Fix logic error in sshd(8) concerning the handling of failed

attempts to bind ports for X11 forwarding. Security: FreeBSD-SA-08:05.openssh Approved by: so (cperciva)
Fix sendfile(2) write-only file permission bypass. [08:03.sendfile]
2026-10-30 12:25:10 +01:00 · 2008-04-17 00:00:54 +00:00 · 2008-02-14 11:50:28 +00:00 · 2008-01-15 23:36:53 +00:00 · 2008-01-14 22:57:19 +00:00 · 2007-11-29 16:09:26 +00:00
96 changed files with 1514 additions and 2178 deletions
@@ -1,12 +0,0 @@
-$FreeBSD$
-
-This file documents formal review/approval requirements that have been
-approved by core.
-
-subsystem       login   expires  notes
--------------------------------------
-
-Special cases:
-src/*	RELENG_4_*	Requires Security Officer approval.
-src/*	RELENG_5_*	Requires Security Officer approval.
-src/*	RELENG_6_*	Requires Security Officer approval.
@@ -83,7 +83,7 @@ CLEANDIR=	cleandir
 .endif

 CVS?=		cvs
-CVSFLAGS?=	-r RELENG_5 -P -d -I!
+CVSFLAGS?=	-r RELENG_5_5 -P -d -I!
 SUP?=		/usr/local/bin/cvsup
 SUPFLAGS?=	-g -L 2 -P -
 .if defined(SUPHOST)
@@ -8,6 +8,101 @@ Items affecting the ports and packages system can be found in
 /usr/ports/UPDATING.  Please read that file before running
 portupgrade.

+20080416:	p20	FreeBSD-SA-08:05.openssh
+	Fix logic error in sshd(8) concerning the handling of failed
+	attempts to bind ports for X11 forwarding.
+
+20080214:	p19	FreeBSD-SA-08:02.sendfile, FreeBSD-SA-08:03.ipsec
+	Fix sendfile(2) write-only file permission bypass. [08:02]
+
+	Fix IPsec null pointer dereference panic. [08:03]
+
+20080114:	p18	FreeBSD-SA-08:01.pty
+	Fix issues which allow snooping on ptys.
+
+20071129:	p17	FreeBSD-SA-07:09.random, FreeBSD-SA-07:10.gtar
+	Correct a random value disclosure in random(4). [07:09]
+
+	Correct a gtar directory traversal vulnerability. [07:10]
+
+20071003:	p16	FreeBSD-SA-07:08.openssl
+	Correct a buffer overflow in OpenSSL SSL_get_shared_ciphers().
+
+20070801:	p15	FreeBSD-SA-07:01.jail, FreeBSD-SA-07:06.tcpdump,
+			FreeBSD-SA-07:07.bind
+	Correct a bug in the patch for FreeBSD-SA-07:01.jail. [07:01]
+
+	Correct a buffer overflow in tcpdump(1). [07:06]
+
+	Correct predictable query ids in named(8). [07:07]
+
+20070712:	p14	FreeBSD-SA-07:05.libarchive
+	Correct multiple security issues in how libarchive handles
+	corrupt tar archives, including a potentially exploitable
+	buffer overflow.
+
+20070523:	p13	FreeBSD-SA-07:04.file
+	Fix buffer overflow in libmagic(3).
+
+20070426:	p12	FreeBSD-SA-07:03.ipv6
+	Disable processing of IPv6 type 0 Routing Headers.  This behaviour
+	can be changed via the (newly added) net.inet6.ip6.rthdr0_allowed
+	sysctl.
+
+20070209:	p11	FreeBSD-SA-07:02.bind
+	Correct two remote denials of service in BIND involving DNSSEC and
+	recursive DNS queries respectively.
+
+20070111:	p10	FreeBSD-SA-07:01.jail
+	Correct jail rc.d script privilege escalation.
+
+20061206:	p9	FreeBSD-SA-06:25.kmem, FreeBSD-SA-06.26.gtar
+	Correct a signedness bug which allowed members of the operator
+	group to read kernel memory. [06:25]
+
+	Disable handling of GNUTYPE_NAMES tar file entries by default,
+	since they can be used to extract files outside of the cwd. [06:26]
+
+20060930:	p8	FreeBSD-SA-06:22.openssh
+	Correct multiple vulnerabilities in sshd(8).
+
+20060929:	p7	FreeBSD-SA-06:23.openssl
+	Correct problem in the 2006-09-28 patch concerning the handling of
+	excessively large DH moduli.
+
+20060928:	p6	FreeBSD-SA-06:23.openssl
+	Correct multiple vulnerabilities in crypto(3).
+	Limit the size of public keys used in order to protect applications
+	from a denial of service via insane key sizes.
+
+20060919:	p5	FreeBSD-SA-06:21.gzip
+	Correct multiple vulnerabilities in gzip(1).
+
+20060906:	p4	FreeBSD-SA-06:19.openssl, FreeBSD-SA-06:20.bind
+	Correct incorrect PKCS#1 v1.5 padding validation in
+	crypto(3). [06:19]
+
+	Correct multiple denial-of-service vulnerabilities in BIND related to
+	SIG Query Processing and Excessive Recursive Queries. [06:20]
+
+20060823:	p3	FreeBSD-SA-06:18.ppp
+	Correct buffer overflow in the handling of LCP options in ppp(4).
+
+20060614:	p2	FreeBSD-SA-06:17.sendmail
+	Correct a bug in the handling of multipart messages by sendmail(8)
+	which can allow a malformed message to crash a sendmail queue
+	processing process.
+
+20060531:	p1	FreeBSD-SA-06:15.ypserv, FreeBSD-SA-06:16.smbfs
+	Enable inadvertantly disabled "securenet" access controls in
+	ypserv. [06:15]
+
+	Correct a bug in the handling of backslash characters in smbfs
+	which can allow an attacker to escape from a chroot(2). [06:16]
+
+20060525:
+	FreeBSD 5.5-RELEASE
+
 20060127:
 	The i386 loader(8) now defaults to the serial speed set by the
 	previous boot stage, if the comconsole is already in use.  If
@@ -1271,6 +1271,14 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		}
 	}

+	/*
+	 * Hash the incoming request here as it is after
+	 * dns_dispatch_importrecv().
+	 */
+	dns_dispatch_hash(&client->now, sizeof(client->now));
+	dns_dispatch_hash(isc_buffer_base(buffer),
+			  isc_buffer_usedlength(buffer));
+
 	/*
 	 * It's a request.  Parse it.
 	 */
@@ -2393,7 +2393,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		is_zone = ISC_FALSE;

 		qtype = event->qtype;
-		if (qtype == dns_rdatatype_rrsig)
+		if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
 			type = dns_rdatatype_any;
 		else
 			type = qtype;
@@ -2434,7 +2434,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	/*
 	 * If it's a SIG query, we'll iterate the node.
 	 */
-	if (qtype == dns_rdatatype_rrsig)
+	if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
 		type = dns_rdatatype_any;
 	else
 		type = qtype;
@@ -20,14 +20,16 @@
 #include <config.h>

 #include <stdlib.h>
+#include <sys/types.h>
+#include <unistd.h>

 #include <isc/entropy.h>
-#include <isc/lfsr.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/print.h>
 #include <isc/string.h>
 #include <isc/task.h>
+#include <isc/time.h>
 #include <isc/util.h>

 #include <dns/acl.h>
@@ -41,13 +43,22 @@

 typedef ISC_LIST(dns_dispentry_t)	dns_displist_t;

+typedef struct dns_nsid {
+	isc_uint16_t	nsid_state;
+	isc_uint16_t	*nsid_vtable;
+	isc_uint16_t	*nsid_pool;
+	isc_uint16_t	nsid_a1, nsid_a2, nsid_a3;
+	isc_uint16_t	nsid_c1, nsid_c2, nsid_c3;
+	isc_uint16_t	nsid_state2;
+	isc_boolean_t	nsid_usepool;
+} dns_nsid_t;
+
 typedef struct dns_qid {
 	unsigned int	magic;
 	unsigned int	qid_nbuckets;	/* hash table size */
 	unsigned int	qid_increment;	/* id increment on collision */
 	isc_mutex_t	lock;
-	isc_lfsr_t	qid_lfsr1;	/* state generator info */
-	isc_lfsr_t	qid_lfsr2;	/* state generator info */
+	dns_nsid_t	nsid;
 	dns_displist_t	*qid_table;	/* the table itself */
 } dns_qid_t;

@@ -156,7 +167,7 @@ static void destroy_disp(isc_task_t *task, isc_event_t *event);
 static void udp_recv(isc_task_t *, isc_event_t *);
 static void tcp_recv(isc_task_t *, isc_event_t *);
 static void startrecv(dns_dispatch_t *);
-static dns_messageid_t dns_randomid(dns_qid_t *);
+static dns_messageid_t dns_randomid(dns_nsid_t *);
 static isc_uint32_t dns_hash(dns_qid_t *, isc_sockaddr_t *, dns_messageid_t);
 static void free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len);
 static void *allocate_udp_buffer(dns_dispatch_t *disp);
@@ -177,8 +188,12 @@ static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr,
 static isc_boolean_t destroy_mgr_ok(dns_dispatchmgr_t *mgr);
 static void destroy_mgr(dns_dispatchmgr_t **mgrp);
 static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
-				 unsigned int increment, dns_qid_t **qidp);
+				 unsigned int increment, isc_boolean_t usepool,
+				 dns_qid_t **qidp);
 static void qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp);
+static isc_uint16_t nsid_next(dns_nsid_t *nsid);
+static isc_result_t nsid_init(isc_mem_t *mctx, dns_nsid_t *nsid, isc_boolean_t usepool);
+static void nsid_destroy(isc_mem_t *mctx, dns_nsid_t *nsid);

 #define LVL(x) ISC_LOG_DEBUG(x)

@@ -258,38 +273,16 @@ request_log(dns_dispatch_t *disp, dns_dispentry_t *resp,
 	}
 }

-static void
-reseed_lfsr(isc_lfsr_t *lfsr, void *arg)
-{
-	dns_dispatchmgr_t *mgr = arg;
-	isc_result_t result;
-	isc_uint32_t val;
-
-	REQUIRE(VALID_DISPATCHMGR(mgr));
-
-	if (mgr->entropy != NULL) {
-		result = isc_entropy_getdata(mgr->entropy, &val, sizeof(val),
-					     NULL, 0);
-		INSIST(result == ISC_R_SUCCESS);
-		lfsr->count = (val & 0x1f) + 32;
-		lfsr->state = val;
-		return;
-	}
-
-	lfsr->count = (random() & 0x1f) + 32;	/* From 32 to 63 states */
-	lfsr->state = random();
-}
-
 /*
 * Return an unpredictable message ID.
 */
 static dns_messageid_t
-dns_randomid(dns_qid_t *qid) {
+dns_randomid(dns_nsid_t *nsid) {
 	isc_uint32_t id;

-	id = isc_lfsr_generate32(&qid->qid_lfsr1, &qid->qid_lfsr2);
+	id = nsid_next(nsid);

-	return (dns_messageid_t)(id & 0xFFFF);
+	return ((dns_messageid_t)id);
 }

 /*
@@ -629,6 +622,9 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		goto restart;
 	}

+	dns_dispatch_hash(&ev->timestamp, sizeof(&ev->timestamp));
+	dns_dispatch_hash(ev->region.base, ev->region.length);
+
 	/* response */
 	bucket = dns_hash(qid, &ev->address, id);
 	LOCK(&qid->lock);
@@ -819,6 +815,8 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		goto restart;
 	}

+	dns_dispatch_hash(tcpmsg->buffer.base, tcpmsg->buffer.length);
+
 	/*
 	 * Response.
 	 */
@@ -1202,7 +1200,7 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr,
 	isc_mempool_setmaxalloc(mgr->bpool, maxbuffers);
 	isc_mempool_associatelock(mgr->bpool, &mgr->pool_lock);

-	result = qid_allocate(mgr, buckets, increment, &mgr->qid);
+	result = qid_allocate(mgr, buckets, increment, ISC_TRUE, &mgr->qid);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;

@@ -1348,7 +1346,7 @@ dispatch_find(dns_dispatchmgr_t *mgr, isc_sockaddr_t *local,

 static isc_result_t
 qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
-	     unsigned int increment, dns_qid_t **qidp)
+	     unsigned int increment, isc_boolean_t usepool, dns_qid_t **qidp)
 {
 	dns_qid_t *qid;
 	unsigned int i;
@@ -1369,8 +1367,16 @@ qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
 		return (ISC_R_NOMEMORY);
 	}

+	if (nsid_init(mgr->mctx, &qid->nsid, usepool) != ISC_R_SUCCESS) {
+		isc_mem_put(mgr->mctx, qid->qid_table,
+			    buckets * sizeof(dns_displist_t));
+		isc_mem_put(mgr->mctx, qid, sizeof(*qid));
+		return (ISC_R_NOMEMORY);
+	}
+
 	if (isc_mutex_init(&qid->lock) != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_mutex_init failed");
+		nsid_destroy(mgr->mctx, &qid->nsid);
 		isc_mem_put(mgr->mctx, qid->qid_table,
 			    buckets * sizeof(dns_displist_t));
 		isc_mem_put(mgr->mctx, qid, sizeof(*qid));
@@ -1383,21 +1389,6 @@ qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
 	qid->qid_nbuckets = buckets;
 	qid->qid_increment = increment;
 	qid->magic = QID_MAGIC;
-
-	/*
-	 * Initialize to a 32-bit LFSR.  Both of these are from Applied
-	 * Cryptography.
-	 *
-	 * lfsr1:
-	 *	x^32 + x^7 + x^5 + x^3 + x^2 + x + 1
-	 *
-	 * lfsr2:
-	 *	x^32 + x^7 + x^6 + x^2 + 1
-	 */
-	isc_lfsr_init(&qid->qid_lfsr1, 0, 32, 0x80000057U,
-		      0, reseed_lfsr, mgr);
-	isc_lfsr_init(&qid->qid_lfsr2, 0, 32, 0x80000062U,
-		      0, reseed_lfsr, mgr);
 	*qidp = qid;
 	return (ISC_R_SUCCESS);
 }
@@ -1413,6 +1404,7 @@ qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp) {

 	*qidp = NULL;
 	qid->magic = 0;
+	nsid_destroy(mctx, &qid->nsid);
 	isc_mem_put(mctx, qid->qid_table,
 		    qid->qid_nbuckets * sizeof(dns_displist_t));
 	DESTROYLOCK(&qid->lock);
@@ -1556,7 +1548,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 		return (result);
 	}

-	result = qid_allocate(mgr, buckets, increment, &disp->qid);
+	result = qid_allocate(mgr, buckets, increment, ISC_FALSE, &disp->qid);
 	if (result != ISC_R_SUCCESS)
 		goto deallocate_dispatch;

