-whose crotch was all smelly and messie.
-	She enjoyed a good squirm
-	with an alien worm
--- and got stains all over her dressie!
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady who favors coition,
-has invented the spaceship position.
-	She lies down with ease
-	and pulls up her knees,
-and hollers, "Lift off!" and "Ignitions!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Isaac the famous seducer,
-will meet a young lass and conducer
-	to let him get fresh
-	with her quivering flesh,
-but if there isn't the time, he'll just gucer.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-And old man of Texas named Tanners
-was notorious for his bad manners.
-	When he noticed the start
-	of an imminent fart,
-he'd announce it with bullhorns and banners.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A woman who wanted to see,
-if she stood up, how far she could pee,
-	had pardon to beg,
-	when it ran down her leg,
-and formed icicles off her left knee.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A promiscuous sort was dear Laurie
-(Yes, this is that kind of story.)
-	She did it with Joe
-	and Larry and Moe
-and Curly and Howard and Morrie.
-
-And Johnny and Richard and Pritchard and Kerry
-And Lonnie and Horace and Boris and Barry
-	and Donald and Harold
-	and Ronald and Gerald
-and Tommy and Dicky and Harry.
-
-And . . . Peter and Paul and Teddy and Todd
-and Matthew and Mark and Simon and Rod
-	and Brucie and Mark
-	and Bobby and Clarck
-and she still isn't finished! My God!
-
-And David and Dennis and Huey and Ken
-and Dewey and Louie, then David again,
-	and Willy and Ben
-	and David again
-and again and again and again.
-
-And Danny and Manny and Gary and Fred
-and Mackie and Jackie and Dougie and Ned
-	and Harvey and Len
-	(then David again)
-and -- hold on just a second, she's dead!
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young man from St. Loo,
-who gave his dear sister a screw.
-	Said he, with aplomb,
-	"You're better than Mom."
-Said she, "That's what Dad told me too!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady who didn't like flies
-managed to hide her surprise,
-	when she opened up one
-	and found it was fun.
-Now she willingly widens her thighs.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young lady named Nancy,
-who liked having sex, plain of fancy.
-	With lightning and thunder,
-	and a profound sense of wonder,
-But not with a partner -- much too chancy.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young lady quite tearful.
-Of sucking a cock, she was fearful.
-	In a moment of dreard,
-	she just turned her head.
-And, boy! Did she get an earful!
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A mathematician named Boris
-had a wife with a wondrous clitoris.
-	He charged a small fee
-	for his colleagues to see
-that it was made in the shape of a torus.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-The ladies all had to agree
-that Mort's penis was too small to see.
-	A whore named Louise
-	sniffed, "Who will _that_ please?"
-Mort proudly submitted, "Just me!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young fellow named Fisk
-whose comings and goings were brisk,
-	He hid things that were stolen
-	inside his colon,
-and said, "Hey! It's my own *."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A stunning young lady named Joan
-thought a penis was made with a bone.
-	She just didn't know
-	'twas her sexual glow
-that turned parts of men into stone.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A midwife named Flo from Arabia
-often enjoys giving baby a
-	forty-volt shock
-	to the base of the cock.
-(On a girl, she goes for the labia.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-I know of a lass who's for sale.
-She's really a nice piece of tail.
-	From June to September,
-	she'll devour your member,
-but the rest of the year, she's in jail.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Miss Wilkerson thought it her duty
-to maintain her conjugal beauty.
-	She mixed up a paste
-	of industrial waste,
-and applied it to her sweet patootie.*
-
-* The facts about beauty are known,
-and well-learned by those who are grown:
-	beauty is thin,
-	it lies on the skin;
-but ugly goes down to the bone.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-The punctual Cynthia Rolen
-missed a period, (or it was stolen)
-	She looked up her ass
-	with a tube made of glass,
-but found only her own semi-colon;
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A short-organ fellow named Kevin
-used a vacuum to stretch it to seven,
-	then to eight and to nine,
-	and though ten was divine,
-there will be film at eleven.*
-
-* If you think that our boy's now a stud,
-you've been fooled by the size of his pud.
-	Although twelve inches soft,
-	when it rises aloft,
-he just faints from the sheer lack of blood.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There once was a lady named Lizard,
-who got lost in a pink candy blizzard,
-	with a fellow named Jim
-	who wanted to swim
-up her legs to visit her gizzard.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young fellow named Ted,
-who had a radio put in his head.
-	Long wave or short
-	he did it for sport
--- and to improve his reception in bed.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young lady from Venus,
-whose body was shaped like a penis.
-	A fellow named Hunt
-	was shaped like a cunt,
-so it all worked out fine, just between us.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was an old bastard named Gene,
-impotent, selfish, and mean.
-	His dick was so shamed
-	by what the man claimed,
-it pretended that is was a spleen.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There once was a fellow named Jason,
-whose horrible death I would hasten.
-	I'd feed him to worms,
-	just to see how he squirms
--- but they'd vomit his crap  in a basin.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-With a French lass, it's unwise to trifle.
-They have urges they simply can't stifle.
-	A woman of France
-	will pull down her pants
-at the sight of a towering eye-full.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-"My God!" screamed devout Mrs. Pike,
-as she fondled her stableman's spike.
-	"This is quite out of place,
-	and a great loss of face
--- but I think I have fallen in like!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A well-endower fellow from Ortening
-prepared for an evening of sportening,
-	with a boy from a disco,
-	till he lubed up his Crisco,
-and discovered, alas, it was _shortening_!
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady who read Sigmund Freud,
-thought her genitals underemployed;
-	so she put in a stand
-	for a seven-piece band,
-and held dances that we all enjoyed.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady named Shirley was mellow
-and she said to her eager young fellow,
-	"I prefer bagels and lox
-	to sucking off cocks,
-Or even a nice dish of Jell-O!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young man from St. Helens
-afflicted with shrinkin's and swellin's.
-	His dick was so small
-	it was not there at all,
-but his balls looked like honeydew melons.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A woman who once faked a lettera
-reference by which she could gettera
-	job much improved,
-	regretted her move
-when they asked her to show her et cetera.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady of South Madagascar
-wears a bag on her head; it's to mask her.
-	A bottle of scotch
-	might loosen her crotch.
-Wait here, I'll go and I'll ask her.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Chuck is weird, let the whole world know it.
-He brought in his bucket to show it.
-	We all had a fit
-	when we saw it was shit.
-We didn't know he was planning to throw it.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-"Which partners are best? Sixty-niners.
-And better than that? Try the Shriners."
-	These are the results
-	of consenting adults,
-(and occasional like-minded minors.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady's iambic pentameter
-is thirty-two inches diameter.
-	The breadth of her scansion
-	is due to expansion
-in the pants of a critical amateur.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young fellow from Norwich
-Who liked having sex with his porridge.
-	With sugar and cream
-	and a buttery scream --
-(The leftovers went into storage.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young fellow named Jim
-who liked to get naked and swim
-	with plastic sex toys
-	shaped like pubescent boys,
-'cause he'd rather be gay than be grim.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady who jogged in the breeze
-had bosoms that flapped to her knees.
-	Said she, "They're quite warm,
-	they keep me dry in a storm,
-and when it snows, I use them for skis."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was an old voyeur named Zeke,
-who liked to hide in the closet and peek,
-	then jump out with loud cries
-	of "Aha!" and "Surprise!"
-and point out your flaws in technique.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Rick promised to gently deflower
-a maiden who lived on South Gower,
-	(The truth is, he spread
-	her legs wide on the bed,
-and finsihed her off in an hour.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-These poems have come out of my forehead.
-The subject are all fairly torrid
-	-- except for the few
-	that will make you say, "Pugh!"
-And those are the ones that are horrid.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Juanita, the subject of scandals,
-used to use unscented candles,
-	but now thinks it nice
-	to use a device
-with batteries, buzzers, and handles.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was an old prune name of Ginty
-who only ate muffins and thin tea.
-	Thinking of sex
-	gave her the blecchs,
-and left her all dried up and squinty.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-I have written some limericks quite fateful,
-malicious and vicious and hateful;
-	but I've torn up the jokes
-	that would sicken most folks,
-and humanity ought ot be grateful;
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Here's the tale of Benjamin Sneed:
-Where others were two'd he was three'd
-	and when they unmasked it,
-	(three balls in his basket),
-he was voted "Most Likely to Breed."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A maiden who had a third breast
-always kept her hand close to her chest,
-	and I promised her well
-	that I never woudl tell.
-(Write me privately. Name on request.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Skydiver Daniel McDopp
-used to masturbate right from the top.
-	Whenever he fell,
-	he jerked off like hell.
-He was good to the very last drop.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A necrophile name of Ned Schultz,
-often brags of his deed and exults,
-	"Tis legal, it's said,
-	to make love to the dead,
-if performed by consenting adults."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Have you ever met Jamie McBeezis?
-He does any damn thing that he pleases.
-	Says Jamie, undaunted,
-	"If you've got it,then flaunt it!"
-But he's referring to social diseases.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There once was a nearsighted gynie
-whose glasses were sparkly and shiny;
-	but they stayed in the drawer
-	while he worked on a whore
-and tied up the tubes of her hiney.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A shepherd named Jimmie Fitzhugh,
-said to his sweetheart, "It's true.
-	Nothing is moister
-	than a fresh oister,
-unless, of course, it is ewe."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There's a reason why Barton is queer.
-When you meet him, the reason is clear.
-	A goddess named Venus
-	gave him a penis,
-but Mother Nature filled up his brassiere.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Then there was Benjamin Bright,
-a contestant on "What's My Delight?"
-	They guesses at his habits
-	with little white rabbits,
-but were stumped by his mouse and his kite.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young man from St. Lutz,
-who had a remarkable putz.
-	It would sniff, it would hunt,
-	for it only liked cunt.
-Absolutely no lips, hands, or butts.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Sally's sex life was carefully planned.
-Said she, "I prefer to be manned.
-	Things that are anal,
-	are always so banal,
-but things that expand are just grand."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Sally-Jo was exceedingly vexed,
-when they said she was quite oversexed.
-	She said, "That's not true,
-	I just like to screw,
-Now, please take a number. Who's next?"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Sally sued for support; she was claimin'
-Phil had fathered her baby (named Damon).
-	She said, "I ought to know."
-	as she pointed below.
-"'Cause this is the box that he came in."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-We will need a computer to tally
-all the cowboys who scouted our Sally.
-	There were some on her mountains
-	and some on her fountains,
-and quite a few down in the valley.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady who overly lusted
-was frequently opened and thrusted.
-	When the baby came due
-	it was female too,
-and its hymen was already busted.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-When writing these verses of mine,
-I start with a clever last line,
-	then work backward from there,
-	toward the opening pair,
-with the hope it'll all work out fine.*
-
-*only sometimes it doesn't.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There once was a whore from St. Paul,
-who took anyone, wide, short, or tall.
-	She said to her clients,
-	"It's not really science --
-it's just that one size will fit all!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young fellow named Forrest
-whose cornhole was one of the sorest.
-	Said he, "I don't mind
-	a regular grind
--- but I do wish my ass were clitorised."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-When Shakespeare awakes with a scream
-and his member a-drippin' with cream,
-	'tis just the commission
-	of nocturnal emission,
-which he dubs, "A Mid-Slumber Night-Stream."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-Sally-Jo taught erotic correction.
-She told her student to get an erection.
-	"Put your dick in my mouth.
-	Move it north, move it south --
-Now, you're getting a sense of direction!"
-
-Her instructions were very explicit,
-and more than a little illicit:
-	"Please fill up my cunny
-	with fresh clover honey,
-and butter my buns like a biscuit."
-
-"Then wrap me up nice in a blanket,
-and I'll sit on your staff while you crank it.
-	I'll put on some feathers,
-	and laces and leathers,
-and wiggle my ass while you spank it."
-
-"Now that your fingers are stinky,
-tie me up in some chains that are clinky.
-	Bring in goats and a sheik,
-	give my titties a tweak
---and _now_, we can start getting kinky!"
-
-"Forget what the chain and the whip meant.
-Just get the straps and the slings and a shipment
-	of high-grade Vaseline,
-	and a strong trampoline,
-and allof the other equipment!"
-
-"Now, when we get all the bedsprings a-drummin',
-that's when I'll start in a-hummin',
-	then quickly, my dear,
-	put it into my ear,
-so I'll hear the sound of it comin'!"
-
-"I don't know how much this is costing,"
-said her student, still covered with frosting.
-	"But I can say with affinity
-	that I've lost my virginity.
-Quite frankly, my dear, you're _exhausting_!"
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a mad pilot named Lizzy,
-whose manners were said to be skizzy.
-	She could loop, she could twirl,
-	she could make your head whirl.
-She left all her men fucking dizzy.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-The speed of Ed's seed is unclocked
-whenever a lady's unfrocked.
-	Tho' his spirit is willin,
-	when a pussy needs fillin',
-he's a man who goes off half-cocked.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A lady whose name is Tirelli
-has tits made of dynamite jelli.
-	If you take on this dare,
-	you must fondle with care.
-(The detonator's south of her belli.)
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-The fame of our Mame was her tushy,
-and the front of her cunt. (It was bushy.)
-	But I heard that her Mike
-	preferred for his spike
-the place in her face that was skwooshy.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A whore with a face like a hound
-complained that her sales were down,
-	till a lover named Michael
-	bought her a cycle,
-and she peddled it all over town.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-There was a young man named Levine
-who said to his lady, inclined,
-	"Thanks for the spasm,
-	it felt like orgasm;
-as a matter of fact, 'twas divine."
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%
-A king who was mad at the time,
-decreed limerick writing a crime.
-	but late in the night
-	all the poets woudl write
-verses without any rhyme or meter.
-
-From The War Against The Chtorr, (c) David Gerrold, 1984-2000, all
-rights reserved, used with permission of the author.
-%

gnu/usr.bin/cvs/lib/config.h.proto

@@ -248,7 +248,7 @@
 #define HAVE_SIGVEC 1
 
 /* Define to 1 if you have the <stdint.h> header file. */
-#define HAVE_STDINT_H 1
+/* #undef HAVE_STDINT_H */
 
 /* Define to 1 if you have the <stdlib.h> header file. */
 #define HAVE_STDLIB_H 1

gnu/usr.bin/groff/tmac/mdoc.local

@@ -52,7 +52,7 @@
 .ds doc-str-Lb-libvgl      Video Graphics Library (libvgl, \-lvgl)
 .
 .\" Default .Os value
-.ds doc-operating-system FreeBSD\~4.8
+.ds doc-operating-system FreeBSD\~4.9
 .
 .\" FreeBSD releases not found in doc-common
 .ds doc-operating-system-FreeBSD-4.9    4.9

gnu/usr.bin/gzip/gzip.c

@@ -830,8 +830,11 @@ local void treat_file(iname)
     }
 
     close(ifd);
-    if (!to_stdout && close(ofd)) {
-	write_error();
+    if (!to_stdout) {
+        /* Copy modes, times, ownership, and remove the input file */
+        copy_stat(&istat);
+        if (close(ofd))
+	    write_error();
     }
     if (method == -1) {
 	if (!to_stdout) unlink (ofname);
@@ -851,10 +854,6 @@ local void treat_file(iname)
 	}
 	fprintf(stderr, "\n");
     }
-    /* Copy modes, times, ownership, and remove the input file */
-    if (!to_stdout) {
-	copy_stat(&istat);
-    }
 }
 
 /* ========================================================================
@@ -1257,6 +1256,7 @@ local int get_method(in)
 		/* Copy the base name. Keep a directory prefix intact. */
                 char *p = basename(ofname);
                 char *base = p;
+		char *base2;
 		for (;;) {
 		    *p = (char)get_char();
 		    if (*p++ == '\0') break;
@@ -1264,6 +1264,8 @@ local int get_method(in)
 			error("corrupted input -- file name too large");
 		    }
 		}
+		base2 = basename (base);
+		strcpy(base, base2);
                 /* If necessary, adapt the name to local OS conventions: */
                 if (!list) {
                    MAKE_LEGAL_NAME(base);
@@ -1636,12 +1638,12 @@ local void copy_stat(ifstat)
     reset_times(ofname, ifstat);
 #endif
     /* Copy the protection modes */
-    if (chmod(ofname, ifstat->st_mode & 07777)) {
+    if (fchmod(ofd, ifstat->st_mode & 07777)) {
 	WARN((stderr, "%s: ", progname));
 	if (!quiet) perror(ofname);
     }
 #ifndef NO_CHOWN
-    chown(ofname, ifstat->st_uid, ifstat->st_gid);  /* Copy ownership */
+    (void) fchown(ofd, ifstat->st_uid, ifstat->st_gid);  /* Copy ownership */
 #endif
     remove_ofname = 0;
     /* It's now safe to remove the input file: */

gnu/usr.bin/send-pr/send-pr.sh

@@ -262,7 +262,7 @@ TEMP=`mktemp -t pf` || exit 1
 # Catch some signals. ($xs kludge needed by Sun /bin/sh)
 xs=0
 trap 'rm -f $REF $TEMP; exit $xs' 0
-trap 'echo "$COMMAND: Aborting ..."; rm -f $REF $TEMP; xs=1; exit' 1 2 3 13 15
+trap 'SAV=`mktemp -t pr`;echo "$COMMAND: Aborting ... saving unfinished PR into $SAV"; rm -f $REF ; mv $TEMP $SAV; xs=1; exit' 1 2 3 13 15
 
 # If they told us to use a specific file, then do so.
 if [ -n "$IN_FILE" ]; then

lib/libalias/alias_skinny.c

@@ -1,338 +0,0 @@
-/*-
- * alias_skinny.c
- *
- * Copyright (c) 2002, 2003 MarcusCom, Inc.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * Author: Joe Marcus Clarke <marcus@FreeBSD.org>
- *
- * $FreeBSD$
- */
-
-#include <stdio.h>
-#include <string.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in_systm.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <netinet/ip.h>
-#include <netinet/tcp.h>
-#include <netinet/udp.h>
-#include <unistd.h>
-
-#include "alias_local.h"
-
-/*
- * alias_skinny.c handles the translation for the Cisco Skinny Station
- * protocol.  Skinny typically uses TCP port 2000 to set up calls between
- * a Cisco Call Manager and a Cisco IP phone.  When a phone comes on line,
- * it first needs to register with the Call Manager.  To do this it sends
- * a registration message.  This message contains the IP address of the
- * IP phone.  This message must then be translated to reflect our global
- * IP address.  Along with the registration message (and usually in the
- * same packet), the phone sends an IP port message.  This message indicates
- * the TCP port over which it will communicate.
- *
- * When a call is placed from the phone, the Call Manager will send an
- * Open Receive Channel message to the phone to let the caller know someone
- * has answered.  The phone then sends back an Open Receive Channel
- * Acknowledgement.  In this packet, the phone sends its IP address again,
- * and the UDP port over which the voice traffic should flow.  These values
- * need translation.  Right after the Open Receive Channel Acknowledgement, 
- * the Call Manager sends a Start Media Transmission message indicating the
- * call is connected.  This message contains the IP address and UDP port 
- * number of the remote (called) party.  Once this message is translated, the 
- * call can commence.  The called part sends the first UDP packet to the
- * calling phone at the pre-arranged UDP port in the Open Receive Channel
- * Acknowledgement.
- *
- * Skinny is a Cisco-proprietary protocol and is a trademark of Cisco Systems,
- * Inc.  All rights reserved.
-*/
-
-/* #define DEBUG 1 */
-
-/* Message types that need translating */
-#define REG_MSG         0x00000001
-#define IP_PORT_MSG     0x00000002
-#define OPNRCVCH_ACK    0x00000022
-#define START_MEDIATX   0x0000008a
-
-struct skinny_header {
-    u_int32_t       len;
-    u_int32_t       reserved;
-    u_int32_t       msgId;
-};
-
-struct RegisterMessage {
-    u_int32_t       msgId;
-    char            devName[16];
-    u_int32_t       uid;
-    u_int32_t       instance;
-    u_int32_t       ipAddr;
-    u_char          devType;
-    u_int32_t       maxStreams;
-};
-
-struct IpPortMessage {
-    u_int32_t       msgId;
-    u_int32_t       stationIpPort;  /* Note: Skinny uses 32-bit port
-                                     * numbers */
-};
-
-struct OpenReceiveChannelAck {
-    u_int32_t       msgId;
-    u_int32_t       status;
-    u_int32_t       ipAddr;
-    u_int32_t       port;
-    u_int32_t       passThruPartyID;
-};
-
-struct StartMediaTransmission {
-    u_int32_t       msgId;
-    u_int32_t       conferenceID;
-    u_int32_t       passThruPartyID;
-    u_int32_t       remoteIpAddr;
-    u_int32_t       remotePort;
-    u_int32_t       MSPacket;
-    u_int32_t       payloadCap;
-    u_int32_t       precedence;
-    u_int32_t       silenceSuppression;
-    u_short         maxFramesPerPacket;
-    u_int32_t       G723BitRate;
-};
-
-typedef enum {
-    ClientToServer = 0,
-    ServerToClient = 1
-} ConvDirection;
-
-
-static int
-alias_skinny_reg_msg(struct RegisterMessage *reg_msg, struct ip *pip,
-                     struct tcphdr *tc, struct alias_link *link,
-                     ConvDirection direction)
-{
-  reg_msg->ipAddr = (u_int32_t) GetAliasAddress(link).s_addr;
-
-  tc->th_sum = 0;
-  tc->th_sum = TcpChecksum(pip);
-
-  return 0;
-}
-
-static int
-alias_skinny_startmedia(struct StartMediaTransmission *start_media,
-                        struct ip *pip, struct tcphdr *tc,
-                        struct alias_link *link, u_int32_t localIpAddr,
-                        ConvDirection direction)
-{
-  struct in_addr  dst, src;
-
-  dst.s_addr = start_media->remoteIpAddr;
-  src.s_addr = localIpAddr;
-
-  /* XXX I should probably handle in bound global translations as well. */
-
-  return 0;
-}
-
-static int
-alias_skinny_port_msg(struct IpPortMessage *port_msg, struct ip *pip,
-                      struct tcphdr *tc, struct alias_link *link,
-                      ConvDirection direction)
-{
-  port_msg->stationIpPort = (u_int32_t) ntohs(GetAliasPort(link));
-
-  tc->th_sum = 0;
-  tc->th_sum = TcpChecksum(pip);
-
-  return 0;
-}
-
-static int
-alias_skinny_opnrcvch_ack(struct OpenReceiveChannelAck *opnrcvch_ack,
-                          struct ip * pip, struct tcphdr *tc,
-                          struct alias_link *link, u_int32_t *localIpAddr,
-                          ConvDirection direction)
-{
-  struct in_addr  null_addr;
-  struct alias_link *opnrcv_link;
-  u_int32_t localPort;
-
-  *localIpAddr = (u_int32_t) opnrcvch_ack->ipAddr;
-  localPort = opnrcvch_ack->port;
-
-  null_addr.s_addr = INADDR_ANY;
-  opnrcv_link = FindUdpTcpOut(pip->ip_src, null_addr,
-                              htons((u_short) opnrcvch_ack->port), 0,
-                              IPPROTO_UDP, 1);
-  opnrcvch_ack->ipAddr = (u_int32_t) GetAliasAddress(opnrcv_link).s_addr;
-  opnrcvch_ack->port = (u_int32_t) ntohs(GetAliasPort(opnrcv_link));
-
-  tc->th_sum = 0;
-  tc->th_sum = TcpChecksum(pip);
-
-  return 0;
-}
-
-void
-AliasHandleSkinny(struct ip *pip, struct alias_link *link)
-{
-  int             hlen, tlen, dlen;
-  struct tcphdr  *tc;
-  u_int32_t       msgId, len, t, lip;
-  struct skinny_header *sd;
-  int             orig_len, skinny_hdr_len = sizeof(struct skinny_header);
-  ConvDirection   direction;
-
-  tc = (struct tcphdr *) ((char *)pip + (pip->ip_hl << 2));
-  hlen = (pip->ip_hl + tc->th_off) << 2;
-  tlen = ntohs(pip->ip_len);
-  dlen = tlen - hlen;
-
-  sd = (struct skinny_header *) ((char *)pip + hlen);
-
-  /*
-   * XXX This direction is reserved for future use.  I still need to
-   * handle the scenario where the call manager is on the inside, and
-   * the calling phone is on the global outside.
-   */
-  if (ntohs(tc->th_dport) == skinnyPort) {
-    direction = ClientToServer;
-  } else if (ntohs(tc->th_sport) == skinnyPort) {
-    direction = ServerToClient;
-  } else {
-#ifdef DEBUG
-    fprintf(stderr,
-            "PacketAlias/Skinny: Invalid port number, not a Skinny packet\n");
-#endif
-    return;
-  }
-
-  orig_len = dlen;
-  /*
-   * Skinny packets can contain many messages.  We need to loop through
-   * the packet using len to determine message boundaries.  This comes
-   * into play big time with port messages being in the same packet as
-   * register messages.  Also, open receive channel acks are
-   * usually buried in a pakcet some 400 bytes long.
-   */
-  while (dlen >= skinny_hdr_len) {
-    len = (sd->len);
-    msgId = (sd->msgId);
-    t = len;
-
-    if (t < 0 || t > orig_len || t > dlen) {
-#ifdef DEBUG
-      fprintf(stderr,
-              "PacketAlias/Skinny: Not a skinny packet, invalid length \n");
-#endif
-      return;
-    }
-    switch (msgId) {
-      case REG_MSG:
-        {
-          struct RegisterMessage *reg_mesg;
-
-          if (len < sizeof(struct RegisterMessage)) {
-#ifdef DEBUG
-            fprintf(stderr,
-                    "PacketAlias/Skinny: Not a skinny packet, bad registration message\n");
-#endif
-            return;
-          }
-          reg_mesg = (struct RegisterMessage *) & sd->msgId;
-#ifdef DEBUG
-          fprintf(stderr,
-                  "PacketAlias/Skinny: Received a register message");
-#endif
-	  alias_skinny_reg_msg(reg_mesg, pip, tc, link, direction);
-        }
-        break;
-      case IP_PORT_MSG:
-        {
-          struct IpPortMessage *port_mesg;
-          if (len < sizeof(struct IpPortMessage)) {
-#ifdef DEBUG
-            fprintf(stderr,
-                    "PacketAlias/Skinny: Not a skinny packet, port message\n");
-#endif
-            return;
-          }
-#ifdef DEBUG
-          fprintf(stderr
-                  "PacketAlias/Skinny: Received ipport message\n");
-#endif
-          port_mesg = (struct IpPortMessage *) & sd->msgId;
-          alias_skinny_port_msg(port_mesg, pip, tc, link, direction);
-        }
-        break;
-      case OPNRCVCH_ACK:
-        {
-          struct OpenReceiveChannelAck *opnrcvchn_ack;
-
-          if (len < sizeof(struct OpenReceiveChannelAck)) {
-#ifdef DEBUG
-            fprintf(stderr,
-                    "PacketAlias/Skinny: Not a skinny packet, packet,OpnRcvChnAckMsg\n");
-#endif
-            return;
-          }
-#ifdef DEBUG
-          fprintf(stderr,
-                  "PacketAlias/Skinny: Received open rcv channel msg\n");
-#endif
-          opnrcvchn_ack = (struct OpenReceiveChannelAck *) & sd->msgId;
-          alias_skinny_opnrcvch_ack(opnrcvchn_ack, pip, tc, link, &lip, direction);
-        }
-        break;
-      case START_MEDIATX:
-        {
-          struct StartMediaTransmission *startmedia_tx;
-
-          if (len < sizeof(struct StartMediaTransmission)) {
-#ifdef DEBUG
-            fprintf(stderr,
-                    "PacketAlias/Skinny: Not a skinny packet,StartMediaTx Message\n");
-#endif
-            return;
-          }
-#ifdef DEBUG
-          fprintf(stderr,
-                  "PacketAlias/Skinny: Received start media trans msg\n");
-#endif
-           startmedia_tx = (struct StartMediaTransmission *) & sd->msgId;
-           alias_skinny_startmedia(startmedia_tx, pip, tc, link, lip, direction);
-         }
-         break;
-       default:
-         break;
-     }
-     /* Place the pointer at the next message in the packet. */
-     dlen -= len + (skinny_hdr_len - sizeof(msgId));
-     sd = (struct skinny_header *) (((char *)&sd->msgId) + len);
-   }
-}