@@ -1854,7 +1846,7 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 	 */
 	qid = DNS_QID(disp);
 	LOCK(&qid->lock);
-	id = dns_randomid(qid);
+	id = dns_randomid(&qid->nsid);
 	bucket = dns_hash(qid, dest, id);
 	ok = ISC_FALSE;
 	for (i = 0; i < 64; i++) {
@@ -2197,3 +2189,409 @@ dns_dispatchmgr_dump(dns_dispatchmgr_t *mgr) {
 	}
 }
 #endif
+
+/*
+ * Allow the user to pick one of two ID randomization algorithms.
+ *
+ * The first algorithm is an adaptation of the sequence shuffling
+ * algorithm discovered by Carter Bays and S. D. Durham [ACM Trans. Math.
+ * Software 2 (1976), 59-64], as documented as Algorithm B in Chapter
+ * 3.2.2 in Volume 2 of Knuth's "The Art of Computer Programming".  We use
+ * a randomly selected linear congruential random number generator with a
+ * modulus of 2^16, whose increment is a randomly picked odd number, and
+ * whose multiplier is picked from a set which meets the following
+ * criteria:
+ *     Is of the form 8*n+5, which ensures "high potency" according to
+ *     principle iii in the summary chapter 3.6.  This form also has a
+ *     gcd(a-1,m) of 4 which is good according to principle iv.
+ *
+ *     Is between 0.01 and 0.99 times the modulus as specified by
+ *     principle iv.
+ *
+ *     Passes the spectral test "with flying colors" (ut >= 1) in
+ *     dimensions 2 through 6 as calculated by Algorithm S in Chapter
+ *     3.3.4 and the ratings calculated by formula 35 in section E.
+ *
+ *     Of the multipliers that pass this test, pick the set that is
+ *     best according to the theoretical bounds of the serial
+ *     correlation test.  This was calculated using a simplified
+ *     version of Knuth's Theorem K in Chapter 3.3.3.
+ *
+ * These criteria may not be important for this use, but we might as well
+ * pick from the best generators since there are so many possible ones and
+ * we don't have that many random bits to do the picking.
+ *
+ * We use a modulus of 2^16 instead of something bigger so that we will
+ * tend to cycle through all the possible IDs before repeating any,
+ * however the shuffling will perturb this somewhat.  Theoretically there
+ * is no minimimum interval between two uses of the same ID, but in
+ * practice it seems to be >64000.
+ *
+ * Our adaptatation  of Algorithm B mixes the hash state which has
+ * captured various random events into the shuffler to perturb the
+ * sequence.
+ *
+ * One disadvantage of this algorithm is that if the generator parameters
+ * were to be guessed, it would be possible to mount a limited brute force
+ * attack on the ID space since the IDs are only shuffled within a limited
+ * range.
+ *
+ * The second algorithm uses the same random number generator to populate
+ * a pool of 65536 IDs.  The hash state is used to pick an ID from a window
+ * of 4096 IDs in this pool, then the chosen ID is swapped with the ID
+ * at the beginning of the window and the window position is advanced.
+ * This means that the interval between uses of the ID will be no less
+ * than 65536-4096.  The ID sequence in the pool will become more random
+ * over time.
+ *
+ * For both algorithms, two more linear congruential random number generators
+ * are selected.  The ID from the first part of algorithm is used to seed
+ * the first of these generators, and its output is used to seed the second.
+ * The strategy is use these generators as 1 to 1 hashes to obfuscate the
+ * properties of the generator used in the first part of either algorithm.
+ *
+ * The first algorithm may be suitable for use in a client resolver since
+ * its memory requirements are fairly low and it's pretty random out of
+ * the box.  It is somewhat succeptible to a limited brute force attack,
+ * so the second algorithm is probably preferable for a longer running
+ * program that issues a large number of queries and has time to randomize
+ * the pool.
+ */
+
+#define NSID_SHUFFLE_TABLE_SIZE 100 /* Suggested by Knuth */
+/*
+ * Pick one of the next 4096 IDs in the pool.
+ * There is a tradeoff here between randomness and how often and ID is reused.
+ */
+#define NSID_LOOKAHEAD 4096     /* Must be a power of 2 */
+#define NSID_SHUFFLE_ONLY 1     /* algorithm 1 */
+#define NSID_USE_POOL 2         /* algorithm 2 */
+#define NSID_HASHSHIFT       3
+#define NSID_HASHROTATE(v) \
+        (((v) << NSID_HASHSHIFT) | ((v) >> ((sizeof(v) * 8) - NSID_HASHSHIFT)))
+
+static isc_uint32_t	nsid_hash_state;
+
+/*
+ * Keep a running hash of various bits of data that we'll use to
+ * stir the ID pool or perturb the ID generator
+ */
+static void
+nsid_hash(void *data, size_t len) {
+	unsigned char *p = data;
+	/*
+	 * Hash function similar to the one we use for hashing names.
+	 * We don't fold case or toss the upper bit here, though.
+	 * This hash doesn't do much interesting when fed binary zeros,
+	 * so there may be a better hash function.
+	 * This function doesn't need to be very strong since we're
+	 * only using it to stir the pool, but it should be reasonably
+	 * fast.
+	 */
+	/*
+	 * We don't care about locking access to nsid_hash_state.
+	 * In fact races make the result even more non deteministic.
+	 */
+	while (len-- > 0U) {
+		nsid_hash_state = NSID_HASHROTATE(nsid_hash_state);
+		nsid_hash_state += *p++;
+	}
+}
+
+/*
+ * Table of good linear congruential multipliers for modulus 2^16
+ * in order of increasing serial correlation bounds (so trim from
+ * the end).
+ */
+static const isc_uint16_t nsid_multiplier_table[] = {
+	17565, 25013, 11733, 19877, 23989, 23997, 24997, 25421,
+	26781, 27413, 35901, 35917, 35973, 36229, 38317, 38437,
+	39941, 40493, 41853, 46317, 50581, 51429, 53453, 53805,
+	11317, 11789, 12045, 12413, 14277, 14821, 14917, 18989,
+	19821, 23005, 23533, 23573, 23693, 27549, 27709, 28461,
+	29365, 35605, 37693, 37757, 38309, 41285, 45261, 47061,
+	47269, 48133, 48597, 50277, 50717, 50757, 50805, 51341,
+	51413, 51581, 51597, 53445, 11493, 14229, 20365, 20653,
+	23485, 25541, 27429, 29421, 30173, 35445, 35653, 36789,
+	36797, 37109, 37157, 37669, 38661, 39773, 40397, 41837,
+	41877, 45293, 47277, 47845, 49853, 51085, 51349, 54085,
+	56933,  8877,  8973,  9885, 11365, 11813, 13581, 13589,
+	13613, 14109, 14317, 15765, 15789, 16925, 17069, 17205,
+	17621, 17941, 19077, 19381, 20245, 22845, 23733, 24869,
+	25453, 27213, 28381, 28965, 29245, 29997, 30733, 30901,
+	34877, 35485, 35613, 36133, 36661, 36917, 38597, 40285,
+	40693, 41413, 41541, 41637, 42053, 42349, 45245, 45469,
+	46493, 48205, 48613, 50861, 51861, 52877, 53933, 54397,
+	55669, 56453, 56965, 58021,  7757,  7781,  8333,  9661,
+	12229, 14373, 14453, 17549, 18141, 19085, 20773, 23701,
+	24205, 24333, 25261, 25317, 27181, 30117, 30477, 34757,
+	34885, 35565, 35885, 36541, 37957, 39733, 39813, 41157,
+	41893, 42317, 46621, 48117, 48181, 49525, 55261, 55389,
+	56845,  7045,  7749,  7965,  8469,  9133,  9549,  9789,
+	10173, 11181, 11285, 12253, 13453, 13533, 13757, 14477,
+	15053, 16901, 17213, 17269, 17525, 17629, 18605, 19013,
+	19829, 19933, 20069, 20093, 23261, 23333, 24949, 25309,
+	27613, 28453, 28709, 29301, 29541, 34165, 34413, 37301,
+	37773, 38045, 38405, 41077, 41781, 41925, 42717, 44437,
+	44525, 44613, 45933, 45941, 47077, 50077, 50893, 52117,
+	 5293, 55069, 55989, 58125, 59205,  6869, 14685, 15453,
+	16821, 17045, 17613, 18437, 21029, 22773, 22909, 25445,
+	25757, 26541, 30709, 30909, 31093, 31149, 37069, 37725,
+	37925, 38949, 39637, 39701, 40765, 40861, 42965, 44813,
+	45077, 45733, 47045, 50093, 52861, 52957, 54181, 56325,
+	56365, 56381, 56877, 57013,  5741, 58101, 58669,  8613,
+	10045, 10261, 10653, 10733, 11461, 12261, 14069, 15877,
+	17757, 21165, 23885, 24701, 26429, 26645, 27925, 28765,
+	29197, 30189, 31293, 39781, 39909, 40365, 41229, 41453,
+	41653, 42165, 42365, 47421, 48029, 48085, 52773,  5573,
+	57037, 57637, 58341, 58357, 58901,  6357,  7789,  9093,
+	10125, 10709, 10765, 11957, 12469, 13437, 13509, 14773,
+	15437, 15773, 17813, 18829, 19565, 20237, 23461, 23685,
+	23725, 23941, 24877, 25461, 26405, 29509, 30285, 35181,
+	37229, 37893, 38565, 40293, 44189, 44581, 45701, 47381,
+	47589, 48557,  4941, 51069,  5165, 52797, 53149,  5341,
+	56301, 56765, 58581, 59493, 59677,  6085,  6349,  8293,
+	 8501,  8517, 11597, 11709, 12589, 12693, 13517, 14909,
+	17397, 18085, 21101, 21269, 22717, 25237, 25661, 29189,
+	30101, 31397, 33933, 34213, 34661, 35533, 36493, 37309,
+	40037,  4189, 42909, 44309, 44357, 44389,  4541, 45461,
+	46445, 48237, 54149, 55301, 55853, 56621, 56717, 56901,
+	 5813, 58437, 12493, 15365, 15989, 17829, 18229, 19341,
+	21013, 21357, 22925, 24885, 26053, 27581, 28221, 28485,
+	30605, 30613, 30789, 35437, 36285, 37189,  3941, 41797,
+	 4269, 42901, 43293, 44645, 45221, 46893,  4893, 50301,
+	50325,  5189, 52109, 53517, 54053, 54485,  5525, 55949,
+	56973, 59069, 59421, 60733, 61253,  6421,  6701,  6709,
+	 7101,  8669, 15797, 19221, 19837, 20133, 20957, 21293,
+	21461, 22461, 29085, 29861, 30869, 34973, 36469, 37565,
+	38125, 38829, 39469, 40061, 40117, 44093, 47429, 48341,
+	50597, 51757,  5541, 57629, 58405, 59621, 59693, 59701,
+	61837,  7061, 10421, 11949, 15405, 20861, 25397, 25509,
+	25893, 26037, 28629, 28869, 29605, 30213, 34205, 35637,
+	36365, 37285,  3773, 39117,  4021, 41061, 42653, 44509,
+	 4461, 44829,  4725,  5125, 52269, 56469, 59085,  5917,
+	60973,  8349, 17725, 18637, 19773, 20293, 21453, 22533,
+	24285, 26333, 26997, 31501, 34541, 34805, 37509, 38477,
+	41333, 44125, 46285, 46997, 47637, 48173,  4925, 50253,
+	50381, 50917, 51205, 51325, 52165, 52229,  5253,  5269,
+	53509, 56253, 56341,  5821, 58373, 60301, 61653, 61973,
+	62373,  8397, 11981, 14341, 14509, 15077, 22261, 22429,
+	24261, 28165, 28685, 30661, 34021, 34445, 39149,  3917,
+	43013, 43317, 44053, 44101,  4533, 49541, 49981,  5277,
+	54477, 56357, 57261, 57765, 58573, 59061, 60197, 61197,
+	62189,  7725,  8477,  9565, 10229, 11437, 14613, 14709,
+	16813, 20029, 20677, 31445,  3165, 31957,  3229, 33541,
+	36645,  3805, 38973,  3965,  4029, 44293, 44557, 46245,
+	48917,  4909, 51749, 53709, 55733, 56445,  5925,  6093,
+	61053, 62637,  8661,  9109, 10821, 11389, 13813, 14325,
+	15501, 16149, 18845, 22669, 26437, 29869, 31837, 33709,
+	33973, 34173,  3677,  3877,  3981, 39885, 42117,  4421,
+	44221, 44245, 44693, 46157, 47309,  5005, 51461, 52037,
+	55333, 55693, 56277, 58949,  6205, 62141, 62469,  6293,
+	10101, 12509, 14029, 17997, 20469, 21149, 25221, 27109,
+	 2773,  2877, 29405, 31493, 31645,  4077, 42005, 42077,
+	42469, 42501, 44013, 48653, 49349,  4997, 50101, 55405,
+	56957, 58037, 59429, 60749, 61797, 62381, 62837,  6605,
+	10541, 23981, 24533,  2701, 27333, 27341, 31197, 33805,
+	 3621, 37381,  3749,  3829, 38533, 42613, 44381, 45901,
+	48517, 51269, 57725, 59461, 60045, 62029, 13805, 14013,
+	15461, 16069, 16157, 18573,  2309, 23501, 28645,  3077,
+	31541, 36357, 36877,  3789, 39429, 39805, 47685, 47949,
+	49413,  5485, 56757, 57549, 57805, 58317, 59549, 62213,
+	62613, 62853, 62933,  8909, 12941, 16677, 20333, 21541,
+	24429, 26077, 26421,  2885, 31269, 33381,  3661, 40925,
+	42925, 45173,  4525,  4709, 53133, 55941, 57413, 57797,
+	62125, 62237, 62733,  6773, 12317, 13197, 16533, 16933,
+	18245,  2213,  2477, 29757, 33293, 35517, 40133, 40749,
+	 4661, 49941, 62757,  7853,  8149,  8573, 11029, 13421,
+	21549, 22709, 22725, 24629,  2469, 26125,  2669, 34253,
+	36709, 41013, 45597, 46637, 52285, 52333, 54685, 59013,
+	60997, 61189, 61981, 62605, 62821,  7077,  7525,  8781,
+	10861, 15277,  2205, 22077, 28517, 28949, 32109, 33493,
+	 4661, 49941, 62757,  7853,  8149,  8573, 11029, 13421,
+	21549, 22709, 22725, 24629,  2469, 26125,  2669, 34253,
+	36709, 41013, 45597, 46637, 52285, 52333, 54685, 59013,
+	60997, 61189, 61981, 62605, 62821,  7077,  7525,  8781,
+	10861, 15277,  2205, 22077, 28517, 28949, 32109, 33493,
+	 3685, 39197, 39869, 42621, 44997, 48565,  5221, 57381,
+	61749, 62317, 63245, 63381, 23149,  2549, 28661, 31653,
+	33885, 36341, 37053, 39517, 42805, 45853, 48997, 59349,
+	60053, 62509, 63069,  6525,  1893, 20181,  2365, 24893,
+	27397, 31357, 32277, 33357, 34437, 36677, 37661, 43469,
+	43917, 50997, 53869,  5653, 13221, 16741, 17893,  2157,
+	28653, 31789, 35301, 35821, 61613, 62245, 12405, 14517,
+	17453, 18421,  3149,  3205, 40341,  4109, 43941, 46869,
+	48837, 50621, 57405, 60509, 62877,  8157, 12933, 12957,
+	16501, 19533,  3461, 36829, 52357, 58189, 58293, 63053,
+	17109,  1933, 32157, 37701, 59005, 61621, 13029, 15085,
+	16493, 32317, 35093,  5061, 51557, 62221, 20765, 24613,
+	 2629, 30861, 33197, 33749, 35365, 37933, 40317, 48045,
+	56229, 61157, 63797,  7917, 17965,  1917,  1973, 20301,
+	 2253, 33157, 58629, 59861, 61085, 63909,  8141,  9221,
+	14757,  1581, 21637, 26557, 33869, 34285, 35733, 40933,
+	42517, 43501, 53653, 61885, 63805,  7141, 21653, 54973,
+	31189, 60061, 60341, 63357, 16045,  2053, 26069, 33997,
+	43901, 54565, 63837,  8949, 17909, 18693, 32349, 33125,
+	37293, 48821, 49053, 51309, 64037,  7117,  1445, 20405,
+	23085, 26269, 26293, 27349, 32381, 33141, 34525, 36461,
+	37581, 43525,  4357, 43877,  5069, 55197, 63965,  9845,
+	12093,  2197,  2229, 32165, 33469, 40981, 42397,  8749,
+	10853,  1453, 18069, 21693, 30573, 36261, 37421, 42533
+};
+
+#define NSID_MULT_TABLE_SIZE \
+        ((sizeof nsid_multiplier_table)/(sizeof nsid_multiplier_table[0]))
+#define NSID_RANGE_MASK (NSID_LOOKAHEAD - 1)
+#define NSID_POOL_MASK 0xFFFF /* used to wrap the pool index */
+#define NSID_SHUFFLE_ONLY 1
+#define NSID_USE_POOL 2
+
+static isc_uint16_t
+nsid_next(dns_nsid_t *nsid) {
+        isc_uint16_t id, compressed_hash;
+	isc_uint16_t j;
+
+        compressed_hash = ((nsid_hash_state >> 16) ^
+			   (nsid_hash_state)) & 0xFFFF;
+
+	if (nsid->nsid_usepool) {
+	        isc_uint16_t pick;
+
+                pick = compressed_hash & NSID_RANGE_MASK;
+		pick = (nsid->nsid_state + pick) & NSID_POOL_MASK;
+                id = nsid->nsid_pool[pick];
+                if (pick != 0) {
+                        /* Swap two IDs to stir the pool */
+                        nsid->nsid_pool[pick] =
+                                nsid->nsid_pool[nsid->nsid_state];
+                        nsid->nsid_pool[nsid->nsid_state] = id;
+                }
+
+                /* increment the base pointer into the pool */
+                if (nsid->nsid_state == 65535)
+                        nsid->nsid_state = 0;
+                else
+                        nsid->nsid_state++;
+	} else {
+		/*
+		 * This is the original Algorithm B
+		 * j = ((u_long) NSID_SHUFFLE_TABLE_SIZE * nsid_state2) >> 16;
+		 *
+		 * We'll perturb it with some random stuff  ...
+		 */
+		j = ((isc_uint32_t) NSID_SHUFFLE_TABLE_SIZE *
+		     (nsid->nsid_state2 ^ compressed_hash)) >> 16;
+		nsid->nsid_state2 = id = nsid->nsid_vtable[j];
+		nsid->nsid_state = (((isc_uint32_t) nsid->nsid_a1 * nsid->nsid_state) +
+				      nsid->nsid_c1) & 0xFFFF;
+		nsid->nsid_vtable[j] = nsid->nsid_state;
+	}
+
+        /* Now lets obfuscate ... */
+        id = (((isc_uint32_t) nsid->nsid_a2 * id) + nsid->nsid_c2) & 0xFFFF;
+        id = (((isc_uint32_t) nsid->nsid_a3 * id) + nsid->nsid_c3) & 0xFFFF;
+
+        return (id);
+}
+
+static isc_result_t
+nsid_init(isc_mem_t *mctx, dns_nsid_t *nsid, isc_boolean_t usepool) {
+        isc_time_t now;
+        pid_t mypid;
+        isc_uint16_t a1ndx, a2ndx, a3ndx, c1ndx, c2ndx, c3ndx;
+        int i;
+
+	isc_time_now(&now);
+        mypid = getpid();
+
+        /* Initialize the state */
+	memset(nsid, 0, sizeof(*nsid));
+        nsid_hash(&now, sizeof now);
+        nsid_hash(&mypid, sizeof mypid);
+
+        /*
+         * Select our random number generators and initial seed.
+         * We could really use more random bits at this point,
+         * but we'll try to make a silk purse out of a sows ear ...
+         */
+        /* generator 1 */
+        a1ndx = ((isc_uint32_t) NSID_MULT_TABLE_SIZE *
+                 (nsid_hash_state & 0xFFFF)) >> 16;
+        nsid->nsid_a1 = nsid_multiplier_table[a1ndx];
+        c1ndx = (nsid_hash_state >> 9) & 0x7FFF;
+        nsid->nsid_c1 = 2 * c1ndx + 1;
+
+        /* generator 2, distinct from 1 */
+        a2ndx = ((isc_uint32_t) (NSID_MULT_TABLE_SIZE - 1) *
+                 ((nsid_hash_state >> 10) & 0xFFFF)) >> 16;
+        if (a2ndx >= a1ndx)
+                a2ndx++;
+        nsid->nsid_a2 = nsid_multiplier_table[a2ndx];
+        c2ndx = nsid_hash_state % 32767;
+        if (c2ndx >= c1ndx)
+                c2ndx++;
+        nsid->nsid_c2 = 2*c2ndx + 1;
+
+        /* generator 3, distinct from 1 and 2 */
+        a3ndx = ((isc_uint32_t) (NSID_MULT_TABLE_SIZE - 2) *
+                 ((nsid_hash_state >> 20) & 0xFFFF)) >> 16;
+        if (a3ndx >= a1ndx || a3ndx >= a2ndx)
+                a3ndx++;
+        if (a3ndx >= a1ndx && a3ndx >= a2ndx)
+                a3ndx++;
+        nsid->nsid_a3 = nsid_multiplier_table[a3ndx];
+        c3ndx = nsid_hash_state % 32766;
+        if (c3ndx >= c1ndx || c3ndx >= c2ndx)
+                c3ndx++;
+        if (c3ndx >= c1ndx && c3ndx >= c2ndx)
+                c3ndx++;
+        nsid->nsid_c3 = 2*c3ndx + 1;
+
+        nsid->nsid_state =
+		((nsid_hash_state >> 16) ^ (nsid_hash_state)) & 0xFFFF;
+
+	nsid->nsid_usepool = usepool;
+	if (nsid->nsid_usepool) {
+                nsid->nsid_pool = isc_mem_get(mctx, 0x10000 * sizeof(isc_uint16_t));
+		if (nsid->nsid_pool == NULL)
+			return (ISC_R_NOMEMORY);
+                for (i = 0; ; i++) {
+                        nsid->nsid_pool[i] = nsid->nsid_state;
+                        nsid->nsid_state =
+				 (((u_long) nsid->nsid_a1 * nsid->nsid_state) +
+				   nsid->nsid_c1) & 0xFFFF;
+                        if (i == 0xFFFF)
+                                break;
+                }
+	} else {
+		nsid->nsid_vtable = isc_mem_get(mctx, NSID_SHUFFLE_TABLE_SIZE *
+						(sizeof(isc_uint16_t)) );
+		if (nsid->nsid_vtable == NULL)
+			return (ISC_R_NOMEMORY);
+
+		for (i = 0; i < NSID_SHUFFLE_TABLE_SIZE; i++) {
+			nsid->nsid_vtable[i] = nsid->nsid_state;
+			nsid->nsid_state =
+				   (((isc_uint32_t) nsid->nsid_a1 * nsid->nsid_state) +
+					 nsid->nsid_c1) & 0xFFFF;
+		}
+		nsid->nsid_state2 = nsid->nsid_state;
+	} 
+	return (ISC_R_SUCCESS);
+}
+
+static void
+nsid_destroy(isc_mem_t *mctx, dns_nsid_t *nsid) {
+	if (nsid->nsid_usepool)
+		isc_mem_put(mctx, nsid->nsid_pool,
+			    0x10000 * sizeof(isc_uint16_t));
+	else
+		isc_mem_put(mctx, nsid->nsid_vtable,
+			    NSID_SHUFFLE_TABLE_SIZE * (sizeof(isc_uint16_t)) );
+	memset(nsid, 0, sizeof(*nsid));
+}
+
+void
+dns_dispatch_hash(void *data, size_t len) {
+	nsid_hash(data, len);
+}
@@ -437,6 +437,13 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event);
 * 	event != NULL
 */

+void
+dns_dispatch_hash(void *data, size_t len);
+/*%<
+ * Feed 'data' to the dispatch query id generator where 'len' is the size
+ * of 'data'.
+ */
+
 ISC_LANG_ENDDECLS

 #endif /* DNS_DISPATCH_H */
@@ -129,6 +129,7 @@ struct dns_validator {
 };

 #define DNS_VALIDATOR_DLV 1
+#define DNS_VALIDATOR_DEFER 2

 ISC_LANG_BEGINDECLS

@@ -172,6 +173,15 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 * part of a known insecure domain.
 */

+void
+dns_validator_send(dns_validator_t *validator);
+/*%<
+ * Send a deferred validation request
+ *
+ * Requires:
+ *	'validator' to points to a valid DNSSEC validator.
+ */
+
 void
 dns_validator_cancel(dns_validator_t *validator);
 /*
@@ -215,6 +215,11 @@ struct fetchctx {
 	dns_name_t 			nsname; 
 	dns_fetch_t *			nsfetch;
 	dns_rdataset_t			nsrrset;
+
+	/*%
+	 * Number of queries that reference this context.
+	 */
+	unsigned int			nqueries;
 };

 #define FCTX_MAGIC			ISC_MAGIC('F', '!', '!', '!')
@@ -348,6 +353,7 @@ static isc_result_t ncache_adderesult(dns_message_t *message,
 				      dns_rdataset_t *ardataset,
 				      isc_result_t *eresultp);
 static void validated(isc_task_t *task, isc_event_t *event); 
+static void maybe_destroy(fetchctx_t *fctx);

 static isc_result_t
 valcreate(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, dns_name_t *name,
@@ -366,6 +372,9 @@ valcreate(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, dns_name_t *name,
 	valarg->fctx = fctx;
 	valarg->addrinfo = addrinfo;

+	if (!ISC_LIST_EMPTY(fctx->validators))
+		INSIST((valoptions & DNS_VALIDATOR_DEFER) != 0);
+
 	result = dns_validator_create(fctx->res->view, name, type, rdataset,
 				      sigrdataset, fctx->rmessage,
 				      valoptions, task, validated, valarg,
@@ -513,6 +522,9 @@ resquery_destroy(resquery_t **queryp) {

 	INSIST(query->tcpsocket == NULL);

+	query->fctx->nqueries--;
+	if (SHUTTINGDOWN(query->fctx))
+		maybe_destroy(query->fctx);	/* Locks bucket. */
 	query->magic = 0;
 	isc_mem_put(query->mctx, query, sizeof(*query));
 	*queryp = NULL;
@@ -762,7 +774,8 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
 		INSIST(result != ISC_R_SUCCESS ||
 		       dns_rdataset_isassociated(event->rdataset) ||
 		       fctx->type == dns_rdatatype_any ||
-		       fctx->type == dns_rdatatype_rrsig);
+		       fctx->type == dns_rdatatype_rrsig ||
+		       fctx->type == dns_rdatatype_sig);

 		isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event));
 	}
@@ -970,6 +983,8 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	if (result != ISC_R_SUCCESS)
 		return (result);

+	INSIST(ISC_LIST_EMPTY(fctx->validators));
+
 	dns_message_reset(fctx->rmessage, DNS_MESSAGE_INTENTPARSE);

 	query = isc_mem_get(res->mctx, sizeof(*query));
@@ -1083,6 +1098,7 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	}

 	ISC_LIST_APPEND(fctx->queries, query, link);
+	query->fctx->nqueries++;

 	return (ISC_R_SUCCESS);

@@ -1529,7 +1545,7 @@ fctx_finddone(isc_task_t *task, isc_event_t *event) {
 			want_done = ISC_TRUE;
 		}
 	} else if (SHUTTINGDOWN(fctx) && fctx->pending == 0 &&
-		   ISC_LIST_EMPTY(fctx->validators)) {
+		   fctx->nqueries == 0 && ISC_LIST_EMPTY(fctx->validators)) {
 		bucketnum = fctx->bucketnum;
 		LOCK(&res->buckets[bucketnum].lock);
 		/*
@@ -2383,8 +2399,8 @@ fctx_destroy(fetchctx_t *fctx) {
 	REQUIRE(ISC_LIST_EMPTY(fctx->finds));
 	REQUIRE(ISC_LIST_EMPTY(fctx->altfinds));
 	REQUIRE(fctx->pending == 0);
-	REQUIRE(ISC_LIST_EMPTY(fctx->validators));
 	REQUIRE(fctx->references == 0);
+	REQUIRE(ISC_LIST_EMPTY(fctx->validators));

 	FCTXTRACE("destroy");

@@ -2558,7 +2574,7 @@ fctx_doshutdown(isc_task_t *task, isc_event_t *event) {
 	}

 	if (fctx->references == 0 && fctx->pending == 0 &&
-	    ISC_LIST_EMPTY(fctx->validators))
+	    fctx->nqueries == 0 && ISC_LIST_EMPTY(fctx->validators))
 		bucket_empty = fctx_destroy(fctx);

 	UNLOCK(&res->buckets[bucketnum].lock);
@@ -2599,6 +2615,7 @@ fctx_start(isc_task_t *task, isc_event_t *event) {
 		 * pending ADB finds and no pending validations.
 		 */
 		INSIST(fctx->pending == 0);
+		INSIST(fctx->nqueries == 0);
 		INSIST(ISC_LIST_EMPTY(fctx->validators));
 		if (fctx->references == 0) {
 			/*
@@ -2760,6 +2777,7 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 	fctx->restarts = 0;
 	fctx->timeouts = 0;
 	fctx->attributes = 0;
+	fctx->nqueries = 0;

 	dns_name_init(&fctx->nsname, NULL);
 	fctx->nsfetch = NULL;
@@ -3082,12 +3100,21 @@ maybe_destroy(fetchctx_t *fctx) {
 	unsigned int bucketnum;
 	isc_boolean_t bucket_empty = ISC_FALSE;
 	dns_resolver_t *res = fctx->res;
+	dns_validator_t *validator;

 	REQUIRE(SHUTTINGDOWN(fctx));

-	if (fctx->pending != 0 || !ISC_LIST_EMPTY(fctx->validators))
+	if (fctx->pending != 0 || fctx->nqueries != 0)
 		return;

+	for (validator = ISC_LIST_HEAD(fctx->validators);
+	     validator != NULL;
+	     validator = ISC_LIST_HEAD(fctx->validators)) {
+		ISC_LIST_UNLINK(fctx->validators, validator, link);
+		dns_validator_cancel(validator);
+		dns_validator_destroy(&validator);
+	}
+
 	bucketnum = fctx->bucketnum;
 	LOCK(&res->buckets[bucketnum].lock);
 	if (fctx->references == 0)
@@ -3188,7 +3215,8 @@ validated(isc_task_t *task, isc_event_t *event) {
 	if (hevent != NULL) {
 		if (!negative && !chaining &&
 		    (fctx->type == dns_rdatatype_any ||
-		     fctx->type == dns_rdatatype_rrsig)) {
+		     fctx->type == dns_rdatatype_rrsig ||
+		     fctx->type == dns_rdatatype_sig)) {
 			/*
 			 * Don't bind rdatasets; the caller
 			 * will iterate the node.
@@ -3217,7 +3245,9 @@ validated(isc_task_t *task, isc_event_t *event) {
 		result = vevent->result;
 		add_bad(fctx, &addrinfo->sockaddr, result);
 		isc_event_free(&event);
-		if (sentresponse)
+		if (!ISC_LIST_EMPTY(fctx->validators))
+			dns_validator_send(ISC_LIST_HEAD(fctx->validators));
+		else if (sentresponse)
 			fctx_done(fctx, result);
 		else
 			fctx_try(fctx);
@@ -3306,12 +3336,14 @@ validated(isc_task_t *task, isc_event_t *event) {
 	if (!ISC_LIST_EMPTY(fctx->validators)) {
 		INSIST(!negative);
 		INSIST(fctx->type == dns_rdatatype_any ||
-		       fctx->type == dns_rdatatype_rrsig);
+		       fctx->type == dns_rdatatype_rrsig ||
+		       fctx->type == dns_rdatatype_sig);
 		/*
 		 * Don't send a response yet - we have
 		 * more rdatasets that still need to
 		 * be validated.
 		 */
+		dns_validator_send(ISC_LIST_HEAD(fctx->validators));
 		goto cleanup_event;
 	}

@@ -3455,14 +3487,15 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
 				return (result);
 			anodep = &event->node;
 			/*
-			 * If this is an ANY or SIG query, we're not going
-			 * to return any rdatasets, unless we encountered
+			 * If this is an ANY, SIG or RRSIG query, we're not
+			 * going to return any rdatasets, unless we encountered
 			 * a CNAME or DNAME as "the answer".  In this case,
 			 * we're going to return DNS_R_CNAME or DNS_R_DNAME
 			 * and we must set up the rdatasets.
 			 */
 			if ((fctx->type != dns_rdatatype_any &&
-			    fctx->type != dns_rdatatype_rrsig) ||
+			     fctx->type != dns_rdatatype_rrsig &&
+			     fctx->type != dns_rdatatype_sig) ||
 			    (name->attributes & DNS_NAMEATTR_CHAINING) != 0) {
 				ardataset = event->rdataset;
 				asigrdataset = event->sigrdataset;
@@ -3521,7 +3554,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
 		 */
 		if (secure_domain && rdataset->trust != dns_trust_glue) {
 			/*
-			 * SIGs are validated as part of validating the
+			 * RRSIGs are validated as part of validating the
 			 * type they cover.
 			 */
 			if (rdataset->type == dns_rdatatype_rrsig)
@@ -3591,7 +3624,8 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,

 			if (ANSWER(rdataset) && need_validation) {
 				if (fctx->type != dns_rdatatype_any &&
-				    fctx->type != dns_rdatatype_rrsig) {
+				    fctx->type != dns_rdatatype_rrsig &&
+				    fctx->type != dns_rdatatype_sig) {
 					/*
 					 * This is The Answer.  We will
 					 * validate it, but first we cache
@@ -3618,6 +3652,13 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
 							   rdataset,
 							   sigrdataset,
 							   valoptions, task);
+					/*
+					 * Defer any further validations.
+					 * This prevents multiple validators
+					 * from manipulating fctx->rmessage
+					 * simultaniously.
+					 */
+					valoptions |= DNS_VALIDATOR_DEFER;
 				}
 			} else if (CHAINING(rdataset)) {
 				if (rdataset->type == dns_rdatatype_cname)
@@ -3763,23 +3804,28 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 		  isc_result_t *eresultp)
 {
 	isc_result_t result;
+	dns_rdataset_t rdataset;
+
+	if (ardataset == NULL) {
+		dns_rdataset_init(&rdataset);
+		ardataset = &rdataset;
+	}
 	result = dns_ncache_add(message, cache, node, covers, now,
 				maxttl, ardataset);
-	if (result == DNS_R_UNCHANGED) {
+	if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
 		/*
-		 * The data in the cache are better than the negative cache
-		 * entry we're trying to add.
+		 * If the cache now contains a negative entry and we
+		 * care about whether it is DNS_R_NCACHENXDOMAIN or
+		 * DNS_R_NCACHENXRRSET then extract it.
 		 */
-		if (ardataset != NULL && ardataset->type == 0) {
+		if (ardataset->type == 0) {
 			/*
-			 * The cache data is also a negative cache
-			 * entry.
+			 * The cache data is a negative cache entry.
 			 */
 			if (NXDOMAIN(ardataset))
 				*eresultp = DNS_R_NCACHENXDOMAIN;
 			else
 				*eresultp = DNS_R_NCACHENXRRSET;
-			result = ISC_R_SUCCESS;
 		} else {
 			/*
 			 * Either we don't care about the nature of the
@@ -3791,14 +3837,11 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 			 * XXXRTH  There's a CNAME/DNAME problem here.
 			 */
 			*eresultp = ISC_R_SUCCESS;
-			result = ISC_R_SUCCESS;
 		}
-	} else if (result == ISC_R_SUCCESS) {
-		if (NXDOMAIN(ardataset))
-			*eresultp = DNS_R_NCACHENXDOMAIN;
-		else
-			*eresultp = DNS_R_NCACHENXRRSET;
+		result = ISC_R_SUCCESS;
 	}
+	if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset))
+		dns_rdataset_disassociate(ardataset);

 	return (result);
 }
@@ -6339,7 +6382,8 @@ dns_resolver_destroyfetch(dns_fetch_t **fetchp) {
 		/*
 		 * No one cares about the result of this fetch anymore.
 		 */
-		if (fctx->pending == 0 && ISC_LIST_EMPTY(fctx->validators) &&
+		if (fctx->pending == 0 && fctx->nqueries == 0 &&
+		    ISC_LIST_EMPTY(fctx->validators) &&
 		    SHUTTINGDOWN(fctx)) {
 			/*
 			 * This fctx is already shutdown; we were just
@@ -2632,7 +2632,8 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 	ISC_LINK_INIT(val, link);
 	val->magic = VALIDATOR_MAGIC;

-	isc_task_send(task, ISC_EVENT_PTR(&event));
+	if ((options & DNS_VALIDATOR_DEFER) == 0)
+		isc_task_send(task, ISC_EVENT_PTR(&event));

 	*validatorp = val;

@@ -2649,6 +2650,21 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 	return (result);
 }

+void
+dns_validator_send(dns_validator_t *validator) {
+	isc_event_t *event;
+	REQUIRE(VALID_VALIDATOR(validator));
+
+	LOCK(&validator->lock);
+
+	INSIST((validator->options & DNS_VALIDATOR_DEFER) != 0);
+	event = (isc_event_t *)validator->event;
+	validator->options &= ~DNS_VALIDATOR_DEFER;
+	UNLOCK(&validator->lock);
+
+	isc_task_send(validator->task, ISC_EVENT_PTR(&event));
+}
+
 void
 dns_validator_cancel(dns_validator_t *validator) {
 	REQUIRE(VALID_VALIDATOR(validator));
@@ -2663,6 +2679,12 @@ dns_validator_cancel(dns_validator_t *validator) {

 		if (validator->subvalidator != NULL)
 			dns_validator_cancel(validator->subvalidator);
+		if ((validator->options & DNS_VALIDATOR_DEFER) != 0) {
+			isc_task_t *task = validator->event->ev_sender;
+			validator->options &= ~DNS_VALIDATOR_DEFER;
+			isc_event_free((isc_event_t **)&validator->event);
+			isc_task_detach(&task);
+		}
 	}
 	UNLOCK(&validator->lock);
 }
@@ -225,7 +225,7 @@ struct magic_set {
 	/* Accumulation buffer */
 	char *buf;
 	char *ptr;
-	size_t len;
+	size_t left;
 	size_t size;
 	/* Printable buffer */
 	char *pbuf;
@@ -28,6 +28,7 @@
 */
 #include "file.h"
 #include "magic.h"
+#include <limits.h>
 #include <stdarg.h>
 #include <stdlib.h>
 #include <string.h>
@@ -43,27 +44,31 @@ protected int
 file_printf(struct magic_set *ms, const char *fmt, ...)
 {
 	va_list ap;
-	size_t len;
+	size_t len, size;
 	char *buf;

 	va_start(ap, fmt);

-	if ((len = vsnprintf(ms->o.ptr, ms->o.len, fmt, ap)) >= ms->o.len) {
+	if ((len = vsnprintf(ms->o.ptr, ms->o.left, fmt, ap)) >= ms->o.left) {
+		long diff;  /* XXX: really ptrdiff_t */
+
 		va_end(ap);
-		if ((buf = realloc(ms->o.buf, len + 1024)) == NULL) {
+		size = (ms->o.size - ms->o.left) + len + 1024;
+		if ((buf = realloc(ms->o.buf, size)) == NULL) {
 			file_oomem(ms);
 			return -1;
 		}
-		ms->o.ptr = buf + (ms->o.ptr - ms->o.buf);
+		diff = ms->o.ptr - ms->o.buf;
+		ms->o.ptr = buf + diff;
 		ms->o.buf = buf;
-		ms->o.len = ms->o.size - (ms->o.ptr - ms->o.buf);
-		ms->o.size = len + 1024;
+		ms->o.left = size - diff;
+		ms->o.size = size;

 		va_start(ap, fmt);
-		len = vsnprintf(ms->o.ptr, ms->o.len, fmt, ap);
+		len = vsnprintf(ms->o.ptr, ms->o.left, fmt, ap);
 	}
 	ms->o.ptr += len;
-	ms->o.len -= len;
+	ms->o.left -= len;
 	va_end(ap);
 	return 0;
 }
@@ -152,8 +157,8 @@ file_reset(struct magic_set *ms)
 protected const char *
 file_getbuffer(struct magic_set *ms)
 {
-	char *nbuf, *op, *np;
-	size_t nsize;
+	char *pbuf, *op, *np;
+	size_t psize, len;

 	if (ms->haderr)
 		return NULL;
@@ -161,14 +166,20 @@ file_getbuffer(struct magic_set *ms)
 	if (ms->flags & MAGIC_RAW)
 		return ms->o.buf;

-	nsize = ms->o.len * 4 + 1;
-	if (ms->o.psize < nsize) {
-		if ((nbuf = realloc(ms->o.pbuf, nsize)) == NULL) {
+	len = ms->o.size - ms->o.left;
+	if (len > (SIZE_T_MAX - 1) / 4) {
+		file_oomem(ms);
+		return NULL;
+	}
+	/* * 4 is for octal representation, + 1 is for NUL */
+	psize = len * 4 + 1;
+	if (ms->o.psize < psize) {
+		if ((pbuf = realloc(ms->o.pbuf, psize)) == NULL) {
 			file_oomem(ms);
 			return NULL;
 		}
-		ms->o.psize = nsize;
-		ms->o.pbuf = nbuf;
+		ms->o.psize = psize;
+		ms->o.pbuf = pbuf;
 	}

 	for (np = ms->o.pbuf, op = ms->o.buf; *op; op++) {
@@ -92,8 +92,7 @@ magic_open(int flags)
 		return NULL;
 	}

-	ms->o.ptr = ms->o.buf = malloc(ms->o.size = 1024);
-	ms->o.len = 0;
+	ms->o.ptr = ms->o.buf = malloc(ms->o.left = ms->o.size = 1024);
 	if (ms->o.buf == NULL) {
 		free(ms);
 		return NULL;
@@ -4623,7 +4623,7 @@ putbody(mci, e, separator)
 		/* now do the hard work */
 		boundaries[0] = NULL;
 		mci->mci_flags |= MCIF_INHEADER;
-		if (mime8to7(mci, e->e_header, e, boundaries, M87F_OUTER) ==
+		if (mime8to7(mci, e->e_header, e, boundaries, M87F_OUTER, 0) ==
 								SM_IO_EOF)
 			goto writeerr;
 	}
@@ -4654,7 +4654,7 @@ putbody(mci, e, separator)
 			SuprErrs = true;

 		if (mime8to7(mci, e->e_header, e, boundaries,
-				M87F_OUTER|M87F_NO8TO7) == SM_IO_EOF)
+				M87F_OUTER|M87F_NO8TO7, 0) == SM_IO_EOF)
 			goto writeerr;

 		/* restore SuprErrs */
@@ -80,6 +80,7 @@ static bool	MapNLtoCRLF;
 **		boundaries -- the currently pending message boundaries.
 **			NULL if we are processing the outer portion.
 **		flags -- to tweak processing.
+**		level -- recursion level.
 **
 **	Returns:
 **		An indicator of what terminated the message part:
@@ -96,12 +97,13 @@ struct args
 };

 int
-mime8to7(mci, header, e, boundaries, flags)
+mime8to7(mci, header, e, boundaries, flags, level)
 	register MCI *mci;
 	HDR *header;
 	register ENVELOPE *e;
 	char **boundaries;
 	int flags;
+	int level;
 {
 	register char *p;
 	int linelen;
@@ -122,6 +124,18 @@ mime8to7(mci, header, e, boundaries, flags)
 	char pvpbuf[MAXLINE];
 	extern unsigned char MimeTokenTab[256];

+	if (level > MAXMIMENESTING)
+	{
+		if (!bitset(EF_TOODEEP, e->e_flags))
+		{
+			if (tTd(43, 4))
+				sm_dprintf("mime8to7: too deep, level=%d\n",
+					   level);
+			usrerr("mime8to7: recursion level %d exceeded",
+				level);
+			e->e_flags |= EF_DONT_MIME|EF_TOODEEP;
+		}
+	}
 	if (tTd(43, 1))
 	{
 		sm_dprintf("mime8to7: flags = %x, boundaries =", flags);
@@ -242,7 +256,9 @@ mime8to7(mci, header, e, boundaries, flags)
 	*/

 	if (sm_strcasecmp(type, "multipart") == 0 &&
-	    (!bitset(M87F_NO8BIT, flags) || bitset(M87F_NO8TO7, flags)))
+	    (!bitset(M87F_NO8BIT, flags) || bitset(M87F_NO8TO7, flags)) &&
+	    !bitset(EF_TOODEEP, e->e_flags)
+	   )
 	{

 		if (sm_strcasecmp(subtype, "digest") == 0)
@@ -286,10 +302,13 @@ mime8to7(mci, header, e, boundaries, flags)
 		}
 		if (i >= MAXMIMENESTING)
 		{
-			usrerr("mime8to7: multipart nesting boundary too deep");
+			if (tTd(43, 4))
+				sm_dprintf("mime8to7: too deep, i=%d\n", i);
+			if (!bitset(EF_TOODEEP, e->e_flags))
+				usrerr("mime8to7: multipart nesting boundary too deep");

 			/* avoid bounce loops */
-			e->e_flags |= EF_DONT_MIME;
+			e->e_flags |= EF_DONT_MIME|EF_TOODEEP;
 		}
 		else
 		{
@@ -333,7 +352,8 @@ mime8to7(mci, header, e, boundaries, flags)
 				goto writeerr;
 			if (tTd(43, 101))
 				putline("+++after putheader", mci);
-			bt = mime8to7(mci, hdr, e, boundaries, flags);
+			bt = mime8to7(mci, hdr, e, boundaries, flags,
+				      level + 1);
 			if (bt == SM_IO_EOF)
 				goto writeerr;
 		}
@@ -374,7 +394,8 @@ mime8to7(mci, header, e, boundaries, flags)

 	if (sm_strcasecmp(type, "message") == 0)
 	{
-		if (!wordinclass(subtype, 's'))
+		if (!wordinclass(subtype, 's') ||
+		    bitset(EF_TOODEEP, e->e_flags))
 		{
 			flags |= M87F_NO8BIT;
 		}
@@ -397,7 +418,8 @@ mime8to7(mci, header, e, boundaries, flags)
 			    !bitset(M87F_NO8TO7, flags) &&
 			    !putline("MIME-Version: 1.0", mci))
 				goto writeerr;
-			bt = mime8to7(mci, hdr, e, boundaries, flags);
+			bt = mime8to7(mci, hdr, e, boundaries, flags,
+				      level + 1);
 			mci->mci_flags &= ~MCIF_INMIME;
 			return bt;
 		}
@@ -942,6 +942,7 @@ struct envelope
 #define EF_TOOBIG	0x02000000L	/* message is too big */
 #define EF_SPLIT	0x04000000L	/* envelope has been split */
 #define EF_UNSAFE	0x08000000L	/* unsafe: read from untrusted source */
+#define EF_TOODEEP	0x10000000L	/* message is nested too deep */

 #define DLVR_NOTIFY	0x01
 #define DLVR_RETURN	0x02
@@ -1655,7 +1656,7 @@ EXTERN unsigned long	PrivacyFlags;	/* privacy flags */

 /* functions */
 extern bool	mime7to8 __P((MCI *, HDR *, ENVELOPE *));
-extern int	mime8to7 __P((MCI *, HDR *, ENVELOPE *, char **, int));
+extern int	mime8to7 __P((MCI *, HDR *, ENVELOPE *, char **, int, int));

 /*
 **  Flags passed to returntosender.
@@ -124,6 +124,9 @@ GLOBAL size_t record_size;
 /* Boolean value.  */
 GLOBAL int absolute_names_option;

+/* Allow GNUTYPE_NAMES type? */
+GLOBAL bool allow_name_mangling_option;
+
 /* This variable tells how to interpret newer_mtime_option, below.  If zero,
   files get archived if their mtime is not less than newer_mtime_option.
   If nonzero, files get archived if *either* their ctime or mtime is not less
@@ -1219,7 +1219,13 @@ extract_archive (void)
      break;

    case GNUTYPE_NAMES:
-      extract_mangle ();
+      if (allow_name_mangling_option)
+	extract_mangle ();
+      else {
+	ERROR ((0, 0, _("GNUTYPE_NAMES mangling ignored")));
+	if (backup_option)
+	  undo_last_backup ();
+      }
      break;

    case GNUTYPE_MULTIVOL:
@@ -210,12 +210,11 @@ contains_dot_dot (char const *name)
      if (p[0] == '.' && p[1] == '.' && (ISSLASH (p[2]) || !p[2]))
 	return 1;

-      do
+      while (! ISSLASH (*p))
 	{
 	  if (! *p++)
 	    return 0;
 	}
-      while (! ISSLASH (*p));

      do
 	{
@@ -129,6 +129,7 @@ confirm (const char *message_action, const char *message_name)
 enum
 {
  ANCHORED_OPTION = CHAR_MAX + 1,
+  ALLOW_NAME_MANGLING_OPTION,
  BACKUP_OPTION,
  DELETE_OPTION,
  EXCLUDE_OPTION,
@@ -178,6 +179,7 @@ static struct option long_options[] =
  {"absolute-names", no_argument, 0, 'P'},
  {"absolute-paths", no_argument, 0, OBSOLETE_ABSOLUTE_NAMES},
  {"after-date", required_argument, 0, 'N'},
+  {"allow-name-mangling", no_argument, 0, ALLOW_NAME_MANGLING_OPTION},
  {"anchored", no_argument, 0, ANCHORED_OPTION},
  {"append", no_argument, 0, 'r'},
  {"atime-preserve", no_argument, &atime_preserve_option, 1},
@@ -392,6 +394,8 @@ Archive format selection:\n\
              PATTERN                at list/extract time, a globbing PATTERN\n\
  -o, --old-archive, --portability   write a V7 format archive\n\
      --posix                        write a POSIX format archive\n\
+      --allow-name-mangling          allow GNUTYPE_NAMES mangling --\n\
+                                     considered dangerous\n\
  -j, -y, --bzip, --bzip2, --bunzip2 filter the archive through bzip2\n\
  -z, --gzip, --ungzip               filter the archive through gzip\n\
  -Z, --compress, --uncompress       filter the archive through compress\n\
@@ -901,6 +905,10 @@ decode_options (int argc, char **argv)
 	set_use_compress_program_option ("compress");
 	break;

+      case ALLOW_NAME_MANGLING_OPTION:
+	allow_name_mangling_option = true;
+	break;
+
      case OBSOLETE_VERSION_CONTROL:
 	WARN ((0, 0, _("Obsolete option name replaced by --backup")));
 	/* Fall through.  */
@@ -618,6 +618,26 @@ trunc:
 	return -2;
 }

+/*
+ * As I remember, some versions of systems have an snprintf() that
+ * returns -1 if the buffer would have overflowed.  If the return
+ * value is negative, set buflen to 0, to indicate that we've filled
+ * the buffer up.
+ *
+ * If the return value is greater than buflen, that means that
+ * the buffer would have overflowed; again, set buflen to 0 in
+ * that case.
+ */
+#define UPDATE_BUF_BUFLEN(buf, buflen, strlen) \
+    if (strlen<0) \
+       	buflen=0; \
+    else if ((u_int)strlen>buflen) \
+        buflen=0; \
+    else { \
+        buflen-=strlen; \
+	buf+=strlen; \
+    }
+
 static int
 decode_labeled_vpn_l2(const u_char *pptr, char *buf, u_int buflen)
 {
@@ -628,11 +648,13 @@ decode_labeled_vpn_l2(const u_char *pptr, char *buf, u_int buflen)
        tlen=plen;
        pptr+=2;
 	TCHECK2(pptr[0],15);
+	buf[0]='\0';
        strlen=snprintf(buf, buflen, "RD: %s, CE-ID: %u, Label-Block Offset: %u, Label Base %u",
                        bgp_vpn_rd_print(pptr),
                        EXTRACT_16BITS(pptr+8),
                        EXTRACT_16BITS(pptr+10),
                        EXTRACT_24BITS(pptr+12)>>4); /* the label is offsetted by 4 bits so lets shift it right */
+        UPDATE_BUF_BUFLEN(buf, buflen, strlen);
        pptr+=15;
        tlen-=15;

@@ -648,23 +670,32 @@ decode_labeled_vpn_l2(const u_char *pptr, char *buf, u_int buflen)

            switch(tlv_type) {
            case 1:
-                strlen+=snprintf(buf+strlen,buflen-strlen, "\n\t\tcircuit status vector (%u) length: %u: 0x",
-                                 tlv_type,
-                                 tlv_len);
+                if (buflen!=0) {
+                    strlen=snprintf(buf,buflen, "\n\t\tcircuit status vector (%u) length: %u: 0x",
+                                    tlv_type,
+                                    tlv_len);
+                    UPDATE_BUF_BUFLEN(buf, buflen, strlen);
+                }
                ttlv_len=ttlv_len/8+1; /* how many bytes do we need to read ? */
                while (ttlv_len>0) {
                    TCHECK(pptr[0]);
-                    strlen+=snprintf(buf+strlen,buflen-strlen, "%02x",*pptr++);
+                    if (buflen!=0) {
+                        strlen=snprintf(buf,buflen, "%02x",*pptr++);
+                        UPDATE_BUF_BUFLEN(buf, buflen, strlen);
+                    }
                    ttlv_len--;
                }
                break;
            default:
-                snprintf(buf+strlen,buflen-strlen, "\n\t\tunknown TLV #%u, length: %u",
-                         tlv_type,
-                         tlv_len);
+                if (buflen!=0) {
+                    strlen=snprintf(buf,buflen, "\n\t\tunknown TLV #%u, length: %u",
+                                    tlv_type,
+                                    tlv_len);
+                    UPDATE_BUF_BUFLEN(buf, buflen, strlen);
+                }
                break;
            }
-            tlen-=(tlv_len<<3); /* the tlv-length is expressed in bits so lets shift it tright */
+            tlen-=(tlv_len<<3); /* the tlv-length is expressed in bits so lets shift it right */
        }
        return plen+2;

@@ -49,6 +49,7 @@ typedef struct KbdintDevice KbdintDevice;

 struct Authctxt {
 	int		 success;
+	int		 authenticated;	/* authenticated and alarms cancelled */
 	int		 postponed;	/* authentication needs another step */
 	int		 valid;		/* user exists and is allowed to login */
 	int		 attempt;
@@ -2529,9 +2529,6 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
 				debug2("bind port %d: %.100s", port, strerror(errno));
 				close(sock);

-				if (ai->ai_next)
-					continue;
-
 				for (n = 0; n < num_socks; n++) {
 					close(socks[n]);
 				}
@@ -27,6 +27,24 @@ RCSID("$OpenBSD: deattack.c,v 1.19 2003/09/18 08:49:45 markus Exp $");
 #include "xmalloc.h"
 #include "deattack.h"

+/*
+ * CRC attack detection has a worst-case behaviour that is O(N^3) over
+ * the number of identical blocks in a packet. This behaviour can be 
+ * exploited to create a limited denial of service attack. 
+ * 
+ * However, because we are dealing with encrypted data, identical
+ * blocks should only occur every 2^35 maximally-sized packets or so. 
+ * Consequently, we can detect this DoS by looking for identical blocks
+ * in a packet.
+ *
+ * The parameter below determines how many identical blocks we will
+ * accept in a single packet, trading off between attack detection and
+ * likelihood of terminating a legitimate connection. A value of 32 
+ * corresponds to an average of 2^40 messages before an attack is
+ * misdetected
+ */
+#define MAX_IDENTICAL	32
+
 /* SSH Constants */
 #define SSH_MAXBLOCKS	(32 * 1024)
 #define SSH_BLOCKSIZE	(8)
@@ -87,7 +105,7 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV)
 	static u_int16_t *h = (u_int16_t *) NULL;
 	static u_int32_t n = HASH_MINSIZE / HASH_ENTRYSIZE;
 	u_int32_t i, j;
-	u_int32_t l;
+	u_int32_t l, same;
 	u_char *c;
 	u_char *d;

@@ -133,7 +151,7 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV)
 	if (IV)
 		h[HASH(IV) & (n - 1)] = HASH_IV;

-	for (c = buf, j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) {
+	for (c = buf, same = j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) {
 		for (i = HASH(c) & (n - 1); h[i] != HASH_UNUSED;
 		    i = (i + 1) & (n - 1)) {
 			if (h[i] == HASH_IV) {
@@ -144,6 +162,8 @@ detect_attack(u_char *buf, u_int32_t len, u_char *IV)
 						break;
 				}
 			} else if (!CMP(c, buf + h[i] * SSH_BLOCKSIZE)) {
+				if (++same > MAX_IDENTICAL)
+					return (DEATTACK_DOS_DETECTED);
 				if (check_crc(c, buf, len, IV))
 					return (DEATTACK_DETECTED);
 				else
@@ -25,6 +25,7 @@
 /* Return codes */
 #define DEATTACK_OK		0
 #define DEATTACK_DETECTED	1
+#define DEATTACK_DOS_DETECTED	2

 int	 detect_attack(u_char *, u_int32_t, u_char[8]);
 #endif
@@ -511,6 +511,11 @@ struct winsize {
 # undef HAVE_UPDWTMPX
 #endif

+#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) && \
+    defined(SYSLOG_R_SAFE_IN_SIGHAND)
+# define DO_LOG_SAFE_IN_SIGHAND
+#endif
+
 #if !defined(HAVE_MEMMOVE) && defined(HAVE_BCOPY)
 # define memmove(s1, s2, n) bcopy((s2), (s1), (n))
 #endif /* !defined(HAVE_MEMMOVE) && defined(HAVE_BCOPY) */
@@ -127,6 +127,20 @@ error(const char *fmt,...)
 	va_end(args);
 }

+void
+sigdie(const char *fmt,...)
+{
+	va_list args;
+
+#ifdef DO_LOG_SAFE_IN_SIGHAND
+	va_start(args, fmt);
+	do_log(SYSLOG_LEVEL_FATAL, fmt, args);
+	va_end(args);
+#endif
+	_exit(1);
+}
+
+
 /* Log this message (information that usually should go to the log). */

 void
@@ -64,6 +64,7 @@ LogLevel log_level_number(char *);

 void     fatal(const char *, ...) __attribute__((format(printf, 1, 2)));
 void     error(const char *, ...) __attribute__((format(printf, 1, 2)));
+void     sigdie(const char *, ...) __attribute__((format(printf, 1, 2)));
 void     logit(const char *, ...) __attribute__((format(printf, 1, 2)));
 void     verbose(const char *, ...) __attribute__((format(printf, 1, 2)));
 void     debug(const char *, ...) __attribute__((format(printf, 1, 2)));
@@ -940,9 +940,16 @@ packet_read_poll1(void)
 	 * (C)1998 CORE-SDI, Buenos Aires Argentina
 	 * Ariel Futoransky(futo@core-sdi.com)
 	 */
-	if (!receive_context.plaintext &&
-	    detect_attack(buffer_ptr(&input), padded_len, NULL) == DEATTACK_DETECTED)
-		packet_disconnect("crc32 compensation attack: network attack detected");
+	if (!receive_context.plaintext) {
+		switch (detect_attack(buffer_ptr(&input), padded_len, NULL)) {
+		case DEATTACK_DETECTED:
+			packet_disconnect("crc32 compensation attack: "
+			    "network attack detected");
+		case DEATTACK_DOS_DETECTED:
+			packet_disconnect("deattack denial of "
+			    "service detected");
+		}
+	}

 	/* Decrypt data to incoming_packet. */
 	buffer_clear(&incoming_packet);
@@ -2266,7 +2266,7 @@ do_cleanup(Authctxt *authctxt)
 		return;
 	called = 1;

-	if (authctxt == NULL)
+	if (authctxt == NULL || !authctxt->authenticated)
 		return;
 #ifdef KRB5
 	if (options.kerberos_ticket_cleanup &&
@@ -36,4 +36,4 @@
 #   Cipher 3des
 #   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
 #   EscapeChar ~
-#   VersionAddendum FreeBSD-20060123
+#   VersionAddendum FreeBSD-20060930
@@ -719,7 +719,7 @@ Note that this option applies to protocol version 2 only.
 Specifies a string to append to the regular version string to identify
 OS- or site-specific modifications.
 The default is
-.Dq FreeBSD-20060123 .
+.Dq FreeBSD-20060930 .
 .It Cm XAuthLocation
 Specifies the full pathname of the
 .Xr xauth 1
@@ -314,7 +314,7 @@ grace_alarm_handler(int sig)
 		kill(pmonitor->m_pid, SIGALRM);

 	/* Log error and exit. */
-	fatal("Timeout before authentication for %s", get_remote_ipaddr());
+	sigdie("Timeout before authentication for %s", get_remote_ipaddr());
 }

 /*
@@ -1509,6 +1509,8 @@ main(int ac, char **av)
 	}

 authenticated:
+	authctxt->authenticated = 1;
+
 	/*
 	 * In privilege separation, we fork another child and prepare
 	 * file descriptor passing.
@@ -14,7 +14,7 @@
 # Note that some of FreeBSD's defaults differ from OpenBSD's, and
 # FreeBSD has a few additional options.