lib/libc/locale/gb18030.5

@@ -1,77 +0,0 @@
-.\" Copyright (c) 2002, 2003 Tim J. Robbins
-.\" All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-.\" SUCH DAMAGE.
-.\"
-.\" $FreeBSD$
-.Dd August 10, 2003
-.Dt GB18030 5
-.Os
-.Sh NAME
-.Nm gb18030
-.Nd "GB 18030 encoding method for Chinese text"
-.Sh SYNOPSIS
-.Nm ENCODING
-.Qq GB18030
-.Sh DESCRIPTION
-The
-.Nm GB18030
-encoding implements GB 18030-2000, a PRC national standard for the encoding of
-Chinese characters.
-It is a superset of the older GB\ 2312-1980 and GBK encodings,
-and incorporates Unicode's Unihan Extension A completely.
-It also provides code space for all Unicode 3.0 code points.
-.Pp
-Multibyte characters in the
-.Nm GB18030
-encoding can be one byte, two bytes, or
-four bytes long.
-There are a total of over 1.5 million code positions.
-.Pp
-.No GB\ 11383-1981 ( Ns
-.Tn ASCII )
-characters are represented by single bytes in the range 0x00 to 0x7F.
-.Pp
-Chinese characters are represented as either two bytes or four bytes.
-Characters that are represented by two bytes begin with a byte in the range
-0x81-0xFE and end with a byte either in the range 0x40-0x7E or 0x80-0xFE.
-.Pp
-Characters that are represented by four bytes begin with a byte in the range
-0x81-0xFE, have a second byte in the range 0x30-0x39, a third byte in the range
-0x81-0xFE and a fourth byte in the range 0x30-0x39.
-.Sh SEE ALSO
-.Xr euc 4 ,
-.Xr gbk 5 ,
-.Xr utf8 5
-.Rs
-.%T "Chinese National Standard GB 18030-2000: Information Technology -- Chinese ideograms coded character set for information interchange -- Extension for the basic set"
-.%D "March 2000"
-.Re
-.Rs
-.%Q "The Unicode Consortium"
-.%T "The Unicode Standard, Version 3.0"
-.%D "2000"
-.Re
-.Sh STANDARDS
-The
-.Nm GB18030
-encoding is believed to be compatible with GB 18030-2000.

lib/libc/locale/gb18030.c

@@ -1,166 +0,0 @@
-/*
- * Copyright (c) 2003
- *	The Regents of the University of California.  All rights reserved.
- *
- * This code is contributed to Robin Hu <huxw@knight.6test.edu.cn>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#include <rune.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <sys/types.h>
-
-rune_t	_GB18030_sgetrune(const char *, size_t, char const **);
-int	_GB18030_sputrune(rune_t, char *, size_t, char **);
-
-int
-_GB18030_init(rl)
-	_RuneLocale *rl;
-{
-	rl->sgetrune = _GB18030_sgetrune;
-	rl->sputrune = _GB18030_sputrune;
-	_CurrentRuneLocale = rl;
-	__mb_cur_max = 4;
-	return (0);
-}
-
-static inline int
-_gb18030_check_string(s_, n)
-     const char* s_;
-     int n;
-{  
-  const unsigned char* s = s_;
-  if ((s[0]>=0x81&&s[0]<=0xfe)) {
-    if (n<2) goto bad_string;
-    if ((s[1]>=0x40&&s[1]<=0x7e)||(s[1]>=0x80&&s[1]<=0xfe))
-      return 2;
-    if ((s[1]>=0x30&&s[1]<=0x39)) {
-      if (n<4) goto bad_string;
-      if ((s[2]>=0x81&&s[2]<=0xfe) && (s[3]>=0x30&&s[3]<=0x39))
-        return 4;
-      else
-        goto bad_string;
-    }
-  } else {
-    return 1;
-  }
- bad_string:
-  return -1;
-}
-
-static inline int
-_gb18030_check_rune(r)
-     rune_t r;
-{
-  if (r&0xff000000) {
-      return 4;
-  }
-  if (r&0xff00) {
-      return 2;
-  }
-  return 1;
-}
-
-rune_t
-_GB18030_sgetrune(string, n, result)
-	const char *string;
-	size_t n;
-	char const **result;
-{
-  rune_t rune = 0;
-  int len;
-
-  len = _gb18030_check_string(string, n);
-
-  if (len == -1) {
-    if (result)
-      *result = string;
-    return (_INVALID_RUNE);
-  }
-  
-  while (--len >= 0)
-    rune = (rune << 8) | ((u_int)(*string++) & 0xff);
-
-  rune &= 0x7fffffff;
-  if (result)
-    *result = string;
-  return rune;
-}
-
-int
-_GB18030_sputrune(c, string, n, result)
-	rune_t c;
-	char *string, **result;
-	size_t n;
-{
-  int len;
-  len = _gb18030_check_rune(c);
-
-  switch (len) {
-  case 1:
-    if (n >= 1) {  
-      *string = c & 0xff;
-      if (result)
-        *result = string + 1;
-      return (1);
-    }
-    break;
-  case 2:
-    if (n >= 2) {
-      string[0] = (c >> 8) & 0xff;
-      string[1] = c & 0xff;
-      if (result)
-        *result = string + 2;
-      return (2);
-    }
-    break;
-  case 4:
-    if (n >= 4) {
-      string[0] = ((c >>24) & 0xff) | 0x80;
-      string[1] = (c >>16) & 0xff;
-      string[2] = (c >>8)  & 0xff;
-      string[3] = c & 0xff;
-      if (result)
-        *result = string + 4;
-      return (4);
-    }
-    break;
-  default:
-    break;
-  }
-  if (result)
-    *result = string;
-  return (0);
-}

lib/libc/locale/gbk.5

@@ -1,62 +0,0 @@
-.\" Copyright (c) 2003 Tim J. Robbins
-.\" All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-.\" SUCH DAMAGE.
-.\"
-.\" $FreeBSD$
-.Dd August 10, 2003
-.Dt GBK 5
-.Os
-.Sh NAME
-.Nm gbk
-.Nd "Guojia biaozhun kuozhan (GBK) encoding method for Chinese text"
-.Sh SYNOPSIS
-.Nm ENCODING
-.Qq GBK
-.Sh DESCRIPTION
-GBK is a backwards-compatible extension of the GB\ 2312-1980 encoding
-method for Chinese text, which adds the characters defined in the
-Unified Han portion of the Unicode 2.1 standard.
-.Pp
-Multibyte characters in the GBK
-encoding can be one byte or two bytes long.
-.No GB\ 11383-1981 ( Ns
-.Tn ASCII )
-characters are represented by single bytes in the range 0x00 to 0x7F.
-Chinese characters are represented by two bytes, beginning with a byte in
-the range 0x80-0xFE and ending with a byte in the range 0x40-0xFE.
-.Sh SEE ALSO
-.Xr euc 4 ,
-.Xr gb18030 5 ,
-.Xr utf8 5
-.Rs
-.%Q "The Unicode Consortium"
-.%T "The Unicode Standard, Version 2.1"
-.%D "1999"
-.Re
-.Rs
-.%T "Chinese National Standard GB 18030-2000: Information Technology -- Chinese ideograms coded character set for information interchange -- Extension for the basic set"
-.%D "March 2000"
-.Re
-.Sh STANDARDS
-GBK is not a standard, but has been superceded by
-GB\ 18030-2000.

lib/libc/locale/gbk.c

@@ -1,116 +0,0 @@
-/*-
- * Copyright (c) 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * This code is derived from software contributed to Berkeley by
- * Paul Borman at Krystal Technologies.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#include <rune.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <sys/types.h>
-
-rune_t  _GBK_sgetrune(const char *, size_t, char const **);
-int     _GBK_sputrune(rune_t, char *, size_t, char **);
-
-int
-_GBK_init(rl)
-	_RuneLocale *rl;
-{
-	rl->sgetrune = _GBK_sgetrune;
-	rl->sputrune = _GBK_sputrune;
-	_CurrentRuneLocale = rl;
-	__mb_cur_max = 2;
-	return (0);
-}
-
-static inline int
-_gbk_check(c)
-	u_int c;
-{
-	c &= 0xff;
-	return ((c >= 0x80 && c <= 0xfe) ? 2 : 1);
-}
-
-rune_t
-_GBK_sgetrune(string, n, result)
-	const char *string;
-	size_t n;
-	char const **result;
-{
-	rune_t rune = 0;
-	int len;
-
-	if (n < 1 || (len = _gbk_check(*string)) > n) {
-		if (result)
-			*result = string;
-		return (_INVALID_RUNE);
-	}
-	while (--len >= 0)
-		rune = (rune << 8) | ((u_int)(*string++) & 0xff);
-	if (result)
-		*result = string;
-	return rune;
-}
-
-int
-_GBK_sputrune(c, string, n, result)
-	rune_t c;
-	char *string, **result;
-	size_t n;
-{
-	if (c & 0x8000) {
-		if (n >= 2) {
-			string[0] = (c >> 8) & 0xff;
-			string[1] = c & 0xff;
-			if (result)
-				*result = string + 2;
-			return (2);
-		}
-	}
-	else {
-		if (n >= 1) {
-			*string = c & 0xff;
-			if (result)
-				*result = string + 1;
-			return (1);
-		}
-	}
-	if (result)
-		*result = string;
-	return (0);
-	
-}

libexec/rtld-elf/libmap.h

@@ -1,7 +0,0 @@
-/*
- * $FreeBSD$
- */
-
-int	lm_init (void);
-void	lm_fini (void);
-char *	lm_find (const char *, const char *);

release/Makefile

@@ -25,7 +25,7 @@
 #
 # Automatic SNAP versioning:
 DATE != date +%Y%m%d
-BASE = 4.8
+BASE = 4.9
 BUILDNAME?=${BASE}-${DATE}-STABLE
 #
 #CHROOTDIR=/junk/release

release/doc/en_US.ISO8859-1/share/sgml/release.dsl

@@ -35,16 +35,6 @@
 		  (list (list "HREF" "mailto:[email protected]"))
                   (literal "[email protected]"))
                 (literal ">.")
-            (make element gi: "p"
-                  attributes: (list (list "align" "center"))
-              (make element gi: "small"  
-                (literal "All users of FreeBSD ")
-		(literal (entity-text "release.branch"))
-		(literal " should subscribe to the ")
-                (literal "<")
-		(create-link (list (list "HREF" "mailto:[email protected]"))
-                  (literal "[email protected]"))
-                (literal "> mailing list.")))
 
             (make element gi: "p"
                   attributes: (list (list "align" "center"))

release/doc/ja_JP.eucJP/hardware/Makefile

@@ -1,14 +0,0 @@
-# $FreeBSD$
-# Original revision: 1.6
-
-RELN_ROOT?= ${.CURDIR}/../..
-
-SUBDIR = alpha
-SUBDIR+= amd64
-SUBDIR+= ia64
-SUBDIR+= i386
-SUBDIR+= sparc64
-SUBDIR+= pc98
-
-.include "${RELN_ROOT}/share/mk/doc.relnotes.mk"
-.include "${DOC_PREFIX}/share/mk/doc.project.mk"

release/doc/ja_JP.eucJP/hardware/common/hw.ent

@@ -1,19 +0,0 @@
-<!-- -*- sgml -*- -->
-<!--
-    $FreeBSD$
-    Original revision: 1.5
--->
-
-<!-- Text constants which probably don't need to be changed.-->
-
-<!-- Files to be included -->
-
-<!ENTITY artheader SYSTEM "../common/artheader.sgml">
-<!ENTITY sect.intro SYSTEM "../common/intro.sgml">
-<!ENTITY sect.proc.alpha SYSTEM "../alpha/proc-alpha.sgml">
-<!ENTITY sect.proc.amd64 SYSTEM "../amd64/proc-amd64.sgml">
-<!ENTITY sect.proc.i386 SYSTEM "../i386/proc-i386.sgml">
-<!ENTITY sect.proc.ia64 SYSTEM "../ia64/proc-ia64.sgml">
-<!ENTITY sect.proc.sparc64 SYSTEM "../sparc64/proc-sparc64.sgml">
-<!ENTITY sect.proc.pc98 SYSTEM "../pc98/proc-pc98.sgml">
-<!ENTITY sect.dev SYSTEM "../common/dev.sgml">

release/doc/share/examples/Makefile.relnotesng

@@ -12,7 +12,7 @@ UNITEXTS=	readme errata
 
 IMAGEDIR=	.imagedir
 RHOST=		freefall.freebsd.org
-RDIR=		public_html/relnotes/4-STABLE
+RDIR=		public_html/relnotes/4.9-RELEASE
 DOCDIR=		./release/doc
 LANG=		en_US.ISO8859-1
 

release/doc/share/sgml/release.ent

@@ -6,7 +6,7 @@
 
 <!-- Version of the OS we're describing.  This needs to be updated
      with each new release. -->
-<!ENTITY release.current "4.9-RC">
+<!ENTITY release.current "4.9-RELEASE">
 
 <!-- The previous version used for comparison in the "What's New"
      section.  For -CURRENT, we might point back to the last
@@ -14,26 +14,26 @@
 <!ENTITY release.prev "4.8-RELEASE">
 
 <!-- The next version to be released, usually used for snapshots. -->
-<!ENTITY release.next "4.9-RELEASE">
+<!ENTITY release.next "4.9.1-RELEASE">
 
 <!-- The name of this branch. -->
 <!ENTITY release.branch "4-STABLE">
 
 <!-- The URL for obtaining this version of FreeBSD. -->
-<!ENTITY release.url "http://snapshots.jp.FreeBSD.org/">
+<!ENTITY release.url "ftp://ftp.FreeBSD.org/">
 
 <!-- The type of release (usually this will be either "snapshot"
      or "release" -->
-<!ENTITY release.type "snapshot">
-<!ENTITY % release.type.snapshot "INCLUDE">
-<!ENTITY % release.type.release "IGNORE">
+<!ENTITY release.type "release">
+<!ENTITY % release.type.snapshot "IGNORE">
+<!ENTITY % release.type.release "INCLUDE">
 
 <!-- The manpaths for man page references -->
 <!ENTITY release.man.url "http://www.FreeBSD.org/cgi/man.cgi">
 <!ENTITY release.manpath.xfree86       "4.3.0">
 <!ENTITY release.manpath.netbsd        "1.6.1">
 <!ENTITY release.manpath.freebsd-ports "Ports">
-<!ENTITY release.manpath.freebsd       "4.8-stable">
+<!ENTITY release.manpath.freebsd       "4.9-RELEASE">
 
 <!-- Text constants which probably don't need to be changed.-->
 

release/sysinstall/install.c

@@ -1139,6 +1139,8 @@ installVarDefaults(dialogMenuItem *self)
     variable_set2(VAR_BROWSER_BINARY,		"/usr/local/bin/links", 0);
     variable_set2(VAR_FTP_STATE,		"passive", 0);
     variable_set2(VAR_NFS_SECURE,		"NO", -1);
+    variable_set2(VAR_NFS_TCP,   		"NO", -1);
+    variable_set2(VAR_NFS_V3,   		"YES", -1);
     if (OnVTY)
 	    variable_set2(VAR_FIXIT_TTY,		"standard", 0);
     else

release/sysinstall/nfs.c

@@ -60,9 +60,13 @@ mediaInitNFS(Device *dev)
 	return FALSE;
 
     msgNotify("Mounting %s over NFS on %s", dev->name, mountpoint);
-    if (vsystem("mount_nfs %s %s %s %s",
-		variable_get(VAR_SLOW_ETHER) ? "-r 1024 -w 1024" : "",
-		variable_get(VAR_NFS_SECURE) ? "-P" : "", dev->name, mountpoint)) {
+    if (vsystem("mount_nfs %s %s %s %s %s %s",
+		!variable_cmp(VAR_NFS_TCP, "YES") ? "-T" : "",
+		!variable_cmp(VAR_NFS_V3, "YES") ? "-3" : "",
+		!variable_cmp(VAR_SLOW_ETHER, "YES") ?
+			"-r 1024 -w 1024" : "-r 4096 -w 4096",
+		!variable_cmp(VAR_NFS_SECURE, "YES") ? "-P" : "",
+		dev->name, mountpoint)) {
 	msgConfirm("Error mounting %s on %s: %s.", dev->name, mountpoint, strerror(errno));
 	if (netDevice)
 	    DEVICE_SHUTDOWN(netDevice);

release/sysinstall/options.c

@@ -112,6 +112,10 @@ static Option Options[] = {
       OPT_IS_VAR,	NULL,			VAR_NFS_SECURE,		varCheck	},
 { "NFS Slow",		"User is using a slow PC or ethernet card",
       OPT_IS_VAR,	NULL,			VAR_SLOW_ETHER,		varCheck	},
+{ "NFS TCP",		"Use TCP protocol for NFS",
+      OPT_IS_VAR,	NULL,			VAR_NFS_TCP,		varCheck	},
+{ "NFS version 3",	"Use NFS version 3",
+      OPT_IS_VAR,	NULL,			VAR_NFS_V3,		varCheck	},
 { "Debugging",		"Emit extra debugging output on VTY2 (ALT-F2)",
       OPT_IS_VAR,	NULL,			VAR_DEBUG,		varCheck	},
 { "No Warnings",	"Don't Warn the user when a setting seems incorrect",

release/sysinstall/sysinstall.h

@@ -147,6 +147,8 @@
 #define VAR_NEWFS_ARGS			"newfsArgs"
 #define VAR_NFS_PATH			"nfs"
 #define VAR_NFS_HOST			"nfsHost"
+#define VAR_NFS_V3			"nfs_use_v3"
+#define VAR_NFS_TCP			"nfs_use_tcp"
 #define VAR_NFS_SECURE			"nfs_reserved_port_only"
 #define VAR_NFS_SERVER			"nfs_server_enable"
 #define VAR_NO_CONFIRM			"noConfirm"

share/examples/cvsup/standard-supfile

@@ -51,7 +51,7 @@
 *default host=CHANGE_THIS.FreeBSD.org
 *default base=/usr
 *default prefix=/usr
-*default release=cvs tag=RELENG_4
+*default release=cvs tag=RELENG_4_9
 *default delete use-rel-suffix
 
 # If your network link is a T1 or faster, comment out the following line.

share/man/man4/bfe.4

@@ -1,99 +0,0 @@
-.\"
-.\" Copyright (c) 2003 Stuart Walsh
-.\"
-.\" All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE DEVELOPERS BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.\" $FreeBSD$
-.\"
-.Dd September 4, 2003
-.Dt BFE 4
-.Os
-.Sh NAME
-.Nm bfe
-.Nd Broadcom BCM4401 Ethernet Device Driver
-.Sh SYNOPSIS
-.Cd "device miibus"
-.Cd "device bfe"
-.Sh DESCRIPTION
-The
-.Nm
-driver provides support for the Broadcom BCM4401 based Fast Ethernet adapters.
-.Pp
-The
-.Nm
-driver supports the following media types:
-.Pp
-.Bl -tag -width xxxxxxxxxxxxxxxxxxxx
-.It autoselect
-Enable autoselection of the media type and options
-.It 10baseT/UTP
-Set 10Mbps operation
-.It 100baseTX
-Set 100Mbps (fast ethernet) operation
-.El
-.Pp
-The
-.Nm
-driver supports the following media options:
-.Pp
-.Bl -tag -width xxxxxxxxxxxxxxxxxxxx
-.It full-duplex
-Set full duplex operation
-.El
-.Pp
-For further information on configuring this device, see
-.Xr ifconfig 8 .
-.Pp
-.Sh DIAGNOSTICS
-.Bl -diag
-.It "bfe%d: couldn't map memory"
-A fatal initialization error has occurred.
-.It "bfe%d: couldn't map interrupt"
-A fatal initialization error has occurred.
-.It "bfe%d: failed to allocate DMA resources"
-There are not enough mbuf's available for allocation.
-.It "bfe%d: watchdog timeout -- resetting"
-The device has stopped responding to the network, or there is a problem with
-the network connection (cable).
-.El
-.Sh SEE ALSO
-.Xr arp 4 ,
-.Xr miibus 4 ,
-.Xr netintro 4 ,
-.Xr ng_ether 4 ,
-.Xr ifconfig 8
-.Sh HISTORY
-The
-.Nm
-device driver first appeared in
-.Fx 5.1 .
-.Sh AUTHORS
-.An -nosplit
-The
-.Nm
-device driver was written by
-.An Stuart Walsh
-and
-.An Duncan Barclay .
-This manual page was written by
-.An Stuart Walsh .