-#VersionAddendum FreeBSD-20060123
+#VersionAddendum FreeBSD-20060930

 #Port 22
 #Protocol 2
@@ -660,7 +660,7 @@ The default is
 Specifies a string to append to the regular version string to identify
 OS- or site-specific modifications.
 The default is
-.Dq FreeBSD-20060123 .
+.Dq FreeBSD-20060930 .
 .It Cm X11DisplayOffset
 Specifies the first display number available for
 .Nm sshd Ns 's
@@ -5,7 +5,7 @@

 #define SSH_VERSION             (ssh_version_get())
 #define SSH_VERSION_BASE        "OpenSSH_3.8.1p1"
-#define SSH_VERSION_ADDENDUM    "FreeBSD-20060123"
+#define SSH_VERSION_ADDENDUM    "FreeBSD-20060930"

 const char *ssh_version_get(void);
 void ssh_version_set_addendum(const char *add);
@@ -628,6 +628,9 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, unsigned char **in, long inl
 		ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR);
 		return 0;
 	} else if(ret == -1) return -1;
+
+	ret = 0;
+
 	/* SEQUENCE, SET and "OTHER" are left in encoded form */
 	if((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER)) {
 		/* Clear context cache for type OTHER because the auto clear when
@@ -70,6 +70,10 @@
 #include <openssl/crypto.h>
 #include <openssl/ossl_typ.h>
 	
+#ifndef OPENSSL_DH_MAX_MODULUS_BITS
+# define OPENSSL_DH_MAX_MODULUS_BITS	10000
+#endif
+
 #define DH_FLAG_CACHE_MONT_P	0x01

 #ifdef  __cplusplus
@@ -200,6 +204,7 @@ void ERR_load_DH_strings(void);
 /* Reason codes. */
 #define DH_R_BAD_GENERATOR				 101
 #define DH_R_NO_PRIVATE_VALUE				 100
+#define DH_R_MODULUS_TOO_LARGE				 103

 #ifdef  __cplusplus
 }
@@ -78,6 +78,7 @@ static ERR_STRING_DATA DH_str_functs[]=
 static ERR_STRING_DATA DH_str_reasons[]=
 	{
 {DH_R_BAD_GENERATOR                      ,"bad generator"},
+{DH_R_MODULUS_TOO_LARGE                  ,"modulus too large"},
 {DH_R_NO_PRIVATE_VALUE                   ,"no private value"},
 {0,NULL}
 	};
@@ -164,6 +164,12 @@ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
 	BIGNUM *tmp;
 	int ret= -1;

+	if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
+		{
+		DHerr(DH_F_DH_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE);
+		return -1;
+		}
+
 	ctx = BN_CTX_new();
 	if (ctx == NULL) goto err;
 	BN_CTX_start(ctx);
@@ -79,6 +79,10 @@
 # include <openssl/dh.h>
 #endif

+#ifndef OPENSSL_DSA_MAX_MODULUS_BITS
+# define OPENSSL_DSA_MAX_MODULUS_BITS	10000
+#endif
+
 #define DSA_FLAG_CACHE_MONT_P	0x01

 #if defined(OPENSSL_FIPS)
@@ -245,8 +249,10 @@ void ERR_load_DSA_strings(void);
 #define DSA_F_SIG_CB					 114

 /* Reason codes. */
+#define DSA_R_BAD_Q_VALUE				 102
 #define DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE		 100
 #define DSA_R_MISSING_PARAMETERS			 101
+#define DSA_R_MODULUS_TOO_LARGE				 103

 #ifdef  __cplusplus
 }
@@ -85,8 +85,10 @@ static ERR_STRING_DATA DSA_str_functs[]=

 static ERR_STRING_DATA DSA_str_reasons[]=
 	{
+{DSA_R_BAD_Q_VALUE                       ,"bad q value"},
 {DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE       ,"data too large for key size"},
 {DSA_R_MISSING_PARAMETERS                ,"missing parameters"},
+{DSA_R_MODULUS_TOO_LARGE                 ,"modulus too large"},
 {0,NULL}
 	};

@@ -245,6 +245,18 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
 		return -1;
 		}

+	if (BN_num_bits(dsa->q) != 160)
+		{
+		DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_BAD_Q_VALUE);
+		return -1;
+		}
+
+	if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS)
+		{
+		DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_MODULUS_TOO_LARGE);
+		return -1;
+		}
+
 	BN_init(&u1);
 	BN_init(&u2);
 	BN_init(&t1);
@@ -155,6 +155,17 @@ struct rsa_st
 	BN_BLINDING *blinding;
 	};

+#ifndef OPENSSL_RSA_MAX_MODULUS_BITS
+# define OPENSSL_RSA_MAX_MODULUS_BITS	16400
+#endif
+
+#ifndef OPENSSL_RSA_SMALL_MODULUS_BITS
+# define OPENSSL_RSA_SMALL_MODULUS_BITS	4112
+#endif
+#ifndef OPENSSL_RSA_MAX_PUBEXP_BITS
+# define OPENSSL_RSA_MAX_PUBEXP_BITS	72 /* exponent limit enforced for "large" modulus only */
+#endif
+
 #define RSA_3	0x3L
 #define RSA_F4	0x10001L

@@ -348,6 +359,7 @@ void ERR_load_RSA_strings(void);
 #define RSA_R_INVALID_MESSAGE_LENGTH			 131
 #define RSA_R_IQMP_NOT_INVERSE_OF_Q			 126
 #define RSA_R_KEY_SIZE_TOO_SMALL			 120
+#define RSA_R_MODULUS_TOO_LARGE				 105
 #define RSA_R_NULL_BEFORE_BLOCK_MISSING			 113
 #define RSA_R_N_DOES_NOT_EQUAL_P_Q			 127
 #define RSA_R_OAEP_DECODING_ERROR			 121
@@ -105,6 +105,28 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
 	unsigned char *buf=NULL;
 	BN_CTX *ctx=NULL;

+	if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
+		{
+		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);
+		return -1;
+		}
+
+	if (BN_ucmp(rsa->n, rsa->e) <= 0)
+		{
+		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
+		return -1;
+		}
+
+	/* for large moduli, enforce exponent limit */
+	if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
+		{
+		if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
+			{
+			RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
+			return -1;
+			}
+		}
+	
 	BN_init(&f);
 	BN_init(&ret);
 	if ((ctx=BN_CTX_new()) == NULL) goto err;
@@ -505,6 +527,28 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
 	unsigned char *buf=NULL;
 	BN_CTX *ctx=NULL;

+	if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
+		{
+		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);
+		return -1;
+		}
+
+	if (BN_ucmp(rsa->n, rsa->e) <= 0)
+		{
+		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
+		return -1;
+		}
+
+	/* for large moduli, enforce exponent limit */
+	if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
+		{
+		if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
+			{
+			RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
+			return -1;
+			}
+		}
+	
 	BN_init(&f);
 	BN_init(&ret);
 	ctx=BN_CTX_new();
@@ -116,6 +116,7 @@ static ERR_STRING_DATA RSA_str_reasons[]=
 {RSA_R_INVALID_MESSAGE_LENGTH            ,"invalid message length"},
 {RSA_R_IQMP_NOT_INVERSE_OF_Q             ,"iqmp not inverse of q"},
 {RSA_R_KEY_SIZE_TOO_SMALL                ,"key size too small"},
+{RSA_R_MODULUS_TOO_LARGE                 ,"modulus too large"},
 {RSA_R_NULL_BEFORE_BLOCK_MISSING         ,"null before block missing"},
 {RSA_R_N_DOES_NOT_EQUAL_P_Q              ,"n does not equal p q"},
 {RSA_R_OAEP_DECODING_ERROR               ,"oaep decoding error"},
@@ -185,6 +185,23 @@ int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
 		sig=d2i_X509_SIG(NULL,&p,(long)i);

 		if (sig == NULL) goto err;
+
+		/* Excess data can be used to create forgeries */
+		if(p != s+i)
+			{
+			RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
+			goto err;
+			}
+
+		/* Parameters to the signature algorithm can also be used to
+		   create forgeries */
+		if(sig->algor->parameter
+		   && sig->algor->parameter->type != V_ASN1_NULL)
+			{
+			RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
+			goto err;
+			}
+
 		sigtype=OBJ_obj2nid(sig->algor->algorithm);


@@ -538,7 +538,8 @@ static int get_server_hello(SSL *s)
 		CRYPTO_add(&s->session->peer->references, 1, CRYPTO_LOCK_X509);
 		}

-	if (s->session->peer != s->session->sess_cert->peer_key->x509)
+	if (s->session->sess_cert == NULL 
+      || s->session->peer != s->session->sess_cert->peer_key->x509)
 		/* can't happen */
 		{
 		ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
@@ -1733,7 +1733,7 @@ static int ssl3_get_client_key_exchange(SSL *s)

                if (kssl_ctx->client_princ)
                        {
-                        int len = strlen(kssl_ctx->client_princ);
+                        size_t len = strlen(kssl_ctx->client_princ);
                        if ( len < SSL_MAX_KRB5_PRINCIPAL_LENGTH ) 
                                {
                                s->session->krb5_client_princ_len = len;
@@ -1149,7 +1149,6 @@ int SSL_set_cipher_list(SSL *s,const char *str)
 char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
 	{
 	char *p;
-	const char *cp;
 	STACK_OF(SSL_CIPHER) *sk;
 	SSL_CIPHER *c;
 	int i;
@@ -1162,20 +1161,21 @@ char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
 	sk=s->session->ciphers;
 	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
 		{
-		/* Decrement for either the ':' or a '\0' */
-		len--;
+		int n;
+
 		c=sk_SSL_CIPHER_value(sk,i);
-		for (cp=c->name; *cp; )
+		n=strlen(c->name);
+		if (n+1 > len)
 			{
-			if (len-- == 0)
-				{
-				*p='\0';
-				return(buf);
-				}
-			else
-				*(p++)= *(cp++);
+			if (p != buf)
+				--p;
+			*p='\0';
+			return buf;
 			}
+		strcpy(p,c->name);
+		p+=n;
 		*(p++)=':';
+		len-=n+1;
 		}
 	p[-1]='\0';
 	return(buf);
@@ -66,6 +66,8 @@ init_variables()
 	[ -z "${jail_fstab}" ] && jail_fstab="/etc/fstab.${_j}"
 	eval jail_flags=\"\$jail_${_j}_flags\"
 	[ -z "${jail_flags}" ] && jail_flags="-l -U root"
+	eval _consolelog=\"\${jail_${_j}_consolelog:-${jail_consolelog}}\"
+	[ -z "${_consolelog}" ] && _consolelog="/var/log/jail_${_j}_console.log"

 	# Debugging aid
 	#
@@ -84,6 +86,7 @@ init_variables()
 	debug "$_j exec start: $jail_exec_start"
 	debug "$_j exec stop: $jail_exec_stop"
 	debug "$_j flags: $jail_flags"
+	debug "$_j consolelog: $_consolelog"
 }

 # set_sysctl rc_knob mib msg
@@ -113,6 +116,56 @@ set_sysctl()
 	fi
 }

+# is_current_mountpoint()
+#	Is the directory mount point for a currently mounted file
+#	system?
+#
+is_current_mountpoint()
+{
+	local _dir _dir2
+
+	_dir=$1
+
+	_dir=`echo $_dir | sed -Ee 's#//+#/#g' -e 's#/$##'`
+	[ ! -d "${_dir}" ] && return 1
+	_dir2=`df ${_dir} | tail +2 | awk '{ print $6 }'`
+	[ "${_dir}" = "${_dir2}" ]
+	return $?
+}
+
+# is_symlinked_mountpoint()
+#	Is a mount point, or any of its parent directories, a symlink?
+#
+is_symlinked_mountpoint()
+{
+	local _dir
+
+	_dir=$1
+
+	[ -L "$_dir" ] && return 0
+	[ "$_dir" = "/" ] && return 1
+	is_symlinked_mountpoint `dirname $_dir`
+	return $?
+}
+
+# secure_umount
+#	Try to unmount a mount point without being vulnerable to
+#	symlink attacks.
+#
+secure_umount()
+{
+	local _dir
+
+	_dir=$1
+
+	if is_current_mountpoint ${_dir}; then
+		umount -f ${_dir} >/dev/null 2>&1
+	else
+		debug "Nothing mounted on ${_dir} - not unmounting"
+	fi
+}
+
+
 # jail_umount_fs
 #	This function unmounts certain special filesystems in the
 #	currently selected jail. The caller must call the init_variables()
@@ -120,27 +173,65 @@ set_sysctl()
 #
 jail_umount_fs()
 {
+	local _device _mountpt _rest
+
 	if checkyesno jail_fdescfs; then
 		if [ -d "${jail_fdescdir}" ] ; then
-			umount -f ${jail_fdescdir} >/dev/null 2>&1
+			secure_umount ${jail_fdescdir}
 		fi
 	fi
 	if checkyesno jail_devfs; then
 		if [ -d "${jail_devdir}" ] ; then
-			umount -f ${jail_devdir} >/dev/null 2>&1
+			secure_umount ${jail_devdir}
 		fi
 	fi
 	if checkyesno jail_procfs; then
 		if [ -d "${jail_procdir}" ] ; then
-			umount -f ${jail_procdir} >/dev/null 2>&1
+			secure_umount ${jail_procdir}
 		fi
 	fi
 	if checkyesno jail_mount; then
 		[ -f "${jail_fstab}" ] || warn "${jail_fstab} does not exist"
-		umount -a -F "${jail_fstab}" >/dev/null 2>&1
+		tail -r ${jail_fstab} | while read _device _mountpt _rest; do
+			case ":${_device}" in
+			:#* | :)
+				continue
+				;;
+			esac
+			secure_umount ${_mountpt}
+		done
 	fi
 }

+# jail_mount_fstab()
+#	Mount file systems from a per jail fstab while trying to
+#	secure against symlink attacks at the mount points.
+#
+#	If we are certain we cannot secure against symlink attacks we
+#	do not mount all of the file systems (since we cannot just not
+#	mount the file system with the problematic mount point).
+#
+#	The caller must call the init_variables() routine before
+#	calling this one.
+#
+jail_mount_fstab()
+{
+	local _device _mountpt _rest
+
+	while read _device _mountpt _rest; do
+		case ":${_device}" in
+		:#* | :)
+			continue
+			;;
+		esac
+		if is_symlinked_mountpoint ${_mountpt}; then
+			warn "${_mountpt} has symlink as parent - not mounting from ${jail_fstab}"
+			return
+		fi
+	done <${jail_fstab}
+	mount -a -F "${jail_fstab}"
+}
+
 jail_start()
 {
 	echo -n 'Configuring jails:'
@@ -163,9 +254,13 @@ jail_start()
 			if [ ! -f "${jail_fstab}" ]; then
 				err 3 "$name: ${jail_fstab} does not exist"
 			fi
-			mount -a -F "${jail_fstab}"
+			jail_mount_fstab
 		fi
 		if checkyesno jail_devfs; then
+			if is_symlinked_mountpoint ${jail_devdir}; then
+				warn "${jail_devdir} has symlink as parent - not starting jail ${_jail}"
+				continue
+			fi
 			info "Mounting devfs on ${jail_devdir}"
 			devfs_mount_jail "${jail_devdir}" ${jail_ruleset}

@@ -186,13 +281,21 @@ jail_start()
 			#	cd "$__pwd"
 		fi
 		if checkyesno jail_fdescfs; then
-			info "Mounting fdescfs on ${jail_fdescdir}"
-			mount -t fdescfs fdesc "${jail_fdescdir}"
+ 			if is_symlinked_mountpoint ${jail_fdescdir}; then
+ 				warn "${jail_fdescdir} has symlink as parent, not mounting"
+ 			else
+				info "Mounting fdescfs on ${jail_fdescdir}"
+				mount -t fdescfs fdesc "${jail_fdescdir}"
+			fi
 		fi
 		if checkyesno jail_procfs; then
-			info "Mounting procfs onto ${jail_procdir}"
-			if [ -d "${jail_procdir}" ] ; then
-				mount -t procfs proc "${jail_procdir}"
+			if is_symlinked_mountpoint ${jail_procdir}; then
+				warn "${jail_procdir} has symlink as parent, not mounting"
+			else
+				info "Mounting procfs onto ${jail_procdir}"
+				if [ -d "${jail_procdir}" ] ; then
+					mount -t procfs proc "${jail_procdir}"
+				fi
 			fi
 		fi
 		_tmp_jail=${_tmp_dir}/jail.$$
@@ -200,7 +303,7 @@ jail_start()
 			${jail_ip} ${jail_exec_start} > ${_tmp_jail} 2>&1
 		[ "$?" -eq 0 ] && echo -n " $jail_hostname"
 		_jail_id=$(head -1 ${_tmp_jail})
-		tail +2 ${_tmp_jail} >${jail_rootdir}/var/log/console.log
+		tail +2 ${_tmp_jail} >${_consolelog}
 		rm -f ${_tmp_jail}
 		echo ${_jail_id} > /var/run/jail_${_jail}.id
 	done
@@ -219,7 +322,7 @@ jail_stop()
 				init_variables $_jail
 				if [ -n "${jail_exec_stop}" ]; then
 					eval env -i /usr/sbin/jexec ${_jail_id} ${jail_exec_stop} \
-						>> ${jail_rootdir}/var/log/console.log 2>&1
+						>> ${_consolelog} 2>&1
 				fi
 				killall -j ${_jail_id} -TERM > /dev/null 2>&1
 				sleep 1
@@ -56,7 +56,7 @@
 .ds doc-str-Lb-libvgl      Video Graphics Library (libvgl, \-lvgl)
 .
 .\" Default .Os value
-.ds doc-default-operating-system FreeBSD\~5.4
+.ds doc-default-operating-system FreeBSD\~5.5
 .
 .\" FreeBSD releases not found in doc-common
 .ds doc-operating-system-FreeBSD-4.11   4.11
@@ -202,6 +202,8 @@ extern int test;           /* check .z file integrity */
 extern int to_stdout;      /* output to stdout (-c) */
 extern int save_orig_name; /* set if original name must be saved */

+#define MIN(a,b) ((a) <= (b) ? (a) : (b))
+
 #define get_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf(0))
 #define try_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf(1))

@@ -316,7 +316,7 @@ int *m;                 /* maximum lookup bits, returns actual */
  {
    *t = (struct huft *)NULL;
    *m = 0;
-    return 0;
+    return 2;
  }


@@ -148,13 +148,17 @@ local void make_table(nchar, bitlen, tablebits, table)
    unsigned i, k, len, ch, jutbits, avail, nextcode, mask;

    for (i = 1; i <= 16; i++) count[i] = 0;
-    for (i = 0; i < (unsigned)nchar; i++) count[bitlen[i]]++;
+    for (i = 0; i < (unsigned)nchar; i++) {
+        if (bitlen[i] > 16)
+        error("Bad table (case a)\n");
+        else count[bitlen[i]]++;
+    }

    start[1] = 0;
    for (i = 1; i <= 16; i++)
 	start[i + 1] = start[i] + (count[i] << (16 - i));
-    if ((start[17] & 0xffff) != 0)
-	error("Bad table\n");
+    if ((start[17] & 0xffff) != 0 || tablebits > 16) /* 16 for weight below */
+	error("Bad table (case b)\n");

    jutbits = 16 - tablebits;
    for (i = 1; i <= (unsigned)tablebits; i++) {
@@ -168,15 +172,15 @@ local void make_table(nchar, bitlen, tablebits, table)

    i = start[tablebits + 1] >> jutbits;
    if (i != 0) {
-	k = 1 << tablebits;
-	while (i != k) table[i++] = 0;
+	k = MIN(1 << tablebits, DIST_BUFSIZE);
+	while (i < k) table[i++] = 0;
    }

    avail = nchar;
    mask = (unsigned) 1 << (15 - tablebits);
    for (ch = 0; ch < (unsigned)nchar; ch++) {
 	if ((len = bitlen[ch]) == 0) continue;
-	nextcode = start[len] + weight[len];
+	nextcode = MIN(start[len] + weight[len], DIST_BUFSIZE);
 	if (len <= (unsigned)tablebits) {
 	    for (i = start[len]; i < nextcode; i++) table[i] = ch;
 	} else {
@@ -217,7 +221,7 @@ local void read_pt_len(nn, nbit, i_special)
 	for (i = 0; i < 256; i++) pt_table[i] = c;
    } else {
 	i = 0;
-	while (i < n) {
+	while (i < MIN(n,NPT)) {
 	    c = bitbuf >> (BITBUFSIZ - 3);
 	    if (c == 7) {
 		mask = (unsigned) 1 << (BITBUFSIZ - 1 - 3);
@@ -227,7 +231,7 @@ local void read_pt_len(nn, nbit, i_special)
 	    pt_len[i++] = c;
 	    if (i == i_special) {
 		c = getbits(2);
-		while (--c >= 0) pt_len[i++] = 0;
+		while (--c >= 0 && i < NPT) pt_len[i++] = 0;
 	    }
 	}
 	while (i < nn) pt_len[i++] = 0;
@@ -247,7 +251,7 @@ local void read_c_len()
 	for (i = 0; i < 4096; i++) c_table[i] = c;
    } else {
 	i = 0;
-	while (i < n) {
+	while (i < MIN(n,NC)) {
 	    c = pt_table[bitbuf >> (BITBUFSIZ - 8)];
 	    if (c >= NT) {
 		mask = (unsigned) 1 << (BITBUFSIZ - 1 - 8);
@@ -255,14 +259,14 @@ local void read_c_len()
 		    if (bitbuf & mask) c = right[c];
 		    else               c = left [c];
 		    mask >>= 1;
-		} while (c >= NT);
+		} while (c >= NT && (mask || c != left[c]));
 	    }
 	    fillbuf((int) pt_len[c]);
 	    if (c <= 2) {
 		if      (c == 0) c = 1;
 		else if (c == 1) c = getbits(4) + 3;
 		else             c = getbits(CBIT) + 20;
-		while (--c >= 0) c_len[i++] = 0;
+		while (--c >= 0 && i < NC) c_len[i++] = 0;
 	    } else c_len[i++] = c - 2;
 	}
 	while (i < NC) c_len[i++] = 0;
@@ -291,7 +295,7 @@ local unsigned decode_c()
 	    if (bitbuf & mask) j = right[j];
 	    else               j = left [j];
 	    mask >>= 1;
-	} while (j >= NC);
+	} while (j >= NC && (mask || j != left[j]));
    }
    fillbuf((int) c_len[j]);
    return j;
@@ -308,7 +312,7 @@ local unsigned decode_p()
 	    if (bitbuf & mask) j = right[j];
 	    else               j = left [j];
 	    mask >>= 1;
-	} while (j >= NP);
+	} while (j >= NP && (mask || j != left[j]));
    }
    fillbuf((int) pt_len[j]);
    if (j != 0) j = ((unsigned) 1 << (j - 1)) + getbits((int) (j - 1));
@@ -355,7 +359,7 @@ local unsigned decode(count, buffer)
    while (--j >= 0) {
 	buffer[r] = buffer[i];
 	i = (i + 1) & (DICSIZ - 1);
-	if (++r == count) return r;
+	if (++r >= count) return r;
    }
    for ( ; ; ) {
 	c = decode_c();
@@ -365,14 +369,14 @@ local unsigned decode(count, buffer)
 	}
 	if (c <= UCHAR_MAX) {
 	    buffer[r] = c;
-	    if (++r == count) return r;
+	    if (++r >= count) return r;
 	} else {
 	    j = c - (UCHAR_MAX + 1 - THRESHOLD);
 	    i = (r - decode_p() - 1) & (DICSIZ - 1);
 	    while (--j >= 0) {
 		buffer[r] = buffer[i];
 		i = (i + 1) & (DICSIZ - 1);
-		if (++r == count) return r;
+		if (++r >= count) return r;
 	    }
 	}
    }
@@ -12,7 +12,6 @@ static char rcsid[] = "$FreeBSD$";
 #include "gzip.h"
 #include "crypt.h"

-#define MIN(a,b) ((a) <= (b) ? (a) : (b))
 /* The arguments must not have side effects. */

 #define MAX_BITLEN 25
@@ -132,7 +131,7 @@ local void read_tree()
 	/* Remember where the literals of this length start in literal[] : */
 	lit_base[len] = base;
 	/* And read the literals: */
-	for (n = leaves[len]; n > 0; n--) {
+	for (n = leaves[len]; n > 0 && base < LITERALS; n--) {
 	    literal[base++] = (uch)get_byte();
 	}
    }
@@ -168,7 +167,7 @@ local void build_tree()
    prefixp = &prefix_len[1<<peek_bits];
    for (len = 1; len <= peek_bits; len++) {
 	int prefixes = leaves[len] << (peek_bits-len); /* may be 0 */
-	while (prefixes--) *--prefixp = (uch)len;
+	while (prefixes-- && prefixp > prefix_len) *--prefixp = (uch)len;
    }
    /* The length of all other codes is unknown: */
    while (prefixp > prefix_len) *--prefixp = 0;
@@ -595,7 +595,13 @@ tar_read_header(struct archive *a, struct tar *tar,
 		}
 	}
 	--tar->header_recursion_depth;
-	return (err);
+	/* We return warnings or success as-is.  Anything else is fatal. */
+	if (err == ARCHIVE_WARN || err == ARCHIVE_OK)
+		return (err);
+	if (err == ARCHIVE_EOF)
+		/* EOF when recursively reading a header is bad. */
+		archive_set_error(a, EINVAL, "Damaged tar archive");
+	return (ARCHIVE_FATAL);
 }

 /*
@@ -666,32 +672,55 @@ static int
 header_Solaris_ACL(struct archive *a, struct tar *tar,
    struct archive_entry *entry, struct stat *st, const void *h)
 {
-	int err, err2;
-	char *p;
+	const struct archive_entry_header_ustar *header;
+	size_t size;
+	int err;
+	char *acl, *p;
 	wchar_t *wp;

+	/*
+	 * read_body_to_string adds a NUL terminator, but we need a little
+	 * more to make sure that we don't overrun acl_text later.
+	 */
+	header = (const struct archive_entry_header_ustar *)h;
+	size = tar_atol(header->size, sizeof(header->size));
 	err = read_body_to_string(a, tar, &(tar->acl_text), h);
-	err2 = tar_read_header(a, tar, entry, st);
-	err = err_combine(err, err2);
-
-	/* XXX Ensure p doesn't overrun acl_text */
+	if (err != ARCHIVE_OK)
+		return (err);
+	err = tar_read_header(a, tar, entry, st);
+	if ((err != ARCHIVE_OK) && (err != ARCHIVE_WARN))
+		return (err);

 	/* Skip leading octal number. */
 	/* XXX TODO: Parse the octal number and sanity-check it. */
-	p = tar->acl_text.s;
-	while (*p != '\0')
+	p = acl = tar->acl_text.s;
+	while (*p != '\0' && p < acl + size)
 		p++;
 	p++;

-	wp = malloc((strlen(p) + 1) * sizeof(wchar_t));
-	if (wp != NULL) {
-		utf8_decode(wp, p, strlen(p));
-		err2 = __archive_entry_acl_parse_w(entry, wp,
-		    ARCHIVE_ENTRY_ACL_TYPE_ACCESS);
-		err = err_combine(err, err2);
-		free(wp);
+	if (p >= acl + size) {
+		archive_set_error(a, ARCHIVE_ERRNO_MISC,
+		    "Malformed Solaris ACL attribute");
+		return(ARCHIVE_WARN);
 	}