share/man/man4/multicast.4

@@ -1,917 +0,0 @@
-.\" Copyright (c) 2001-2003 International Computer Science Institute
-.\"
-.\" Permission is hereby granted, free of charge, to any person obtaining a
-.\" copy of this software and associated documentation files (the "Software"),
-.\" to deal in the Software without restriction, including without limitation
-.\" the rights to use, copy, modify, merge, publish, distribute, sublicense,
-.\" and/or sell copies of the Software, and to permit persons to whom the
-.\" Software is furnished to do so, subject to the following conditions:
-.\"
-.\" The above copyright notice and this permission notice shall be included in
-.\" all copies or substantial portions of the Software.
-.\"
-.\" The names and trademarks of copyright holders may not be used in
-.\" advertising or publicity pertaining to the software without specific
-.\" prior permission. Title to copyright in this software and any associated
-.\" documentation will at all times remain with the copyright holders.
-.\"
-.\" THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-.\" IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-.\" FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-.\" AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-.\" LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-.\" FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-.\" DEALINGS IN THE SOFTWARE.
-.\"
-.\" $FreeBSD$
-.\"
-.Dd September 4, 2003
-.Dt MULTICAST 4
-.Os
-.\"
-.Sh NAME
-.Nm multicast
-.Nd Multicast Routing
-.\"
-.Sh SYNOPSIS
-.Cd "options MROUTING"
-.Pp
-.In sys/types.h
-.In sys/socket.h
-.In netinet/in.h
-.In netinet/ip_mroute.h
-.In netinet6/ip6_mroute.h
-.Ft int
-.Fn getsockopt "int s" IPPROTO_IP MRT_INIT "void *optval" "socklen_t *optlen"
-.Ft int
-.Fn setsockopt "int s" IPPROTO_IP MRT_INIT "const void *optval" "socklen_t optlen"
-.Ft int
-.Fn getsockopt "int s" IPPROTO_IPV6 MRT6_INIT "void *optval" "socklen_t *optlen"
-.Ft int
-.Fn setsockopt "int s" IPPROTO_IPV6 MRT6_INIT "const void *optval" "socklen_t optlen"
-.Sh DESCRIPTION
-.Tn "Multicast routing"
-is used to efficiently propagate data
-packets to a set of multicast listeners in multipoint networks.
-If unicast is used to replicate the data to all listeners,
-then some of the network links may carry multiple copies of the same
-data packets.
-With multicast routing, the overhead is reduced to one copy
-(at most) per network link.
-.Pp
-All multicast-capable routers must run a common multicast routing
-protocol.
-The Distance Vector Multicast Routing Protocol (DVMRP)
-was the first developed multicast routing protocol.
-Later, other protocols such as Multicast Extensions to OSPF (MOSPF),
-Core Based Trees (CBT),
-Protocol Independent Multicast - Sparse Mode (PIM-SM),
-and Protocol Independent Multicast - Dense Mode (PIM-DM)
-were developed as well.
-.Pp
-To start multicast routing,
-the user must enable multicast forwarding in the kernel
-(see
-.Sx SYNOPSIS
-about the kernel configuration options),
-and must run a multicast routing capable user-level process.
-From developer's point of view,
-the programming guide described in the
-.Sx "Programming Guide"
-section should be used to control the multicast forwarding in the kernel.
-.\"
-.Ss Programming Guide
-This section provides information about the basic multicast routing API.
-The so-called
-.Dq advanced multicast API
-is described in the
-.Sx "Advanced Multicast API Programming Guide"
-section.
-.Pp
-First, a multicast routing socket must be open.
-That socket would be used
-to control the multicast forwarding in the kernel.
-Note that most operations below require certain privilege
-(i.e., root privilege):
-.Pp
-.Bd -literal
-/* IPv4 */
-int mrouter_s4;
-mrouter_s4 = socket(AF_INET, SOCK_RAW, IPPROTO_IGMP);
-.Ed
-.Pp
-.Bd -literal
-int mrouter_s6;
-mrouter_s6 = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
-.Ed
-.Pp
-Note that if the router needs to open an IGMP or ICMPv6 socket
-(in case of IPv4 and IPv6 respectively)
-for sending or receiving of IGMP or MLD multicast group membership messages,
-then the same mrouter_s4 or mrouter_s6 sockets should be used
-for sending and receiving respectively IGMP or MLD messages.
-In case of BSD-derived kernel, it may be possible to open separate sockets
-for IGMP or MLD messages only.
-However, some other kernels (e.g., Linux) require that the multicast
-routing socket must be used for sending and receiving of IGMP or MLD
-messages.
-Therefore, for portability reason the multicast
-routing socket should be reused for IGMP and MLD messages as well.
-.Pp
-After the multicast routing socket is open, it can be used to enable
-or disable multicast forwarding in the kernel:
-.Bd -literal
-/* IPv4 */
-int v = 1;        /* 1 to enable, or 0 to disable */
-setsockopt(mrouter_s4, IPPROTO_IP, MRT_INIT, (void *)&v, sizeof(v));
-.Ed
-.Pp
-.Bd -literal
-/* IPv6 */
-int v = 1;        /* 1 to enable, or 0 to disable */
-setsockopt(mrouter_s6, IPPROTO_IPV6, MRT6_INIT, (void *)&v, sizeof(v));
-\&...
-/* If necessary, filter all ICMPv6 messages */
-struct icmp6_filter filter;
-ICMP6_FILTER_SETBLOCKALL(&filter);
-setsockopt(mrouter_s6, IPPROTO_ICMPV6, ICMP6_FILTER, (void *)&filter,
-           sizeof(filter));
-.Ed
-.Pp
-After multicast forwarding is enabled, the multicast routing socket
-can be used to enable PIM processing in the kernel if we are running PIM-SM or
-PIM-DM
-(see
-.Xr pim 4 ) .
-.Pp
-For each network interface (e.g., physical or a virtual tunnel)
-that would be used for multicast forwarding, a corresponding
-multicast interface must be added to the kernel:
-.Bd -literal
-/* IPv4 */
-struct vifctl vc;
-memset(&vc, 0, sizeof(vc));
-/* Assign all vifctl fields as appropriate */
-vc.vifc_vifi = vif_index;
-vc.vifc_flags = vif_flags;
-vc.vifc_threshold = min_ttl_threshold;
-vc.vifc_rate_limit = max_rate_limit;
-memcpy(&vc.vifc_lcl_addr, &vif_local_address, sizeof(vc.vifc_lcl_addr));
-if (vc.vifc_flags & VIFF_TUNNEL)
-    memcpy(&vc.vifc_rmt_addr, &vif_remote_address,
-           sizeof(vc.vifc_rmt_addr));
-setsockopt(mrouter_s4, IPPROTO_IP, MRT_ADD_VIF, (void *)&vc,
-           sizeof(vc));
-.Ed
-.Pp
-The
-.Dq vif_index
-must be unique per vif.
-The
-.Dq vif_flags
-contains the
-.Dq VIFF_*
-flags as defined in <netinet/ip_mroute.h>.
-The
-.Dq min_ttl_threshold
-contains the minimum TTL a multicast data packet must have to be
-forwarded on that vif.
-Typically, it would have value of 1.
-The
-.Dq max_rate_limit
-contains the maximum rate (in bits/s) of the multicast data packets forwarded
-on that vif.
-Value of 0 means no limit.
-The 
-.Dq vif_local_address
-contains the local IP address of the corresponding local interface.
-The
-.Dq vif_remote_address
-contains the remote IP address in case of DVMRP multicast tunnels.
-.Pp
-.Bd -literal
-/* IPv6 */
-struct mif6ctl mc;
-memset(&mc, 0, sizeof(mc));
-/* Assign all mif6ctl fields as appropriate */
-mc.mif6c_mifi = mif_index;
-mc.mif6c_flags = mif_flags;
-mc.mif6c_pifi = pif_index;
-setsockopt(mrouter_s6, IPPROTO_IPV6, MRT6_ADD_MIF, (void *)&mc,
-           sizeof(mc));
-.Ed
-.Pp
-The
-.Dq mif_index
-must be unique per vif.
-The
-.Dq mif_flags
-contains the
-.Dq MIFF_*
-flags as defined in <netinet6/ip6_mroute.h>.
-The
-.Dq pif_index
-is the physical interface index of the corresponding local interface.
-.Pp
-A multicast interface is deleted by:
-.Bd -literal
-/* IPv4 */
-vifi_t vifi = vif_index;
-setsockopt(mrouter_s4, IPPROTO_IP, MRT_DEL_VIF, (void *)&vifi,
-           sizeof(vifi));
-.Ed
-.Pp
-.Bd -literal
-/* IPv6 */
-mifi_t mifi = mif_index;
-setsockopt(mrouter_s6, IPPROTO_IPV6, MRT6_DEL_MIF, (void *)&mifi,
-           sizeof(mifi));
-.Ed
-.Pp
-After the multicast forwarding is enabled, and the multicast virtual
-interfaces are
-added, the kernel may deliver upcall messages (also called signals
-later in this text) on the multicast routing socket that was open
-earlier with
-.Dq MRT_INIT
-or
-.Dq MRT6_INIT .
-The IPv4 upcalls have
-.Dq struct igmpmsg
-header (see <netinet/ip_mroute.h>) with field
-.Dq im_mbz
-set to zero.
-Note that this header follows the structure of
-.Dq struct ip
-with the protocol field
-.Dq ip_p
-set to zero.
-The IPv6 upcalls have
-.Dq struct mrt6msg
-header (see <netinet6/ip6_mroute.h>) with field
-.Dq im6_mbz
-set to zero.
-Note that this header follows the structure of
-.Dq struct ip6_hdr
-with the next header field
-.Dq ip6_nxt
-set to zero.
-.Pp
-The upcall header contains field
-.Dq im_msgtype
-and
-.Dq im6_msgtype
-with the type of the upcall
-.Dq IGMPMSG_*
-and
-.Dq MRT6MSG_*
-for IPv4 and IPv6 respectively.
-The values of the rest of the upcall header fields
-and the body of the upcall message depend on the particular upcall type.
-.Pp
-If the upcall message type is
-.Dq IGMPMSG_NOCACHE
-or
-.Dq MRT6MSG_NOCACHE ,
-this is an indication that a multicast packet has reached the multicast
-router, but the router has no forwarding state for that packet.
-Typically, the upcall would be a signal for the multicast routing
-user-level process to install the appropriate Multicast Forwarding
-Cache (MFC) entry in the kernel.
-.Pp
-A MFC entry is added by:
-.Bd -literal
-/* IPv4 */
-struct mfcctl mc;
-memset(&mc, 0, sizeof(mc));
-memcpy(&mc.mfcc_origin, &source_addr, sizeof(mc.mfcc_origin));
-memcpy(&mc.mfcc_mcastgrp, &group_addr, sizeof(mc.mfcc_mcastgrp));
-mc.mfcc_parent = iif_index;
-for (i = 0; i < maxvifs; i++)
-    mc.mfcc_ttls[i] = oifs_ttl[i];
-setsockopt(mrouter_s4, IPPROTO_IP, MRT_ADD_MFC,
-           (void *)&mc, sizeof(mc));
-.Ed
-.Pp
-.Bd -literal
-/* IPv6 */
-struct mf6cctl mc;
-memset(&mc, 0, sizeof(mc));
-memcpy(&mc.mf6cc_origin, &source_addr, sizeof(mc.mf6cc_origin));
-memcpy(&mc.mf6cc_mcastgrp, &group_addr, sizeof(mf6cc_mcastgrp));
-mc.mf6cc_parent = iif_index;
-for (i = 0; i < maxvifs; i++)
-    if (oifs_ttl[i] > 0)
-        IF_SET(i, &mc.mf6cc_ifset);
-setsockopt(mrouter_s4, IPPROTO_IPV6, MRT6_ADD_MFC,
-           (void *)&mc, sizeof(mc));
-.Ed
-.Pp
-The
-.Dq source_addr
-and
-.Dq group_addr
-are the source and group address of the multicast packet (as set
-in the upcall message).
-The
-.Dq iif_index
-is the virtual interface index of the multicast interface the multicast
-packets for this specific source and group address should be received on.
-The
-.Dq oifs_ttl[]
-array contains the minimum TTL (per interface) a multicast packet
-should have to be forwarded on an outgoing interface.
-If the TTL value is zero, the corresponding interface is not included
-in the set of outgoing interfaces.
-Note that in case of IPv6 only the set of outgoing interfaces can
-be specified.
-.Pp
-A MFC entry is deleted by:
-.Bd -literal
-/* IPv4 */
-struct mfcctl mc;
-memset(&mc, 0, sizeof(mc));
-memcpy(&mc.mfcc_origin, &source_addr, sizeof(mc.mfcc_origin));
-memcpy(&mc.mfcc_mcastgrp, &group_addr, sizeof(mc.mfcc_mcastgrp));
-setsockopt(mrouter_s4, IPPROTO_IP, MRT_DEL_MFC,
-           (void *)&mc, sizeof(mc));
-.Ed
-.Pp
-.Bd -literal
-/* IPv6 */
-struct mf6cctl mc;
-memset(&mc, 0, sizeof(mc));
-memcpy(&mc.mf6cc_origin, &source_addr, sizeof(mc.mf6cc_origin));
-memcpy(&mc.mf6cc_mcastgrp, &group_addr, sizeof(mf6cc_mcastgrp));
-setsockopt(mrouter_s4, IPPROTO_IPV6, MRT6_DEL_MFC,
-           (void *)&mc, sizeof(mc));
-.Ed
-.Pp
-The following method can be used to get various statistics per
-installed MFC entry in the kernel (e.g., the number of forwarded
-packets per source and group address):
-.Bd -literal
-/* IPv4 */
-struct sioc_sg_req sgreq;
-memset(&sgreq, 0, sizeof(sgreq));
-memcpy(&sgreq.src, &source_addr, sizeof(sgreq.src));
-memcpy(&sgreq.grp, &group_addr, sizeof(sgreq.grp));
-ioctl(mrouter_s4, SIOCGETSGCNT, &sgreq);
-.Ed
-.Pp
-.Bd -literal
-/* IPv6 */
-struct sioc_sg_req6 sgreq;
-memset(&sgreq, 0, sizeof(sgreq));
-memcpy(&sgreq.src, &source_addr, sizeof(sgreq.src));
-memcpy(&sgreq.grp, &group_addr, sizeof(sgreq.grp));
-ioctl(mrouter_s6, SIOCGETSGCNT_IN6, &sgreq);
-.Ed
-.Pp
-The following method can be used to get various statistics per
-multicast virtual interface in the kernel (e.g., the number of forwarded
-packets per interface):
-.Bd -literal
-/* IPv4 */
-struct sioc_vif_req vreq;
-memset(&vreq, 0, sizeof(vreq));
-vreq.vifi = vif_index;
-ioctl(mrouter_s4, SIOCGETVIFCNT, &vreq);
-.Ed
-.Pp
-.Bd -literal
-/* IPv6 */
-struct sioc_mif_req6 mreq;
-memset(&mreq, 0, sizeof(mreq));
-mreq.mifi = vif_index;
-ioctl(mrouter_s6, SIOCGETMIFCNT_IN6, &mreq);
-.Ed
-.Pp
-.Ss Advanced Multicast API Programming Guide
-If we want to add new features in the kernel, it becomes difficult
-to preserve backward compatibility (binary and API),
-and at the same time to allow user-level processes to take advantage of
-the new features (if the kernel supports them).
-.Pp
-One of the mechanisms that allows us to preserve the backward 
-compatibility is a sort of negotiation
-between the user-level process and the kernel:
-.Bl -enum
-.It
-The user-level process tries to enable in the kernel the set of new
-features (and the corresponding API) it would like to use.
-.It
-The kernel returns the (sub)set of features it knows about
-and is willing to be enabled.
-.It
-The user-level process uses only that set of features
-the kernel has agreed on.
-.El
-.\"
-.Pp
-To support backward compatibility, if the user-level process doesn't
-ask for any new features, the kernel defaults to the basic
-multicast API (see the
-.Sx "Programming Guide"
-section).
-.\" XXX: edit as appropriate after the advanced multicast API is
-.\" supported under IPv6
-Currently, the advanced multicast API exists only for IPv4;
-in the future there will be IPv6 support as well.
-.Pp
-Below is a summary of the expandable API solution.
-Note that all new options and structures are defined
-in <netinet/ip_mroute.h> and <netinet6/ip6_mroute.h>,
-unless stated otherwise.
-.Pp
-The user-level process uses new get/setsockopt() options to
-perform the API features negotiation with the kernel.
-This negotiation must be performed right after the multicast routing
-socket is open.
-The set of desired/allowed features is stored in a bitset
-(currently, in uint32_t; i.e., maximum of 32 new features).
-The new get/setsockopt() options are
-.Dq MRT_API_SUPPORT
-and
-.Dq MRT_API_CONFIG .
-Example:
-.Bd -literal
-uint32_t v;
-getsockopt(sock, IPPROTO_IP, MRT_API_SUPPORT, (void *)&v, sizeof(v));
-.Ed
-.Pp
-would set in
-.Dq v
-the pre-defined bits that the kernel API supports.
-The eight least significant bits in uint32_t are same as the
-eight possible flags
-.Dq MRT_MFC_FLAGS_*
-that can be used in
-.Dq mfcc_flags
-as part of the new definition of
-.Dq struct mfcctl
-(see below about those flags), which leaves 24 flags for other new features.
-The value returned by getsockopt(MRT_API_SUPPORT) is read-only; in other
-words, setsockopt(MRT_API_SUPPORT) would fail.
-.Pp
-To modify the API, and to set some specific feature in the kernel, then:
-.Bd -literal
-uint32_t v = MRT_MFC_FLAGS_DISABLE_WRONGVIF;
-if (setsockopt(sock, IPPROTO_IP, MRT_API_CONFIG, (void *)&v, sizeof(v))
-    != 0) {
-    return (ERROR);
-}
-if (v & MRT_MFC_FLAGS_DISABLE_WRONGVIF)
-    return (OK);	/* Success */
-else
-    return (ERROR);
-.Ed
-.Pp
-In other words, when setsockopt(MRT_API_CONFIG) is called, the
-argument to it specifies the desired set of features to
-be enabled in the API and the kernel.
-The return value in
-.Dq v
-is the actual (sub)set of features that were enabled in the kernel.
-To obtain later the same set of features that were enabled, then:
-.Bd -literal
-getsockopt(sock, IPPROTO_IP, MRT_API_CONFIG, (void *)&v, sizeof(v));
-.Ed
-.Pp
-The set of enabled features is global.
-In other words, setsockopt(MRT_API_CONFIG)
-should be called right after setsockopt(MRT_INIT).
-.Pp
-Currently, the following set of new features is defined:
-.Bd -literal
-#define	MRT_MFC_FLAGS_DISABLE_WRONGVIF (1 << 0) /* disable WRONGVIF signals */
-#define	MRT_MFC_FLAGS_BORDER_VIF   (1 << 1)  /* border vif              */
-#define MRT_MFC_RP                 (1 << 8)  /* enable RP address	*/
-#define MRT_MFC_BW_UPCALL          (1 << 9)  /* enable bw upcalls	*/
-.Ed
-.\" .Pp
-.\" In the future there might be:
-.\" .Bd -literal
-.\" #define MRT_MFC_GROUP_SPECIFIC     (1 << 10) /* allow (*,G) MFC entries */
-.\" .Ed
-.\" .Pp
-.\" to allow (*,G) MFC entries (i.e., group-specific entries) in the kernel.
-.\" For now this is left-out until it is clear whether
-.\" (*,G) MFC support is the preferred solution instead of something more generic
-.\" solution for example.
-.\"
-.\" 2. The newly defined struct mfcctl2.
-.\"
-.Pp
-The advanced multicast API uses a newly defined
-.Dq struct mfcctl2
-instead of the traditional
-.Dq struct mfcctl .
-The original
-.Dq struct mfcctl
-is kept as is.
-The new
-.Dq struct mfcctl2
-is:
-.Bd -literal
-/*
- * The new argument structure for MRT_ADD_MFC and MRT_DEL_MFC overlays
- * and extends the old struct mfcctl.
- */
-struct mfcctl2 {
-        /* the mfcctl fields */
-        struct in_addr  mfcc_origin;       /* ip origin of mcasts       */
-        struct in_addr  mfcc_mcastgrp;     /* multicast group associated*/
-        vifi_t          mfcc_parent;       /* incoming vif              */
-        u_char          mfcc_ttls[MAXVIFS];/* forwarding ttls on vifs   */
-
-        /* extension fields */
-        uint8_t         mfcc_flags[MAXVIFS];/* the MRT_MFC_FLAGS_* flags*/
-        struct in_addr  mfcc_rp;            /* the RP address           */
-};
-.Ed
-.Pp
-The new fields are
-.Dq mfcc_flags[MAXVIFS]
-and
-.Dq mfcc_rp .
-Note that for compatibility reasons they are added at the end.
-.Pp
-The
-.Dq mfcc_flags[MAXVIFS]
-field is used to set various flags per
-interface per (S,G) entry.
-Currently, the defined flags are:
-.Bd -literal
-#define	MRT_MFC_FLAGS_DISABLE_WRONGVIF (1 << 0) /* disable WRONGVIF signals */
-#define	MRT_MFC_FLAGS_BORDER_VIF       (1 << 1) /* border vif          */
-.Ed
-.Pp
-The
-.Dq MRT_MFC_FLAGS_DISABLE_WRONGVIF
-flag is used to explicitly disable the
-.Dq IGMPMSG_WRONGVIF
-kernel signal at the (S,G) granularity if a multicast data packet
-arrives on the wrong interface.
-Usually, this signal is used to
-complete the shortest-path switch in case of PIM-SM multicast routing,
-or to trigger a PIM assert message.
-However, it should not be delivered for interfaces that are not in
-the outgoing interface set, and that are not expecting to
-become an incoming interface.
-Hence, if the
-.Dq MRT_MFC_FLAGS_DISABLE_WRONGVIF
-flag is set for some of the
-interfaces, then a data packet that arrives on that interface for
-that MFC entry will NOT trigger a WRONGVIF signal.
-If that flag is not set, then a signal is triggered (the default action).
-.Pp
-The
-.Dq MRT_MFC_FLAGS_BORDER_VIF
-flag is used to specify whether the Border-bit in PIM
-Register messages should be set (in case when the Register encapsulation
-is performed inside the kernel).
-If it is set for the special PIM Register kernel virtual interface
-(see
-.Xr pim 4 ) ,
-the Border-bit in the Register messages sent to the RP will be set.
-.Pp
-The remaining six bits are reserved for future usage.
-.Pp
-The
-.Dq mfcc_rp
-field is used to specify the RP address (in case of PIM-SM multicast routing)
-for a multicast
-group G if we want to perform kernel-level PIM Register encapsulation.
-The
-.Dq mfcc_rp
-field is used only if the
-.Dq MRT_MFC_RP
-advanced API flag/capability has been successfully set by
-setsockopt(MRT_API_CONFIG).
-.Pp
-.\"
-.\" 3. Kernel-level PIM Register encapsulation
-.\"
-If the
-.Dq MRT_MFC_RP
-flag was successfully set by
-setsockopt(MRT_API_CONFIG), then the kernel will attempt to perform
-the PIM Register encapsulation itself instead of sending the
-multicast data packets to user level (inside IGMPMSG_WHOLEPKT
-upcalls) for user-level encapsulation.
-The RP address would be taken from the
-.Dq mfcc_rp
-field
-inside the new
-.Dq struct mfcctl2 .
-However, even if the
-.Dq MRT_MFC_RP
-flag was successfully set, if the
-.Dq mfcc_rp
-field was set to
-.Dq INADDR_ANY ,
-then the
-kernel will still deliver an IGMPMSG_WHOLEPKT upcall with the
-multicast data packet to the user-level process.
-.Pp
-In addition, if the multicast data packet is too large to fit within
-a single IP packet after the PIM Register encapsulation (e.g., if
-its size was on the order of 65500 bytes), the data packet will be
-fragmented, and then each of the fragments will be encapsulated
-separately.
-Note that typically a multicast data packet can be that
-large only if it was originated locally from the same hosts that
-performs the encapsulation; otherwise the transmission of the
-multicast data packet over Ethernet for example would have
-fragmented it into much smaller pieces.
-.\"
-.\" Note that if this code is ported to IPv6, we may need the kernel to
-.\" perform MTU discovery to the RP, and keep those discoveries inside
-.\" the kernel so the encapsulating router may send back ICMP
-.\" Fragmentation Required if the size of the multicast data packet is
-.\" too large (see "Encapsulating data packets in the Register Tunnel"
-.\" in Section 4.4.1 in the PIM-SM spec
-.\" draft-ietf-pim-sm-v2-new-05.{txt,ps}).
-.\" For IPv4 we may be able to get away without it, but for IPv6 we need
-.\" that.
-.\"
-.\" 4. Mechanism for "multicast bandwidth monitoring and upcalls".
-.\"
-.Pp
-Typically, a multicast routing user-level process would need to know the
-forwarding bandwidth for some data flow.
-For example, the multicast routing process may want to timeout idle MFC
-entries, or in case of PIM-SM it can initiate (S,G) shortest-path switch if
-the bandwidth rate is above a threshold for example.
-.Pp
-The original solution for measuring the bandwidth of a dataflow was
-that a user-level process would periodically
-query the kernel about the number of forwarded packets/bytes per
-(S,G), and then based on those numbers it would estimate whether a source
-has been idle, or whether the source's transmission bandwidth is above a
-threshold.
-That solution is far from being scalable, hence the need for a new
-mechanism for bandwidth monitoring.
-.Pp
-Below is a description of the bandwidth monitoring mechanism.
-.Bl -bullet
-.It
-If the bandwidth of a data flow satisfies some pre-defined filter,
-the kernel delivers an upcall on the multicast routing socket
-to the multicast routing process that has installed that filter.
-.It
-The bandwidth-upcall filters are installed per (S,G). There can be
-more than one filter per (S,G).
-.It
-Instead of supporting all possible comparison operations
-(i.e., < <= == != > >= ), there is support only for the
-<= and >= operations,
-because this makes the kernel-level implementation simpler,
-and because practically we need only those two.
-Further, the missing operations can be simulated by secondary
-user-level filtering of those <= and >= filters.
-For example, to simulate !=, then we need to install filter
-.Dq bw <= 0xffffffff ,
-and after an
-upcall is received, we need to check whether
-.Dq measured_bw != expected_bw .
-.It
-The bandwidth-upcall mechanism is enabled by
-setsockopt(MRT_API_CONFIG) for the MRT_MFC_BW_UPCALL flag.
-.It
-The bandwidth-upcall filters are added/deleted by the new
-setsockopt(MRT_ADD_BW_UPCALL) and setsockopt(MRT_DEL_BW_UPCALL)
-respectively (with the appropriate
-.Dq struct bw_upcall
-argument of course).
-.El
-.Pp
-From application point of view, a developer needs to know about
-the following:
-.Bd -literal
-/*
- * Structure for installing or delivering an upcall if the
- * measured bandwidth is above or below a threshold.
- *
- * User programs (e.g. daemons) may have a need to know when the
- * bandwidth used by some data flow is above or below some threshold.
- * This interface allows the userland to specify the threshold (in
- * bytes and/or packets) and the measurement interval. Flows are
- * all packet with the same source and destination IP address.
- * At the moment the code is only used for multicast destinations
- * but there is nothing that prevents its use for unicast.
- *
- * The measurement interval cannot be shorter than some Tmin (currently, 3s).
- * The threshold is set in packets and/or bytes per_interval.
- *
- * Measurement works as follows:
- *
- * For >= measurements: 
- * The first packet marks the start of a measurement interval.
- * During an interval we count packets and bytes, and when we
- * pass the threshold we deliver an upcall and we are done.
- * The first packet after the end of the interval resets the
- * count and restarts the measurement.
- *
- * For <= measurement:
- * We start a timer to fire at the end of the interval, and
- * then for each incoming packet we count packets and bytes.
- * When the timer fires, we compare the value with the threshold,
- * schedule an upcall if we are below, and restart the measurement
- * (reschedule timer and zero counters).
- */
-
-struct bw_data {
-        struct timeval  b_time;
-        uint64_t        b_packets;
-        uint64_t        b_bytes;
-};
-
-struct bw_upcall {
-        struct in_addr  bu_src;         /* source address            */
-        struct in_addr  bu_dst;         /* destination address       */
-        uint32_t        bu_flags;       /* misc flags (see below)    */
-#define BW_UPCALL_UNIT_PACKETS (1 << 0) /* threshold (in packets)    */
-#define BW_UPCALL_UNIT_BYTES   (1 << 1) /* threshold (in bytes)      */
-#define BW_UPCALL_GEQ          (1 << 2) /* upcall if bw >= threshold */
-#define BW_UPCALL_LEQ          (1 << 3) /* upcall if bw <= threshold */
-#define BW_UPCALL_DELETE_ALL   (1 << 4) /* delete all upcalls for s,d*/
-        struct bw_data  bu_threshold;   /* the bw threshold          */
-        struct bw_data  bu_measured;    /* the measured bw           */
-};
-
-/* max. number of upcalls to deliver together */
-#define BW_UPCALLS_MAX				128
-/* min. threshold time interval for bandwidth measurement */
-#define BW_UPCALL_THRESHOLD_INTERVAL_MIN_SEC	3
-#define BW_UPCALL_THRESHOLD_INTERVAL_MIN_USEC	0
-.Ed
-.Pp
-The
-.Dq bw_upcall
-structure is used as an argument to
-setsockopt(MRT_ADD_BW_UPCALL) and setsockopt(MRT_DEL_BW_UPCALL).
-Each setsockopt(MRT_ADD_BW_UPCALL) installs a filter in the kernel
-for the source and destination address in the
-.Dq bw_upcall
-argument,
-and that filter will trigger an upcall according to the following
-pseudo-algorithm:
-.Bd -literal
- if (bw_upcall_oper IS ">=") {
-    if (((bw_upcall_unit & PACKETS == PACKETS) &&
-         (measured_packets >= threshold_packets)) ||
-        ((bw_upcall_unit & BYTES == BYTES) &&
-         (measured_bytes >= threshold_bytes)))
-       SEND_UPCALL("measured bandwidth is >= threshold");
-  }
-  if (bw_upcall_oper IS "<=" && measured_interval >= threshold_interval) {
-    if (((bw_upcall_unit & PACKETS == PACKETS) &&
-         (measured_packets <= threshold_packets)) ||
-        ((bw_upcall_unit & BYTES == BYTES) &&
-         (measured_bytes <= threshold_bytes)))
-       SEND_UPCALL("measured bandwidth is <= threshold");
-  }
-.Ed
-.Pp
-In the same
-.Dq bw_upcall
-the unit can be specified in both BYTES and PACKETS.
-However, the GEQ and LEQ flags are mutually exclusive.
-.Pp
-Basically, an upcall is delivered if the measured bandwidth is >= or
-<= the threshold bandwidth (within the specified measurement
-interval).
-For practical reasons, the smallest value for the measurement
-interval is 3 seconds.
-If smaller values are allowed, then the bandwidth
-estimation may be less accurate, or the potentially very high frequency
-of the generated upcalls may introduce too much overhead.
-For the >= operation, the answer may be known before the end of
-.Dq threshold_interval ,
-therefore the upcall may be delivered earlier.
-For the <= operation however, we must wait
-until the threshold interval has expired to know the answer.
-.Pp
-Example of usage:
-.Bd -literal
-struct bw_upcall bw_upcall;
-/* Assign all bw_upcall fields as appropriate */
-memset(&bw_upcall, 0, sizeof(bw_upcall));
-memcpy(&bw_upcall.bu_src, &source, sizeof(bw_upcall.bu_src));
-memcpy(&bw_upcall.bu_dst, &group, sizeof(bw_upcall.bu_dst));
-bw_upcall.bu_threshold.b_data = threshold_interval;
-bw_upcall.bu_threshold.b_packets = threshold_packets;
-bw_upcall.bu_threshold.b_bytes = threshold_bytes;
-if (is_threshold_in_packets)
-    bw_upcall.bu_flags |= BW_UPCALL_UNIT_PACKETS;
-if (is_threshold_in_bytes)
-    bw_upcall.bu_flags |= BW_UPCALL_UNIT_BYTES;
-do {
-    if (is_geq_upcall) {
-        bw_upcall.bu_flags |= BW_UPCALL_GEQ;
-        break;
-    }
-    if (is_leq_upcall) {
-        bw_upcall.bu_flags |= BW_UPCALL_LEQ;
-        break;
-    }
-    return (ERROR);
-} while (0);
-setsockopt(mrouter_s4, IPPROTO_IP, MRT_ADD_BW_UPCALL,
-          (void *)&bw_upcall, sizeof(bw_upcall));
-.Ed
-.Pp
-To delete a single filter, then use MRT_DEL_BW_UPCALL,
-and the fields of bw_upcall must be set
-exactly same as when MRT_ADD_BW_UPCALL was called.
-.Pp
-To delete all bandwidth filters for a given (S,G), then
-only the
-.Dq bu_src
-and
-.Dq bu_dst
-fields in
-.Dq struct bw_upcall
-need to be set, and then just set only the
-.Dq BW_UPCALL_DELETE_ALL
-flag inside field
-.Dq bw_upcall.bu_flags .
-.Pp
-The bandwidth upcalls are received by aggregating them in the new upcall
-message:
-.Bd -literal
-#define IGMPMSG_BW_UPCALL  4  /* BW monitoring upcall */
-.Ed
-.Pp
-This message is an array of
-.Dq struct bw_upcall
-elements (up to BW_UPCALLS_MAX = 128).
-The upcalls are
-delivered when there are 128 pending upcalls, or when 1 second has
-expired since the previous upcall (whichever comes first).
-In an
-.Dq struct upcall
-element, the
-.Dq bu_measured
-field is filled-in to
-indicate the particular measured values.
-However, because of the way
-the particular intervals are measured, the user should be careful how
-bu_measured.b_time is used.
-For example, if the 
-filter is installed to trigger an upcall if the number of packets
-is >= 1, then
-.Dq bu_measured
-may have a value of zero in the upcalls after the
-first one, because the measured interval for >= filters is
-.Dq clocked
-by the forwarded packets.
-Hence, this upcall mechanism should not be used for measuring
-the exact value of the bandwidth of the forwarded data.
-To measure the exact bandwidth, the user would need to
-get the forwarded packets statistics with the ioctl(SIOCGETSGCNT)
-mechanism
-(see the
-.Sx Programming Guide
-section) .
-.Pp
-Note that the upcalls for a filter are delivered until the specific
-filter is deleted, but no more frequently than once per
-.Dq bu_threshold.b_time .
-For example, if the filter is specified to
-deliver a signal if bw >= 1 packet, the first packet will trigger a
-signal, but the next upcall will be triggered no earlier than
-.Dq bu_threshold.b_time
-after the previous upcall.
-.Pp
-.\"
-.Sh SEE ALSO
-.Xr getsockopt 2 ,
-.Xr recvfrom 2 ,
-.Xr recvmsg 2 ,
-.Xr setsockopt 2 ,
-.Xr socket 2 ,
-.Xr icmp6 4 ,
-.Xr inet 4 ,
-.Xr inet6 4 ,
-.Xr intro 4 ,
-.Xr ip 4 ,
-.Xr ip6 4 ,
-.Xr pim 4
-.\"
-.Pp
-.Sh AUTHORS
-The original multicast code was written by David Waitzman (BBN Labs),
-and later modified by the following individuals:
-Steve Deering (Stanford), Mark J. Steiglitz (Stanford),
-Van Jacobson (LBL), Ajit Thyagarajan (PARC),
-Bill Fenner (PARC).
-The IPv6 multicast support was implemented by the KAME project
-(http://www.kame.net), and was based on the IPv4 multicast code.
-The advanced multicast API and the multicast bandwidth
-monitoring were implemented by Pavlin Radoslavov (ICSI)
-in collaboration with Chris Brown (NextHop).
-.Pp
-This manual page was written by Pavlin Radoslavov (ICSI).

share/man/man4/pim.4

@@ -1,192 +0,0 @@
-.\" Copyright (c) 2001-2003 International Computer Science Institute
-.\"
-.\" Permission is hereby granted, free of charge, to any person obtaining a
-.\" copy of this software and associated documentation files (the "Software"),
-.\" to deal in the Software without restriction, including without limitation
-.\" the rights to use, copy, modify, merge, publish, distribute, sublicense,
-.\" and/or sell copies of the Software, and to permit persons to whom the
-.\" Software is furnished to do so, subject to the following conditions:
-.\"
-.\" The above copyright notice and this permission notice shall be included in
-.\" all copies or substantial portions of the Software.
-.\"
-.\" The names and trademarks of copyright holders may not be used in
-.\" advertising or publicity pertaining to the software without specific
-.\" prior permission. Title to copyright in this software and any associated
-.\" documentation will at all times remain with the copyright holders.
-.\"
-.\" THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-.\" IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-.\" FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-.\" AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-.\" LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-.\" FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-.\" DEALINGS IN THE SOFTWARE.
-.\"
-.\" $FreeBSD$
-.\"
-.Dd September 4, 2003
-.Dt PIM 4
-.Os
-.\"
-.Sh NAME
-.Nm pim
-.Nd Protocol Independent Multicast
-.\"
-.Sh SYNOPSIS
-.Cd "options MROUTING"
-.Cd "options PIM"
-.Pp
-.In sys/types.h
-.In sys/socket.h
-.In netinet/in.h
-.In netinet/ip_mroute.h
-.In netinet/pim.h
-.Ft int
-.Fn getsockopt "int s" IPPROTO_IP MRT_PIM "void *optval" "socklen_t *optlen"
-.Ft int
-.Fn setsockopt "int s" IPPROTO_IP MRT_PIM "const void *optval" "socklen_t optlen"
-.Ft int
-.Fn getsockopt "int s" IPPROTO_IPV6 MRT6_PIM "void *optval" "socklen_t *optlen"
-.Ft int
-.Fn setsockopt "int s" IPPROTO_IPV6 MRT6_PIM "const void *optval" "socklen_t optlen"
-.Sh DESCRIPTION
-.Tn PIM
-is the common name for two multicast routing protocols:
-Protocol Independent Multicast - Sparse Mode (PIM-SM) and
-Protocol Independent Multicast - Dense Mode (PIM-DM).
-.Pp
-PIM-SM is a multicast routing protocol that can use the underlying
-unicast routing information base or a separate multicast-capable
-routing information base.
-It builds unidirectional shared trees rooted at a Rendezvous
-Point (RP) per group,
-and optionally creates shortest-path trees per source.
-.Pp
-PIM-DM is a multicast routing protocol that uses the underlying
-unicast routing information base to flood multicast datagrams
-to all multicast routers.
-Prune messages are used to prevent future datagrams from propagating
-to routers with no group membership information.
-.Pp
-Both PIM-SM and PIM-DM are fairly complex protocols,
-though PIM-SM is much more complex.
-To enable PIM-SM or PIM-DM multicast routing in a router,
-the user must enable multicast routing and PIM processing in the kernel
-(see
-.Sx SYNOPSIS
-about the kernel configuration options),
-and must run a PIM-SM or PIM-DM capable user-level process.
-From developer's point of view,
-the programming guide described in the
-.Sx "Programming Guide"
-section should be used to control the PIM processing in the kernel.
-.\"
-.Ss Programming Guide
-After a multicast routing socket is open and multicast forwarding
-is enabled in the kernel
-(see
-.Xr multicast 4 ) ,
-one of the following socket options should be used to enable or disable
-PIM processing in the kernel.
-Note that those options require certain privilege
-(i.e., root privilege):
-.Pp
-.Bd -literal
-/* IPv4 */
-int v = 1;        /* 1 to enable, or 0 to disable */
-setsockopt(mrouter_s4, IPPROTO_IP, MRT_PIM, (void *)&v, sizeof(v));
-.Ed
-.Pp
-.Bd -literal
-/* IPv6 */
-int v = 1;        /* 1 to enable, or 0 to disable */
-setsockopt(mrouter_s6, IPPROTO_IPV6, MRT6_PIM, (void *)&v, sizeof(v));
-.Ed
-.Pp
-After PIM processing is enabled, the multicast-capable interfaces
-should be added
-(see
-.Xr multicast 4 ) .
-In case of PIM-SM, the PIM-Register virtual interface must be added
-as well.
-This can be accomplished by using the following options:
-.Bd -literal
-/* IPv4 */
-struct vifctl vc;
-memset(&vc, 0, sizeof(vc));
-/* Assign all vifctl fields as appropriate */
-\&...
-if (is_pim_register_vif)
-    vc.vifc_flags |= VIFF_REGISTER;
-setsockopt(mrouter_s4, IPPROTO_IP, MRT_ADD_VIF, (void *)&vc,
-           sizeof(vc));
-.Ed
-.Bd -literal
-/* IPv6 */
-struct mif6ctl mc;
-memset(&mc, 0, sizeof(mc));
-/* Assign all mif6ctl fields as appropriate */
-\&...
-if (is_pim_register_vif)
-    mc.mif6c_flags |= MIFF_REGISTER;
-setsockopt(mrouter_s6, IPPROTO_IPV6, MRT6_ADD_MIF, (void *)&mc,
-           sizeof(mc));
-.Ed
-.Pp
-Sending or receiving of PIM packets can be accomplished by
-opening first a
-.Dq raw socket
-(see
-.Xr socket 2 ) ,
-with protocol value of
-.Dq IPPROTO_PIM :
-.Bd -literal
-/* IPv4 */
-int pim_s4;
-pim_s4 = socket(AF_INET, SOCK_RAW, IPPROTO_PIM);
-.Ed
-.Bd -literal
-/* IPv6 */
-int pim_s6;
-pim_s6 = socket(AF_INET6, SOCK_RAW, IPPROTO_PIM);
-.Ed
-.Pp
-Then, the following system calls can be used to send or receive PIM
-packets:
-.Xr sendto 2 ,
-.Xr sendmsg 2 ,
-.Xr recvfrom 2 ,
-.Xr recvmsg 2 .
-.\"
-.Sh SEE ALSO
-.Xr getsockopt 2 ,
-.Xr recvfrom 2 ,
-.Xr recvmsg 2 ,
-.Xr sendmsg 2 ,
-.Xr sendto 2 ,
-.Xr setsockopt 2 ,
-.Xr socket 2 ,
-.Xr inet 4 ,
-.Xr intro 4 ,
-.Xr ip 4 ,
-.Xr multicast 4
-.\"
-.Sh STANDARDS
-.\" XXX the PIM-SM number must be updated after RFC 2362 is
-.\" replaced by a new RFC by the end of year 2003 or so.
-The PIM-SM protocol is specified in RFC 2362 (to be replaced by
-.Xr draft-ietf-pim-sm-v2-new-* ) .
-The PIM-DM protocol is specified in
-.Xr draft-ietf-pim-dm-new-v2-* ) .
-.\"
-.Sh AUTHORS
-The original IPv4 PIM kernel support for IRIX and SunOS-4.x was
-implemented by Ahmed Helmy (USC and SGI).
-Later the code was ported to various BSD flavors and modified by
-George Edmond Eddy (Rusty) (ISI),
-Hitoshi Asaeda (WIDE Project), and Pavlin Radoslavov (USC/ISI and ICSI).
-The IPv6 PIM kernel support was implemented by the KAME project
-(http://www.kame.net), and was based on the IPv4 PIM kernel support.
-.Pp
-This manual page was written by Pavlin Radoslavov (ICSI).

share/mklocale/zh_CN.GBK.src

@@ -1,199 +0,0 @@
-/*
- * GBK      first byte:   81-FE
- *          second byte:  40-7E, 80-FE
- *
- * $FreeBSD$
- */
-
-ENCODING	"GBK"
-/* VARIABLE     GBK character set */
-
-/*
- * ASCII
- */
-ALPHA		'A' - 'Z' 'a' - 'z'
-CONTROL		0x00 - 0x1f 0x7f
-DIGIT		'0' - '9'
-GRAPH		0x21 - 0x7e
-LOWER		'a' - 'z'
-PUNCT		0x21 - 0x2f 0x3a - 0x40 0x5b - 0x60 0x7b - 0x7e
-SPACE		0x09 - 0x0d 0x20
-UPPER		'A' - 'Z'
-XDIGIT		'0' - '9' 'a' - 'f' 'A' - 'F'
-BLANK		' ' '\t'
-PRINT		0x20 - 0x7e
-
-MAPLOWER	< 'A' - 'Z' : 'a' > < 'a' - 'z' : 'a' >
-MAPUPPER	< 'A' - 'Z' : 'A' > < 'a' - 'z' : 'A' >
-TODIGIT		< '0' - '9' : 0 >
-TODIGIT		< 'A' - 'F' : 10 > < 'a' - 'f' : 10 >
-
-/*
- * the real thing
- */
-IDEOGRAM	0x8140 - 0x817e 0x8180 - 0x81fe
-IDEOGRAM	0x8240 - 0x827e 0x8280 - 0x82fe
-IDEOGRAM	0x8340 - 0x837e 0x8380 - 0x83fe
-IDEOGRAM	0x8440 - 0x847e 0x8480 - 0x84fe
-IDEOGRAM	0x8540 - 0x857e 0x8580 - 0x85fe
-IDEOGRAM	0x8640 - 0x867e 0x8680 - 0x86fe
-IDEOGRAM	0x8740 - 0x877e 0x8780 - 0x87fe
-IDEOGRAM	0x8840 - 0x887e 0x8880 - 0x88fe
-IDEOGRAM	0x8940 - 0x897e 0x8980 - 0x89fe
-IDEOGRAM	0x8a40 - 0x8a7e 0x8a80 - 0x8afe
-IDEOGRAM	0x8b40 - 0x8b7e 0x8b80 - 0x8bfe
-IDEOGRAM	0x8c40 - 0x8c7e 0x8c80 - 0x8cfe
-IDEOGRAM	0x8d40 - 0x8d7e 0x8d80 - 0x8dfe
-IDEOGRAM	0x8e40 - 0x8e7e 0x8e80 - 0x8efe
-IDEOGRAM	0x8f40 - 0x8f7e 0x8f80 - 0x8ffe
-IDEOGRAM	0x9040 - 0x907e 0x9080 - 0x90fe
-IDEOGRAM	0x9140 - 0x917e 0x9180 - 0x91fe
-IDEOGRAM	0x9240 - 0x927e 0x9280 - 0x92fe
-IDEOGRAM	0x9340 - 0x937e 0x9380 - 0x93fe
-IDEOGRAM	0x9440 - 0x947e 0x9480 - 0x94fe
-IDEOGRAM	0x9540 - 0x957e 0x9580 - 0x95fe
-IDEOGRAM	0x9640 - 0x967e 0x9680 - 0x96fe
-IDEOGRAM	0x9740 - 0x977e 0x9780 - 0x97fe
-IDEOGRAM	0x9840 - 0x987e 0x9880 - 0x98fe
-IDEOGRAM	0x9940 - 0x997e 0x9980 - 0x99fe
-IDEOGRAM	0x9a40 - 0x9a7e 0x9a80 - 0x9afe
-IDEOGRAM	0x9b40 - 0x9b7e 0x9b80 - 0x9bfe
-IDEOGRAM	0x9c40 - 0x9c7e 0x9c80 - 0x9cfe
-IDEOGRAM	0x9d40 - 0x9d7e 0x9d80 - 0x9dfe
-IDEOGRAM	0x9e40 - 0x9e7e 0x9e80 - 0x9efe
-IDEOGRAM	0x9f40 - 0x9f7e 0x9f80 - 0x9ffe
-IDEOGRAM	0xa040 - 0xa07e 0xa080 - 0xa0fe
-
-SPACE		0xa1a1
-BLANK		0xa1a1
-PUNCT		0xa1a2 - 0xa1fe
-
-/* full width 0 1 2 .. 9 */
-/* ?DIGIT           0xa2a1 - 0xa2aa 0xa2b1 - 0xa2e2 0xa2e5 - 0xa2ee 0xa2f1 - 0xa2fc */
-
-TODIGIT		< 0xa2a1 - 0xa2aa : 1 >
-TODIGIT		< 0xa2b1 - 0xa2c4 : 1 >
-TODIGIT		< 0xa2c5 - 0xa2d8 : 1 >
-TODIGIT		< 0xa2d9 - 0xa2e2 : 1 >
-TODIGIT		< 0xa2e5 - 0xa2ee : 1 >
-TODIGIT		< 0xa2f1 - 0xa2fc : 1 >
-
-ALPHA		0xa3c1 - 0xa3da 0xa3e1 - 0xa3fa
-/* ?DIGIT           0xa3b0 - 0xa3b9 */
-UPPER		0xa3c1 - 0xa3da
-LOWER		0xa3e1 - 0xa3fa
-PUNCT		0xa3a1 - 0xa3af 0xa3ba - 0xa3c0 0xa3db - 0xa3e0 0xa3fb - 0xa3fe
-/* ?XDIGIT          0xa3b0 - 0xa3b9 0xa3c1 - 0xa3c6 0xa3e1 - 0xa3e6 */
-
-MAPLOWER	< 0xa3c1 - 0xa3da : 0xa3e1 > < 0xa3e1 - 0xa3fa : 0xa3e1 >
-MAPUPPER	< 0xa3c1 - 0xa3da : 0xa3c1 > < 0xa3b0 - 0xa3b9 : 0xa3c1 >
-TODIGIT		< 0xa3b0 - 0xa3b9 : 0 >
-TODIGIT		< 0xa3c1 - 0xa3c6 : 10 > < 0xa3e1 - 0xa3e6 : 10 >
-
-PHONOGRAM	0xa4a1 - 0xa4f3			/* Hiragana */
-PHONOGRAM	0xa5a1 - 0xa5f6			/* Katakana */
-
-UPPER		0xa6a1 - 0xa6b8			/* Greek */
-LOWER		0xa6c1 - 0xa6d8			/* Greek */
-MAPLOWER	< 0xa6a1 - 0xa6b8 : 0xa6c1 > < 0xa6c1 - 0xa6d8 : 0xa6c1 >
-MAPUPPER	< 0xa6a1 - 0xa6b8 : 0xa6a1 > < 0xa6c1 - 0xa6d8 : 0xa6a1 >
-
-UPPER		0xa7a1 - 0xa7c1			/* Cyrillic */
-LOWER		0xa7d1 - 0xa7f1			/* Cyrillic */
-MAPLOWER	< 0xa7a1 - 0xa7c1 : 0xa7d1 > < 0xa7d1 - 0xa7f1 : 0xa7d1 >
-MAPUPPER	< 0xa7a1 - 0xa7c1 : 0xa7a1 > < 0xa7d1 - 0xa7f1 : 0xa7a1 >
-
-PUNCT		0xa840 - 0xa853
-SPECIAL		0xa854 - 0xa877			/* Box drawings */
-PUNCT		0xa878 - 0xa87e 0xa880 - 0xa895
-SPECIAL		0xa8a1 - 0xa8c0
-PHONOGRAM	0xa8c5 - 0xa8e9			/* Pin yin */
-TODIGIT		< 0xa940 - 0xa948 : 1 >
-SPECIAL		0xa949 - 0xa95a 0xa95c 0xa960 - 0xa97e 0xa980 - 0xa996
-SPECIAL		0xa9a4 - 0xa9ef			/* Box drawings */
-
-IDEOGRAM	0xaa40 - 0xaa7e 0xaa80 - 0xaaa0
-IDEOGRAM	0xab40 - 0xab7e 0xab80 - 0xaba0
-IDEOGRAM	0xac40 - 0xac7e 0xac80 - 0xaca0
-IDEOGRAM	0xad40 - 0xad7e 0xad80 - 0xada0
-IDEOGRAM	0xae40 - 0xae7e 0xae80 - 0xaea0
-IDEOGRAM	0xaf40 - 0xaf7e 0xaf80 - 0xafa0
-IDEOGRAM	0xb040 - 0xb07e 0xb080 - 0xb0fe
-IDEOGRAM	0xb140 - 0xb17e 0xb180 - 0xb1fe
-IDEOGRAM	0xb240 - 0xb27e 0xb280 - 0xb2fe
-IDEOGRAM	0xb340 - 0xb37e 0xb380 - 0xb3fe
-IDEOGRAM	0xb440 - 0xb47e 0xb480 - 0xb4fe
-IDEOGRAM	0xb540 - 0xb57e 0xb580 - 0xb5fe
-IDEOGRAM	0xb640 - 0xb67e 0xb680 - 0xb6fe
-IDEOGRAM	0xb740 - 0xb77e 0xb780 - 0xb7fe
-IDEOGRAM	0xb840 - 0xb87e 0xb880 - 0xb8fe
-IDEOGRAM	0xb940 - 0xb97e 0xb980 - 0xb9fe
-IDEOGRAM	0xba40 - 0xba7e 0xba80 - 0xbafe
-IDEOGRAM	0xbb40 - 0xbb7e 0xbb80 - 0xbbfe
-IDEOGRAM	0xbc40 - 0xbc7e 0xbc80 - 0xbcfe
-IDEOGRAM	0xbd40 - 0xbd7e 0xbd80 - 0xbdfe
-IDEOGRAM	0xbe40 - 0xbe7e 0xbe80 - 0xbefe
-IDEOGRAM	0xbf40 - 0xbf7e 0xbf80 - 0xbffe
-IDEOGRAM	0xc040 - 0xc07e 0xc080 - 0xc0fe
-IDEOGRAM	0xc140 - 0xc17e 0xc180 - 0xc1fe
-IDEOGRAM	0xc240 - 0xc27e 0xc280 - 0xc2fe
-IDEOGRAM	0xc340 - 0xc37e 0xc380 - 0xc3fe
-IDEOGRAM	0xc440 - 0xc47e 0xc480 - 0xc4fe
-IDEOGRAM	0xc540 - 0xc57e 0xc580 - 0xc5fe
-IDEOGRAM	0xc640 - 0xc67e 0xc680 - 0xc6fe
-IDEOGRAM	0xc740 - 0xc77e 0xc780 - 0xc7fe
-IDEOGRAM	0xc840 - 0xc87e 0xc880 - 0xc8fe
-IDEOGRAM	0xc940 - 0xc97e 0xc980 - 0xc9fe
-IDEOGRAM	0xca40 - 0xca7e 0xca80 - 0xcafe
-IDEOGRAM	0xcb40 - 0xcb7e 0xcb80 - 0xcbfe
-IDEOGRAM	0xcc40 - 0xcc7e 0xcc80 - 0xccfe
-IDEOGRAM	0xcd40 - 0xcd7e 0xcd80 - 0xcdfe
-IDEOGRAM	0xce40 - 0xce7e 0xce80 - 0xcefe
-IDEOGRAM	0xcf40 - 0xcf7e 0xcf80 - 0xcffe
-IDEOGRAM	0xd040 - 0xd07e 0xd080 - 0xd0fe
-IDEOGRAM	0xd140 - 0xd17e 0xd180 - 0xd1fe
-IDEOGRAM	0xd240 - 0xd27e 0xd280 - 0xd2fe
-IDEOGRAM	0xd340 - 0xd37e 0xd380 - 0xd3fe
-IDEOGRAM	0xd440 - 0xd47e 0xd480 - 0xd4fe
-IDEOGRAM	0xd540 - 0xd57e 0xd580 - 0xd5fe
-IDEOGRAM	0xd640 - 0xd67e 0xd680 - 0xd6fe
-IDEOGRAM	0xd740 - 0xd77e 0xd780 - 0xd7fe
-IDEOGRAM	0xd840 - 0xd87e 0xd880 - 0xd8fe
-IDEOGRAM	0xd940 - 0xd97e 0xd980 - 0xd9fe
-IDEOGRAM	0xda40 - 0xda7e 0xda80 - 0xdafe
-IDEOGRAM	0xdb40 - 0xdb7e 0xdb80 - 0xdbfe
-IDEOGRAM	0xdc40 - 0xdc7e 0xdc80 - 0xdcfe
-IDEOGRAM	0xdd40 - 0xdd7e 0xdd80 - 0xddfe
-IDEOGRAM	0xde40 - 0xde7e 0xde80 - 0xdefe
-IDEOGRAM	0xdf40 - 0xdf7e 0xdf80 - 0xdffe
-IDEOGRAM	0xe040 - 0xe07e 0xe080 - 0xe0fe
-IDEOGRAM	0xe140 - 0xe17e 0xe180 - 0xe1fe
-IDEOGRAM	0xe240 - 0xe27e 0xe280 - 0xe2fe
-IDEOGRAM	0xe340 - 0xe37e 0xe380 - 0xe3fe
-IDEOGRAM	0xe440 - 0xe47e 0xe480 - 0xe4fe
-IDEOGRAM	0xe540 - 0xe57e 0xe580 - 0xe5fe
-IDEOGRAM	0xe640 - 0xe67e 0xe680 - 0xe6fe
-IDEOGRAM	0xe740 - 0xe77e 0xe780 - 0xe7fe
-IDEOGRAM	0xe840 - 0xe87e 0xe880 - 0xe8fe
-IDEOGRAM	0xe940 - 0xe97e 0xe980 - 0xe9fe
-IDEOGRAM	0xea40 - 0xea7e 0xea80 - 0xeafe
-IDEOGRAM	0xeb40 - 0xeb7e 0xeb80 - 0xebfe
-IDEOGRAM	0xec40 - 0xec7e 0xec80 - 0xecfe
-IDEOGRAM	0xed40 - 0xed7e 0xed80 - 0xedfe
-IDEOGRAM	0xee40 - 0xee7e 0xee80 - 0xeefe
-IDEOGRAM	0xef40 - 0xef7e 0xef80 - 0xeffe
-IDEOGRAM	0xf040 - 0xf07e 0xf080 - 0xf0fe
-IDEOGRAM	0xf140 - 0xf17e 0xf180 - 0xf1fe
-IDEOGRAM	0xf240 - 0xf27e 0xf280 - 0xf2fe
-IDEOGRAM	0xf340 - 0xf37e 0xf380 - 0xf3fe
-IDEOGRAM	0xf440 - 0xf47e 0xf480 - 0xf4fe
-IDEOGRAM	0xf540 - 0xf57e 0xf580 - 0xf5fe
-IDEOGRAM	0xf640 - 0xf67e 0xf680 - 0xf6fe
-IDEOGRAM	0xf740 - 0xf77e 0xf780 - 0xf7fe
-IDEOGRAM	0xf840 - 0xf87e 0xf880 - 0xf8a0
-IDEOGRAM	0xf940 - 0xf97e 0xf980 - 0xf9a0
-IDEOGRAM	0xfa40 - 0xfa7e 0xfa80 - 0xfaa0
-IDEOGRAM	0xfb40 - 0xfb7e 0xfb80 - 0xfba0
-IDEOGRAM	0xfc40 - 0xfc7e 0xfc80 - 0xfca0
-IDEOGRAM	0xfd40 - 0xfd7e 0xfd80 - 0xfda0
-IDEOGRAM	0xfe40 - 0xfe7e 0xfe80 - 0xfea0