+	/* Skip leading octal number. */
+	size -= (p - acl);
+	acl = p;
+
+	while (*p != '\0' && p < acl + size)
+		p++;
+
+	wp = malloc((p - acl + 1) * sizeof(wchar_t));
+	if (wp == NULL) {
+		archive_set_error(a, ENOMEM,
+		    "Can't allocate work buffer for ACL parsing");
+		return (ARCHIVE_FATAL);
+	}
+	utf8_decode(wp, acl, p - acl);
+	err = __archive_entry_acl_parse_w(entry, wp,
+	    ARCHIVE_ENTRY_ACL_TYPE_ACCESS);
+	free(wp);
 	return (err);
 }

@@ -702,15 +731,17 @@ static int
 header_longlink(struct archive *a, struct tar *tar,
    struct archive_entry *entry, struct stat *st, const void *h)
 {
-	int err, err2;
+	int err;

 	err = read_body_to_string(a, tar, &(tar->longlink), h);
-	err2 = tar_read_header(a, tar, entry, st);
-	if (err == ARCHIVE_OK && err2 == ARCHIVE_OK) {
-		/* Set symlink if symlink already set, else hardlink. */
-		archive_entry_set_link(entry, tar->longlink.s);
-	}
-	return (err_combine(err, err2));
+	if (err != ARCHIVE_OK)
+		return (err);
+	err = tar_read_header(a, tar, entry, st);
+	if ((err != ARCHIVE_OK) && (err != ARCHIVE_WARN))
+		return (err);
+	/* Set symlink if symlink already set, else hardlink. */
+	archive_entry_set_link(entry, tar->longlink.s);
+	return (ARCHIVE_OK);
 }

 /*
@@ -720,14 +751,17 @@ static int
 header_longname(struct archive *a, struct tar *tar,
    struct archive_entry *entry, struct stat *st, const void *h)
 {
-	int err, err2;
+	int err;

 	err = read_body_to_string(a, tar, &(tar->longname), h);
+	if (err != ARCHIVE_OK)
+		return (err);
 	/* Read and parse "real" header, then override name. */
-	err2 = tar_read_header(a, tar, entry, st);
-	if (err == ARCHIVE_OK && err2 == ARCHIVE_OK)
-		archive_entry_set_pathname(entry, tar->longname.s);
-	return (err_combine(err, err2));
+	err = tar_read_header(a, tar, entry, st);
+	if ((err != ARCHIVE_OK) && (err != ARCHIVE_WARN))
+		return (err);
+	archive_entry_set_pathname(entry, tar->longname.s);
+	return (ARCHIVE_OK);
 }


@@ -761,12 +795,20 @@ read_body_to_string(struct archive *a, struct tar *tar,
 	header = h;
 	size  = tar_atol(header->size, sizeof(header->size));

+	/* Sanity check. */
+	if ((size > 1048576) || (size < 0)) {
+		archive_set_error(a, EINVAL, "Special header too large");
+		return (ARCHIVE_FATAL);
+	}
+
 	/* Read the body into the string. */
 	archive_string_ensure(as, size+1);
 	padded_size = (size + 511) & ~ 511;
 	dest = as->s;
 	while (padded_size > 0) {
 		bytes_read = (a->compression_read_ahead)(a, &src, padded_size);
+		if (bytes_read == 0)
+			return (ARCHIVE_EOF);
 		if (bytes_read < 0)
 			return (ARCHIVE_FATAL);
 		if (bytes_read > padded_size)
@@ -952,11 +994,13 @@ static int
 header_pax_global(struct archive *a, struct tar *tar,
    struct archive_entry *entry, struct stat *st, const void *h)
 {
-	int err, err2;
+	int err;

 	err = read_body_to_string(a, tar, &(tar->pax_global), h);
-	err2 = tar_read_header(a, tar, entry, st);
-	return (err_combine(err, err2));
+	if (err != ARCHIVE_OK)
+		return (err);
+	err = tar_read_header(a, tar, entry, st);
+	return (err);
 }

 static int
@@ -965,10 +1009,14 @@ header_pax_extensions(struct archive *a, struct tar *tar,
 {
 	int err, err2;

-	read_body_to_string(a, tar, &(tar->pax_header), h);
+	err = read_body_to_string(a, tar, &(tar->pax_header), h);
+	if (err != ARCHIVE_OK)
+		return (err);

 	/* Parse the next header. */
 	err = tar_read_header(a, tar, entry, st);
+	if ((err != ARCHIVE_OK) && (err != ARCHIVE_WARN))
+		return (err);

 	/*
 	 * TODO: Parse global/default options into 'entry' struct here
@@ -1066,8 +1114,11 @@ pax_header(struct archive *a, struct tar *tar, struct archive_entry *entry,
 				l--;
 				break;
 			}
-			if (*p < '0' || *p > '9')
-				return (-1);
+			if (*p < '0' || *p > '9') {
+				archive_set_error(a, ARCHIVE_ERRNO_MISC,
+				    "Ignoring malformed pax extended attributes");
+				return (ARCHIVE_WARN);
+			}
 			line_length *= 10;
 			line_length += *p - '0';
 			if (line_length > 999999) {
@@ -1079,8 +1130,19 @@ pax_header(struct archive *a, struct tar *tar, struct archive_entry *entry,
 			l--;
 		}

-		if (line_length > attr_length)
-			return (0);
+		/*
+		 * Parsed length must be no bigger than available data,
+		 * at least 1, and the last character of the line must
+		 * be '\n'.
+		 */
+		if (line_length > attr_length
+		    || line_length < 1
+		    || attr[line_length - 1] != '\n')
+		{
+			archive_set_error(a, ARCHIVE_ERRNO_MISC,
+			    "Ignoring malformed pax extended attribute");
+			return (ARCHIVE_WARN);
+		}

 		/* Ensure pax_entry buffer is big enough. */
 		if (tar->pax_entry_length <= line_length) {
@@ -76,8 +76,7 @@ openpty(int *amaster, int *aslave, char *name, struct termios *termp, struct win
 					break; /* try the next pty group */
 			} else {
 				line[5] = 't';
-				(void) chown(line, getuid(), ttygid);
-				(void) chmod(line, S_IRUSR|S_IWUSR|S_IWGRP);
+				(void) grantpt(master);
 				(void) revoke(line);
 				if ((slave = open(line, O_RDWR, 0)) != -1) {
 					*amaster = master;
@@ -18,11 +18,11 @@
 # Set these, release builder!
 #
 # Fixed version:
-#BUILDNAME=5.4-RELEASE
+#BUILDNAME=5.5-RELEASE
 #
 # Automatic SNAP versioning:
 DATE != date +%Y%m%d
-BASE = 5.4
+BASE = 5.5
 BUILDNAME?=${BASE}-${DATE}-SNAP
 #
 #CHROOTDIR=/junk/release
@@ -16,8 +16,7 @@
 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
 %release;

-<!ENTITY release.bugfix "5.4-RELEASE">
-<!ENTITY release.bugfix.next "5.5-RELEASE">
+<!ENTITY release.bugfix "5.5-RELEASE">
 ]>

 <article>
@@ -59,9 +58,6 @@
      operation or usability.  An up-to-date version of this document
      should always be consulted before installing this version of
      &os;.</para>
-
-    <para>This errata document for &os; &release.bugfix;
-      will be maintained until the release of &os; &release.bugfix.next;.</para>
  </abstract>

  <sect1 id="intro">
@@ -95,166 +91,7 @@
  <sect1 id="security">
    <title>Security Advisories</title>

-    <para>The following security advisories pertain to &os; &release.bugfix;.
-      For more information, consult the individual advisories available from
-      <ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/"></ulink>.</para>
-
-    <informaltable frame="none" pgwide="0">
-      <tgroup cols="3">
-	<colspec colwidth="1*">
-	<colspec colwidth="1*">
-	<colspec colwidth="3*">
-	<thead>
-	  <row>
-	    <entry>Advisory</entry>
-	    <entry>Date</entry>
-	    <entry>Topic</entry>
-	  </row>
-	</thead>
-
-	<tbody>
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:14.fpu.asc"
-		>06:14.fpu</ulink></entry>
-	    <entry>19&nbsp;April&nbsp;2006</entry>
-	    <entry><para>FPU information disclosure</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:13.sendmail.asc"
-		>06:13.sendmail</ulink></entry>
-	    <entry>22&nbsp;March&nbsp;2006</entry>
-	    <entry><para>Race condition in sendmail</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:12.opie.asc"
-		>06:12.opie</ulink></entry>
-	    <entry>22&nbsp;March&nbsp;2006</entry>
-	    <entry><para>OPIE arbitrary password change</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:11.ipsec.asc"
-		>06:11.ipsec</ulink></entry>
-	    <entry>22&nbsp;March&nbsp;2006</entry>
-	    <entry><para>IPsec replay attack vulnerability</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:10.nfs.asc"
-		>06:10.nfs</ulink></entry>
-	    <entry>1&nbsp;March&nbsp;2006</entry>
-	    <entry><para>Remote denial of service in NFS server</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:09.openssh.asc"
-		>06:09.openssh</ulink></entry>
-	    <entry>1&nbsp;March&nbsp;2006</entry>
-	    <entry><para>Remote denial of service in OpenSSH</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:07.pf.asc"
-		>06:07.pf</ulink></entry>
-	    <entry>25&nbsp;January&nbsp;2006</entry>
-	    <entry><para>IP fragment handling panic in &man.pf.4;</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:03.cpio.asc"
-		>06:03.cpio</ulink></entry>
-	    <entry>11&nbsp;January&nbsp;2006</entry>
-	    <entry><para>Multiple vulnerabilities in &man.cpio.1;</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:02.ee.asc"
-		>06:02.eex</ulink></entry>
-	    <entry>11&nbsp;January&nbsp;2006</entry>
-	    <entry><para>&man.ee.1; temporary file privilege escalation</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:01.texindex.asc"
-		>06:01.texindex</ulink></entry>
-	    <entry>11&nbsp;January&nbsp;2006</entry>
-	    <entry><para>Texindex temporary file privilege escalation</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:09.htt.asc"
-		>SA-05:09.htt</ulink></entry>
-	    <entry>22&nbsp;May&nbsp;2005</entry>
-	    <entry><para>information disclosure when using HTT</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:10.tcpdump.asc"
-		>SA-05:10.tcpdump</ulink></entry>
-	    <entry>9&nbsp;Jun&nbsp;2005</entry>
-	    <entry><para>Infinite loops in tcpdump protocol decoding</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:11.gzip.asc"
-		>SA-05:11.gzip</ulink></entry>
-	    <entry>9&nbsp;Jun&nbsp;2005</entry>
-	    <entry><para>gzip directory traversal and permission race vulnerabilities</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:13.ipfw.asc"
-		>SA-05:13.ipfw</ulink></entry>
-	    <entry>29&nbsp;Jun&nbsp;2005</entry>
-	    <entry><para>ipfw packet matching errors with address tables</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:14.bzip2.asc"
-		>SA-05:14.bzip2</ulink></entry>
-	    <entry>29&nbsp;Jun&nbsp;2005</entry>
-	    <entry><para>bzip2 denial of service and permission race vulnerabilities</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:15.tcp.asc"
-		>SA-05:15.tcp</ulink></entry>
-	    <entry>29&nbsp;Jun&nbsp;2005</entry>
-	    <entry><para>TCP connection stall denial of service</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:16.zlib.asc"
-		>SA-05:16.zlib</ulink></entry>
-	    <entry>6&nbsp;Jul&nbsp;2005</entry>
-	    <entry><para>Buffer overflow in zlib</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:17.devfs.asc"
-		>SA-05:17.devfs</ulink></entry>
-	    <entry>20&nbsp;Jul&nbsp;2005</entry>
-	    <entry><para>devfs ruleset bypass</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:18.zlib.asc"
-		>SA-05:18.zlib</ulink></entry>
-	    <entry>27&nbsp;Jul&nbsp;2005</entry>
-	    <entry><para>Buffer overflow in zlib</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:19.ipsec.asc"
-		>SA-05:19.ipsec</ulink></entry>
-	    <entry>27&nbsp;Jul&nbsp;2005</entry>
-	    <entry><para>IPsec incorrect key usage in AES-XCBC-MAC</para></entry>
-	  </row>
-	</tbody>
-      </tgroup>
-    </informaltable>
+    <para>No advisories.</para>
  </sect1>

  <sect1 id="open-issues">
@@ -266,122 +103,6 @@
  <sect1 id="late-news">
    <title>Late-Breaking News</title>

-    <para>(6 May 2005) An error in the default permissions on the
-      <filename class="devicefile">/dev/iir</filename> device node,
-      which allowed unprivileged local users to send commands to the
-      hardware supported by the &man.iir.4; driver.  Although the
-      error was fixed prior to &release.prev;, it was applied too late
-      in the release cycle to be mentioned in the release notes.  For
-      more information, see security advisory
-      <ulink url="ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:06.iir.asc">FreeBSD-SA-05:06.iir</ulink>.
-      </para>
-
-    <para>(6 May 2005) A bug in the validation of &man.i386.get.ldt.2;
-      system call input arguments, which may allow kernel memory may
-      be disclosed to the user process, has been fixed.  This bug was
-      fixed prior to &release.prev;, although not in time to be
-      mentioned in the release notes.  For more information, see
-      security advisory
-      <ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:07.ldt.asc">FreeBSD-SA-05:07.ldt</ulink>.
-      </para>
-
-    <para>(6 May 2005) Several information disclosure vulnerabilities
-      in various parts of the kernel have been fixed in
-      &release.prev;, although too late to be mentioned in the release
-      notes.  For more information, see security advisory
-      <ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:08.kmem.asc">FreeBSD-SA-05:08.kmem</ulink>.
-      </para>
-
-    <para>(24 Jun 2005) The &os;/sparc64 &release.bugfix; should
-      have stated that the &os;/sparc64 GENERIC kernel prior
-      to the upcoming 6.0-RELEASE officially only supports serial consoles.
-      This is especially true for the &os;/sparc64 &release.bugfix;
-      GENERIC kernel because the ofw_console(4) driver which also provides
-      limited indirect support for graphical consoles has been replaced
-      with the &man.uart.4; driver in favor better serial support.</para>
-
-    <para>Due to this limitation to serial consoles the screen will
-      stop working after the message <quote><computeroutput>jumping to kernel entry
-	  at...</computeroutput></quote> is
-      displayed when trying to use the &os;/sparc64 &release.bugfix;
-      GENERIC kernel with a graphical console, while &os; itself continues
-      working actually.</para>
-
-    <para>If you want to use &os;/sparc64 with a graphical console anyway
-      you can do one of the following:</para>
-
-    <itemizedlist>
-      <listitem>
-	<para>In case your machine is equipped with a Sun Creator,
-	  Sun Creator3D, or Sun Elite3D frame buffer card
-	  and a Sun RS232 keyboard you can install &os;/sparc64
-	  &release.bugfix; with a serial console and afterwards
-	  compile a custom kernel with the following additional
-	  options:</para>
-
-	<programlisting>device          sc
-device          creator
-options         KBD_INSTALL_CDEV</programlisting>
-
-	<para>Additionally you have to enable the <filename>tty[1-7]</filename>
-	  entries in <filename>/etc/ttys</filename>
-	  like so:</para>
-
-	<programlisting>ttyv0   "/usr/libexec/getty Pc"         cons25  on  secure
-# Virtual terminals
-ttyv1   "/usr/libexec/getty Pc"         cons25  on  secure
-ttyv2   "/usr/libexec/getty Pc"         cons25  on  secure
-ttyv3   "/usr/libexec/getty Pc"         cons25  on  secure
-ttyv4   "/usr/libexec/getty Pc"         cons25  on  secure
-ttyv5   "/usr/libexec/getty Pc"         cons25  on  secure
-ttyv6   "/usr/libexec/getty Pc"         cons25  on  secure
-ttyv7   "/usr/libexec/getty Pc"         cons25  on  secure</programlisting>
-
-	<para>This will yield native support for these keyboards
-	  and frame buffers including VTY switching and X Window System.
-	  Note that this really requires at least &os;/sparc64
-	  &release.bugfix; otherwise it will not work on
-	  most of the UltraSPARC models.</para>
-      </listitem>
-
-      <listitem>
-	<para>In case your machine is equipped with a ATI Mach64
-	  frame buffer (found on-board in e.g. Sun Blade 100/150
-	  and Sun Ultra 5/10 as well as on Sun PGX8 and Sun PGX64
-	  add-on cards) or a PS/2 or a USB keyboard update to a
-	  &os;/sparc64 6.0 from June 10 2005 or later.
-	  If you use the stock GENERIC kernel and <filename>/etc/ttys</filename>
-	  from there no further action is required.</para>
-
-	<para>This will yield native support for these keyboards and frame buffers
-	  including VTY switching and X Window System.</para>
-      </listitem>
-
-      <listitem>
-	<para>In case your machine is equipped with hardware other than those
-	  mentioned above or you refuse to update to &os;/sparc64 6.0
-	  you can re-enable the ofw_console(4) driver as a last resort.
-	  To do so build a custom kernel with the following additional
-	  options:</para>
-
-	<programlisting>device          ofw_console
-device          sab
-device          zs</programlisting>
-
-	<para>and make sure to comment out the following kernel option:</para>
-
-	<programlisting>device          uart</programlisting>
-
-	<para>This will yield limited indirect support for
-	  any graphical console hardware, however with poor performance,
-	  and VTY switching as well as X Window System do not work with this.
-	  Note that ofw_console(4) is not really MPSAFE and therefore
-	  can result in panics under certain conditions.</para>
-      </listitem>
-    </itemizedlist>
-
-    <para>For more details of how to recompile your kernel or
-      update to &os; 6.0, see
-      <ulink url="http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/kernelconfig.html">Configuring the &os; Kernel</ulink> and
-      <ulink url="http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/cutting-edge.html">The Cutting Edge</ulink> sections in the &os; Handbook, respectively.</para>
+    <para>No news.</para>
+  </sect1>
 </article>
@@ -77,6 +77,18 @@
    documentation.  An up-to-date copy of the errata for &os;
    &release.current; can be found on the &os; Web site.</para>

+  <para>&os; &release.current; is the last planned release on the
+    &release.branch; branch.  The &os; development community is
+    currently focusing its efforts on the 6-STABLE and CURRENT
+    codelines.  No new major features are planned for the
+    &release.branch; branch, although minor updates and bugfixes may
+    be merged at the discretion of individual developers.  The &os;
+    security team will support the &release.current;-based security
+    branch with advisories and security patches until the end-of-life
+    date documented at
+    <ulink url="http://security.freebsd.org/"></ulink> (as of this
+    writing, 31 May 2008).</para>
+
 </sect1>

 <sect1 id="new">
@@ -308,7 +320,7 @@
 	<para arch="i386,amd64">Many (but not all) changes to the
 	  &man.ndis.4; system were merged from HEAD.</para>

-	<para>The &man.xl.4; driver now supports &man.polling.4;</para>
+	<para>The &man.xl.4; driver now supports &man.polling.4;.</para>

      </sect4>
    </sect3>
@@ -453,7 +465,7 @@

    <para>The timezone database has been updated from the
      <application>tzdata2005g</application> release to the
-      <application>tzdata2005r</application> release.</para>
+      <application>tzdata2006g</application> release.</para>
  </sect2>

  <sect2 id="ports">
@@ -35,17 +35,6 @@
 		  (list (list "HREF" "mailto:[email protected]"))
                  (literal "[email protected]"))
                (literal ">.")))
-            (make element gi: "p"
-                  attributes: (list (list "align" "center"))
-              (make element gi: "small"  
-                (literal "All users of FreeBSD ")
-		(literal (entity-text "release.branch"))
-		(literal " should subscribe to the ")
-                (literal "<")
-		(create-link (list (list "HREF" "mailto:[email protected]"))
-                  (literal "[email protected]"))
-                (literal "> mailing list.")))
-
            (make element gi: "p"
                  attributes: (list (list "align" "center"))
              (make element gi: "small"  
@@ -12,7 +12,7 @@ UNITEXTS=	readme errata

 IMAGEDIR=	.imagedir
 RHOST=		freefall.freebsd.org
-RDIR=		public_html/relnotes/5-STABLE
+RDIR=		public_html/relnotes/5.5-RELEASE
 DOCDIR=		./release/doc
 LANG=		en_US.ISO8859-1

@@ -6,7 +6,7 @@

 <!-- Version of the OS we're describing.  This needs to be updated
     with each new release. -->
-<!ENTITY release.current "5.4-STABLE">
+<!ENTITY release.current "5.5-RELEASE">

 <!-- The previous version used for comparison in the "What's New"
     section.  For -CURRENT, we might point back to the last
@@ -19,19 +19,19 @@
 <!ENTITY release.prev.stable "4.11-RELEASE">

 <!-- The next version to be released, usually used for snapshots. -->
-<!ENTITY release.next "5.5-RELEASE">
+<!ENTITY release.next "5.6-RELEASE">

 <!-- The name of this branch. -->
-<!ENTITY release.branch "5-STABLE">
+<!ENTITY release.branch "5.5-STABLE">

 <!-- The URL for obtaining this version of FreeBSD. -->
-<!ENTITY release.url "http://www.FreeBSD.org/snapshots/">
+<!ENTITY release.url "ftp://ftp.FreeBSD.org/">

 <!-- The type of release (usually this will be either "snapshot"
     or "release" -->
-<!ENTITY release.type "snapshot">
-<!ENTITY % release.type.snapshot "INCLUDE">
-<!ENTITY % release.type.release "IGNORE">
+<!ENTITY release.type "release">
+<!ENTITY % release.type.snapshot "IGNORE">
+<!ENTITY % release.type.release "INCLUDE">

 <!-- The manpaths for man page references -->
 <!ENTITY release.man.url "http://www.FreeBSD.org/cgi/man.cgi">
@@ -39,7 +39,7 @@
 <!ENTITY release.manpath.xorg          "6.9.0">
 <!ENTITY release.manpath.netbsd        "3.0">
 <!ENTITY release.manpath.freebsd-ports "Ports">
-<!ENTITY release.manpath.freebsd       "5.4-stable">
+<!ENTITY release.manpath.freebsd       "5.5-RELEASE">

 <!-- Text constants which probably don't need to be changed.-->

@@ -10,7 +10,7 @@

 	The FreeBSD Simplified Chinese Project

-	Original Revision: 1.69.2.33
+	Original Revision: 1.69.2.35.2.1
 -->

 <!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
@@ -19,8 +19,7 @@
 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
 %release;

-<!ENTITY release.bugfix "5.4-RELEASE">
-<!ENTITY release.bugfix.next "5.5-RELEASE">
+<!ENTITY release.bugfix "5.5-RELEASE">
 ]>

 <article>
@@ -59,9 +58,6 @@
      而没有来得及加入的重要信息。 这些信息可能包括安全公告，
      以及关于可能影响软件和文档的操作或可用性的新闻。
      在安装此版本的 &os; 之前， 应首先阅读此文档的最新版本。</para>
-
-    <para>这份 &os; &release.bugfix; 的勘误文档将被持续地维护，
-      直到 &os; 的 &release.bugfix.next; 发布为止。</para>
  </abstract>

  <sect1 id="intro">
@@ -90,254 +86,18 @@
  <sect1 id="security">
    <title>安全公告</title>

-    <para>下列安全公告与 &os; &release.bugfix; 有关。
-      要了解进一步的信息， 请从
-      <ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/"></ulink>
-      下载并阅读安全公告。</para>
-
-    <informaltable frame="none" pgwide="0">
-      <tgroup cols="3">
-	<colspec colwidth="1*">
-	<colspec colwidth="1*">
-	<colspec colwidth="3*">
-	<thead>
-	  <row>
-	    <entry>安全公告</entry>
-	    <entry>日期</entry>
-	    <entry>主题</entry>
-	  </row>
-	</thead>
-
-	<tbody>
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:10.nfs.asc"
-		>06:10.nfs</ulink></entry>
-	    <entry>2006&nbsp;年&nbsp;3&nbsp;月&nbsp;1&nbsp;日</entry>
-	    <entry><para>针对 NFS 服务器的远程拒绝服务攻击</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:09.openssh.asc"
-		>06:09.openssh</ulink></entry>
-	    <entry>2006&nbsp;年&nbsp;3&nbsp;月&nbsp;1&nbsp;日</entry>
-	    <entry><para>针对 OpenSSH 的远程拒绝服务攻击</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:07.pf.asc"
-		>06:07.pf</ulink></entry>
-	    <entry>2006&nbsp;年&nbsp;1&nbsp;月&nbsp;25&nbsp;日</entry>
-	    <entry><para>&man.pf.4; 中 IP 分片处理导致的 panic</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:03.cpio.asc"
-		>06:03.cpio</ulink></entry>
-	    <entry>2006&nbsp;年&nbsp;1&nbsp;月&nbsp;11日</entry>
-	    <entry><para>在 &man.cpio.1; 中存在多处漏洞</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:02.ee.asc"
-		>06:02.eex</ulink></entry>
-	    <entry>2006&nbsp;年&nbsp;1&nbsp;月&nbsp;11日</entry>
-	    <entry><para>&man.ee.1; 临时文件特权提升</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:01.texindex.asc"
-		>06:01.texindex</ulink></entry>
-	    <entry>2006&nbsp;年&nbsp;1&nbsp;月&nbsp;11日</entry>
-	    <entry><para>Texindex 临时文件特权提升</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:09.htt.asc"
-		>SA-05:09.htt</ulink></entry>
-	    <entry>2005&nbsp;年&nbsp;5&nbsp;月&nbsp;22&nbsp;日</entry>
-	    <entry><para>使用 HTT 引致的信息泄露</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:10.tcpdump.asc"
-		>SA-05:10.tcpdump</ulink></entry>
-	    <entry>2005&nbsp;年&nbsp;6&nbsp;月&nbsp;9&nbsp;日</entry>
-	    <entry><para>在 tcpdump 协议解码中的死循环</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:11.gzip.asc"
-		>SA-05:11.gzip</ulink></entry>
-	    <entry>2005&nbsp;年&nbsp;6&nbsp;月&nbsp;9&nbsp;日</entry>
-	    <entry><para>gzip 目录遍历及权限竞态条件漏洞</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:13.ipfw.asc"
-		>SA-05:13.ipfw</ulink></entry>
-	    <entry>2005&nbsp;年&nbsp;6&nbsp;月&nbsp;29&nbsp;日</entry>
-	    <entry><para>ipfw 地指表的包匹配差错</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:14.bzip2.asc"
-		>SA-05:14.bzip2</ulink></entry>
-	    <entry>2005&nbsp;年&nbsp;6&nbsp;月&nbsp;29&nbsp;日</entry>
-	    <entry><para>bzip2 拒绝服务和权限竞态条件漏洞</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:15.tcp.asc"
-		>SA-05:15.tcp</ulink></entry>
-	    <entry>2005&nbsp;年&nbsp;6&nbsp;月&nbsp;29&nbsp;日</entry>
-	    <entry><para>针对挂起 TCP 连接的拒绝服务攻击</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:16.zlib.asc"
-		>SA-05:16.zlib</ulink></entry>
-	    <entry>2005&nbsp;年&nbsp;7&nbsp;月&nbsp;6&nbsp;日</entry>
-	    <entry><para>zlib 中的缓冲区溢出问题</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:17.devfs.asc"
-		>SA-05:17.devfs</ulink></entry>
-	    <entry>2005&nbsp;年&nbsp;7&nbsp;月&nbsp;20&nbsp;日</entry>
-	    <entry><para>绕过 devfs 规则</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:18.zlib.asc"
-		>SA-05:18.zlib</ulink></entry>
-	    <entry>2005&nbsp;年&nbsp;7&nbsp;月&nbsp;27&nbsp;日</entry>
-	    <entry><para>zlib 中的缓冲区溢出问题</para></entry>
-	  </row>
-
-	  <row>
-	    <entry><ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:19.ipsec.asc"
-		>SA-05:19.ipsec</ulink></entry>
-	    <entry>2005&nbsp;年&nbsp;7&nbsp;月&nbsp;27&nbsp;日</entry>
-	    <entry><para>IPsec 对 AES-XCBC-MAC 密钥的不当使用</para></entry>
-	  </row>
-	</tbody>
-      </tgroup>
-    </informaltable>
+    <para>目前为止尚未发布任何安全公告。</para>
  </sect1>