share/monetdef/zh_CN.GB18030.src

@@ -1,36 +0,0 @@
-# $FreeBSD$
-#
-# WARNING: spaces may be essential at the end of lines
-# WARNING: empty lines are essential too
-#
-# int_curr_symbol (last character always SPACE)
-CNY
-# currency_symbol
-£¤
-# mon_decimal_point
-.
-# mon_thousands_sep
-,
-# mon_grouping, separated by ;
-3;3
-# positive_sign
-
-# negative_sign
--
-# int_frac_digits
-0
-# frac_digits
-0
-# p_cs_precedes
-1
-# p_sep_by_space
-0
-# n_cs_precedes
-1
-# n_sep_by_space
-0
-# p_sign_posn
-1
-# n_sign_posn
-4
-# EOF

share/msgdef/zh_CN.GB18030.src

@@ -1,14 +0,0 @@
-# $FreeBSD$
-#
-# WARNING: spaces may be essential at the end of lines
-# WARNING: empty lines are essential too
-#
-# yesexpr
-^[yYｙＹ是].*
-# noexpr
-^[nNｎＮ不否].*
-# yesstr
-是
-# nostr
-否
-# EOF

share/timedef/zh_CN.GB18030.src

@@ -1,102 +0,0 @@
-# $FreeBSD$
-#
-# WARNING: spaces may be essential at the end of lines
-# WARNING: empty lines are essential too
-#
-# Short month names
-#
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11
-12
-#
-# Long month names
-#
-一月
-二月
-三月
-四月
-五月
-六月
-七月
-八月
-九月
-十月
-十一月
-十二月
-#
-# Short weekday names
-#
-日
-一
-二
-三
-四
-五
-六
-#
-# Long weekday names
-#
-星期日
-星期一
-星期二
-星期三
-星期四
-星期五
-星期六
-#
-# X_fmt
-#
-%H时%M分%S秒
-#
-# x_fmt
-#
-%Y/%m/%d
-#
-# c_fmt
-#
-%a %b/%e %T %Y
-#
-# am
-#
-上午
-#
-# pm
-#
-下午
-#
-# date_fmt
-#
-%Y年%b月%e日 %A %X %Z
-#
-# Long month names (alternative)
-#
-一月
-二月
-三月
-四月
-五月
-六月
-七月
-八月
-九月
-十月
-十一月
-十二月
-#
-# md_order
-#
-md
-#
-# ampm_fmt
-#
-%I:%M:%S %p
-# EOF

sys/compat/linux/linux_ioctl.c

@@ -933,19 +933,21 @@ linux_ioctl_cdrom(struct proc *p, struct linux_ioctl_args *args)
 	}
 
 	case LINUX_CDROMREADTOCENTRY: {
-		struct linux_cdrom_tocentry lte, *ltep =
-		    (struct linux_cdrom_tocentry *)args->arg;
+		struct linux_cdrom_tocentry lte;
 		struct ioc_read_toc_single_entry irtse;
-		irtse.address_format = ltep->cdte_format;
-		irtse.track = ltep->cdte_track;
+
+		error = copyin((caddr_t)args->arg, &lte, sizeof(lte));
+		if (error)
+			return (error);
+		irtse.address_format = lte.cdte_format;
+		irtse.track = lte.cdte_track;
 		error = fo_ioctl(fp, CDIOREADTOCENTRY, (caddr_t)&irtse, p);
 		if (!error) {
-			lte = *ltep;
 			lte.cdte_ctrl = irtse.entry.control;
 			lte.cdte_adr = irtse.entry.addr_type;
 			bsd_to_linux_msf_lba(irtse.address_format,
 			    &irtse.entry.addr, &lte.cdte_addr);
-			copyout(&lte, (caddr_t)args->arg, sizeof(lte));
+			error = copyout(&lte, (caddr_t)args->arg, sizeof(lte));
 		}
 		return (error);
 	}
@@ -1268,6 +1270,7 @@ static int
 linux_ioctl_console(struct proc *p, struct linux_ioctl_args *args)
 {
 	struct file *fp = p->p_fd->fd_ofiles[args->fd];
+	int error;
 
 	switch (args->cmd & 0xffff) {
 
@@ -1326,11 +1329,16 @@ linux_ioctl_console(struct proc *p, struct linux_ioctl_args *args)
 		return  (ioctl(p, (struct ioctl_args *)args));
 
 	case LINUX_VT_SETMODE: {
-		struct vt_mode *mode;
+		struct vt_mode mode;
+		error = copyin((caddr_t)args->arg, &mode, sizeof(mode));
+		if (error)
+			return (error);
+		if (!ISSIGVALID(mode.frsig) && ISSIGVALID(mode.acqsig))
+			mode.frsig = mode.acqsig;
+		error = copyout(&mode, (caddr_t)args->arg, sizeof(mode));
+		if (error)
+			return (error);
 		args->cmd = VT_SETMODE;
-		mode = (struct vt_mode *)args->arg;
-		if (!ISSIGVALID(mode->frsig) && ISSIGVALID(mode->acqsig))
-			mode->frsig = mode->acqsig;
 		return (ioctl(p, (struct ioctl_args *)args));
 	}
 

sys/conf/newvers.sh

@@ -36,7 +36,7 @@
 
 TYPE="FreeBSD"
 REVISION="4.9"
-BRANCH="RC"
+BRANCH="RELEASE-p25"
 RELEASE="${REVISION}-${BRANCH}"
 VERSION="${TYPE} ${RELEASE}"
 

sys/dev/ata/ata-dma.c

@@ -490,12 +490,12 @@ ata_dmainit(struct ata_device *atadev, int apiomode, int wdmamode, int udmamode)
 	    int32_t timing;
 
 	    switch(ATA_PIO0 + apiomode) {
-	    case ATA_PIO0: timing = 0x006d0003;
-	    case ATA_PIO1: timing = 0x00580002;
-	    case ATA_PIO2: timing = 0x00440001;
-	    case ATA_PIO3: timing = 0x00330001;
-	    case ATA_PIO4: timing = 0x00310001;
-	    default:	   timing = 0x006d0003;
+	    case ATA_PIO0: timing = 0x006d0003; break;
+	    case ATA_PIO1: timing = 0x00580002; break;
+	    case ATA_PIO2: timing = 0x00440001; break;
+	    case ATA_PIO3: timing = 0x00330001; break;
+	    case ATA_PIO4: timing = 0x00310001; break;
+	    default:	   timing = 0x006d0003; break;
 	    }
 	    pci_write_config(parent, 0x58 + (channel << 2), timing, 4);
 	    word54 &= ~(0x000f000f << (devno << 2));

sys/dev/bfe/if_bfereg.h

@@ -1,512 +0,0 @@
-/* Copyright (c) 2003 Stuart Walsh */
-/* $FreeBSD$ */
-
-#ifndef _BFE_H
-#define _BFE_H
-
-/* PCI registers */
-#define BFE_PCI_MEMLO           0x10
-#define BFE_PCI_MEMHIGH         0x14
-#define BFE_PCI_INTLINE         0x3C
-
-/* Register layout. */
-#define BFE_DEVCTRL         0x00000000  /* Device Control */
-#define BFE_PFE             0x00000080  /* Pattern Filtering Enable */
-#define BFE_IPP             0x00000400  /* Internal EPHY Present */
-#define BFE_EPR             0x00008000  /* EPHY Reset */
-#define BFE_PME             0x00001000  /* PHY Mode Enable */
-#define BFE_PMCE            0x00002000  /* PHY Mode Clocks Enable */
-#define BFE_PADDR           0x0007c000  /* PHY Address */
-#define BFE_PADDR_SHIFT     18
-
-#define BFE_BIST_STAT       0x0000000C  /* Built-In Self-Test Status */
-#define BFE_WKUP_LEN        0x00000010  /* Wakeup Length */
-
-#define BFE_ISTAT           0x00000020  /* Interrupt Status */
-#define BFE_ISTAT_PME       0x00000040 /* Power Management Event */
-#define BFE_ISTAT_TO        0x00000080 /* General Purpose Timeout */
-#define BFE_ISTAT_DSCE      0x00000400 /* Descriptor Error */
-#define BFE_ISTAT_DATAE     0x00000800 /* Data Error */
-#define BFE_ISTAT_DPE       0x00001000 /* Descr. Protocol Error */
-#define BFE_ISTAT_RDU       0x00002000 /* Receive Descr. Underflow */
-#define BFE_ISTAT_RFO       0x00004000 /* Receive FIFO Overflow */
-#define BFE_ISTAT_TFU       0x00008000 /* Transmit FIFO Underflow */
-#define BFE_ISTAT_RX        0x00010000 /* RX Interrupt */
-#define BFE_ISTAT_TX        0x01000000 /* TX Interrupt */
-#define BFE_ISTAT_EMAC      0x04000000 /* EMAC Interrupt */
-#define BFE_ISTAT_MII_WRITE 0x08000000 /* MII Write Interrupt */
-#define BFE_ISTAT_MII_READ  0x10000000 /* MII Read Interrupt */
-#define BFE_ISTAT_ERRORS    (BFE_ISTAT_DSCE | BFE_ISTAT_DATAE | BFE_ISTAT_DPE |\
-        BFE_ISTAT_RDU | BFE_ISTAT_RFO | BFE_ISTAT_TFU)
-
-#define BFE_IMASK           0x00000024 /* Interrupt Mask */
-#define BFE_IMASK_DEF       (BFE_ISTAT_ERRORS | BFE_ISTAT_TO | BFE_ISTAT_RX | \
-        BFE_ISTAT_TX)
-
-#define BFE_MAC_CTRL        0x000000A8 /* MAC Control */
-#define BFE_CTRL_CRC32_ENAB 0x00000001 /* CRC32 Generation Enable */
-#define BFE_CTRL_PDOWN      0x00000004 /* Onchip EPHY Powerdown */
-#define BFE_CTRL_EDET       0x00000008 /* Onchip EPHY Energy Detected */
-#define BFE_CTRL_LED        0x000000e0 /* Onchip EPHY LED Control */
-#define BFE_CTRL_LED_SHIFT  5
-
-#define BFE_RCV_LAZY        0x00000100 /* Lazy Interrupt Control */
-#define BFE_LAZY_TO_MASK    0x00ffffff /* Timeout */
-#define BFE_LAZY_FC_MASK    0xff000000 /* Frame Count */
-#define BFE_LAZY_FC_SHIFT   24
-
-#define BFE_DMATX_CTRL      0x00000200 /* DMA TX Control */
-#define BFE_TX_CTRL_ENABLE  0x00000001 /* Enable */
-#define BFE_TX_CTRL_SUSPEND 0x00000002 /* Suepend Request */
-#define BFE_TX_CTRL_LPBACK  0x00000004 /* Loopback Enable */
-#define BFE_TX_CTRL_FAIRPRI 0x00000008 /* Fair Priority */
-#define BFE_TX_CTRL_FLUSH   0x00000010 /* Flush Request */
-
-#define BFE_DMATX_ADDR      0x00000204 /* DMA TX Descriptor Ring Address */
-#define BFE_DMATX_PTR       0x00000208 /* DMA TX Last Posted Descriptor */
-#define BFE_DMATX_STAT      0x0000020C /* DMA TX Current Active Desc. + Status */
-#define BFE_STAT_CDMASK     0x00000fff /* Current Descriptor Mask */
-#define BFE_STAT_SMASK      0x0000f000 /* State Mask */
-#define BFE_STAT_DISABLE    0x00000000 /* State Disabled */
-#define BFE_STAT_SACTIVE    0x00001000 /* State Active */
-#define BFE_STAT_SIDLE      0x00002000 /* State Idle Wait */
-#define BFE_STAT_STOPPED    0x00003000 /* State Stopped */
-#define BFE_STAT_SSUSP      0x00004000 /* State Suspend Pending */
-#define BFE_STAT_EMASK      0x000f0000 /* Error Mask */
-#define BFE_STAT_ENONE      0x00000000 /* Error None */
-#define BFE_STAT_EDPE       0x00010000 /* Error Desc. Protocol Error */
-#define BFE_STAT_EDFU       0x00020000 /* Error Data FIFO Underrun */
-#define BFE_STAT_EBEBR      0x00030000 /* Error Bus Error on Buffer Read */
-#define BFE_STAT_EBEDA      0x00040000 /* Error Bus Error on Desc. Access */
-#define BFE_STAT_FLUSHED    0x00100000 /* Flushed */
-
-#define BFE_DMARX_CTRL      0x00000210 /* DMA RX Control */
-#define BFE_RX_CTRL_ENABLE  0x00000001 /* Enable */
-#define BFE_RX_CTRL_ROMASK  0x000000fe /* Receive Offset Mask */
-#define BFE_RX_CTRL_ROSHIFT 1           /* Receive Offset Shift */
-
-#define BFE_DMARX_ADDR      0x00000214 /* DMA RX Descriptor Ring Address */
-#define BFE_DMARX_PTR       0x00000218 /* DMA RX Last Posted Descriptor */
-#define BFE_DMARX_STAT      0x0000021C /* DMA RX Current Active Desc. + Status */
-
-#define BFE_RXCONF          0x00000400 /* EMAC RX Config */
-#define BFE_RXCONF_DBCAST   0x00000001 /* Disable Broadcast */
-#define BFE_RXCONF_ALLMULTI 0x00000002 /* Accept All Multicast */
-#define BFE_RXCONF_NORXTX   0x00000004 /* Receive Disable While Transmitting */
-#define BFE_RXCONF_PROMISC  0x00000008 /* Promiscuous Enable */
-#define BFE_RXCONF_LPBACK   0x00000010 /* Loopback Enable */
-#define BFE_RXCONF_FLOW     0x00000020 /* Flow Control Enable */
-#define BFE_RXCONF_ACCEPT   0x00000040 /* Accept Unicast Flow Control Frame */
-#define BFE_RXCONF_RFILT    0x00000080 /* Reject Filter */
-
-#define BFE_RXMAXLEN        0x00000404 /* EMAC RX Max Packet Length */
-#define BFE_TXMAXLEN        0x00000408 /* EMAC TX Max Packet Length */
-
-#define BFE_MDIO_CTRL       0x00000410 /* EMAC MDIO Control */
-#define BFE_MDIO_MAXF_MASK  0x0000007f /* MDC Frequency */
-#define BFE_MDIO_PREAMBLE   0x00000080 /* MII Preamble Enable */
-
-#define BFE_MDIO_DATA       0x00000414 /* EMAC MDIO Data */
-#define BFE_MDIO_DATA_DATA  0x0000ffff /* R/W Data */
-#define BFE_MDIO_TA_MASK    0x00030000 /* Turnaround Value */
-#define BFE_MDIO_TA_SHIFT   16
-#define BFE_MDIO_TA_VALID   2
-
-#define BFE_MDIO_RA_MASK    0x007c0000 /* Register Address */
-#define BFE_MDIO_PMD_MASK   0x0f800000 /* Physical Media Device */
-#define BFE_MDIO_OP_MASK    0x30000000 /* Opcode */
-#define BFE_MDIO_SB_MASK    0xc0000000 /* Start Bits */
-#define BFE_MDIO_SB_START   0x40000000 /* Start Of Frame */
-#define BFE_MDIO_RA_SHIFT   18
-#define BFE_MDIO_PMD_SHIFT  23
-#define BFE_MDIO_OP_SHIFT   28
-#define BFE_MDIO_OP_WRITE   1
-#define BFE_MDIO_OP_READ    2
-#define BFE_MDIO_SB_SHIFT   30
-
-#define BFE_EMAC_IMASK      0x00000418 /* EMAC Interrupt Mask */
-#define BFE_EMAC_ISTAT      0x0000041C /* EMAC Interrupt Status */
-#define BFE_EMAC_INT_MII    0x00000001 /* MII MDIO Interrupt */
-#define BFE_EMAC_INT_MIB    0x00000002 /* MIB Interrupt */
-#define BFE_EMAC_INT_FLOW   0x00000003 /* Flow Control Interrupt */
-
-#define BFE_CAM_DATA_LO     0x00000420 /* EMAC CAM Data Low */
-#define BFE_CAM_DATA_HI     0x00000424 /* EMAC CAM Data High */
-#define BFE_CAM_HI_VALID    0x00010000 /* Valid Bit */
-
-#define BFE_CAM_CTRL        0x00000428 /* EMAC CAM Control */
-#define BFE_CAM_ENABLE      0x00000001 /* CAM Enable */
-#define BFE_CAM_MSEL        0x00000002 /* Mask Select */
-#define BFE_CAM_READ        0x00000004 /* Read */
-#define BFE_CAM_WRITE       0x00000008 /* Read */
-#define BFE_CAM_INDEX_MASK  0x003f0000 /* Index Mask */
-#define BFE_CAM_BUSY        0x80000000 /* CAM Busy */
-#define BFE_CAM_INDEX_SHIFT 16
-
-#define BFE_ENET_CTRL       0x0000042C /* EMAC ENET Control */
-#define BFE_ENET_ENABLE     0x00000001 /* EMAC Enable */
-#define BFE_ENET_DISABLE    0x00000002 /* EMAC Disable */
-#define BFE_ENET_SRST       0x00000004 /* EMAC Soft Reset */
-#define BFE_ENET_EPSEL      0x00000008 /* External PHY Select */
-
-#define BFE_TX_CTRL         0x00000430 /* EMAC TX Control */
-#define BFE_TX_DUPLEX       0x00000001 /* Full Duplex */
-#define BFE_TX_FMODE        0x00000002 /* Flow Mode */
-#define BFE_TX_SBENAB       0x00000004 /* Single Backoff Enable */
-#define BFE_TX_SMALL_SLOT   0x00000008 /* Small Slottime */
-
-#define BFE_TX_WMARK        0x00000434 /* EMAC TX Watermark */
-
-#define BFE_MIB_CTRL        0x00000438 /* EMAC MIB Control */
-#define BFE_MIB_CLR_ON_READ 0x00000001 /* Autoclear on Read */
-
-/* Status registers */
-#define BFE_TX_GOOD_O       0x00000500 /* MIB TX Good Octets */
-#define BFE_TX_GOOD_P       0x00000504 /* MIB TX Good Packets */
-#define BFE_TX_O            0x00000508 /* MIB TX Octets */
-#define BFE_TX_P            0x0000050C /* MIB TX Packets */
-#define BFE_TX_BCAST        0x00000510 /* MIB TX Broadcast Packets */
-#define BFE_TX_MCAST        0x00000514 /* MIB TX Multicast Packets */
-#define BFE_TX_64           0x00000518 /* MIB TX <= 64 byte Packets */
-#define BFE_TX_65_127       0x0000051C /* MIB TX 65 to 127 byte Packets */
-#define BFE_TX_128_255      0x00000520 /* MIB TX 128 to 255 byte Packets */
-#define BFE_TX_256_511      0x00000524 /* MIB TX 256 to 511 byte Packets */
-#define BFE_TX_512_1023     0x00000528 /* MIB TX 512 to 1023 byte Packets */
-#define BFE_TX_1024_MAX     0x0000052C /* MIB TX 1024 to max byte Packets */
-#define BFE_TX_JABBER       0x00000530 /* MIB TX Jabber Packets */
-#define BFE_TX_OSIZE        0x00000534 /* MIB TX Oversize Packets */
-#define BFE_TX_FRAG         0x00000538 /* MIB TX Fragment Packets */
-#define BFE_TX_URUNS        0x0000053C /* MIB TX Underruns */
-#define BFE_TX_TCOLS        0x00000540 /* MIB TX Total Collisions */
-#define BFE_TX_SCOLS        0x00000544 /* MIB TX Single Collisions */
-#define BFE_TX_MCOLS        0x00000548 /* MIB TX Multiple Collisions */
-#define BFE_TX_ECOLS        0x0000054C /* MIB TX Excessive Collisions */
-#define BFE_TX_LCOLS        0x00000550 /* MIB TX Late Collisions */
-#define BFE_TX_DEFERED      0x00000554 /* MIB TX Defered Packets */
-#define BFE_TX_CLOST        0x00000558 /* MIB TX Carrier Lost */
-#define BFE_TX_PAUSE        0x0000055C /* MIB TX Pause Packets */
-#define BFE_RX_GOOD_O       0x00000580 /* MIB RX Good Octets */
-#define BFE_RX_GOOD_P       0x00000584 /* MIB RX Good Packets */
-#define BFE_RX_O            0x00000588 /* MIB RX Octets */
-#define BFE_RX_P            0x0000058C /* MIB RX Packets */
-#define BFE_RX_BCAST        0x00000590 /* MIB RX Broadcast Packets */
-#define BFE_RX_MCAST        0x00000594 /* MIB RX Multicast Packets */
-#define BFE_RX_64           0x00000598 /* MIB RX <= 64 byte Packets */
-#define BFE_RX_65_127       0x0000059C /* MIB RX 65 to 127 byte Packets */
-#define BFE_RX_128_255      0x000005A0 /* MIB RX 128 to 255 byte Packets */
-#define BFE_RX_256_511      0x000005A4 /* MIB RX 256 to 511 byte Packets */
-#define BFE_RX_512_1023     0x000005A8 /* MIB RX 512 to 1023 byte Packets */
-#define BFE_RX_1024_MAX     0x000005AC /* MIB RX 1024 to max byte Packets */
-#define BFE_RX_JABBER       0x000005B0 /* MIB RX Jabber Packets */
-#define BFE_RX_OSIZE        0x000005B4 /* MIB RX Oversize Packets */
-#define BFE_RX_FRAG         0x000005B8 /* MIB RX Fragment Packets */
-#define BFE_RX_MISS         0x000005BC /* MIB RX Missed Packets */
-#define BFE_RX_CRCA         0x000005C0 /* MIB RX CRC Align Errors */
-#define BFE_RX_USIZE        0x000005C4 /* MIB RX Undersize Packets */
-#define BFE_RX_CRC          0x000005C8 /* MIB RX CRC Errors */
-#define BFE_RX_ALIGN        0x000005CC /* MIB RX Align Errors */
-#define BFE_RX_SYM          0x000005D0 /* MIB RX Symbol Errors */
-#define BFE_RX_PAUSE        0x000005D4 /* MIB RX Pause Packets */
-#define BFE_RX_NPAUSE       0x000005D8 /* MIB RX Non-Pause Packets */
-
-#define BFE_SBIMSTATE       0x00000F90 /* BFE_SB Initiator Agent State */
-#define BFE_PC              0x0000000f /* Pipe Count */
-#define BFE_AP_MASK         0x00000030 /* Arbitration Priority */
-#define BFE_AP_BOTH         0x00000000 /* Use both timeslices and token */
-#define BFE_AP_TS           0x00000010 /* Use timeslices only */
-#define BFE_AP_TK           0x00000020 /* Use token only */
-#define BFE_AP_RSV          0x00000030 /* Reserved */
-#define BFE_IBE             0x00020000 /* In Band Error */
-#define BFE_TO              0x00040000 /* Timeout */
-
-
-/* Seems the bcm440x has a fairly generic core, we only need be concerned with
- * a couple of these
- */
-#define BFE_SBINTVEC        0x00000F94 /* BFE_SB Interrupt Mask */
-#define BFE_INTVEC_PCI      0x00000001 /* Enable interrupts for PCI */
-#define BFE_INTVEC_ENET0    0x00000002 /* Enable interrupts for enet 0 */
-#define BFE_INTVEC_ILINE20  0x00000004 /* Enable interrupts for iline20 */
-#define BFE_INTVEC_CODEC    0x00000008 /* Enable interrupts for v90 codec */
-#define BFE_INTVEC_USB      0x00000010 /* Enable interrupts for usb */
-#define BFE_INTVEC_EXTIF    0x00000020 /* Enable interrupts for external i/f */
-#define BFE_INTVEC_ENET1    0x00000040 /* Enable interrupts for enet 1 */
-
-#define BFE_SBTMSLOW        0x00000F98 /* BFE_SB Target State Low */
-#define BFE_RESET           0x00000001 /* Reset */
-#define BFE_REJECT          0x00000002 /* Reject */
-#define BFE_CLOCK           0x00010000 /* Clock Enable */
-#define BFE_FGC             0x00020000 /* Force Gated Clocks On */
-#define BFE_PE              0x40000000 /* Power Management Enable */
-#define BFE_BE              0x80000000 /* BIST Enable */
-
-#define BFE_SBTMSHIGH       0x00000F9C /* BFE_SB Target State High */
-#define BFE_SERR            0x00000001 /* S-error */
-#define BFE_INT             0x00000002 /* Interrupt */
-#define BFE_BUSY            0x00000004 /* Busy */
-#define BFE_GCR             0x20000000 /* Gated Clock Request */
-#define BFE_BISTF           0x40000000 /* BIST Failed */
-#define BFE_BISTD           0x80000000 /* BIST Done */
-
-#define BFE_SBBWA0          0x00000FA0 /* BFE_SB Bandwidth Allocation Table 0 */
-#define BFE_TAB0_MASK       0x0000ffff /* Lookup Table 0 */
-#define BFE_TAB1_MASK       0xffff0000 /* Lookup Table 0 */
-#define BFE_TAB0_SHIFT      0
-#define BFE_TAB1_SHIFT      16
-
-#define BFE_SBIMCFGLOW      0x00000FA8 /* BFE_SB Initiator Configuration Low */
-#define BFE_STO_MASK        0x00000003 /* Service Timeout */
-#define BFE_RTO_MASK        0x00000030 /* Request Timeout */
-#define BFE_CID_MASK        0x00ff0000 /* Connection ID */
-#define BFE_RTO_SHIFT       4
-#define BFE_CID_SHIFT       16
-
-#define BFE_SBIMCFGHIGH     0x00000FAC /* BFE_SB Initiator Configuration High */
-#define BFE_IEM_MASK        0x0000000c /* Inband Error Mode */
-#define BFE_TEM_MASK        0x00000030 /* Timeout Error Mode */
-#define BFE_BEM_MASK        0x000000c0 /* Bus Error Mode */
-#define BFE_TEM_SHIFT       4
-#define BFE_BEM_SHIFT       6
-
-#define BFE_SBTMCFGLOW      0x00000FB8 /* BFE_SB Target Configuration Low */
-#define BFE_LOW_CD_MASK     0x000000ff /* Clock Divide Mask */
-#define BFE_LOW_CO_MASK     0x0000f800 /* Clock Offset Mask */
-#define BFE_LOW_IF_MASK     0x00fc0000 /* Interrupt Flags Mask */
-#define BFE_LOW_IM_MASK     0x03000000 /* Interrupt Mode Mask */
-#define BFE_LOW_CO_SHIFT    11
-#define BFE_LOW_IF_SHIFT    18
-#define BFE_LOW_IM_SHIFT    24
-
-#define BFE_SBTMCFGHIGH     0x00000FBC /* BFE_SB Target Configuration High */
-#define BFE_HIGH_BM_MASK    0x00000003 /* Busy Mode */
-#define BFE_HIGH_RM_MASK    0x0000000C /* Retry Mode */
-#define BFE_HIGH_SM_MASK    0x00000030 /* Stop Mode */
-#define BFE_HIGH_EM_MASK    0x00000300 /* Error Mode */
-#define BFE_HIGH_IM_MASK    0x00000c00 /* Interrupt Mode */
-#define BFE_HIGH_RM_SHIFT   2
-#define BFE_HIGH_SM_SHIFT   4
-#define BFE_HIGH_EM_SHIFT   8
-#define BFE_HIGH_IM_SHIFT   10
-
-#define BFE_SBBCFG          0x00000FC0 /* BFE_SB Broadcast Configuration */
-#define BFE_LAT_MASK        0x00000003 /* BFE_SB Latency */
-#define BFE_MAX0_MASK       0x000f0000 /* MAX Counter 0 */
-#define BFE_MAX1_MASK       0x00f00000 /* MAX Counter 1 */
-#define BFE_MAX0_SHIFT      16
-#define BFE_MAX1_SHIFT      20
-
-#define BFE_SBBSTATE        0x00000FC8 /* BFE_SB Broadcast State */
-#define BFE_SBBSTATE_SRD    0x00000001 /* ST Reg Disable */
-#define BFE_SBBSTATE_HRD    0x00000002 /* Hold Reg Disable */
-
-#define BFE_SBACTCNFG       0x00000FD8 /* BFE_SB Activate Configuration */
-#define BFE_SBFLAGST        0x00000FE8 /* BFE_SB Current BFE_SBFLAGS */
-
-#define BFE_SBIDLOW         0x00000FF8 /* BFE_SB Identification Low */
-#define BFE_CS_MASK         0x00000003 /* Config Space Mask */
-#define BFE_AR_MASK         0x00000038 /* Num Address Ranges Supported */
-#define BFE_SYNCH           0x00000040 /* Sync */
-#define BFE_INIT            0x00000080 /* Initiator */
-#define BFE_MINLAT_MASK     0x00000f00 /* Minimum Backplane Latency */
-#define BFE_MAXLAT_MASK     0x0000f000 /* Maximum Backplane Latency */
-#define BFE_FIRST           0x00010000 /* This Initiator is First */
-#define BFE_CW_MASK         0x000c0000 /* Cycle Counter Width */
-#define BFE_TP_MASK         0x00f00000 /* Target Ports */
-#define BFE_IP_MASK         0x0f000000 /* Initiator Ports */
-#define BFE_AR_SHIFT        3
-#define BFE_MINLAT_SHIFT    8
-#define BFE_MAXLAT_SHIFT    12
-#define BFE_CW_SHIFT        18
-#define BFE_TP_SHIFT        20
-#define BFE_IP_SHIFT        24
-
-#define BFE_SBIDHIGH        0x00000FFC /* BFE_SB Identification High */
-#define BFE_RC_MASK         0x0000000f /* Revision Code */
-#define BFE_CC_MASK         0x0000fff0 /* Core Code */
-#define BFE_VC_MASK         0xffff0000 /* Vendor Code */
-#define BFE_CC_SHIFT        4
-#define BFE_VC_SHIFT        16
-
-#define BFE_CORE_ILINE20    0x801
-#define BFE_CORE_SDRAM      0x803
-#define BFE_CORE_PCI        0x804
-#define BFE_CORE_MIPS       0x805
-#define BFE_CORE_ENET       0x806
-#define BFE_CORE_CODEC      0x807
-#define BFE_CORE_USB        0x808
-#define BFE_CORE_ILINE100   0x80a
-#define BFE_CORE_EXTIF      0x811
-
-/* SSB PCI config space registers.  */
-#define BFE_BAR0_WIN        0x80
-#define BFE_BAR1_WIN        0x84
-#define BFE_SPROM_CONTROL   0x88
-#define BFE_BAR1_CONTROL    0x8c
-
-/* SSB core and hsot control registers.  */
-#define BFE_SSB_CONTROL     0x00000000
-#define BFE_SSB_ARBCONTROL  0x00000010
-#define BFE_SSB_ISTAT       0x00000020
-#define BFE_SSB_IMASK       0x00000024
-#define BFE_SSB_MBOX        0x00000028
-#define BFE_SSB_BCAST_ADDR  0x00000050
-#define BFE_SSB_BCAST_DATA  0x00000054
-#define BFE_SSB_PCI_TRANS_0 0x00000100
-#define BFE_SSB_PCI_TRANS_1 0x00000104
-#define BFE_SSB_PCI_TRANS_2 0x00000108
-#define BFE_SSB_SPROM       0x00000800
-
-#define BFE_SSB_PCI_MEM     0x00000000
-#define BFE_SSB_PCI_IO      0x00000001
-#define BFE_SSB_PCI_CFG0    0x00000002
-#define BFE_SSB_PCI_CFG1    0x00000003
-#define BFE_SSB_PCI_PREF    0x00000004
-#define BFE_SSB_PCI_BURST   0x00000008
-#define BFE_SSB_PCI_MASK0   0xfc000000
-#define BFE_SSB_PCI_MASK1   0xfc000000
-#define BFE_SSB_PCI_MASK2   0xc0000000
-
-#define BFE_DESC_LEN        0x00001fff
-#define BFE_DESC_CMASK      0x0ff00000 /* Core specific bits */
-#define BFE_DESC_EOT        0x10000000 /* End of Table */
-#define BFE_DESC_IOC        0x20000000 /* Interrupt On Completion */
-#define BFE_DESC_EOF        0x40000000 /* End of Frame */
-#define BFE_DESC_SOF        0x80000000 /* Start of Frame */
-
-#define BFE_RX_CP_THRESHOLD 256
-#define BFE_RX_HEADER_LEN   28
-
-#define BFE_RX_FLAG_OFIFO   0x00000001 /* FIFO Overflow */
-#define BFE_RX_FLAG_CRCERR  0x00000002 /* CRC Error */
-#define BFE_RX_FLAG_SERR    0x00000004 /* Receive Symbol Error */
-#define BFE_RX_FLAG_ODD     0x00000008 /* Frame has odd number of nibbles */
-#define BFE_RX_FLAG_LARGE   0x00000010 /* Frame is > RX MAX Length */
-#define BFE_RX_FLAG_MCAST   0x00000020 /* Dest is Multicast Address */
-#define BFE_RX_FLAG_BCAST   0x00000040 /* Dest is Broadcast Address */
-#define BFE_RX_FLAG_MISS    0x00000080 /* Received due to promisc mode */
-#define BFE_RX_FLAG_LAST    0x00000800 /* Last buffer in frame */
-#define BFE_RX_FLAG_ERRORS  (BFE_RX_FLAG_ODD | BFE_RX_FLAG_SERR |           \
-        BFE_RX_FLAG_CRCERR | BFE_RX_FLAG_OFIFO)
-
-#define BFE_MCAST_TBL_SIZE  32
-#define BFE_PCI_DMA         0x40000000
-#define BFE_REG_PCI         0x18002000
-
-#define BCOM_VENDORID           0x14E4
-#define BCOM_DEVICEID_BCM4401   0x4401
-
-#define PCI_SETBIT(dev, reg, x, s)  \
-    pci_write_config(dev, reg, (pci_read_config(dev, reg, s) | (x)), s)
-#define PCI_CLRBIT(dev, reg, x, s)  \
-    pci_write_config(dev, reg, (pci_read_config(dev, reg, s) & ~(x)), s)
-
-#define BFE_RX_RING_SIZE        512
-#define BFE_TX_RING_SIZE        512
-#define BFE_LINK_DOWN           5
-#define BFE_TX_LIST_CNT         511
-#define BFE_RX_LIST_CNT         511
-#define BFE_TX_LIST_SIZE        BFE_TX_LIST_CNT * sizeof(struct bfe_desc)
-#define BFE_RX_LIST_SIZE        BFE_RX_LIST_CNT * sizeof(struct bfe_desc)
-#define BFE_RX_OFFSET           30
-#define BFE_TX_QLEN             256
-
-#define CSR_READ_4(sc, reg)                                                 \
-        bus_space_read_4(sc->bfe_btag, sc->bfe_bhandle, reg)
-
-#define CSR_WRITE_4(sc, reg, val)                                            \
-        bus_space_write_4(sc->bfe_btag, sc->bfe_bhandle, reg, val)
-
-#define BFE_OR(sc, name, val)                                               \
-        CSR_WRITE_4(sc, name, CSR_READ_4(sc, name) | val)
-
-#define BFE_AND(sc, name, val)                                              \
-        CSR_WRITE_4(sc, name, CSR_READ_4(sc, name) & val)
-
-#define BFE_LOCK(scp)       mtx_lock(&sc->bfe_mtx)
-#define BFE_UNLOCK(scp)     mtx_unlock(&sc->bfe_mtx)
-
-#define BFE_INC(x, y)       (x) = ((x) == ((y)-1)) ? 0 : (x)+1
-
-struct bfe_data {
-    struct mbuf     *bfe_mbuf;
-    bus_dmamap_t     bfe_map;
-};
-
-struct bfe_desc {
-    u_int32_t         bfe_ctrl;
-    u_int32_t         bfe_addr;
-};
-
-struct bfe_rxheader {
-    u_int16_t    len;
-    u_int16_t    flags;
-    u_int16_t    pad[12];
-};
-
-struct bfe_hw_stats {
-    u_int32_t tx_good_octets, tx_good_pkts, tx_octets;
-    u_int32_t tx_pkts, tx_broadcast_pkts, tx_multicast_pkts;
-    u_int32_t tx_len_64, tx_len_65_to_127, tx_len_128_to_255;
-    u_int32_t tx_len_256_to_511, tx_len_512_to_1023, tx_len_1024_to_max;
-    u_int32_t tx_jabber_pkts, tx_oversize_pkts, tx_fragment_pkts;
-    u_int32_t tx_underruns, tx_total_cols, tx_single_cols;
-    u_int32_t tx_multiple_cols, tx_excessive_cols, tx_late_cols;
-    u_int32_t tx_defered, tx_carrier_lost, tx_pause_pkts;
-    u_int32_t __pad1[8];
-
-    u_int32_t rx_good_octets, rx_good_pkts, rx_octets;
-    u_int32_t rx_pkts, rx_broadcast_pkts, rx_multicast_pkts;
-    u_int32_t rx_len_64, rx_len_65_to_127, rx_len_128_to_255;
-    u_int32_t rx_len_256_to_511, rx_len_512_to_1023, rx_len_1024_to_max;
-    u_int32_t rx_jabber_pkts, rx_oversize_pkts, rx_fragment_pkts;
-    u_int32_t rx_missed_pkts, rx_crc_align_errs, rx_undersize;
-    u_int32_t rx_crc_errs, rx_align_errs, rx_symbol_errs;
-    u_int32_t rx_pause_pkts, rx_nonpause_pkts;
-};
-
-struct bfe_softc 
-{
-    struct arpcom           arpcom;     /* interface info */
-    device_t                bfe_dev;
-    device_t                bfe_miibus;
-    bus_space_handle_t      bfe_bhandle;
-    vm_offset_t             bfe_vhandle;
-    bus_space_tag_t         bfe_btag;
-    bus_dma_tag_t           bfe_tag;
-    bus_dma_tag_t           bfe_parent_tag;
-    bus_dma_tag_t           bfe_tx_tag, bfe_rx_tag;
-    bus_dmamap_t            bfe_tx_map, bfe_rx_map;
-    void                    *bfe_intrhand;
-    struct resource         *bfe_irq;
-    struct resource         *bfe_res;
-    struct callout_handle   bfe_stat_ch;
-    struct bfe_hw_stats     bfe_hwstats;
-    struct bfe_desc         *bfe_tx_list, *bfe_rx_list;
-    struct bfe_data         bfe_tx_ring[BFE_TX_LIST_CNT]; /* XXX */
-    struct bfe_data         bfe_rx_ring[BFE_RX_LIST_CNT]; /* XXX */
-    struct mtx              bfe_mtx;
-    u_int32_t               bfe_flags;
-    u_int32_t               bfe_imask;
-    u_int32_t               bfe_dma_offset;
-    u_int32_t               bfe_tx_cnt, bfe_tx_cons, bfe_tx_prod;
-    u_int32_t               bfe_rx_cnt, bfe_rx_prod, bfe_rx_cons;
-    u_int32_t               bfe_tx_dma, bfe_rx_dma;
-    u_int32_t               bfe_link;
-    u_int8_t                bfe_phyaddr; /* Address of the card's PHY */
-    u_int8_t                bfe_mdc_port;
-    u_int8_t                bfe_unit;   /* interface number */
-    u_int8_t                bfe_core_unit;
-    u_int8_t                bfe_up;
-    int                     bfe_if_flags;
-    char                    *bfe_vpd_prodname;
-    char                    *bfe_vpd_readonly;
-};
-
-struct bfe_type 
-{
-    u_int16_t   bfe_vid;
-    u_int16_t   bfe_did;
-    char        *bfe_name;
-};
-
-#endif /* _BFE_H */

sys/dev/firewire/fwphyreg.h

@@ -1,168 +0,0 @@
-/*
- * Copyright (C) 2003
- * 	Hidetoshi Shimokawa. All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *
- *	This product includes software developed by Hidetoshi Shimokawa.
- *
- * 4. Neither the name of the author nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * $FreeBSD$
- */
-
-struct phyreg_base {
-#if BYTE_ORDER == BIG_ENDIAN
-	u_int8_t	phy_id:6,
-			r:1,
-			cps:1;
-	u_int8_t	rhb:1,
-			ibr:1,
-			gap_count:6;
-	u_int8_t	extended:3,
-			num_ports:5;
-	u_int8_t	phy_speed:3,
-			:1,
-			delay:4;
-	u_int8_t	lctrl:1,
-			c:1,
-			jitter:3,
-			pwr_class:3;
-	u_int8_t	wdie:1,
-			isbr:1,
-			ctoi:1,
-			cpsi:1,
-			stoi:1,
-			pei:1,
-			eaa:1,
-			emc:1;
-	u_int8_t	legacy_spd:3,
-			blink:1,
-			bridge:2,
-			:2;
-	u_int8_t	page_select:3,
-			:1,
-			port_select:4;
-#else
-	u_int8_t	cps:1,
-			r:1,
-			phy_id:6;
-	u_int8_t	gap_count:6,
-			ibr:1,
-			rhb:1;
-	u_int8_t	num_ports:5,
-			extended:3;
-	u_int8_t	delay:4,
-			:1,
-			phy_speed:3;
-	u_int8_t	pwr_class:3,
-			jitter:3,
-			c:1,
-			lctrl:1;
-	u_int8_t	emc:1,
-			eaa:1,
-			pei:1,
-			stoi:1,
-			cpsi:1,
-			ctoi:1,
-			isbr:1,
-			wdie:1;
-	u_int8_t	:2,
-			bridge:2,
-			blink:1,
-			legacy_spd:3;
-	u_int8_t	port_select:4,
-			:1,
-			page_select:3;
-#endif
-};
-
-struct phyreg_page0 {
-#if BYTE_ORDER == BIG_ENDIAN
-	u_int8_t	astat:2,
-			bstat:2,
-			ch:1,
-			con:1,
-			rxok:1,
-			dis:1;
-	u_int8_t	negotiated_speed:3,
-			pie:1,
-			fault:1,
-			stanby_fault:1,
-			disscrm:1,
-			b_only:1;
-	u_int8_t	dc_connected:1,
-			max_port_speed:3,
-			lpp:1,
-			cable_speed:3;
-	u_int8_t	connection_unreliable:1,
-			:3,
-			beta_mode:1,
-			:3;
-	u_int8_t	port_error;
-	u_int8_t	:5,
-			loop_disable:1,
-			in_standby:1,
-			hard_disable:1;
-	u_int8_t	:8;
-	u_int8_t	:8;
-#else
-	u_int8_t	dis:1,
-			rxok:1,
-			con:1,
-			ch:1,
-			bstat:2,
-			astat:2;
-	u_int8_t	b_only:1,
-			disscrm:1,
-			stanby_fault:1,
-			fault:1,
-			pie:1,
-			negotiated_speed:3;
-	u_int8_t	cable_speed:3,
-			lpp:1,
-			max_port_speed:3,
-			dc_connected:1;
-	u_int8_t	:3,
-			beta_mode:1,
-			:3,
-			connection_unreliable:1;
-	u_int8_t	port_error;
-	u_int8_t	hard_disable:1,
-			in_standby:1,
-			loop_disable:1,
-			:5;
-	u_int8_t	:8;
-	u_int8_t	:8;
-#endif
-};
-
-struct phyreg_page1 {
-	u_int8_t	compliance;
-	u_int8_t	:8;
-	u_int8_t	vendor_id[3];
-	u_int8_t	product_id[3];
-};

sys/dev/iir/iir_ctrl.c

@@ -104,12 +104,12 @@ gdt_make_dev(int unit)
 
 #ifdef SDEV_PER_HBA
     dev = make_dev(&iir_cdevsw, hba2minor(unit), UID_ROOT, GID_OPERATOR,
-                   S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH, "iir%d", unit);
+                   S_IRUSR | S_IWUSR, "iir%d", unit);
 #else
     if (sdev_made)
         return (0);
     dev = make_dev(&iir_cdevsw, 0, UID_ROOT, GID_OPERATOR,
-                   S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH, "iir");
+                   S_IRUSR | S_IWUSR, "iir");
     sdev_made = 1;
 #endif
     return (dev);

sys/dev/ips/ips_ioctl.h

@@ -1,61 +0,0 @@
-/*-
- * Copyright (c) 2002 Adaptec Inc.
- * All rights reserved.
- *
- * Written by: David Jeffery
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * $FreeBSD$
- */
-
-
-#include <sys/ioccom.h>
-
-#define IPS_USER_CMD _IOWR(0x81,0x21,ips_user_request)
-
-#define IPS_IOCTL_READ	1
-#define IPS_IOCTL_WRITE 2
-
-#define IPS_REBUILD_STAT_SIZE 116
-#define IPS_SUBSYS_PARAM_SIZE 128
-#define IPS_RW_NVRAM_SIZE 128
-
-#define IPS_IOCTL_BUFFER_SIZE 4096
-
-
-typedef struct ips_ioctl{
-	ips_generic_cmd *	command_buffer;
-	void *			data_buffer;
-	ips_cmd_status_t	status;
-	int			datasize;
-	int			readwrite;
-	bus_dma_tag_t 		dmatag;
-	bus_dmamap_t  		dmamap;
-}ips_ioctl_t;
-
-typedef struct ips_user_request{
-	void *	command_buffer;
-	void *	data_buffer;
-	u_int32_t	status;
-}ips_user_request;
-

sys/dev/mii/tdkphy.c

@@ -1,316 +0,0 @@
-/*
- * Copyright (c) 2000,2001 Jonathan Chen.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification, immediately at the beginning of the file.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
- * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-/*
- * Driver for the TDK 78Q2120 MII
- *
- * References:
- *   Datasheet for the 78Q2120 - http://www.tsc.tdk.com/lan/78q2120.pdf
- *   Most of this code stolen from ukphy.c
- */
-
-/*
- * The TDK 78Q2120 is found on some Xircom X3201 based cardbus cards.  It's just
- * like any other normal phy, except it does auto negotiation in a different
- * way.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/kernel.h>
-#include <sys/socket.h>
-#include <sys/errno.h>
-#include <sys/module.h>
-#include <sys/bus.h>
-
-#include <net/if.h>
-#include <net/if_media.h>
-
-#include <machine/clock.h>
-
-#include <dev/mii/mii.h>
-#include <dev/mii/miivar.h>
-#include "miidevs.h"
-
-#include <dev/mii/tdkphyreg.h>
-
-#include "miibus_if.h"
-
-#if 0
-#if !defined(lint)
-static const char rcsid[] =
-  "$Id: tdkphy.c,v 1.3 2000/10/14 06:20:56 jon Exp $";
-#endif
-#endif
-
-static int tdkphy_probe(device_t);
-static int tdkphy_attach(device_t);
-
-static device_method_t tdkphy_methods[] = {
-	/* device interface */
-	DEVMETHOD(device_probe,		tdkphy_probe),
-	DEVMETHOD(device_attach,	tdkphy_attach),
-	DEVMETHOD(device_detach,	mii_phy_detach),
-	DEVMETHOD(device_shutdown,	bus_generic_shutdown),
-	{ 0, 0 }
-};
-
-static devclass_t tdkphy_devclass;
-
-static driver_t tdkphy_driver = {
-	"tdkphy",
-	tdkphy_methods,
-	sizeof(struct mii_softc)
-};
-
-DRIVER_MODULE(tdkphy, miibus, tdkphy_driver, tdkphy_devclass, 0, 0);
-
-static int tdkphy_service(struct mii_softc *, struct mii_data *, int);
-static void tdkphy_status(struct mii_softc *);
-
-static int
-tdkphy_probe(device_t dev)
-{
-        struct mii_attach_args *ma;
-        ma = device_get_ivars(dev);
- 	if ((MII_OUI(ma->mii_id1, ma->mii_id2) != MII_OUI_TDK ||
-	     MII_MODEL(ma->mii_id2) != MII_MODEL_TDK_78Q2120))
-		return (ENXIO);
-
-	device_set_desc(dev, MII_STR_TDK_78Q2120);
-	return (0);
-}
-
-static int
-tdkphy_attach(device_t dev)
-{
-	struct mii_softc *sc;
-	struct mii_attach_args *ma;
-	struct mii_data *mii;
-	sc = device_get_softc(dev);
-	ma = device_get_ivars(dev);
-	sc->mii_dev = device_get_parent(dev);
-	mii = device_get_softc(sc->mii_dev);
-	LIST_INSERT_HEAD(&mii->mii_phys, sc, mii_list);
-
-	if (bootverbose)
-		device_printf(dev, "OUI 0x%06x, model 0x%04x, rev. %d\n",
-		    MII_OUI(ma->mii_id1, ma->mii_id2),
-		    MII_MODEL(ma->mii_id2), MII_REV(ma->mii_id2));
-
-	sc->mii_inst = mii->mii_instance;
-	sc->mii_phy = ma->mii_phyno;
-	sc->mii_service = tdkphy_service;
-	sc->mii_pdata = mii;
-
-	mii->mii_instance++;
-
-	sc->mii_flags |= MIIF_NOISOLATE;
-
-#define	ADD(m, c)	ifmedia_add(&mii->mii_media, (m), (c), NULL)
-
-	ADD(IFM_MAKEWORD(IFM_ETHER, IFM_NONE, 0, sc->mii_inst),
-	    BMCR_ISO);
-#if 0
-	ADD(IFM_MAKEWORD(IFM_ETHER, IFM_100_TX, IFM_LOOP, sc->mii_inst),
-	    BMCR_LOOP|BMCR_S100);
-#endif
-
-	mii_phy_reset(sc);
-
-	sc->mii_capabilities =
-	    PHY_READ(sc, MII_BMSR) & ma->mii_capmask;
-	device_printf(dev, " ");
-	mii_add_media(sc);
-	printf("\n");
-#undef ADD
-
-	MIIBUS_MEDIAINIT(sc->mii_dev);
-
-	return(0);
-}
-
-static int
-tdkphy_service(struct mii_softc *sc, struct mii_data *mii, int cmd)
-{
-	struct ifmedia_entry *ife = mii->mii_media.ifm_cur;
-	int reg;
-
-	switch (cmd) {
-	case MII_POLLSTAT:
-		/*
-		 * If we're not polling our PHY instance, just return.
-		 */
-		if (IFM_INST(ife->ifm_media) != sc->mii_inst)
-			return (0);
-		break;
-
-	case MII_MEDIACHG:
-		/*
-		 * If the media indicates a different PHY instance,
-		 * isolate ourselves.
-		 */
-		if (IFM_INST(ife->ifm_media) != sc->mii_inst) {
-			reg = PHY_READ(sc, MII_BMCR);
-			PHY_WRITE(sc, MII_BMCR, reg | BMCR_ISO);
-			return (0);
-		}
-
-		/*
-		 * If the interface is not up, don't do anything.
-		 */
-		if ((mii->mii_ifp->if_flags & IFF_UP) == 0)
-			break;
-
-		switch (IFM_SUBTYPE(ife->ifm_media)) {
-		case IFM_AUTO:
-			/*
-			 * If we're already in auto mode, just return.
-			 */
-			if (PHY_READ(sc, MII_BMCR) & BMCR_AUTOEN)
-				return (0);
-			(void) mii_phy_auto(sc);
-			break;
-		case IFM_100_T4:
-			/*
-			 * Not supported on MII
-			 */
-			return (EINVAL);
-		default:
-			/*
-			 * BMCR data is stored in the ifmedia entry.
-			 */
-			PHY_WRITE(sc, MII_ANAR,
-			    mii_anar(ife->ifm_media));
-			PHY_WRITE(sc, MII_BMCR, ife->ifm_data);
-		}
-		break;
-
-	case MII_TICK:
-		/*
-		 * If we're not currently selected, just return.
-		 */
-		if (IFM_INST(ife->ifm_media) != sc->mii_inst)
-			return (0);
-		if (mii_phy_tick(sc) == EJUSTRETURN)
-			return (0);
-		break;
-	}
-
-	/* Update the media status. */
-	tdkphy_status(sc);
-	if (sc->mii_pdata->mii_media_active & IFM_FDX)
-		PHY_WRITE(sc, MII_BMCR, PHY_READ(sc, MII_BMCR) | BMCR_FDX);
-	else
-		PHY_WRITE(sc, MII_BMCR, PHY_READ(sc, MII_BMCR) & ~BMCR_FDX);
-
-	/* Callback if something changed. */
-	mii_phy_update(sc, cmd);
-	return (0);
-}
-
-static void
-tdkphy_status(struct mii_softc *phy)
-{
-	struct mii_data *mii = phy->mii_pdata;
-	int bmsr, bmcr, anlpar, diag;
-
-	mii->mii_media_status = IFM_AVALID;
-	mii->mii_media_active = IFM_ETHER;
-
-	bmsr = PHY_READ(phy, MII_BMSR) | PHY_READ(phy, MII_BMSR);
-	if (bmsr & BMSR_LINK)
-		mii->mii_media_status |= IFM_ACTIVE;
-
-	bmcr = PHY_READ(phy, MII_BMCR);
-	if (bmcr & BMCR_ISO) {
-		mii->mii_media_active |= IFM_NONE;
-		mii->mii_media_status = 0;
-		return;
-	}
-
-	if (bmcr & BMCR_LOOP)
-		mii->mii_media_active |= IFM_LOOP;
-
-	if (bmcr & BMCR_AUTOEN) {
-		/*
-		 * NWay autonegotiation takes the highest-order common
-		 * bit of the ANAR and ANLPAR (i.e. best media advertised
-		 * both by us and our link partner).
-		 */
-		if ((bmsr & BMSR_ACOMP) == 0) {
-			/* Erg, still trying, I guess... */
-			mii->mii_media_active |= IFM_NONE;
-			return;
-		}
-
-		anlpar = PHY_READ(phy, MII_ANAR) & PHY_READ(phy, MII_ANLPAR);
-		/*
-		 * ANLPAR doesn't get set on my card, but we check it anyway,
-		 * since it is mentioned in the 78Q2120 specs.
-		 */
-		if (anlpar & ANLPAR_T4)
-			mii->mii_media_active |= IFM_100_T4;
-		else if (anlpar & ANLPAR_TX_FD)
-			mii->mii_media_active |= IFM_100_TX|IFM_FDX;
-		else if (anlpar & ANLPAR_TX)
-			mii->mii_media_active |= IFM_100_TX;
-		else if (anlpar & ANLPAR_10_FD)
-			mii->mii_media_active |= IFM_10_T|IFM_FDX;
-		else if (anlpar & ANLPAR_10)
-			mii->mii_media_active |= IFM_10_T;
-		else {
-			/*
-			 * ANLPAR isn't set, which leaves two possibilities:
-			 * 1) Auto negotiation failed
-			 * 2) Auto negotiation completed, but the card forgot
-			 *    to set ANLPAR.
-			 * So we check the MII_DIAG(18) register...
-			 */
-			diag = PHY_READ(phy, MII_DIAG);
-			if (diag & DIAG_NEGFAIL) /* assume 10baseT if no neg */
-				mii->mii_media_active |= IFM_10_T;
-			else {
-				if (diag & DIAG_DUPLEX)
-					mii->mii_media_active |= IFM_FDX;
-				if (diag & DIAG_RATE_100)
-					mii->mii_media_active |= IFM_100_TX;
-				else
-					mii->mii_media_active |= IFM_10_T;
-			}
-		}
-	} else {
-		mii->mii_media_active = mii_media_from_bmcr(bmcr);
-	}
-}