  <sect1 id="open-issues">
    <title>存在的问题</title>

-    <para>暂时还没有新的已知问题。</para>
+    <para>目前为止没有新的已知问题。</para>
  </sect1>

  <sect1 id="late-news">
    <title>重大新闻</title>

-    <para>(2005 年 5 月 6 日) 由于默认的
-      <filename class="devicefile">/dev/iir</filename> 设备节点权限设置失误，
-      使得非特权的本地用户能够向 &man.iir.4; 驱动直接发送硬件指令。
-      尽管这一问题已经在 &release.prev; 发布之前修正，
-      但这一修正已经来不及放到发行版说明中。 欲了解进一步的细节，
-      请参见安全公告
-      <ulink url="ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:06.iir.asc">FreeBSD-SA-05:06.iir</ulink>。
-      </para>
-
-    <para>(2005 年 5 月 6 日) 修正了在 &man.i386.get.ldt.2;
-      系统调用的输入参数验证部分存在一些问题， 它们可能使内核内存被泄露给用户进程。
-      尽管这一问题已经在 &release.prev; 发布之前修正，
-      但这一修正已经来不及放到发行版说明中。 欲了解进一步的细节，
-      请参见安全公告
-      <ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:07.ldt.asc">FreeBSD-SA-05:07.ldt</ulink>。
-      </para>
-
-    <para>(2005 年 5 月 6 日) 修正了导致多个内核内存的部分内容的问题。
-      尽管这一问题已经在 &release.prev; 发布之前修正，
-      但这一修正已经来不及放到发行版说明中。 欲了解进一步的细节，
-      请参见安全公告
-      <ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:08.kmem.asc">FreeBSD-SA-05:08.kmem</ulink>。
-      </para>
-
-    <para>(2005 年 6 月 24 日) &os;/sparc64 &release.bugfix;
-      应明示 &os;/sparc64 GENERIC 内核在未来的 6.0-RELEASE
-      之前， 只提供对于串口控制台的正式支持。 对于 &os;/sparc64 &release.bugfix;
-      GENERIC 内核而言更是如此，
-      因为能够提供优先的间接图形控制台支持的 ofw_console(4) 已经为 &man.uart.4;
-      驱动所取代， 以期更好地支持串口。</para>
-
-    <para>由于这一限制， 在显示了 <quote><computeroutput>jumping to kernel entry
-	  at...</computeroutput></quote> 消息之后屏幕会停止工作，
-      如果您使用 &os;/sparc64 &release.bugfix;
-      GENERIC 内核配合图形控制台， 这一状态会持续到 &os; 本身继续执行为止。</para>
-
-    <para>如果一定要使用 &os;/sparc64 来配合图形控制台，
-      您可采取下列措施：</para>
-
-    <itemizedlist>
-      <listitem>
-	<para>如果您的计算机装配了 Sun Creator、
-	  Sun Creator3D， 或 Sun Elite3D 帧缓存卡，
-	  并使用了 Sun RS232 键盘， 则可以使用串口控制台安装 &os;/sparc64
-	  &release.bugfix; 并在随后使用包含下列选项的内核编译配置文件来编译定制的内核：</para>
-
-	<programlisting>device          sc
-device          creator
-options         KBD_INSTALL_CDEV</programlisting>
-
-	<para>除此之外， 您还需要在 <filename>/etc/ttys</filename>
-	  中启用 <filename>tty[1-7]</filename> 项，
-	  类似下面这样：</para>
-
-	<programlisting>ttyv0   "/usr/libexec/getty Pc"         cons25  on  secure
-# Virtual terminals
-ttyv1   "/usr/libexec/getty Pc"         cons25  on  secure
-ttyv2   "/usr/libexec/getty Pc"         cons25  on  secure
-ttyv3   "/usr/libexec/getty Pc"         cons25  on  secure
-ttyv4   "/usr/libexec/getty Pc"         cons25  on  secure
-ttyv5   "/usr/libexec/getty Pc"         cons25  on  secure
-ttyv6   "/usr/libexec/getty Pc"         cons25  on  secure
-ttyv7   "/usr/libexec/getty Pc"         cons25  on  secure</programlisting>
-
-	<para>这些配置将提供针对这些键盘， 以及 VTY 切换和 X 视窗系统的内建支持。	  请注意这些配置需要使用不低于 &os;/sparc64
-	  &release.bugfix; 的版本， 否则在绝大多数型号的 UltraSPARC
-	  上都将无法正常工作。</para>
-      </listitem>
-
-      <listitem>
-	<para>如果您的计算机装配了  ATI Mach64
-	  帧缓存卡 (见于 Sun Blade 100/150
-	  以及 Sun Ultra 5/10 和 Sun PGX8 以及 Sun PGX64
-	  附加卡) 或 PS/2 或 USB 键盘， 就必须升级到
-	  &os;/sparc64 6.0 在 2005 年 6 月 10 日之后的版本。
-	  如果您使用标准的 GENERIC 内核以及 <filename>/etc/ttys</filename>
-	  则不需要做任何额外的操作就可以正常工作了。</para>
-
-	<para>这些配置将提供针对这些键盘以及帧缓存， 以及 VTY 切换和 X
-	  视窗系统的内建支持。</para>
-      </listitem>
-
-      <listitem>
-	<para>如果您的计算机装配了其他硬件，
-	  或者不愿意升级到 &os;/sparc64 6.0，
-	  您可以重新启用 ofw_console(4) 驱动作为最后方案，
-	  方法是增加下列选项并重新联编定制的内核：</para>
-
-	<programlisting>device          ofw_console
-device          sab
-device          zs</programlisting>
-
-	<para>注意需要注释掉下列设置：</para>
-
-	<programlisting>device          uart</programlisting>
-
-	<para>这些操作将提供有限的对于图形控制台硬件的间接支持，
-	  但其性能很不好， 而且 VTY 切换和 X 视窗系统无法与其一同使用。
-	  请注意 ofw_console(4) 并非 MPSAFE 因此在某些特定的情况下，
-	  可能会导致系统崩溃。</para>
-      </listitem>
-    </itemizedlist>
-
-    <para>关于如何重新编译内核或升级到 &os; 6.0 的信息， 请参见 &os; 使用手册中的
-      <ulink url="http://www.FreeBSD.org/doc/zh_CN.GB2312/books/handbook/kernelconfig.html">配置 &os; 内核</ulink> 以及
-      <ulink url="http://www.freebsd.org/doc/zh_CN.GB2312/books/handbook/cutting-edge.html">最前沿</ulink> 章节。</para>
+    <para>目前为止还没有新闻。</para>
+  </sect1>
 </article>
@@ -1,7 +1,7 @@
 <!--
 	The FreeBSD Simplified Chinese Project

-	Original Revision: 1.5.2.1
+	Original Revision: 1.5.2.2
 	$FreeBSD$
 -->

@@ -17,6 +17,7 @@
    <year>2003</year>
    <year>2004</year>
    <year>2005</year>
+    <year>2006</year>
    <holder role="mailto:[email protected]">The FreeBSD Documentation Project</holder>
  </copyright>
 </articleinfo>
@@ -1,7 +1,7 @@
 <!--
 	The FreeBSD Simplified Chinese Project

-	Original Revision: 1.5
+	Original Revision: 1.5.2.1
 	$FreeBSD$
 -->

@@ -18,6 +18,8 @@
    <year>2002</year>
    <year>2003</year>
    <year>2004</year>
+    <year>2005</year>
+    <year>2006</year>
    <holder role="mailto:[email protected]">The FreeBSD Documentation Project</holder>
  </copyright>
 </articleinfo>
@@ -11,19 +11,21 @@

 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
 %release;
-<!ENTITY % devauto PUBLIC "-//FreeBSD//ENTITIES Auto Generated Device Lists//EN">
-%devauto;
-<!ENTITY % sections SYSTEM "../common/hw.ent"> %sections;
+<!ENTITY % sections SYSTEM "../common/install.ent"> %sections;

 <!-- Architecture-specific customization -->

 <!ENTITY arch "sparc64">
 <!ENTITY arch.print "UltraSPARC">
+<!ENTITY release.url "ftp://ftp.FreeBSD.org/pub/FreeBSD/development/sparc64/">
+
 ]>

 <article>
-  &artheader;
-  &sect.intro;
-  &sect.proc.sparc64;
-  &sect.dev;
+&artheader;
+&abstract;
+&sect.install;
+&sect.layout;
+&sect.upgrade;
+&sect.trouble;
 </article>
@@ -1,7 +1,7 @@
 <!--
     The FreeBSD Simplified Chinese Project

-     Original revision: 1.761.2.56
+     Original revision: 1.761.2.59.2.1
 -->
 <articleinfo>
  <title>&os;/&arch; &release.current; 发行说明</title>
@@ -44,7 +44,7 @@

  <para>这篇文档包括了在 &arch.print; 硬件平台上 &os;
    &release.current; 的发行说明。 它描述了最近刚刚加入、修改或删除了的
-    &os; 特性的说明。 同时，它也将给出如何从先前的 &os; 版本完成升级的说明。</para>
+    &os; 特性。 同时，它也将给出如何从先前的 &os; 版本完成升级的说明。</para>

 <![ %release.type.snapshot [

@@ -80,7 +80,6 @@

  <para>这一节描述了
    &os; 自 &release.prev; 以来最明显的新功能和变化。
-    一般说来， 没有注明 &merged; 的那些新特性是 &release.branch; 所独有的。
  </para>

  <para>发行说明中的绝大多数条目是在说明自从
@@ -118,7 +117,7 @@
      <ulink url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:11.gzip.asc">FreeBSD-SA-05:11.gzip</ulink>。
      </para>

-    <para发现并修正了 &man.ipfw.4; 中的一处可能导致包在查询表中无法正确匹配的问题。
+    <para>发现并修正了 &man.ipfw.4; 中的一处可能导致包在查询表中无法正确匹配的问题。
      这一问题只影响 SMP 和启用了
      <literal>PREEMPTION</literal>(抢占) 内核选项的 UP 机器。
      要了解进一步详情， 请参阅安全公告
@@ -214,6 +213,10 @@
      要了解进一步详情， 请参阅安全公告 <ulink
      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:13.sendmail.asc">FreeBSD-SA-06:13.sendmail</ulink>。</para>

+    <para>发现并修正了在 AMD 第7和第8代处理器上运行的 FreeBSD 内核的一处信息泄露问题。
+      要了解进一步详情， 请参阅安全公告 <ulink
+      url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:14.fpu.asc">FreeBSD-SA-06:14.fpu</ulink>。</para>
+
  </sect2>

  <sect2 id="kernel">
@@ -241,6 +244,9 @@
        &man.ce.4; 驱动。
        </para>

+      <para arch="i386,amd64">默认情况下双核处理器 (例如 Intel
+	Core Duo) 在运行启用了 SMP 的内核时， 会同时使用可用的两个核了。</para>
+
      <para></para>

      <sect4 id="mm">
@@ -267,6 +273,9 @@
 	  驱动程序可以使用 &man.ndisgen.8; 工具来构建，
 	  其结果是生成能够使用 &man.kldload.8; 直接加载的内核模块。</para>

+	<para arch="i386,amd64">从 HEAD 合并了许多 (但并非全部) 对
+	  &man.ndis.4; 系统所做的改进。</para>
+
 	<para>&man.xl.4; 驱动支持 &man.polling.4; 了。</para>

      </sect4>
@@ -275,14 +284,19 @@
    <sect3 id="net-proto">
      <title>网络协议</title>

-      <para></para>
+      <para>加入了始创于 NetBSD 的网桥实现 &man.if.bridge.4;。 它支持 IEEE
+	802.1D 生成树协议、 为每个网桥分配独立的接口设备、
+	过滤网桥数据包、 镜像口 (将传送网桥收到的所有包的副本) 等功能。
+	此外， &man.ifconfig.8; 工具也能够配置
+	&man.if.bridge.4; 了。</para>

    </sect3>

    <sect3 id="disks">
      <title>磁盘及存储</title>

-      <para></para>
+      <para>&man.twa.4; 驱动已升级至 3ware 网站上发布的 9.3.0.1
+	版。</para>

    </sect3>

@@ -313,23 +327,77 @@
    <para>&man.getprotoent.3;、 &man.getprotobyname.3;， 以及
      &man.getprotobynumber.3; 这些函数是线程-安全的了。</para>

+    <para>加入了 &man.bsdiff.1; 和 &man.bspatch.1; 工具。
+      这些工具可以用来针对二进制的文件建立和应用补丁。</para>
+
+    <para>&man.cmp.1; 工具新增了 <option>-h</option>
+      选项表示比较符号连接本身， 而非连接所指的文件。</para>
+
    <para>&man.getservent.3;、 &man.getservbyname.3;， 以及
      &man.getservbyport.3; 这些函数是线程-安全的了。</para>

    <para>&man.kldstat.8; 工具新增了用于返回特定内核模块状态的
      <option>-m</option> 选项。</para>

+    <para>&man.getprotoent.3;、 &man.getprotobyname.3;， 以及
+      &man.getprotobynumber.3; 函数是线程安全的了。</para>
+
+    <para>&man.getservent.3;、 &man.getservbyname.3;， 以及
+      &man.getservbyport.3; 函数是线程安全的了。</para>
+
+    <para>&man.kdump.1; 程序新增了用以省略 I/O 数据显示的 <option>-s</option>
+      参数。</para>
+
+    <para>&man.kldstat.8; 工具新增了用以返回特定内核模块状态的
+      <option>-m</option> 选项。</para>
+
    <para>在 <filename>libpthread</filename>、
      <filename>libthr</filename>，
      以及 <filename>libc_r</filename> 中的默认线程本地堆栈尺寸得以增加。 在 32-位
      平台上， 主线程默认使用 2MB 的堆栈， 而其他线程则是 1MB 的堆栈。 在
      64-位 平台上， 默认的堆栈尺寸则相应是 4MB 和 2MB。</para>

+    <para>&man.netstat.1; 工具新增了用于显示接口统计模式的
+      <option>-h</option> 参数， 它表示以便于人类阅读的方式显示接口的全部统计数据。</para>
+
+    <para>&man.ping.8; 工具新增了 <quote>扫荡式
+	ping</quote>， 表示每步增加 &man.icmp.4; 包的尺寸。
+      这对于测试存在问题的信道、 MTU 问题，
+      以及网络中的流量策略功能都非常有用。</para>
+
+    <para>加入了用于管理电源消耗的 &man.powerd.8; 程序。</para>
+
+    <para>&man.rfcomm.sppd.1; 能够支持在指定服务名的同时指定
+      <option>-c</option> 选项和通道号了。
+      支持的名字包括： DUN (拨号网络)、 FAX (传真)、
+      LAN (使用 PPP 访问 LAN)， 以及 SP (串口)。</para>
+
+    <para>&man.rm.1; 工具新增了 <option>-I</option>
+      选项， 表示在递归删除目录或一次删除超过 3 个文件时进行提示 (一次)。</para>
+
    <para>&man.sed.1; 新增了用于启用输出行缓冲的 <option>-l</option> 选项。</para>

+    <para>&man.sh.1; 新增了 <literal>times</literal>
+      内建命令。</para>
+
+    <para>加入了用以显示 UFS 文件系统中快照位置的 &man.snapinfo.8;
+      工具。</para>
+
    <sect3 id="rc-scripts">
      <title><filename>/etc/rc.d</filename> 脚本</title>

+      <para>新增了 <filename>bluetooth</filename> 脚本。
+	这个脚本会在设备连上/断开时， 由
+	&man.devd.8; 调用并启动/停止对应的设备，
+	而无须管理员手工干预。 这个脚本的默认配置参数在
+	<filename>/etc/defaults/bluetooth.device.conf</filename>，
+	这些默认值可以用
+	<filename>/etc/bluetooth/<replaceable>$device</replaceable>.conf</filename>
+	来覆盖
+	(这里的 <replaceable>$device</replaceable> 是 <devicename>ubt0</devicename>、
+	<devicename>btcc0</devicename>， 等等。)
+	要了解进一步详情， 请参阅 &man.bluetooth.conf.5;。</para>
+
      <para><filename>rc.d/jail</filename> 启动脚本新增了
 	<varname>jail_<replaceable>name</replaceable>_flags</varname>
 	变量， 用于对应的设置 &man.jail.8; 的命令行参数。</para>
@@ -348,15 +416,54 @@

    <para>时区数据库从
      <application>tzdata2005g</application> 版升级到了
-      <application>tzdata2005r</application> 版。</para>
+      <application>tzdata2006g</application> 版。</para>
  </sect2>

  <sect2 id="ports">
    <title>Ports/Packages Collection 基础结构</title>

+    <para>&man.pkg.add.1; 命令新增了 <option>-P</option>
+      参数， 它与 <option>-p</option> 参数类似，
+      区别在于给定的前缀也会用于依赖的其他包。</para>
+
+    <para>&man.pkg.add.1; 和 &man.pkg.create.1; 这两个工具新增了
+      <option>-K</option> 参数， 表示将 package 默认保存至当前目录
+      (如果有定义 <varname>PKGDIR</varname> 则保存在那个目录)。</para>
+
+    <para>&man.pkg.create.1; 程序新增了 <option>-x</option>
+      参数， 用以使用基本正则表达式来表示 package 的名字，
+      <option>-E</option> 标志表示使用扩展正则表达式，
+      而 <option>-G</option> 则表示精确匹配。</para>
+
    <para>&man.pkg.version.1; 新增了
      <option>-I</option> 参数， 表示使用
      <filename>INDEX</filename> 作为判断预编译包是否过时的唯一依据。</para>
+
+    <para>&man.pkg.version.1; 工具新增了 <option>-o</option>
+      参数， 用于显示在 package 生成时所记录的来源 (origin) 目录而不是其本身的名字，
+      以及 <option>-O</option> 参数表示只列出所有注册来源为指定来源的 package。</para>
+
+    <para>新增了 &man.portsnap.8; 工具 (<filename>sysutils/portsnap</filename>)
+      到 &os; 基本系统中。 这是一个安全、 便于使用、
+      快速、 轻量级的工具， 能够很好地帮助用户保持他们的 ports tree
+      与官方版本同步。</para>
+
+    <para>删去了从 Ports 套件安装的启动脚本的后缀。
+      这意味着 <filename>foo.sh</filename>
+      都将改名为 <filename>foo</filename>， 并且名为
+      <filename>foo.ORG</filename> 的脚本也会被执行。
+      您应重新安装所有安装了启动脚本的 package， 并清理
+      <varname>local_startup</varname> 目录中多余的文件。</para>
+
+    <para>新增了两个 <filename>rc.conf</filename> 变量，
+      <varname>ldconfig_local_dirs</varname> 和
+      <varname>ldconfig_local32_dirs</varname>。
+      这两个变量用于指定本地的 &man.ldconfig.8; 目录列表。</para>
+
+    <para><filename>pkg-plist</filename> 中的
+      <command>@cwd</command> 命令支持不指定目录参数了。
+      如果没有指定目录参数， 则它将把当前工作目录设置为
+      <command>@cwd</command> 命令给出的第一个前缀。</para>
  </sect2>

  <sect2 id="releng">
@@ -367,7 +474,7 @@
      从 2.10.2 升级到了 2.12.3。</para>

    <para>支持的 <application>KDE</application> 桌面环境
-      (<filename role="package">x11/kde2</filename>) 的版本，
+      (<filename role="package">x11/kde3</filename>) 的版本，
      从 3.4.2 升级到了 3.5.1。</para>

    <para>支持的 <application>Perl</application> 解释器
@@ -1,27 +1,20 @@
+<!-- Original Revision: 1.6 -->
 <!-- $FreeBSD$ -->

 <!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
+<!ENTITY % articles.ent PUBLIC "-//FreeBSD//ENTITIES DocBook FreeBSD Articles Entity Set//EN">
+%articles.ent;

-<!ENTITY release.url "ftp://ftp.FreeBSD.org/pub/FreeBSD/development/sparc64/">
-
-<!ENTITY % man PUBLIC "-//FreeBSD//ENTITIES DocBook Manual Page Entities//EN">
-%man;
-<!ENTITY % authors PUBLIC  "-//FreeBSD//ENTITIES DocBook Author Entities//EN">
-%authors;
-<!ENTITY % mlists PUBLIC "-//FreeBSD//ENTITIES DocBook Mailing List Entities//EN">
-%mlists;
-<!ENTITY % trademarks PUBLIC "-//FreeBSD//ENTITIES DocBook Trademark Entities//EN">
-%trademarks;
 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
 %release;
-<!ENTITY % urls.ent PUBLIC "-//FreeBSD//ENTITIES DocBook URL Entities//EN">
-%urls.ent;
-<!ENTITY % sections SYSTEM "../common/relnotes.ent"> %sections;
+<!ENTITY % sections SYSTEM "../common/relnotes.ent">
+%sections;

 <!-- Architecture-specific customization -->

 <!ENTITY arch "sparc64">
 <!ENTITY arch.print "UltraSPARC">
+<!ENTITY release.url "ftp://ftp.FreeBSD.org/pub/FreeBSD/development/sparc64/">

 ]>

@@ -1,4 +1,4 @@
-<!-- Original Revision: 1.8.2.1 -->
+<!-- Original Revision: 1.8.2.1.6.1 -->
 <!-- $FreeBSD$ -->

 <!DOCTYPE style-sheet PUBLIC "-//James Clark//DTD DSSSL Style Sheet//EN" [
@@ -36,17 +36,6 @@
 		  (list (list "HREF" "mailto:[email protected]"))
                  (literal "[email protected]"))
                (literal ">¡£")))
-            (make element gi: "p"
-                  attributes: (list (list "align" "center"))
-              (make element gi: "small"  
-                (literal "所有 FreeBSD ")
-		(literal (entity-text "release.branch"))
-		(literal " 的用户都应订阅 ")
-                (literal "<")
-		(create-link (list (list "HREF" "mailto:[email protected]"))
-                  (literal "[email protected]"))
-                (literal "> 邮件列表。")))
-
            (make element gi: "p"
                  attributes: (list (list "align" "center"))
              (make element gi: "small"  
@@ -51,7 +51,7 @@
 *default host=CHANGE_THIS.FreeBSD.org
 *default base=/var/db
 *default prefix=/usr
-*default release=cvs tag=RELENG_5
+*default release=cvs tag=RELENG_5_5
 *default delete use-rel-suffix

 # If you seem to be limited by CPU rather than network or disk bandwidth, try
@@ -32,7 +32,7 @@

 TYPE="FreeBSD"
 REVISION="5.5"
-BRANCH="PRERELEASE"
+BRANCH="RELEASE-p20"
 RELEASE="${REVISION}-${BRANCH}"
 VERSION="${TYPE} ${RELEASE}"

@@ -148,6 +148,9 @@ static void em_clean_transmit_interrupts(struct adapter *);
 static int  em_allocate_receive_structures(struct adapter *);
 static int  em_allocate_transmit_structures(struct adapter *);
 static void em_process_receive_interrupts(struct adapter *, int);
+#ifndef __NO_STRICT_ALIGNMENT
+static int  em_fixup_rx(struct adapter *);
+#endif
 static void em_receive_checksum(struct adapter *, 
 				struct em_rx_desc *,
 				struct mbuf *);
@@ -2839,11 +2842,20 @@ em_process_receive_interrupts(struct adapter * adapter, int count)
 				ifp->if_ipackets++;
                                em_receive_checksum(adapter, current_desc,
                                                    adapter->fmp);
+#ifndef __NO_STRICT_ALIGNMENT
+				if (ifp->if_mtu > ETHERMTU &&
+				    em_fixup_rx(adapter) != 0)
+					goto skip;
+
+#endif
                                if (current_desc->status & E1000_RXD_STAT_VP)
                                        VLAN_INPUT_TAG(ifp, adapter->fmp,
                                                       (current_desc->special &
 							E1000_RXD_SPC_VLAN_MASK),
 						       adapter->fmp = NULL);
+#ifndef __NO_STRICT_ALIGNMENT
+skip:
+#endif
 				m = adapter->fmp;
 				adapter->fmp = NULL;
 				adapter->lmp = NULL;
@@ -2879,6 +2891,54 @@ em_process_receive_interrupts(struct adapter * adapter, int count)
 	return;
 }