sys/dev/mii/tdkphyreg.h

@@ -1,82 +0,0 @@
-/*
- * Copyright (c) 2000,2001 Jonathan Chen.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification, immediately at the beginning of the file.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
- * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * $FreeBSD$
- */
-
-/*
- * Register definitions for TDK 78Q2120
- */
-
-#ifndef	_DEV_MII_TDKPHYREG_H_
-#define	_DEV_MII_TDKPHYREG_H_
-
-#define	MII_VENDOR	16
-#define	VENDOR_RXCC	0x0001
-#define	VENDOR_PCSBP	0x0002
-#define	VENDOR_RVSPOL	0x0010
-#define	VENDOR_NOAPOL	0x0020
-#define	VENDOR_GPIO0DIR	0x0040
-#define	VENDOR_GPIO0DAT	0x0080
-#define	VENDOR_GPIO1DIR	0x0100
-#define	VENDOR_GPIO1DAT	0x0200
-#define	VENDOR_10BTLOOP	0x0400
-#define	VENDOR_NOSQE	0x0800
-#define	VENDOR_TXHIM	0x1000
-#define	VENDOR_INTLVL	0x4000
-#define	VENDOR_RPTR	0x8000
-
-#define	MII_INT		17
-#define	INT_STAT_MASK	0x00ff
-#define	INT_STAT_ACOMP	0x0001
-#define	INT_STAT_RFAULT	0x0002
-#define	INT_STAT_LSCHG	0x0004
-#define	INT_STAT_LPACK	0x0008
-#define	INT_STAT_PDF	0x0010
-#define	INT_STAT_PRX	0x0020
-#define	INT_STAT_RXERR	0x0040
-#define	INT_STAT_JABBER	0x0080
-#define	INT_CTRL_MASK	0xff00
-#define	INT_CTRL_ACOMP	0x0100
-#define	INT_CTRL_RFAULT	0x0200
-#define	INT_CTRL_LSCHG	0x0400
-#define	INT_CTRL_LPACK	0x0800
-#define	INT_CTRL_PDF	0x1000
-#define	INT_CTRL_PRX	0x2000
-#define	INT_CTRL_RXERR	0x4000
-#define	INT_CTRL_JABBER	0x8000
-
-
-#define	MII_DIAG	18
-#define	DIAG_RLOCK	0x0100
-#define	DIAG_RPASS	0x0200
-#define	DIAG_RATE_100	0x0400
-#define	DIAG_DUPLEX	0x0800
-#define	DIAG_NEGFAIL	0x1000
-
-
-#endif

sys/dev/usb/ehcireg.h

@@ -1,291 +0,0 @@
-/*	$NetBSD: ehcireg.h,v 1.13 2001/11/23 01:16:27 augustss Exp $	*/
-/*	$FreeBSD$	*/
-
-/*
- * Copyright (c) 2001 The NetBSD Foundation, Inc.
- * All rights reserved.
- *
- * This code is derived from software contributed to The NetBSD Foundation
- * by Lennart Augustsson (lennart@augustsson.net).
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *        This product includes software developed by the NetBSD
- *        Foundation, Inc. and its contributors.
- * 4. Neither the name of The NetBSD Foundation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
- * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * The EHCI 0.96 spec can be found at
- * http://developer.intel.com/technology/usb/download/ehci-r096.pdf
- * and the USB 2.0 spec at
- * http://www.usb.org/developers/data/usb_20.zip
- */
-
-#ifndef _DEV_PCI_EHCIREG_H_
-#define _DEV_PCI_EHCIREG_H_
-
-/*** PCI config registers ***/
-
-#define PCI_CBMEM		0x10	/* configuration base MEM */
-
-#define PCI_INTERFACE_EHCI	0x20
-
-#define PCI_USBREV		0x60	/* RO USB protocol revision */
-#define  PCI_USBREV_MASK	0xff
-#define  PCI_USBREV_PRE_1_0	0x00
-#define  PCI_USBREV_1_0		0x10
-#define  PCI_USBREV_1_1		0x11
-#define  PCI_USBREV_2_0		0x20
-
-#define PCI_EHCI_FLADJ		0x61	/*RW Frame len adj, SOF=59488+6*fladj */
-
-#define PCI_EHCI_PORTWAKECAP	0x62	/* RW Port wake caps (opt)  */
-
-/* Regs ar EECP + offset */
-#define PCI_EHCI_USBLEGSUP	0x00
-#define PCI_EHCI_USBLEGCTLSTS	0x04
-
-/*** EHCI capability registers ***/
-
-#define EHCI_CAPLENGTH		0x00	/*RO Capability register length field */
-/* reserved			0x01 */
-#define EHCI_HCIVERSION		0x02	/* RO Interface version number */
-
-#define EHCI_HCSPARAMS		0x04	/* RO Structural parameters */
-#define  EHCI_HCS_DEBUGPORT(x)	(((x) >> 20) & 0xf)
-#define  EHCI_HCS_P_INCICATOR(x) ((x) & 0x10000)
-#define  EHCI_HCS_N_CC(x)	(((x) >> 12) & 0xf) /* # of companion ctlrs */
-#define  EHCI_HCS_N_PCC(x)	(((x) >> 8) & 0xf) /* # of ports per comp. */
-#define  EHCI_HCS_PPC(x)	((x) & 0x10) /* port power control */
-#define  EHCI_HCS_N_PORTS(x)	((x) & 0xf) /* # of ports */
-
-#define EHCI_HCCPARAMS		0x08	/* RO Capability parameters */
-#define  EHCI_HCC_EECP(x)	(((x) >> 8) & 0xff) /* extended ports caps */
-#define  EHCI_HCC_IST(x)	(((x) >> 4) & 0xf) /* isoc sched threshold */
-#define  EHCI_HCC_ASPC(x)	((x) & 0x4) /* async sched park cap */
-#define  EHCI_HCC_PFLF(x)	((x) & 0x2) /* prog frame list flag */
-#define  EHCI_HCC_64BIT(x)	((x) & 0x1) /* 64 bit address cap */
-
-#define EHCI_HCSP_PORTROUTE	0x0c	/*RO Companion port route description */
-
-/* EHCI operational registers.  Offset given by EHCI_CAPLENGTH register */
-#define EHCI_USBCMD		0x00	/* RO, RW, WO Command register */
-#define  EHCI_CMD_ITC_M		0x00ff0000 /* RW interrupt threshold ctrl */
-#define   EHCI_CMD_ITC_1	0x00010000
-#define   EHCI_CMD_ITC_2	0x00020000
-#define   EHCI_CMD_ITC_4	0x00040000
-#define   EHCI_CMD_ITC_8	0x00080000
-#define   EHCI_CMD_ITC_16	0x00100000
-#define   EHCI_CMD_ITC_32	0x00200000
-#define   EHCI_CMD_ITC_64	0x00400000
-#define  EHCI_CMD_ASPME		0x00000800 /* RW/RO async park enable */
-#define  EHCI_CMD_ASPMC		0x00000300 /* RW/RO async park count */
-#define  EHCI_CMD_LHCR		0x00000080 /* RW light host ctrl reset */
-#define  EHCI_CMD_IAAD		0x00000040 /* RW intr on async adv door bell */
-#define  EHCI_CMD_ASE		0x00000020 /* RW async sched enable */
-#define  EHCI_CMD_PSE		0x00000010 /* RW periodic sched enable */
-#define  EHCI_CMD_FLS_M		0x0000000c /* RW/RO frame list size */
-#define  EHCI_CMD_FLS(x)	(((x) >> 2) & 3) /* RW/RO frame list size */
-#define  EHCI_CMD_HCRESET	0x00000002 /* RW reset */
-#define  EHCI_CMD_RS		0x00000001 /* RW run/stop */
-
-#define EHCI_USBSTS		0x04	/* RO, RW, RWC Status register */
-#define  EHCI_STS_ASS		0x00008000 /* RO async sched status */
-#define  EHCI_STS_PSS		0x00004000 /* RO periodic sched status */
-#define  EHCI_STS_REC		0x00002000 /* RO reclamation */
-#define  EHCI_STS_HCH		0x00001000 /* RO host controller halted */
-#define  EHCI_STS_IAA		0x00000020 /* RWC interrupt on async adv */
-#define  EHCI_STS_HSE		0x00000010 /* RWC host system error */
-#define  EHCI_STS_FLR		0x00000008 /* RWC frame list rollover */
-#define  EHCI_STS_PCD		0x00000004 /* RWC port change detect */
-#define  EHCI_STS_ERRINT	0x00000002 /* RWC error interrupt */
-#define  EHCI_STS_INT		0x00000001 /* RWC interrupt */
-#define  EHCI_STS_INTRS(x)	((x) & 0x3f)
-
-#define EHCI_NORMAL_INTRS (EHCI_STS_IAA | EHCI_STS_HSE | EHCI_STS_PCD | EHCI_STS_ERRINT | EHCI_STS_INT)
-
-#define EHCI_USBINTR		0x08	/* RW Interrupt register */
-#define EHCI_INTR_IAAE		0x00000020 /* interrupt on async advance ena */
-#define EHCI_INTR_HSEE		0x00000010 /* host system error ena */
-#define EHCI_INTR_FLRE		0x00000008 /* frame list rollover ena */
-#define EHCI_INTR_PCIE		0x00000004 /* port change ena */
-#define EHCI_INTR_UEIE		0x00000002 /* USB error intr ena */
-#define EHCI_INTR_UIE		0x00000001 /* USB intr ena */
-
-#define EHCI_FRINDEX		0x0c	/* RW Frame Index register */
-
-#define EHCI_CTRLDSSEGMENT	0x10	/* RW Control Data Structure Segment */
-
-#define EHCI_PERIODICLISTBASE	0x14	/* RW Periodic List Base */
-#define EHCI_ASYNCLISTADDR	0x18	/* RW Async List Base */
-
-#define EHCI_CONFIGFLAG		0x40	/* RW Configure Flag register */
-#define  EHCI_CONF_CF		0x00000001 /* RW configure flag */
-
-#define EHCI_PORTSC(n)		(0x40+4*(n)) /* RO, RW, RWC Port Status reg */
-#define  EHCI_PS_WKOC_E		0x00400000 /* RW wake on over current ena */
-#define  EHCI_PS_WKDSCNNT_E	0x00200000 /* RW wake on disconnect ena */
-#define  EHCI_PS_WKCNNT_E	0x00100000 /* RW wake on connect ena */
-#define  EHCI_PS_PTC		0x000f0000 /* RW port test control */
-#define  EHCI_PS_PIC		0x0000c000 /* RW port indicator control */
-#define  EHCI_PS_PO		0x00002000 /* RW port owner */
-#define  EHCI_PS_PP		0x00001000 /* RW,RO port power */
-#define  EHCI_PS_LS		0x00000c00 /* RO line status */
-#define  EHCI_PS_IS_LOWSPEED(x)	(((x) & EHCI_PS_LS) == 0x00000400)
-#define  EHCI_PS_PR		0x00000100 /* RW port reset */
-#define  EHCI_PS_SUSP		0x00000080 /* RW suspend */
-#define  EHCI_PS_FPR		0x00000040 /* RW force port resume */
-#define  EHCI_PS_OCC		0x00000020 /* RWC over current change */
-#define  EHCI_PS_OCA		0x00000010 /* RO over current active */
-#define  EHCI_PS_PEC		0x00000008 /* RWC port enable change */
-#define  EHCI_PS_PE		0x00000004 /* RW port enable */
-#define  EHCI_PS_CSC		0x00000002 /* RWC connect status change */
-#define  EHCI_PS_CS		0x00000001 /* RO connect status */
-#define  EHCI_PS_CLEAR		(EHCI_PS_OCC|EHCI_PS_PEC|EHCI_PS_CSC)
-
-#define EHCI_PORT_RESET_COMPLETE 2 /* ms */
-
-#define EHCI_FLALIGN_ALIGN	0x1000
-
-/* No data structure may cross a page boundary. */
-#define EHCI_PAGE_SIZE 0x1000
-#define EHCI_PAGE(x) ((x) &~ 0xfff)
-#define EHCI_PAGE_OFFSET(x) ((x) & 0xfff)
-#if defined(__FreeBSD__)
-#define EHCI_PAGE_MASK(x) ((x) & 0xfff)
-#endif
-
-typedef u_int32_t ehci_link_t;
-#define EHCI_LINK_TERMINATE	0x00000001
-#define EHCI_LINK_TYPE(x)	((x) & 0x00000006)
-#define  EHCI_LINK_ITD		0x0
-#define  EHCI_LINK_QH		0x2
-#define  EHCI_LINK_SITD		0x4
-#define  EHCI_LINK_FSTN		0x6
-#define EHCI_LINK_ADDR(x)	((x) &~ 0x1f)
-
-typedef u_int32_t ehci_physaddr_t;
-
-/* Isochronous Transfer Descriptor */
-typedef struct {
-	ehci_link_t	itd_next;
-	/* XXX many more */
-} ehci_itd_t;
-#define EHCI_ITD_ALIGN 32
-
-/* Split Transaction Isochronous Transfer Descriptor */
-typedef struct {
-	ehci_link_t	sitd_next;
-	/* XXX many more */
-} ehci_sitd_t;
-#define EHCI_SITD_ALIGN 32
-
-/* Queue Element Transfer Descriptor */
-#define EHCI_QTD_NBUFFERS 5
-typedef struct {
-	ehci_link_t	qtd_next;
-	ehci_link_t	qtd_altnext;
-	u_int32_t	qtd_status;
-#define EHCI_QTD_GET_STATUS(x)	(((x) >>  0) & 0xff)
-#define  EHCI_QTD_ACTIVE	0x80
-#define  EHCI_QTD_HALTED	0x40
-#define  EHCI_QTD_BUFERR	0x20
-#define  EHCI_QTD_BABBLE	0x10
-#define  EHCI_QTD_XACTERR	0x08
-#define  EHCI_QTD_MISSEDMICRO	0x04
-#define  EHCI_QTD_SPLITXSTATE	0x02
-#define  EHCI_QTD_PINGSTATE	0x01
-#define  EHCI_QTD_STATERRS	0x7c
-#define EHCI_QTD_GET_PID(x)	(((x) >>  8) & 0x3)
-#define EHCI_QTD_SET_PID(x)	((x) <<  8)
-#define  EHCI_QTD_PID_OUT	0x0
-#define  EHCI_QTD_PID_IN	0x1
-#define  EHCI_QTD_PID_SETUP	0x2
-#define EHCI_QTD_GET_CERR(x)	(((x) >> 10) &  0x3)
-#define EHCI_QTD_SET_CERR(x)	((x) << 10)
-#define EHCI_QTD_GET_C_PAGE(x)	(((x) >> 12) &  0x7)
-#define EHCI_QTD_SET_C_PAGE(x)	((x) << 12)
-#define EHCI_QTD_GET_IOC(x)	(((x) >> 15) &  0x1)
-#define EHCI_QTD_IOC		0x00008000
-#define EHCI_QTD_GET_BYTES(x)	(((x) >> 16) &  0x7fff)
-#define EHCI_QTD_SET_BYTES(x)	((x) << 16)
-#define EHCI_QTD_GET_TOGGLE(x)	(((x) >> 31) &  0x1)
-#define EHCI_QTD_TOGGLE		0x80000000
-	ehci_physaddr_t	qtd_buffer[EHCI_QTD_NBUFFERS];
-} ehci_qtd_t;
-#define EHCI_QTD_ALIGN 32
-
-/* Queue Head */
-typedef struct {
-	ehci_link_t	qh_link;
-	u_int32_t	qh_endp;
-#define EHCI_QH_GET_ADDR(x)	(((x) >>  0) & 0x7f) /* endpoint addr */
-#define EHCI_QH_SET_ADDR(x)	(x)
-#define EHCI_QH_ADDRMASK	0x0000007f
-#define EHCI_QH_GET_INACT(x)	(((x) >>  7) & 0x01) /* inactivate on next */
-#define EHCI_QH_INACT		0x00000080
-#define EHCI_QH_GET_ENDPT(x)	(((x) >>  8) & 0x0f) /* endpoint no */
-#define EHCI_QH_SET_ENDPT(x)	((x) <<  8)
-#define EHCI_QH_GET_EPS(x)	(((x) >> 12) & 0x03) /* endpoint speed */
-#define EHCI_QH_SET_EPS(x)	((x) << 12)
-#define  EHCI_QH_SPEED_FULL	0x0
-#define  EHCI_QH_SPEED_LOW	0x1
-#define  EHCI_QH_SPEED_HIGH	0x2
-#define EHCI_QH_GET_DTC(x)	(((x) >> 14) & 0x01) /* data toggle control */
-#define EHCI_QH_DTC		0x00004000
-#define EHCI_QH_GET_HRECL(x)	(((x) >> 15) & 0x01) /* head of reclamation */
-#define EHCI_QH_HRECL		0x00008000
-#define EHCI_QH_GET_MPL(x)	(((x) >> 16) & 0x7ff) /* max packet len */
-#define EHCI_QH_SET_MPL(x)	((x) << 16)
-#define EHCI_QG_MPLMASK		0x07ff0000
-#define EHCI_QH_GET_CTL(x)	(((x) >> 26) & 0x01) /* control endpoint */
-#define EHCI_QH_CTL		0x08000000
-#define EHCI_QH_GET_NRL(x)	(((x) >> 28) & 0x0f) /* NAK reload */
-#define EHCI_QH_SET_NRL(x)	((x) << 28)
-	u_int32_t	qh_endphub;
-#define EHCI_QH_GET_SMASK(x)	(((x) >>  0) & 0xff) /* intr sched mask */
-#define EHCI_QH_SET_SMASK(x)	((x) <<  0)
-#define EHCI_QH_GET_CMASK(x)	(((x) >>  8) & 0xff) /* split completion mask */
-#define EHCI_QH_SET_CMASK(x)	((x) <<  8)
-#define EHCI_QH_GET_HUBA(x)	(((x) >> 16) & 0x7f) /* hub address */
-#define EHCI_QH_SET_HUBA(x)	((x) << 16)
-#define EHCI_QH_GET_PORT(x)	(((x) >> 23) & 0x7f) /* hub port */
-#define EHCI_QH_SET_PORT(x)	((x) << 23)
-#define EHCI_QH_GET_MULT(x)	(((x) >> 30) & 0x03) /* pipe multiplier */
-#define EHCI_QH_SET_MULT(x)	((x) << 30)
-	ehci_link_t	qh_curqtd;
-	ehci_qtd_t	qh_qtd;
-} ehci_qh_t;
-#define EHCI_QH_ALIGN 32
-
-/* Periodic Frame Span Traversal Node */
-typedef struct {
-	ehci_link_t	fstn_link;
-	ehci_link_t	fstn_back;
-} ehci_fstn_t;
-#define EHCI_FSTN_ALIGN 32
-
-#endif /* _DEV_PCI_EHCIREG_H_ */

sys/dev/usb/ehcivar.h

@@ -1,153 +0,0 @@
-/*	$NetBSD: ehcivar.h,v 1.12 2001/12/31 12:16:57 augustss Exp $	*/
-/*	$FreeBSD$	*/
-
-/*
- * Copyright (c) 2001 The NetBSD Foundation, Inc.
- * All rights reserved.
- *
- * This code is derived from software contributed to The NetBSD Foundation
- * by Lennart Augustsson (lennart@augustsson.net).
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *        This product includes software developed by the NetBSD
- *        Foundation, Inc. and its contributors.
- * 4. Neither the name of The NetBSD Foundation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
- * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-typedef struct ehci_soft_qtd {
-	ehci_qtd_t qtd;
-	struct ehci_soft_qtd *nextqtd; /* mirrors nextqtd in TD */
-	ehci_physaddr_t physaddr;
-	usbd_xfer_handle xfer;
-	LIST_ENTRY(ehci_soft_qtd) hnext;
-	u_int16_t len;
-} ehci_soft_qtd_t;
-#define EHCI_SQTD_SIZE ((sizeof (struct ehci_soft_qtd) + EHCI_QTD_ALIGN - 1) / EHCI_QTD_ALIGN * EHCI_QTD_ALIGN)
-#define EHCI_SQTD_CHUNK (EHCI_PAGE_SIZE / EHCI_SQTD_SIZE)
-
-typedef struct ehci_soft_qh {
-	ehci_qh_t qh;
-	struct ehci_soft_qh *next;
-	struct ehci_soft_qtd *sqtd;
-	ehci_physaddr_t physaddr;
-} ehci_soft_qh_t;
-#define EHCI_SQH_SIZE ((sizeof (struct ehci_soft_qh) + EHCI_QH_ALIGN - 1) / EHCI_QH_ALIGN * EHCI_QH_ALIGN)
-#define EHCI_SQH_CHUNK (EHCI_PAGE_SIZE / EHCI_SQH_SIZE)
-
-struct ehci_xfer {
-	struct usbd_xfer xfer;
-	struct usb_task	abort_task;
-	LIST_ENTRY(ehci_xfer) inext; /* list of active xfers */
-	ehci_soft_qtd_t *sqtdstart;
-	ehci_soft_qtd_t *sqtdend;
-#ifdef DIAGNOSTIC
-	int isdone;
-#endif
-};
-#define EXFER(xfer) ((struct ehci_xfer *)(xfer))
-
-
-#define EHCI_HASH_SIZE 128
-#define EHCI_COMPANION_MAX 8
-
-typedef struct ehci_softc {
-	struct usbd_bus sc_bus;		/* base device */
-	bus_space_tag_t iot;
-	bus_space_handle_t ioh;
-	bus_size_t sc_size;
-#if defined(__FreeBSD__)
-	void *ih;
-
-	struct resource *io_res;
-	struct resource *irq_res;
-#endif
-	u_int sc_offs;			/* offset to operational regs */
-
-	char sc_vendor[16];		/* vendor string for root hub */
-	int sc_id_vendor;		/* vendor ID for root hub */
-
-#if defined(__NetBSD__) || defined(__OpenBSD__)
-	void *sc_powerhook;		/* cookie from power hook */
-	void *sc_shutdownhook;		/* cookie from shutdown hook */
-#endif
-
-	u_int sc_ncomp;
-	u_int sc_npcomp;
-	struct usbd_bus *sc_comps[EHCI_COMPANION_MAX];
-
-	usb_dma_t sc_fldma;
-	u_int sc_flsize;
-
-	LIST_HEAD(, ehci_xfer) sc_intrhead;
-
-	ehci_soft_qh_t *sc_freeqhs;
-	ehci_soft_qtd_t *sc_freeqtds;
-
-	int sc_noport;
-	u_int8_t sc_addr;		/* device address */
-	u_int8_t sc_conf;		/* device configuration */
-	usbd_xfer_handle sc_intrxfer;
-	char sc_isreset;
-#ifdef USB_USE_SOFTINTR
-	char sc_softwake;
-#endif /* USB_USE_SOFTINTR */
-
-	u_int32_t sc_eintrs;
-	ehci_soft_qh_t *sc_async_head;
-
-	SIMPLEQ_HEAD(, usbd_xfer) sc_free_xfers; /* free xfers */
-
-	struct lock sc_doorbell_lock;
-
-	usb_callout_t sc_tmo_pcd;
-
-	device_ptr_t sc_child;		/* /dev/usb# device */
-
-	char sc_dying;
-} ehci_softc_t;
-
-#define EREAD1(sc, a) bus_space_read_1((sc)->iot, (sc)->ioh, (a))
-#define EREAD2(sc, a) bus_space_read_2((sc)->iot, (sc)->ioh, (a))
-#define EREAD4(sc, a) bus_space_read_4((sc)->iot, (sc)->ioh, (a))
-#define EWRITE1(sc, a, x) bus_space_write_1((sc)->iot, (sc)->ioh, (a), (x))
-#define EWRITE2(sc, a, x) bus_space_write_2((sc)->iot, (sc)->ioh, (a), (x))
-#define EWRITE4(sc, a, x) bus_space_write_4((sc)->iot, (sc)->ioh, (a), (x))
-#define EOREAD1(sc, a) bus_space_read_1((sc)->iot, (sc)->ioh, (sc)->sc_offs+(a))
-#define EOREAD2(sc, a) bus_space_read_2((sc)->iot, (sc)->ioh, (sc)->sc_offs+(a))
-#define EOREAD4(sc, a) bus_space_read_4((sc)->iot, (sc)->ioh, (sc)->sc_offs+(a))
-#define EOWRITE1(sc, a, x) bus_space_write_1((sc)->iot, (sc)->ioh, (sc)->sc_offs+(a), (x))
-#define EOWRITE2(sc, a, x) bus_space_write_2((sc)->iot, (sc)->ioh, (sc)->sc_offs+(a), (x))
-#define EOWRITE4(sc, a, x) bus_space_write_4((sc)->iot, (sc)->ioh, (sc)->sc_offs+(a), (x))
-
-usbd_status	ehci_init(ehci_softc_t *);
-int		ehci_intr(void *);
-#if defined(__NetBSD__) || defined(__OpenBSD__)
-int		ehci_detach(ehci_softc_t *, int);
-int		ehci_activate(device_ptr_t, enum devact);
-#endif
-
-#define MS_TO_TICKS(ms) ((ms) * hz / 1000)
-