+#ifndef __NO_STRICT_ALIGNMENT
+/*
+ * When jumbo frames are enabled we should realign entire payload on
+ * architecures with strict alignment. This is serious design mistake of 8254x
+ * as it nullifies DMA operations. 8254x just allows RX buffer size to be
+ * 2048/4096/8192/16384. What we really want is 2048 - ETHER_ALIGN to align its
+ * payload. On architecures without strict alignment restrictions 8254x still
+ * performs unaligned memory access which would reduce the performance too. 
+ * To avoid copying over an entire frame to align, we allocate a new mbuf and
+ * copy ethernet header to the new mbuf. The new mbuf is prepended into the
+ * existing mbuf chain.
+ *
+ * Be aware, best performance of the 8254x is achived only when jumbo frame is
+ * not used at all on architectures with strict alignment.
+ */
+static int
+em_fixup_rx(struct adapter *adapter)
+{
+	struct mbuf *m, *n;
+	int error;
+
+	error = 0;
+	m = adapter->fmp;
+	if (m->m_len <= (MCLBYTES - ETHER_HDR_LEN)) {
+		bcopy(m->m_data, m->m_data + ETHER_HDR_LEN, m->m_len);
+		m->m_data += ETHER_HDR_LEN;
+	} else {
+		MGETHDR(n, M_DONTWAIT, MT_DATA);
+		if (n != NULL) {
+			bcopy(m->m_data, n->m_data, ETHER_HDR_LEN);
+			m->m_data += ETHER_HDR_LEN;
+			m->m_len -= ETHER_HDR_LEN;
+			n->m_len = ETHER_HDR_LEN;
+			M_MOVE_PKTHDR(n, m);
+			n->m_next = m;
+			adapter->fmp = n;
+		} else {
+			adapter->dropped_pkts++;
+			m_freem(adapter->fmp);
+			adapter->fmp = NULL;
+			error = ENOMEM;
+		}
+	}
+
+	return (error);
+}
+#endif
+
 /*********************************************************************
 *
 *  Verify that the hardware indicated that the checksum is valid. 
@@ -712,7 +712,7 @@ out:
 			else
 				len = fwdev->rommax - CSRROMOFF + 4;
 		}
-		if (crom_buf->len < len)
+		if (crom_buf->len < len && crom_buf->len >= 0)
 			len = crom_buf->len;
 		else
 			crom_buf->len = len;
@@ -1,250 +0,0 @@
-/* $FreeBSD$ */
-/*-
- * Copyright (c) 2000-2005, LSI Logic Corporation and its contributors.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon including
- *    a substantially similar Disclaimer requirement for further binary
- *    redistribution.
- * 3. Neither the name of the LSI Logic Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF THE COPYRIGHT
- * OWNER OR CONTRIBUTOR IS ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-/*
- *  Copyright (c) 2003-2004 LSI Logic Corporation.
- *
- *
- *           Name:  mpi_inb.h
- *          Title:  MPI Inband structures and definitions
- *  Creation Date:  September 30, 2003
- *
- *    mpi_inb.h Version:  01.05.01
- *
- *  Version History
- *  ---------------
- *
- *  Date      Version   Description
- *  --------  --------  ------------------------------------------------------
- *  05-11-04  01.03.01  Original release.
- *  08-19-04  01.05.01  Original release for MPI v1.5.
- *  --------------------------------------------------------------------------
- */
-
-#ifndef MPI_INB_H
-#define MPI_INB_H
-
-/******************************************************************************
-*
-*        I n b a n d    M e s s a g e s
-*
-*******************************************************************************/
-
-
-/****************************************************************************/
-/* Inband Buffer Post Request                                               */
-/****************************************************************************/
-
-typedef struct _MSG_INBAND_BUFFER_POST_REQUEST
-{
-    U8                      Reserved1;          /* 00h */
-    U8                      BufferCount;        /* 01h */
-    U8                      ChainOffset;        /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     Reserved2;          /* 04h */
-    U8                      Reserved3;          /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U32                     Reserved4;          /* 0Ch */
-    SGE_TRANS_SIMPLE_UNION  SGL;                /* 10h */
-} MSG_INBAND_BUFFER_POST_REQUEST, MPI_POINTER PTR_MSG_INBAND_BUFFER_POST_REQUEST,
-  MpiInbandBufferPostRequest_t , MPI_POINTER pMpiInbandBufferPostRequest_t;
-
-
-typedef struct _WWN_FC_FORMAT
-{
-    U64                     NodeName;           /* 00h */
-    U64                     PortName;           /* 08h */
-} WWN_FC_FORMAT, MPI_POINTER PTR_WWN_FC_FORMAT,
-  WwnFcFormat_t, MPI_POINTER pWwnFcFormat_t;
-
-typedef struct _WWN_SAS_FORMAT
-{
-    U64                     WorldWideID;        /* 00h */
-    U32                     Reserved1;          /* 08h */
-    U32                     Reserved2;          /* 0Ch */
-} WWN_SAS_FORMAT, MPI_POINTER PTR_WWN_SAS_FORMAT,
-  WwnSasFormat_t, MPI_POINTER pWwnSasFormat_t;
-
-typedef union _WWN_INBAND_FORMAT
-{
-    WWN_FC_FORMAT           Fc;
-    WWN_SAS_FORMAT          Sas;
-} WWN_INBAND_FORMAT, MPI_POINTER PTR_WWN_INBAND_FORMAT,
-  WwnInbandFormat, MPI_POINTER pWwnInbandFormat;
-
-
-/* Inband Buffer Post reply message */
-
-typedef struct _MSG_INBAND_BUFFER_POST_REPLY
-{
-    U16                     Reserved1;          /* 00h */
-    U8                      MsgLength;          /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     Reserved2;          /* 04h */
-    U8                      Reserved3;          /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U16                     Reserved4;          /* 0Ch */
-    U16                     IOCStatus;          /* 0Eh */
-    U32                     IOCLogInfo;         /* 10h */
-    U32                     TransferLength;     /* 14h */
-    U32                     TransactionContext; /* 18h */
-    WWN_INBAND_FORMAT       Wwn;                /* 1Ch */
-    U32                     IOCIdentifier[4];   /* 2Ch */
-} MSG_INBAND_BUFFER_POST_REPLY, MPI_POINTER PTR_MSG_INBAND_BUFFER_POST_REPLY,
-  MpiInbandBufferPostReply_t, MPI_POINTER pMpiInbandBufferPostReply_t;
-
-
-/****************************************************************************/
-/* Inband Send Request                                                      */
-/****************************************************************************/
-
-typedef struct _MSG_INBAND_SEND_REQUEST
-{
-    U16                     Reserved1;          /* 00h */
-    U8                      ChainOffset;        /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     Reserved2;          /* 04h */
-    U8                      Reserved3;          /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U32                     Reserved4;          /* 0Ch */
-    WWN_INBAND_FORMAT       Wwn;                /* 10h */
-    U32                     Reserved5;          /* 20h */
-    SGE_IO_UNION            SGL;                /* 24h */
-} MSG_INBAND_SEND_REQUEST, MPI_POINTER PTR_MSG_INBAND_SEND_REQUEST,
-  MpiInbandSendRequest_t , MPI_POINTER pMpiInbandSendRequest_t;
-
-
-/* Inband Send reply message */
-
-typedef struct _MSG_INBAND_SEND_REPLY
-{
-    U16                     Reserved1;          /* 00h */
-    U8                      MsgLength;          /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     Reserved2;          /* 04h */
-    U8                      Reserved3;          /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U16                     Reserved4;          /* 0Ch */
-    U16                     IOCStatus;          /* 0Eh */
-    U32                     IOCLogInfo;         /* 10h */
-    U32                     ResponseLength;     /* 14h */
-} MSG_INBAND_SEND_REPLY, MPI_POINTER PTR_MSG_INBAND_SEND_REPLY,
-  MpiInbandSendReply_t, MPI_POINTER pMpiInbandSendReply_t;
-
-
-/****************************************************************************/
-/* Inband Response Request                                                  */
-/****************************************************************************/
-
-typedef struct _MSG_INBAND_RSP_REQUEST
-{
-    U16                     Reserved1;          /* 00h */
-    U8                      ChainOffset;        /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     Reserved2;          /* 04h */
-    U8                      Reserved3;          /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U32                     Reserved4;          /* 0Ch */
-    WWN_INBAND_FORMAT       Wwn;                /* 10h */
-    U32                     IOCIdentifier[4];   /* 20h */
-    U32                     ResponseLength;     /* 30h */
-    SGE_IO_UNION            SGL;                /* 34h */
-} MSG_INBAND_RSP_REQUEST, MPI_POINTER PTR_MSG_INBAND_RSP_REQUEST,
-  MpiInbandRspRequest_t , MPI_POINTER pMpiInbandRspRequest_t;
-
-
-/* Inband Response reply message */
-
-typedef struct _MSG_INBAND_RSP_REPLY
-{
-    U16                     Reserved1;          /* 00h */
-    U8                      MsgLength;          /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     Reserved2;          /* 04h */
-    U8                      Reserved3;          /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U16                     Reserved4;          /* 0Ch */
-    U16                     IOCStatus;          /* 0Eh */
-    U32                     IOCLogInfo;         /* 10h */
-} MSG_INBAND_RSP_REPLY, MPI_POINTER PTR_MSG_INBAND_RSP_REPLY,
-  MpiInbandRspReply_t, MPI_POINTER pMpiInbandRspReply_t;
-
-
-/****************************************************************************/
-/* Inband Abort Request                                                     */
-/****************************************************************************/
-
-typedef struct _MSG_INBAND_ABORT_REQUEST
-{
-    U8                      Reserved1;          /* 00h */
-    U8                      AbortType;          /* 01h */
-    U8                      ChainOffset;        /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     Reserved2;          /* 04h */
-    U8                      Reserved3;          /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U32                     Reserved4;          /* 0Ch */
-    U32                     ContextToAbort;     /* 10h */
-} MSG_INBAND_ABORT_REQUEST, MPI_POINTER PTR_MSG_INBAND_ABORT_REQUEST,
-  MpiInbandAbortRequest_t , MPI_POINTER pMpiInbandAbortRequest_t;
-
-#define MPI_INBAND_ABORT_TYPE_ALL_BUFFERS       (0x00)
-#define MPI_INBAND_ABORT_TYPE_EXACT_BUFFER      (0x01)
-#define MPI_INBAND_ABORT_TYPE_SEND_REQUEST      (0x02)
-#define MPI_INBAND_ABORT_TYPE_RESPONSE_REQUEST  (0x03)
-
-
-/* Inband Abort reply message */
-
-typedef struct _MSG_INBAND_ABORT_REPLY
-{
-    U8                      Reserved1;          /* 00h */
-    U8                      AbortType;          /* 01h */
-    U8                      MsgLength;          /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     Reserved2;          /* 04h */
-    U8                      Reserved3;          /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U16                     Reserved4;          /* 0Ch */
-    U16                     IOCStatus;          /* 0Eh */
-    U32                     IOCLogInfo;         /* 10h */
-} MSG_INBAND_ABORT_REPLY, MPI_POINTER PTR_MSG_INBAND_ABORT_REPLY,
-  MpiInbandAbortReply_t, MPI_POINTER pMpiInbandAbortReply_t;
-
-
-#endif
@@ -1,117 +0,0 @@
-/* $FreeBSD$ */
-/*-
- * Copyright (c) 2000-2005, LSI Logic Corporation and its contributors.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon including
- *    a substantially similar Disclaimer requirement for further binary
- *    redistribution.
- * 3. Neither the name of the LSI Logic Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF THE COPYRIGHT
- * OWNER OR CONTRIBUTOR IS ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *  NAME:           fc_log.h
- *  SUMMARY:        MPI IocLogInfo definitions for the SYMFC9xx chips
- *  DESCRIPTION:    Contains the enumerated list of values that may be returned
- *                  in the IOCLogInfo field of a MPI Default Reply Message.
- *
- *  CREATION DATE:  6/02/2000
- *  ID:             $Id: //prod/main/platform/os/linux/drivers/message/fusion/lsi/mpi_log_fc.h#1 $
- */
-
-
-/*
- * MpiIocLogInfo_t enum
- *
- * These 32 bit values are used in the IOCLogInfo field of the MPI reply
- * messages.
- * The value is 0xabcccccc where
- *          a = The type of log info as per the MPI spec. Since these codes are
- *              all for Fibre Channel this value will always be 2.
- *          b = Specifies a subclass of the firmware where
- *                  0 = FCP Initiator
- *                  1 = FCP Target
- *                  2 = LAN
- *                  3 = MPI Message Layer
- *                  4 = FC Link
- *                  5 = Context Manager
- *                  6 = Invalid Field Offset
- *                  7 = State Change Info
- *                  all others are reserved for future use
- *          c = A specific value within the subclass.
- *
- * NOTE: Any new values should be added to the end of each subclass so that the
- *       codes remain consistent across firmware releases.
- */
-typedef enum _MpiIocLogInfoFc
-{
-    MPI_IOCLOGINFO_FC_INIT_BASE                     = 0x20000000,
-    MPI_IOCLOGINFO_FC_INIT_ERROR_OUT_OF_ORDER_FRAME = 0x20000001, /* received an out of order frame - unsupported */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_BAD_START_OF_FRAME = 0x20000002, /* Bad Rx Frame, bad start of frame primative */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_BAD_END_OF_FRAME   = 0x20000003, /* Bad Rx Frame, bad end of frame primative */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_OVER_RUN           = 0x20000004, /* Bad Rx Frame, overrun */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_RX_OTHER           = 0x20000005, /* Other errors caught by IOC which require retries */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_SUBPROC_DEAD       = 0x20000006, /* Main processor could not initialize sub-processor */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_RX_OVERRUN         = 0x20000007, /* Scatter Gather overrun  */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_RX_BAD_STATUS      = 0x20000008, /* Receiver detected context mismatch via invalid header */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_RX_UNEXPECTED_FRAME= 0x20000009, /* CtxMgr detected unsupported frame type  */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_LINK_FAILURE       = 0x2000000A, /* Link failure occurred  */
-    MPI_IOCLOGINFO_FC_INIT_ERROR_TX_TIMEOUT         = 0x2000000B, /* Transmitter timeout error */
-
-    MPI_IOCLOGINFO_FC_TARGET_BASE                   = 0x21000000,
-    MPI_IOCLOGINFO_FC_TARGET_NO_PDISC               = 0x21000001, /* not sent because we are waiting for a PDISC from the initiator */
-    MPI_IOCLOGINFO_FC_TARGET_NO_LOGIN               = 0x21000002, /* not sent because we are not logged in to the remote node */
-    MPI_IOCLOGINFO_FC_TARGET_DOAR_KILLED_BY_LIP     = 0x21000003, /* Data Out, Auto Response, not sent due to a LIP */
-    MPI_IOCLOGINFO_FC_TARGET_DIAR_KILLED_BY_LIP     = 0x21000004, /* Data In, Auto Response, not sent due to a LIP */
-    MPI_IOCLOGINFO_FC_TARGET_DIAR_MISSING_DATA      = 0x21000005, /* Data In, Auto Response, missing data frames */
-    MPI_IOCLOGINFO_FC_TARGET_DONR_KILLED_BY_LIP     = 0x21000006, /* Data Out, No Response, not sent due to a LIP */
-    MPI_IOCLOGINFO_FC_TARGET_WRSP_KILLED_BY_LIP     = 0x21000007, /* Auto-response after a write not sent due to a LIP */
-    MPI_IOCLOGINFO_FC_TARGET_DINR_KILLED_BY_LIP     = 0x21000008, /* Data In, No Response, not completed due to a LIP */
-    MPI_IOCLOGINFO_FC_TARGET_DINR_MISSING_DATA      = 0x21000009, /* Data In, No Response, missing data frames */
-    MPI_IOCLOGINFO_FC_TARGET_MRSP_KILLED_BY_LIP     = 0x2100000a, /* Manual Response not sent due to a LIP */
-    MPI_IOCLOGINFO_FC_TARGET_NO_CLASS_3             = 0x2100000b, /* not sent because remote node does not support Class 3 */
-    MPI_IOCLOGINFO_FC_TARGET_LOGIN_NOT_VALID        = 0x2100000c, /* not sent because login to remote node not validated */
-    MPI_IOCLOGINFO_FC_TARGET_FROM_OUTBOUND          = 0x2100000e, /* cleared from the outbound queue after a logout */
-    MPI_IOCLOGINFO_FC_TARGET_WAITING_FOR_DATA_IN    = 0x2100000f, /* cleared waiting for data after a logout */
-
-    MPI_IOCLOGINFO_FC_LAN_BASE                      = 0x22000000,
-    MPI_IOCLOGINFO_FC_LAN_TRANS_SGL_MISSING         = 0x22000001, /* Transaction Context Sgl Missing */
-    MPI_IOCLOGINFO_FC_LAN_TRANS_WRONG_PLACE         = 0x22000002, /* Transaction Context found before an EOB */
-    MPI_IOCLOGINFO_FC_LAN_TRANS_RES_BITS_SET        = 0x22000003, /* Transaction Context value has reserved bits set */
-    MPI_IOCLOGINFO_FC_LAN_WRONG_SGL_FLAG            = 0x22000004, /* Invalid SGL Flags */
-
-    MPI_IOCLOGINFO_FC_MSG_BASE                      = 0x23000000,
-
-    MPI_IOCLOGINFO_FC_LINK_BASE                     = 0x24000000,
-    MPI_IOCLOGINFO_FC_LINK_LOOP_INIT_TIMEOUT        = 0x24000001, /* Loop initialization timed out */
-    MPI_IOCLOGINFO_FC_LINK_ALREADY_INITIALIZED      = 0x24000002, /* Another system controller already initialized the loop */
-    MPI_IOCLOGINFO_FC_LINK_LINK_NOT_ESTABLISHED     = 0x24000003, /* Not synchronized to signal or still negotiating (possible cable problem) */
-    MPI_IOCLOGINFO_FC_LINK_CRC_ERROR                = 0x24000004, /* CRC check detected error on received frame */
-
-    MPI_IOCLOGINFO_FC_CTX_BASE                      = 0x25000000,
-
-    MPI_IOCLOGINFO_FC_INVALID_FIELD_BYTE_OFFSET     = 0x26000000, /* The lower 24 bits give the byte offset of the field in the request message that is invalid */
-    MPI_IOCLOGINFO_FC_INVALID_FIELD_MAX_OFFSET      = 0x26ffffff,
-
-    MPI_IOCLOGINFO_FC_STATE_CHANGE                  = 0x27000000  /* The lower 24 bits give additional information concerning state change */
-
-} MpiIocLogInfoFc_t;
@@ -1,181 +0,0 @@
-/* $FreeBSD$ */
-/*-
- * Copyright (c) 2000-2005, LSI Logic Corporation and its contributors.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon including
- *    a substantially similar Disclaimer requirement for further binary
- *    redistribution.
- * 3. Neither the name of the LSI Logic Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF THE COPYRIGHT
- * OWNER OR CONTRIBUTOR IS ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *                                                                         *
- ***************************************************************************
- *
- *           Name:  iopiIocLogInfo.h
- *          Title:  SAS Firmware IOP Interface IOC Log Info Definitions
- *     Programmer:  Guy Kendall
- *  Creation Date:  September 24, 2003
- *
- *  Version History
- *  ---------------
- *
- *  Last Updated
- *  -------------
- *  Version         %version: 22 %
- *  Date Updated    %date_modified: %
- *  Programmer      %created_by: nperucca %
- *
- *  Date      Who   Description
- *  --------  ---   -------------------------------------------------------
- *  09/24/03  GWK   Initial version
- *
- *
- * Description
- * ------------
- * This include file contains SAS firmware interface IOC Log Info codes
- *
- *-------------------------------------------------------------------------
- */
-
-#ifndef IOPI_IOCLOGINFO_H_INCLUDED
-#define IOPI_IOCLOGINFO_H_INCLUDED
-
-
-/****************************************************************************/
-/*  IOC LOGINFO defines, 0x00000000 - 0x0FFFFFFF                            */
-/*  Format:                                                                 */
-/*      Bits 31-28: MPI_IOCLOGINFO_TYPE_SAS (3)                             */
-/*      Bits 27-24: IOC_LOGINFO_ORIGINATOR: 0=IOP, 1=PL, 2=IR               */
-/*      Bits 23-16: LOGINFO_CODE                                            */
-/*      Bits 15-0:  LOGINFO_CODE Specific                                   */
-/****************************************************************************/
-
-/****************************************************************************/
-/* IOC_LOGINFO_ORIGINATOR defines                                           */
-/****************************************************************************/
-#define IOC_LOGINFO_ORIGINATOR_IOP                      (0x00000000)
-#define IOC_LOGINFO_ORIGINATOR_PL                       (0x01000000)
-#define IOC_LOGINFO_ORIGINATOR_IR                       (0x02000000)
-
-/****************************************************************************/
-/* LOGINFO_CODE defines                                                     */
-/****************************************************************************/
-#define IOC_LOGINFO_CODE_MASK                           (0x00FF0000)
-#define IOC_LOGINFO_CODE_SHIFT                          (16)
-
-/****************************************************************************/
-/* IOP LOGINFO_CODE defines, valid if IOC_LOGINFO_ORIGINATOR = IOP          */
-/****************************************************************************/
-#define IOP_LOGINFO_CODE_INVALID_SAS_ADDRESS            (0x00010000)
-#define IOP_LOGINFO_CODE_UNUSED2                        (0x00020000)
-#define IOP_LOGINFO_CODE_CONFIG_INVALID_PAGE            (0x00030000)
-#define IOP_LOGINFO_CODE_CONFIG_INVALID_PAGE_RT         (0x00030100) /* Route Table Entry not found */
-#define IOP_LOGINFO_CODE_CONFIG_INVALID_PAGE_PN         (0x00030200) /* Invalid Page Number */
-#define IOP_LOGINFO_CODE_CONFIG_INVALID_PAGE_FORM       (0x00030300) /* Invalid FORM */
-#define IOP_LOGINFO_CODE_CONFIG_INVALID_PAGE_PT         (0x00030400) /* Invalid Page Type */
-#define IOP_LOGINFO_CODE_CONFIG_INVALID_PAGE_DNM        (0x00030500) /* Device Not Mapped */
-#define IOP_LOGINFO_CODE_CONFIG_INVALID_PAGE_PERSIST    (0x00030600) /* Persistent Page not found */
-#define IOP_LOGINFO_CODE_CONFIG_INVALID_PAGE_DEFAULT    (0x00030700) /* Default Page not found */
-#define IOP_LOGINFO_CODE_TASK_TERMINATED                (0x00050000)
-
-
-/****************************************************************************/
-/* PL LOGINFO_CODE defines, valid if IOC_LOGINFO_ORIGINATOR = PL            */
-/****************************************************************************/
-#define PL_LOGINFO_CODE_OPEN_FAILURE                        (0x00010000)
-#define PL_LOGINFO_CODE_INVALID_SGL                         (0x00020000)
-#define PL_LOGINFO_CODE_WRONG_REL_OFF_OR_FRAME_LENGTH       (0x00030000)
-#define PL_LOGINFO_CODE_FRAME_XFER_ERROR                    (0x00040000)
-#define PL_LOGINFO_CODE_TX_FM_CONNECTED_LOW                 (0x00050000)
-#define PL_LOGINFO_CODE_SATA_NON_NCQ_RW_ERR_BIT_SET         (0x00060000)
-#define PL_LOGINFO_CODE_SATA_READ_LOG_RECEIVE_DATA_ERR      (0x00070000)
-#define PL_LOGINFO_CODE_SATA_NCQ_FAIL_ALL_CMDS_AFTR_ERR     (0x00080000)
-#define PL_LOGINFO_CODE_SATA_ERR_IN_RCV_SET_DEV_BIT_FIS     (0x00090000)
-#define PL_LOGINFO_CODE_RX_FM_INVALID_MESSAGE               (0x000A0000)
-#define PL_LOGINFO_CODE_RX_CTX_MESSAGE_VALID_ERROR          (0x000B0000)
-#define PL_LOGINFO_CODE_RX_FM_CURRENT_FRAME_ERROR           (0x000C0000)
-#define PL_LOGINFO_CODE_SATA_LINK_DOWN                      (0x000D0000)
-#define PL_LOGINFO_CODE_DISCOVERY_SATA_INIT_W_IOS           (0x000E0000)
-#define PL_LOGINFO_CODE_CONFIG_INVALID_PAGE                 (0x000F0000)
-#define PL_LOGINFO_CODE_CONFIG_INVALID_PAGE_PT              (0x000F0100) /* Invalid Page Type */
-#define PL_LOGINFO_CODE_CONFIG_INVALID_PAGE_NUM_PHYS        (0x000F0200) /* Invalid Number of Phys */
-#define PL_LOGINFO_CODE_CONFIG_INVALID_PAGE_NOT_IMP         (0x000F0300) /* Case Not Handled */