sys/dev/usb/ugraphire_rdesc.h

@@ -1,92 +0,0 @@
-/*	$NetBSD: usb/ugraphire_rdesc.h,v 1.1 2000/12/29 01:47:49 augustss Exp $	*/
-/*	$FreeBSD$ */
-/*
- * Copyright (c) 2000 Nick Hibma <n_hibma@freebsd.org>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-static uByte uhid_graphire_report_descr[] = {
-    0x05, 0x0d,                    /*  USAGE_PAGE (Digitizers)		*/
-    0x09, 0x01,                    /*  USAGE (Digitizer)		*/
-    0xa1, 0x01,                    /*  COLLECTION (Application)		*/
-    0x85, 0x02,                    /*    REPORT_ID (2)			*/
-    0x05, 0x0d,                    /*    USAGE_PAGE (Digitizers)	*/
-    0x09, 0x01,                    /*    USAGE (Digitizer)		*/
-    0xa1, 0x00,                    /*    COLLECTION (Physical)		*/
-    0x15, 0x00,                    /*      LOGICAL_MINIMUM (0)		*/
-    0x25, 0x01,                    /*      LOGICAL_MAXIMUM (1)		*/
-    0x09, 0x33,                    /*      USAGE (Touch)		*/
-    0x95, 0x01,                    /*      REPORT_COUNT (1)		*/
-    0x75, 0x01,                    /*      REPORT_SIZE (1)		*/
-    0x81, 0x02,                    /*      INPUT (Data,Var,Abs)		*/
-    0x09, 0x44,                    /*      USAGE (Barrel Switch)	*/
-    0x95, 0x02,                    /*      REPORT_COUNT (2)		*/
-    0x75, 0x01,                    /*      REPORT_SIZE (1)		*/
-    0x81, 0x02,                    /*      INPUT (Data,Var,Abs)		*/
-    0x09, 0x00,                    /*      USAGE (Undefined)		*/
-    0x95, 0x02,                    /*      REPORT_COUNT (2)		*/
-    0x75, 0x01,                    /*      REPORT_SIZE (1)		*/
-    0x81, 0x03,                    /*      INPUT (Cnst,Var,Abs)		*/
-    0x09, 0x3c,                    /*      USAGE (Invert)		*/
-    0x95, 0x01,                    /*      REPORT_COUNT (1)		*/
-    0x75, 0x01,                    /*      REPORT_SIZE (1)		*/
-    0x81, 0x02,                    /*      INPUT (Data,Var,Abs)		*/
-    0x09, 0x38,                    /*      USAGE (Transducer Index)	*/
-    0x95, 0x01,                    /*      REPORT_COUNT (1)		*/
-    0x75, 0x01,                    /*      REPORT_SIZE (1)		*/
-    0x81, 0x02,                    /*      INPUT (Data,Var,Abs)		*/
-    0x09, 0x32,                    /*      USAGE (In Range)		*/
-    0x95, 0x01,                    /*      REPORT_COUNT (1)		*/
-    0x75, 0x01,                    /*      REPORT_SIZE (1)		*/
-    0x81, 0x02,                    /*      INPUT (Data,Var,Abs)		*/
-    0x05, 0x01,                    /*      USAGE_PAGE (Generic Desktop)	*/
-    0x09, 0x30,                    /*      USAGE (X)			*/
-    0x15, 0x00,                    /*      LOGICAL_MINIMUM (0)		*/
-    0x26, 0xde, 0x27,              /*      LOGICAL_MAXIMUM (10206)	*/
-    0x95, 0x01,                    /*      REPORT_COUNT (1)		*/
-    0x75, 0x10,                    /*      REPORT_SIZE (16)		*/
-    0x81, 0x02,                    /*      INPUT (Data,Var,Abs)		*/
-    0x09, 0x31,                    /*      USAGE (Y)			*/
-    0x26, 0xfe, 0x1c,              /*      LOGICAL_MAXIMUM (7422)	*/
-    0x95, 0x01,                    /*      REPORT_COUNT (1)		*/
-    0x75, 0x10,                    /*      REPORT_SIZE (16)		*/
-    0x81, 0x02,                    /*      INPUT (Data,Var,Abs)		*/
-    0x05, 0x0d,                    /*      USAGE_PAGE (Digitizers)	*/
-    0x09, 0x30,                    /*      USAGE (Tip Pressure)		*/
-    0x26, 0xff, 0x01,              /*      LOGICAL_MAXIMUM (511)	*/
-    0x95, 0x01,                    /*      REPORT_COUNT (1)		*/
-    0x75, 0x10,                    /*      REPORT_SIZE (16)		*/
-    0x81, 0x02,                    /*      INPUT (Data,Var,Abs)		*/
-    0xc0,                          /*    END_COLLECTION			*/
-    0x05, 0x0d,                    /*    USAGE_PAGE (Digitizers)	*/
-    0x09, 0x00,                    /*    USAGE (Undefined)		*/
-    0x85, 0x02,                    /*    REPORT_ID (2)			*/
-    0x95, 0x01,                    /*    REPORT_COUNT (1)		*/
-    0xb1, 0x02,                    /*    FEATURE (Data,Var,Abs)		*/
-    0x09, 0x00,                    /*    USAGE (Undefined)		*/
-    0x85, 0x03,                    /*    REPORT_ID (3)			*/
-    0x95, 0x01,                    /*    REPORT_COUNT (1)		*/
-    0xb1, 0x02,                    /*    FEATURE (Data,Var,Abs)		*/
-    0xc0,                          /*  END_COLLECTION			*/
-};

sys/dev/usb/usb_mem.c

@@ -1,308 +0,0 @@
-/*	$NetBSD: usb_mem.c,v 1.26 2003/02/01 06:23:40 thorpej Exp $	*/
-/*	$FreeBSD$	*/
-
-/*
- * Copyright (c) 1998 The NetBSD Foundation, Inc.
- * All rights reserved.
- *
- * This code is derived from software contributed to The NetBSD Foundation
- * by Lennart Augustsson (lennart@augustsson.net) at
- * Carlstedt Research & Technology.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *        This product includes software developed by the NetBSD
- *        Foundation, Inc. and its contributors.
- * 4. Neither the name of The NetBSD Foundation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
- * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * USB DMA memory allocation.
- * We need to allocate a lot of small (many 8 byte, some larger)
- * memory blocks that can be used for DMA.  Using the bus_dma
- * routines directly would incur large overheads in space and time.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/kernel.h>
-#if defined(__NetBSD__) || defined(__OpenBSD__)
-#include <sys/device.h>		/* for usbdivar.h */
-#include <machine/bus.h>
-#elif defined(__FreeBSD__)
-#include <sys/endian.h>
-#include <sys/module.h>
-#include <sys/bus.h>
-#endif
-#include <sys/queue.h>
-
-#include <machine/bus.h>
-#include <machine/endian.h>
-
-#ifdef DIAGNOSTIC
-#include <sys/proc.h>
-#endif
-
-#include <dev/usb/usb.h>
-#include <dev/usb/usbdi.h>
-#include <dev/usb/usbdivar.h>	/* just for usb_dma_t */
-#include <dev/usb/usb_mem.h>
-
-#ifdef USB_DEBUG
-#define DPRINTF(x)	if (usbdebug) logprintf x
-#define DPRINTFN(n,x)	if (usbdebug>(n)) logprintf x
-extern int usbdebug;
-#else
-#define DPRINTF(x)
-#define DPRINTFN(n,x)
-#endif
-
-#define USB_MEM_SMALL 64
-#define USB_MEM_CHUNKS (PAGE_SIZE / USB_MEM_SMALL)
-#define USB_MEM_BLOCK (USB_MEM_SMALL * USB_MEM_CHUNKS)
-
-/* This struct is overlayed on free fragments. */
-struct usb_frag_dma {
-	usb_dma_block_t *block;
-	u_int offs;
-	LIST_ENTRY(usb_frag_dma) next;
-};
-
-Static bus_dmamap_callback_t usbmem_callback;
-Static usbd_status	usb_block_allocmem(bus_dma_tag_t, size_t, size_t,
-					   usb_dma_block_t **);
-Static void		usb_block_freemem(usb_dma_block_t *);
-
-Static LIST_HEAD(, usb_dma_block) usb_blk_freelist =
-	LIST_HEAD_INITIALIZER(usb_blk_freelist);
-Static int usb_blk_nfree = 0;
-/* XXX should have different free list for different tags (for speed) */
-Static LIST_HEAD(, usb_frag_dma) usb_frag_freelist =
-	LIST_HEAD_INITIALIZER(usb_frag_freelist);
-
-Static void
-usbmem_callback(void *arg, bus_dma_segment_t *segs, int nseg, int error)
-{
-	int i;
-        usb_dma_block_t *p = arg;
-
-	if (error == EFBIG) {
-		printf("usb: mapping to large\n");
-		return;
-	}
-
-	p->nsegs = nseg;
-	for (i = 0; i < nseg && i < sizeof p->segs / sizeof *p->segs; i++)
-		p->segs[i] = segs[i];
-}
-
-Static usbd_status
-usb_block_allocmem(bus_dma_tag_t tag, size_t size, size_t align,
-		   usb_dma_block_t **dmap)
-{
-        usb_dma_block_t *p;
-	int s;
-
-	DPRINTFN(5, ("usb_block_allocmem: size=%lu align=%lu\n",
-		     (u_long)size, (u_long)align));
-
-#ifdef DIAGNOSTIC
-	if (!curproc) {
-		printf("usb_block_allocmem: in interrupt context, size=%lu\n",
-		    (unsigned long) size);
-	}
-#endif
-
-	s = splusb();
-	/* First check the free list. */
-	for (p = LIST_FIRST(&usb_blk_freelist); p; p = LIST_NEXT(p, next)) {
-		if (p->tag == tag && p->size >= size && p->align >= align) {
-			LIST_REMOVE(p, next);
-			usb_blk_nfree--;
-			splx(s);
-			*dmap = p;
-			DPRINTFN(6,("usb_block_allocmem: free list size=%lu\n",
-				    (u_long)p->size));
-			return (USBD_NORMAL_COMPLETION);
-		}
-	}
-	splx(s);
-
-#ifdef DIAGNOSTIC
-	if (!curproc) {
-		printf("usb_block_allocmem: in interrupt context, failed\n");
-		return (USBD_NOMEM);
-	}
-#endif
-
-	DPRINTFN(6, ("usb_block_allocmem: no free\n"));
-	p = malloc(sizeof *p, M_USB, M_NOWAIT);
-	if (p == NULL)
-		return (USBD_NOMEM);
-
-#if __FreeBSD_version >= 500000
-	if (bus_dma_tag_create(tag, align, 0,
-	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
-	    size, sizeof(p->segs) / sizeof(p->segs[0]), size,
-	    BUS_DMA_ALLOCNOW, NULL, NULL, &p->tag) == ENOMEM)
-#else
-	if (bus_dma_tag_create(tag, align, 0,
-	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
-	    size, sizeof(p->segs) / sizeof(p->segs[0]), size,
-	    BUS_DMA_ALLOCNOW, &p->tag) == ENOMEM)
-#endif
-	{
-		goto free;
-	}
-
-	p->size = size;
-	p->align = align;
-	if (bus_dmamem_alloc(p->tag, &p->kaddr,
-	    BUS_DMA_NOWAIT|BUS_DMA_COHERENT, &p->map))
-		goto tagfree;
-
-	if (bus_dmamap_load(p->tag, p->map, p->kaddr, p->size,
-	    usbmem_callback, p, 0))
-		goto memfree;
-
-	/* XXX - override the tag, ok since we never free it */
-	p->tag = tag;
-	*dmap = p;
-	return (USBD_NORMAL_COMPLETION);
-
-	/*
-	 * XXX - do we need to _unload? is the order of _free and _destroy
-	 * correct?
-	 */
-memfree:
-	bus_dmamem_free(p->tag, p->kaddr, p->map);
-tagfree:
-	bus_dma_tag_destroy(p->tag);
-free:
-	free(p, M_USB);
-	return (USBD_NOMEM);
-}
-
-/*
- * Do not free the memory unconditionally since we might be called
- * from an interrupt context and that is BAD.
- * XXX when should we really free?
- */
-Static void
-usb_block_freemem(usb_dma_block_t *p)
-{
-	int s;
-
-	DPRINTFN(6, ("usb_block_freemem: size=%lu\n", (u_long)p->size));
-	s = splusb();
-	LIST_INSERT_HEAD(&usb_blk_freelist, p, next);
-	usb_blk_nfree++;
-	splx(s);
-}
-
-usbd_status
-usb_allocmem(usbd_bus_handle bus, size_t size, size_t align, usb_dma_t *p)
-{
-	bus_dma_tag_t tag = bus->dmatag;
-	usbd_status err;
-	struct usb_frag_dma *f;
-	usb_dma_block_t *b;
-	int i;
-	int s;
-
-	/* compat w/ Net/OpenBSD */
-	if (align == 0)
-		align = 1;
-
-	/* If the request is large then just use a full block. */
-	if (size > USB_MEM_SMALL || align > USB_MEM_SMALL) {
-		DPRINTFN(1, ("usb_allocmem: large alloc %d\n", (int)size));
-		size = (size + USB_MEM_BLOCK - 1) & ~(USB_MEM_BLOCK - 1);
-		err = usb_block_allocmem(tag, size, align, &p->block);
-		if (!err) {
-			p->block->fullblock = 1;
-			p->offs = 0;
-			p->len = size;
-		}
-		return (err);
-	}
-
-	s = splusb();
-	/* Check for free fragments. */
-	for (f = LIST_FIRST(&usb_frag_freelist); f; f = LIST_NEXT(f, next))
-		if (f->block->tag == tag)
-			break;
-	if (f == NULL) {
-		DPRINTFN(1, ("usb_allocmem: adding fragments\n"));
-		err = usb_block_allocmem(tag, USB_MEM_BLOCK, USB_MEM_SMALL,&b);
-		if (err) {
-			splx(s);
-			return (err);
-		}
-		b->fullblock = 0;
-		/* XXX - override the tag, ok since we never free it */
-		b->tag = tag;
-		KASSERT(sizeof *f <= USB_MEM_SMALL, ("USB_MEM_SMALL(%d) is too small for struct usb_frag_dma(%zd)\n",
-		    USB_MEM_SMALL, sizeof *f));
-		for (i = 0; i < USB_MEM_BLOCK; i += USB_MEM_SMALL) {
-			f = (struct usb_frag_dma *)((char *)b->kaddr + i);
-			f->block = b;
-			f->offs = i;
-			LIST_INSERT_HEAD(&usb_frag_freelist, f, next);
-		}
-		f = LIST_FIRST(&usb_frag_freelist);
-	}
-	p->block = f->block;
-	p->offs = f->offs;
-	p->len = USB_MEM_SMALL;
-	LIST_REMOVE(f, next);
-	splx(s);
-	DPRINTFN(5, ("usb_allocmem: use frag=%p size=%d\n", f, (int)size));
-	return (USBD_NORMAL_COMPLETION);
-}
-
-void
-usb_freemem(usbd_bus_handle bus, usb_dma_t *p)
-{
-	struct usb_frag_dma *f;
-	int s;
-
-	if (p->block->fullblock) {
-		DPRINTFN(1, ("usb_freemem: large free\n"));
-		usb_block_freemem(p->block);
-		return;
-	}
-	f = KERNADDR(p, 0);
-	f->block = p->block;
-	f->offs = p->offs;
-	s = splusb();
-	LIST_INSERT_HEAD(&usb_frag_freelist, f, next);
-	splx(s);
-	DPRINTFN(5, ("usb_freemem: frag=%p\n", f));
-}

sys/i386/i386/sys_machdep.c

@@ -342,10 +342,6 @@ i386_get_ldt(p, args)
 	    uap->start, uap->num, (void *)uap->descs);
 #endif
 
-	/* verify range of LDTs exist */
-	if ((uap->start < 0) || (uap->num <= 0))
-		return(EINVAL);
-
 	s = splhigh();
 
 	if (pcb_ldt) {
@@ -357,7 +353,10 @@ i386_get_ldt(p, args)
 		num = min(uap->num, nldt);
 		lp = &ldt[uap->start];
 	}
-	if (uap->start + num > nldt) {
+
+	if ((uap->start > (unsigned int)nldt) ||
+	    ((unsigned int)num > (unsigned int)nldt) ||
+	    ((unsigned int)(uap->start + num) > (unsigned int)nldt)) {
 		splx(s);
 		return(EINVAL);
 	}

sys/i386/isa/npx.c

@@ -137,6 +137,10 @@ void	stop_emulating	__P((void));
 
 typedef u_char bool_t;
 
+#ifdef CPU_ENABLE_SSE
+static	void	fpu_clean_state(void);
+#endif
+
 static	int	npx_attach	__P((device_t dev));
 	void	npx_intr	__P((void *));
 static	void	npx_identify	__P((driver_t *driver, device_t parent));
@@ -914,15 +918,49 @@ fpusave(addr)
 		fnsave(addr);
 }
 
+#ifdef CPU_ENABLE_SSE
+/*
+ * On AuthenticAMD processors, the fxrstor instruction does not restore
+ * the x87's stored last instruction pointer, last data pointer, and last
+ * opcode values, except in the rare case in which the exception summary
+ * (ES) bit in the x87 status word is set to 1.
+ *
+ * In order to avoid leaking this information across processes, we clean
+ * these values by performing a dummy load before executing fxrstor().
+ */
+static	double	dummy_variable = 0.0;
+static void
+fpu_clean_state(void)
+{
+	u_short status;
+
+	/*
+	 * Clear the ES bit in the x87 status word if it is currently
+	 * set, in order to avoid causing a fault in the upcoming load.
+	 */
+	fnstsw(&status);
+	if (status & 0x80)
+		fnclex();
+
+	/*
+	 * Load the dummy variable into the x87 stack.  This mangles
+	 * the x87 stack, but we don't care since we're about to call
+	 * fxrstor() anyway.
+	 */
+	__asm __volatile("ffree %%st(7); fld %0" : : "m" (dummy_variable));
+}
+#endif /* CPU_ENABLE_SSE */
+
 static void
 fpurstor(addr)
       union savefpu *addr;
 {
 
 #ifdef CPU_ENABLE_SSE
-	if (cpu_fxsr)
+	if (cpu_fxsr) {
+		fpu_clean_state();
 		fxrstor(addr);
-	else
+	} else
 #endif
 		frstor(addr);
 }

sys/kern/sysv_shm.c

@@ -318,6 +318,7 @@ shmat(p, uap)
 	rv = vm_map_find(&p->p_vmspace->vm_map, shm_handle->shm_object,
 		0, &attach_va, size, (flags & MAP_FIXED)?0:1, prot, prot, 0);
 	if (rv != KERN_SUCCESS) {
+		vm_object_deallocate(shm_handle->shm_object);
 		return ENOMEM;
 	}
 	vm_map_inherit(&p->p_vmspace->vm_map,

sys/kern/uipc_usrreq.c

@@ -849,6 +849,8 @@ unp_pcblist(SYSCTL_HANDLER_ARGS)
 		unp = unp_list[i];
 		if (unp->unp_gencnt <= gencnt) {
 			struct xunpcb xu;
+
+			bzero(&xu, sizeof(xu));
 			xu.xu_len = sizeof xu;
 			xu.xu_unpp = unp;
 			/*

sys/kern/vfs_subr.c

@@ -2302,6 +2302,7 @@ sysctl_ovfs_conf(SYSCTL_HANDLER_ARGS)
 	struct ovfsconf ovfs;
 
 	for (vfsp = vfsconf; vfsp; vfsp = vfsp->vfc_next) {
+		bzero(&ovfs, sizeof(ovfs));
 		ovfs.vfc_vfsops = vfsp->vfc_vfsops;	/* XXX used as flag */
 		strcpy(ovfs.vfc_name, vfsp->vfc_name);
 		ovfs.vfc_index = vfsp->vfc_typenum;

sys/miscfs/procfs/procfs_status.c

@@ -186,6 +186,7 @@ procfs_docmdline(curp, p, pfs, uio)
 	char *buf, *bp;
 	int buflen;
 	struct ps_strings pstr;
+	char **ps_argvstr;
 	int i;
 	size_t bytes_left, done;
 
@@ -223,9 +224,22 @@ procfs_docmdline(curp, p, pfs, uio)
 			FREE(buf, M_TEMP);
 			return (error);
 		}
+		if (pstr.ps_nargvstr > ARG_MAX) {
+			FREE(buf, M_TEMP);
+			return (E2BIG);
+		}
+		MALLOC(ps_argvstr, char **, pstr.ps_nargvstr * sizeof(char *),
+		    M_TEMP, M_WAITOK);
+		error = copyin((void *)pstr.ps_argvstr, ps_argvstr,
+		    pstr.ps_nargvstr * sizeof(char *));
+		if (error) {
+			FREE(ps_argvstr, M_TEMP);
+			FREE(buf, M_TEMP);
+			return (error);
+		}
 		bytes_left = buflen;
 		for (i = 0; bytes_left && (i < pstr.ps_nargvstr); i++) {
-			error = copyinstr(pstr.ps_argvstr[i], ps,
+			error = copyinstr(ps_argvstr[i], ps,
 					  bytes_left, &done);
 			/* If too long or malformed, just truncate */
 			if (error) {
@@ -236,6 +250,7 @@ procfs_docmdline(curp, p, pfs, uio)
 			bytes_left -= done;
 		}
 		buflen = ps - buf;
+		FREE(ps_argvstr, M_TEMP);
 	}
 
 	error = uiomove_frombuf(bp, buflen, uio);

sys/modules/bfe/Makefile

@@ -1,8 +0,0 @@
-# $FreeBSD$
-
-.PATH: ${.CURDIR}/../../dev/bfe
-
-KMOD=	if_bfe
-SRCS=	if_bfe.c miibus_if.h miidevs.h opt_bdg.h device_if.h bus_if.h pci_if.h
-
-.include <bsd.kmod.mk>

sys/modules/firewire/sbp_targ/Makefile

@@ -1,16 +0,0 @@
-# $FreeBSD$
-
-# Makefile for the SBP-II Target mode
-
-.PATH: ${.CURDIR}/../../../dev/firewire
-
-KMOD	= sbp_targ
-SRCS	= bus_if.h device_if.h \
-	  opt_cam.h opt_scsi.h \
-	  sbp_targ.c sbp.h \
-	  firewire.h firewirereg.h \
-	  iec13213.h
-
-#CFLAGS += -g
-.include <bsd.kmod.mk>
-

sys/modules/ips/Makefile

@@ -1,8 +0,0 @@
-# $FreeBSD$
-
-.PATH:		${.CURDIR}/../../dev/ips
-KMOD		= ips
-SRCS		= ips.c ips_pci.c ips.h ips_disk.c ips_disk.h ips_commands.c \
-			ips_ioctl.h ips_ioctl.c device_if.h bus_if.h pci_if.h 
-
-.include <bsd.kmod.mk>

sys/net/if.c

@@ -1303,6 +1303,12 @@ ifconf(cmd, data)
 		char workbuf[64];
 		int ifnlen, addrs;
 
+		/*
+		 * Zero the ifr_name buffer to make sure we don't
+		 * disclose the contents of the stack.
+		 */
+		memset(ifr.ifr_name, 0, sizeof(ifr.ifr_name));
+
 		if (space <= sizeof (ifr))
 			break;
 		ifnlen = snprintf(workbuf, sizeof(workbuf),

sys/net/if_mib.c

@@ -90,6 +90,7 @@ sysctl_ifdata(SYSCTL_HANDLER_ARGS) /* XXX bad syntax! */
 		return ENOENT;
 
 	case IFDATA_GENERAL:
+		bzero(&ifmd, sizeof(ifmd));
 		ifnlen = snprintf(workbuf, sizeof(workbuf),
 		    "%s%d", ifp->if_name, ifp->if_unit);
 		if(ifnlen + 1 > sizeof ifmd.ifmd_name) {