-#define PL_LOGINFO_CODE_CONFIG_INVALID_PAGE_NO_DEV          (0x000F0400) /* No Device Found */
-#define PL_LOGINFO_CODE_CONFIG_INVALID_PAGE_FORM            (0x000F0500) /* Invalid FORM */
-#define PL_LOGINFO_CODE_CONFIG_INVALID_PAGE_PHY             (0x000F0600) /* Invalid Phy */
-#define PL_LOGINFO_CODE_CONFIG_INVALID_PAGE_NO_OWNER        (0x000F0700) /* No Owner Found */
-#define PL_LOGINFO_CODE_DSCVRY_SATA_INIT_TIMEOUT            (0x00100000)
-#define PL_LOGINFO_CODE_RESET                               (0x00110000)
-#define PL_LOGINFO_CODE_ABORT                               (0x00120000)
-#define PL_LOGINFO_CODE_IO_NOT_YET_EXECUTED                 (0x00130000)
-#define PL_LOGINFO_CODE_IO_EXECUTED                         (0x00140000)
-#define PL_LOGINFO_SUB_CODE_OPEN_FAILURE                    (0x00000100)
-#define PL_LOGINFO_SUB_CODE_INVALID_SGL                     (0x00000200)
-#define PL_LOGINFO_SUB_CODE_WRONG_REL_OFF_OR_FRAME_LENGTH   (0x00000300)
-#define PL_LOGINFO_SUB_CODE_FRAME_XFER_ERROR                (0x00000400)
-#define PL_LOGINFO_SUB_CODE_TX_FM_CONNECTED_LOW             (0x00000500)
-#define PL_LOGINFO_SUB_CODE_SATA_NON_NCQ_RW_ERR_BIT_SET     (0x00000600)
-#define PL_LOGINFO_SUB_CODE_SATA_READ_LOG_RECEIVE_DATA_ERR  (0x00000700)
-#define PL_LOGINFO_SUB_CODE_SATA_NCQ_FAIL_ALL_CMDS_AFTR_ERR (0x00000800)
-#define PL_LOGINFO_SUB_CODE_SATA_ERR_IN_RCV_SET_DEV_BIT_FIS (0x00000900)
-#define PL_LOGINFO_SUB_CODE_RX_FM_INVALID_MESSAGE           (0x00000A00)
-#define PL_LOGINFO_SUB_CODE_RX_CTX_MESSAGE_VALID_ERROR      (0x00000B00)
-#define PL_LOGINFO_SUB_CODE_RX_FM_CURRENT_FRAME_ERROR       (0x00000C00)
-#define PL_LOGINFO_SUB_CODE_SATA_LINK_DOWN                  (0x00000D00)
-#define PL_LOGINFO_SUB_CODE_DISCOVERY_SATA_INIT_W_IOS       (0x00000E00)
-#define PL_LOGINFO_SUB_CODE_DSCVRY_SATA_INIT_TIMEOUT        (0x00001000)
-
-
-#define PL_LOGINFO_CODE_ENCL_MGMT_SMP_FRAME_FAILURE         (0x00200000) /* Can't get SMP Frame */
-#define PL_LOGINFO_CODE_ENCL_MGMT_SMP_READ_ERROR            (0x00200001) /* Error occured on SMP Read */
-#define PL_LOGINFO_CODE_ENCL_MGMT_SMP_WRITE_ERROR           (0x00200002) /* Error occured on SMP Write */
-#define PL_LOGINFO_CODE_ENCL_MGMT_NOT_SUPPORTED_ON_ENCL     (0x00200004) /* Encl Mgmt services not available for this WWID */
-#define PL_LOGINFO_CODE_ENCL_MGMT_ADDR_MODE_NOT_SUPPORTED   (0x00200005) /* Address Mode not suppored */
-#define PL_LOGINFO_CODE_ENCL_MGMT_BAD_SLOT_NUM              (0x00200006) /* Invalid Slot Number in SEP Msg */
-#define PL_LOGINFO_CODE_ENCL_MGMT_SGPIO_NOT_PRESENT         (0x00200007) /* SGPIO not present/enabled */
-
-#define PL_LOGINFO_DA_SEP_NOT_PRESENT                       (0x00200100) /* SEP not present when msg received */
-#define PL_LOGINFO_DA_SEP_SINGLE_THREAD_ERROR               (0x00200101) /* Can only accept 1 msg at a time */
-#define PL_LOGINFO_DA_SEP_ISTWI_INTR_IN_IDLE_STATE          (0x00200102) /* ISTWI interrupt recvd. while IDLE */
-#define PL_LOGINFO_DA_SEP_RECEIVED_NACK_FROM_SLAVE          (0x00200103) /* SEP NACK'd, it is busy */
-#define PL_LOGINFO_DA_SEP_BAD_STATUS_HDR_CHKSUM             (0x00200104) /* SEP stopped or sent bad chksum in Hdr */
-#define PL_LOGINFO_DA_SEP_UNSUPPORTED_SCSI_STATUS_1         (0x00200105) /* SEP returned unknown scsi status */
-#define PL_LOGINFO_DA_SEP_UNSUPPORTED_SCSI_STATUS_2         (0x00200106) /* SEP returned unknown scsi status */
-#define PL_LOGINFO_DA_SEP_CHKSUM_ERROR_AFTER_STOP           (0x00200107) /* SEP returned bad chksum after STOP */
-#define PL_LOGINFO_DA_SEP_CHKSUM_ERROR_AFTER_STOP_GETDATA   (0x00200108) /* SEP returned bad chksum after STOP while gettin data*/
-
-
-/****************************************************************************/
-/* IR LOGINFO_CODE defines, valid if IOC_LOGINFO_ORIGINATOR = IR            */
-/****************************************************************************/
-#define IR_LOGINFO_CODE_UNUSED1                         (0x00010000)
-#define IR_LOGINFO_CODE_UNUSED2                         (0x00020000)
-
-/****************************************************************************/
-/* Defines for convienence                                                  */
-/****************************************************************************/
-#define IOC_LOGINFO_PREFIX_IOP                          ((MPI_IOCLOGINFO_TYPE_SAS << MPI_IOCLOGINFO_TYPE_SHIFT) | IOC_LOGINFO_ORIGINATOR_IOP)
-#define IOC_LOGINFO_PREFIX_PL                           ((MPI_IOCLOGINFO_TYPE_SAS << MPI_IOCLOGINFO_TYPE_SHIFT) | IOC_LOGINFO_ORIGINATOR_PL)
-#define IOC_LOGINFO_PREFIX_IR                           ((MPI_IOCLOGINFO_TYPE_SAS << MPI_IOCLOGINFO_TYPE_SHIFT) | IOC_LOGINFO_ORIGINATOR_IR)
-
-#endif /* end of file */
@@ -1,288 +0,0 @@
-/* $FreeBSD$ */
-/*-
- * Copyright (c) 2000-2005, LSI Logic Corporation and its contributors.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon including
- *    a substantially similar Disclaimer requirement for further binary
- *    redistribution.
- * 3. Neither the name of the LSI Logic Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF THE COPYRIGHT
- * OWNER OR CONTRIBUTOR IS ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- *           Name:  mpi_sas.h
- *          Title:  MPI Serial Attached SCSI structures and definitions
- *  Creation Date:  August 19, 2004
- *
- *    mpi_sas.h Version:  01.05.02
- *
- *  Version History
- *  ---------------
- *
- *  Date      Version   Description
- *  --------  --------  ------------------------------------------------------
- *  08-19-04  01.05.01  Original release.
- *  08-30-05  01.05.02  Added DeviceInfo bit for SEP.
- *                      Added PrimFlags and Primitive field to SAS IO Unit
- *                      Control request, and added a new operation code.
- *  --------------------------------------------------------------------------
- */
-
-#ifndef MPI_SAS_H
-#define MPI_SAS_H
-
-
-/*
- * Values for SASStatus.
- */
-#define MPI_SASSTATUS_SUCCESS                           (0x00)
-#define MPI_SASSTATUS_UNKNOWN_ERROR                     (0x01)
-#define MPI_SASSTATUS_INVALID_FRAME                     (0x02)
-#define MPI_SASSTATUS_UTC_BAD_DEST                      (0x03)
-#define MPI_SASSTATUS_UTC_BREAK_RECEIVED                (0x04)
-#define MPI_SASSTATUS_UTC_CONNECT_RATE_NOT_SUPPORTED    (0x05)
-#define MPI_SASSTATUS_UTC_PORT_LAYER_REQUEST            (0x06)
-#define MPI_SASSTATUS_UTC_PROTOCOL_NOT_SUPPORTED        (0x07)
-#define MPI_SASSTATUS_UTC_STP_RESOURCES_BUSY            (0x08)
-#define MPI_SASSTATUS_UTC_WRONG_DESTINATION             (0x09)
-#define MPI_SASSTATUS_SHORT_INFORMATION_UNIT            (0x0A)
-#define MPI_SASSTATUS_LONG_INFORMATION_UNIT             (0x0B)
-#define MPI_SASSTATUS_XFER_RDY_INCORRECT_WRITE_DATA     (0x0C)
-#define MPI_SASSTATUS_XFER_RDY_REQUEST_OFFSET_ERROR     (0x0D)
-#define MPI_SASSTATUS_XFER_RDY_NOT_EXPECTED             (0x0E)
-#define MPI_SASSTATUS_DATA_INCORRECT_DATA_LENGTH        (0x0F)
-#define MPI_SASSTATUS_DATA_TOO_MUCH_READ_DATA           (0x10)
-#define MPI_SASSTATUS_DATA_OFFSET_ERROR                 (0x11)
-#define MPI_SASSTATUS_SDSF_NAK_RECEIVED                 (0x12)
-#define MPI_SASSTATUS_SDSF_CONNECTION_FAILED            (0x13)
-#define MPI_SASSTATUS_INITIATOR_RESPONSE_TIMEOUT        (0x14)
-
-
-/*
- * Values for the SAS DeviceInfo field used in SAS Device Status Change Event
- * data and SAS IO Unit Configuration pages.
- */
-#define MPI_SAS_DEVICE_INFO_SEP                 (0x00004000)
-#define MPI_SAS_DEVICE_INFO_ATAPI_DEVICE        (0x00002000)
-#define MPI_SAS_DEVICE_INFO_LSI_DEVICE          (0x00001000)
-#define MPI_SAS_DEVICE_INFO_DIRECT_ATTACH       (0x00000800)
-#define MPI_SAS_DEVICE_INFO_SSP_TARGET          (0x00000400)
-#define MPI_SAS_DEVICE_INFO_STP_TARGET          (0x00000200)
-#define MPI_SAS_DEVICE_INFO_SMP_TARGET          (0x00000100)
-#define MPI_SAS_DEVICE_INFO_SATA_DEVICE         (0x00000080)
-#define MPI_SAS_DEVICE_INFO_SSP_INITIATOR       (0x00000040)
-#define MPI_SAS_DEVICE_INFO_STP_INITIATOR       (0x00000020)
-#define MPI_SAS_DEVICE_INFO_SMP_INITIATOR       (0x00000010)
-#define MPI_SAS_DEVICE_INFO_SATA_HOST           (0x00000008)
-
-#define MPI_SAS_DEVICE_INFO_MASK_DEVICE_TYPE    (0x00000007)
-#define MPI_SAS_DEVICE_INFO_NO_DEVICE           (0x00000000)
-#define MPI_SAS_DEVICE_INFO_END_DEVICE          (0x00000001)
-#define MPI_SAS_DEVICE_INFO_EDGE_EXPANDER       (0x00000002)
-#define MPI_SAS_DEVICE_INFO_FANOUT_EXPANDER     (0x00000003)
-
-
-
-/*****************************************************************************
-*
-*        S e r i a l    A t t a c h e d    S C S I     M e s s a g e s
-*
-*****************************************************************************/
-
-/****************************************************************************/
-/* Serial Management Protocol Passthrough Request                           */
-/****************************************************************************/
-
-typedef struct _MSG_SMP_PASSTHROUGH_REQUEST
-{
-    U8                      PassthroughFlags;   /* 00h */
-    U8                      PhysicalPort;       /* 01h */
-    U8                      ChainOffset;        /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     RequestDataLength;  /* 04h */
-    U8                      ConnectionRate;     /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U32                     Reserved1;          /* 0Ch */
-    U64                     SASAddress;         /* 10h */
-    U32                     Reserved2;          /* 18h */
-    U32                     Reserved3;          /* 1Ch */
-    SGE_SIMPLE_UNION        SGL;                /* 20h */
-} MSG_SMP_PASSTHROUGH_REQUEST, MPI_POINTER PTR_MSG_SMP_PASSTHROUGH_REQUEST,
-  SmpPassthroughRequest_t, MPI_POINTER pSmpPassthroughRequest_t;
-
-/* values for PassthroughFlags field */
-#define MPI_SMP_PT_REQ_PT_FLAGS_IMMEDIATE       (0x80)
-
-/* values for ConnectionRate field */
-#define MPI_SMP_PT_REQ_CONNECT_RATE_NEGOTIATED  (0x00)
-#define MPI_SMP_PT_REQ_CONNECT_RATE_1_5         (0x08)
-#define MPI_SMP_PT_REQ_CONNECT_RATE_3_0         (0x09)
-
-
-/* Serial Management Protocol Passthrough Reply */
-typedef struct _MSG_SMP_PASSTHROUGH_REPLY
-{
-    U8                      PassthroughFlags;   /* 00h */
-    U8                      PhysicalPort;       /* 01h */
-    U8                      MsgLength;          /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     ResponseDataLength; /* 04h */
-    U8                      Reserved1;          /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U8                      Reserved2;          /* 0Ch */
-    U8                      SASStatus;          /* 0Dh */
-    U16                     IOCStatus;          /* 0Eh */
-    U32                     IOCLogInfo;         /* 10h */
-    U32                     Reserved3;          /* 14h */
-    U8                      ResponseData[4];    /* 18h */
-} MSG_SMP_PASSTHROUGH_REPLY, MPI_POINTER PTR_MSG_SMP_PASSTHROUGH_REPLY,
-  SmpPassthroughReply_t, MPI_POINTER pSmpPassthroughReply_t;
-
-#define MPI_SMP_PT_REPLY_PT_FLAGS_IMMEDIATE     (0x80)
-
-
-/****************************************************************************/
-/* SATA Passthrough Request                                                 */
-/****************************************************************************/
-
-typedef struct _MSG_SATA_PASSTHROUGH_REQUEST
-{
-    U8                      TargetID;           /* 00h */
-    U8                      Bus;                /* 01h */
-    U8                      ChainOffset;        /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     PassthroughFlags;   /* 04h */
-    U8                      ConnectionRate;     /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U32                     Reserved1;          /* 0Ch */
-    U32                     Reserved2;          /* 10h */
-    U32                     Reserved3;          /* 14h */
-    U32                     DataLength;         /* 18h */
-    U8                      CommandFIS[20];     /* 1Ch */
-    SGE_SIMPLE_UNION        SGL;                /* 30h */
-} MSG_SATA_PASSTHROUGH_REQUEST, MPI_POINTER PTR_MSG_SATA_PASSTHROUGH_REQUEST,
-  SataPassthroughRequest_t, MPI_POINTER pSataPassthroughRequest_t;
-
-/* values for PassthroughFlags field */
-#define MPI_SATA_PT_REQ_PT_FLAGS_RESET_DEVICE   (0x0200)
-#define MPI_SATA_PT_REQ_PT_FLAGS_EXECUTE_DIAG   (0x0100)
-#define MPI_SATA_PT_REQ_PT_FLAGS_DMA_QUEUED     (0x0080)
-#define MPI_SATA_PT_REQ_PT_FLAGS_PACKET_COMMAND (0x0040)
-#define MPI_SATA_PT_REQ_PT_FLAGS_DMA            (0x0020)
-#define MPI_SATA_PT_REQ_PT_FLAGS_PIO            (0x0010)
-#define MPI_SATA_PT_REQ_PT_FLAGS_UNSPECIFIED_VU (0x0004)
-#define MPI_SATA_PT_REQ_PT_FLAGS_WRITE          (0x0002)
-#define MPI_SATA_PT_REQ_PT_FLAGS_READ           (0x0001)
-
-/* values for ConnectionRate field */
-#define MPI_SATA_PT_REQ_CONNECT_RATE_NEGOTIATED (0x00)
-#define MPI_SATA_PT_REQ_CONNECT_RATE_1_5        (0x08)
-#define MPI_SATA_PT_REQ_CONNECT_RATE_3_0        (0x09)
-
-
-/* SATA Passthrough Reply */
-typedef struct _MSG_SATA_PASSTHROUGH_REPLY
-{
-    U8                      TargetID;           /* 00h */
-    U8                      Bus;                /* 01h */
-    U8                      MsgLength;          /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     PassthroughFlags;   /* 04h */
-    U8                      Reserved1;          /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U8                      Reserved2;          /* 0Ch */
-    U8                      SASStatus;          /* 0Dh */
-    U16                     IOCStatus;          /* 0Eh */
-    U32                     IOCLogInfo;         /* 10h */
-    U8                      StatusFIS[20];      /* 14h */
-    U32                     StatusControlRegisters; /* 28h */
-    U32                     TransferCount;      /* 2Ch */
-} MSG_SATA_PASSTHROUGH_REPLY, MPI_POINTER PTR_MSG_SATA_PASSTHROUGH_REPLY,
-  SataPassthroughReply_t, MPI_POINTER pSataPassthroughReply_t;
-
-
-
-
-/****************************************************************************/
-/* SAS IO Unit Control Request                                              */
-/****************************************************************************/
-
-typedef struct _MSG_SAS_IOUNIT_CONTROL_REQUEST
-{
-    U8                      Operation;          /* 00h */
-    U8                      Reserved1;          /* 01h */
-    U8                      ChainOffset;        /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     Reserved2;          /* 04h */
-    U8                      Reserved3;          /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U8                      TargetID;           /* 0Ch */
-    U8                      Bus;                /* 0Dh */
-    U8                      PhyNum;             /* 0Eh */
-    U8                      PrimFlags;          /* 0Fh */
-    U32                     Primitive;          /* 10h */
-    U64                     SASAddress;         /* 14h */
-    U32                     Reserved4;          /* 1Ch */
-} MSG_SAS_IOUNIT_CONTROL_REQUEST, MPI_POINTER PTR_MSG_SAS_IOUNIT_CONTROL_REQUEST,
-  SasIoUnitControlRequest_t, MPI_POINTER pSasIoUnitControlRequest_t;
-
-/* values for the Operation field */
-#define MPI_SAS_OP_CLEAR_NOT_PRESENT             (0x01)
-#define MPI_SAS_OP_CLEAR_ALL_PERSISTENT          (0x02)
-#define MPI_SAS_OP_PHY_LINK_RESET                (0x06)
-#define MPI_SAS_OP_PHY_HARD_RESET                (0x07)
-#define MPI_SAS_OP_PHY_CLEAR_ERROR_LOG           (0x08)
-#define MPI_SAS_OP_MAP_CURRENT                   (0x09)
-#define MPI_SAS_OP_SEND_PRIMITIVE               (0x0A)
-
-/* values for the PrimFlags field */
-#define MPI_SAS_PRIMFLAGS_SINGLE                (0x08)
-#define MPI_SAS_PRIMFLAGS_TRIPLE                (0x02)
-#define MPI_SAS_PRIMFLAGS_REDUNDANT             (0x01)
-
-
-/* SAS IO Unit Control Reply */
-typedef struct _MSG_SAS_IOUNIT_CONTROL_REPLY
-{
-    U8                      Operation;          /* 00h */
-    U8                      Reserved1;          /* 01h */
-    U8                      MsgLength;          /* 02h */
-    U8                      Function;           /* 03h */
-    U16                     Reserved2;          /* 04h */
-    U8                      Reserved3;          /* 06h */
-    U8                      MsgFlags;           /* 07h */
-    U32                     MsgContext;         /* 08h */
-    U16                     Reserved4;          /* 0Ch */
-    U16                     IOCStatus;          /* 0Eh */
-    U32                     IOCLogInfo;         /* 10h */
-} MSG_SAS_IOUNIT_CONTROL_REPLY, MPI_POINTER PTR_MSG_SAS_IOUNIT_CONTROL_REPLY,
-  SasIoUnitControlReply_t, MPI_POINTER pSasIoUnitControlReply_t;
-
-#endif
-
-
@@ -1,380 +0,0 @@
-/* $FreeBSD$ */
-/*-
- * Copyright (c) 2000-2005, LSI Logic Corporation and its contributors.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce at minimum a disclaimer
- *    substantially similar to the "NO WARRANTY" disclaimer below
- *    ("Disclaimer") and any redistribution must be conditioned upon including
- *    a substantially similar Disclaimer requirement for further binary
- *    redistribution.
- * 3. Neither the name of the LSI Logic Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF THE COPYRIGHT
- * OWNER OR CONTRIBUTOR IS ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- *           Name:  mpi_tool.h
- *          Title:  MPI Toolbox structures and definitions
- *  Creation Date:  July 30, 2001
- *
- *    mpi_tool.h Version:  01.05.03
- *
- *  Version History
- *  ---------------
- *
- *  Date      Version   Description
- *  --------  --------  ------------------------------------------------------
- *  08-08-01  01.02.01  Original release.
- *  08-29-01  01.02.02  Added DIAG_DATA_UPLOAD_HEADER and related defines.
- *  01-16-04  01.02.03  Added defines and structures for new tools
- *.                     MPI_TOOLBOX_ISTWI_READ_WRITE_TOOL and
- *                      MPI_TOOLBOX_FC_MANAGEMENT_TOOL.
- *  04-29-04  01.02.04  Added message structures for Diagnostic Buffer Post and
- *                      Diagnostic Release requests and replies.
- *  05-11-04  01.03.01  Original release for MPI v1.3.
- *  08-19-04  01.05.01  Original release for MPI v1.5.
- *  10-06-04  01.05.02  Added define for MPI_DIAG_BUF_TYPE_COUNT.
- *  02-09-05  01.05.03  Added frame size option to FC management tool.
- *                      Added Beacon tool to the Toolbox.
- *  --------------------------------------------------------------------------
- */
-
-#ifndef MPI_TOOL_H
-#define MPI_TOOL_H
-
-#define MPI_TOOLBOX_CLEAN_TOOL                      (0x00)
-#define MPI_TOOLBOX_MEMORY_MOVE_TOOL                (0x01)
-#define MPI_TOOLBOX_DIAG_DATA_UPLOAD_TOOL           (0x02)
-#define MPI_TOOLBOX_ISTWI_READ_WRITE_TOOL           (0x03)
-#define MPI_TOOLBOX_FC_MANAGEMENT_TOOL              (0x04)
-#define MPI_TOOLBOX_BEACON_TOOL                     (0x05)
-
-
-/****************************************************************************/
-/* Toolbox reply                                                            */
-/****************************************************************************/
-
-typedef struct _MSG_TOOLBOX_REPLY
-{
-    U8                      Tool;                       /* 00h */
-    U8                      Reserved;                   /* 01h */
-    U8                      MsgLength;                  /* 02h */
-    U8                      Function;                   /* 03h */
-    U16                     Reserved1;                  /* 04h */
-    U8                      Reserved2;                  /* 06h */
-    U8                      MsgFlags;                   /* 07h */
-    U32                     MsgContext;                 /* 08h */
-    U16                     Reserved3;                  /* 0Ch */
-    U16                     IOCStatus;                  /* 0Eh */
-    U32                     IOCLogInfo;                 /* 10h */
-} MSG_TOOLBOX_REPLY, MPI_POINTER PTR_MSG_TOOLBOX_REPLY,
-  ToolboxReply_t, MPI_POINTER pToolboxReply_t;
-
-
-/****************************************************************************/
-/* Toolbox Clean Tool request                                               */
-/****************************************************************************/
-
-typedef struct _MSG_TOOLBOX_CLEAN_REQUEST
-{
-    U8                      Tool;                       /* 00h */
-    U8                      Reserved;                   /* 01h */
-    U8                      ChainOffset;                /* 02h */
-    U8                      Function;                   /* 03h */
-    U16                     Reserved1;                  /* 04h */
-    U8                      Reserved2;                  /* 06h */
-    U8                      MsgFlags;                   /* 07h */
-    U32                     MsgContext;                 /* 08h */
-    U32                     Flags;                      /* 0Ch */
-} MSG_TOOLBOX_CLEAN_REQUEST, MPI_POINTER PTR_MSG_TOOLBOX_CLEAN_REQUEST,
-  ToolboxCleanRequest_t, MPI_POINTER pToolboxCleanRequest_t;
-
-#define MPI_TOOLBOX_CLEAN_NVSRAM                    (0x00000001)
-#define MPI_TOOLBOX_CLEAN_SEEPROM                   (0x00000002)
-#define MPI_TOOLBOX_CLEAN_FLASH                     (0x00000004)
-#define MPI_TOOLBOX_CLEAN_BOOTLOADER                (0x04000000)
-#define MPI_TOOLBOX_CLEAN_FW_BACKUP                 (0x08000000)
-#define MPI_TOOLBOX_CLEAN_FW_CURRENT                (0x10000000)
-#define MPI_TOOLBOX_CLEAN_OTHER_PERSIST_PAGES       (0x20000000)
-#define MPI_TOOLBOX_CLEAN_PERSIST_MANUFACT_PAGES    (0x40000000)
-#define MPI_TOOLBOX_CLEAN_BOOT_SERVICES             (0x80000000)
-
-
-/****************************************************************************/
-/* Toolbox Memory Move request                                              */
-/****************************************************************************/
-
-typedef struct _MSG_TOOLBOX_MEM_MOVE_REQUEST
-{
-    U8                      Tool;                       /* 00h */
-    U8                      Reserved;                   /* 01h */
-    U8                      ChainOffset;                /* 02h */
-    U8                      Function;                   /* 03h */
-    U16                     Reserved1;                  /* 04h */
-    U8                      Reserved2;                  /* 06h */
-    U8                      MsgFlags;                   /* 07h */
-    U32                     MsgContext;                 /* 08h */
-    SGE_SIMPLE_UNION        SGL;                        /* 0Ch */
-} MSG_TOOLBOX_MEM_MOVE_REQUEST, MPI_POINTER PTR_MSG_TOOLBOX_MEM_MOVE_REQUEST,
-  ToolboxMemMoveRequest_t, MPI_POINTER pToolboxMemMoveRequest_t;
-
-
-/****************************************************************************/
-/* Toolbox Diagnostic Data Upload request                                   */
-/****************************************************************************/
-
-typedef struct _MSG_TOOLBOX_DIAG_DATA_UPLOAD_REQUEST
-{
-    U8                      Tool;                       /* 00h */
-    U8                      Reserved;                   /* 01h */
-    U8                      ChainOffset;                /* 02h */
-    U8                      Function;                   /* 03h */
-    U16                     Reserved1;                  /* 04h */
-    U8                      Reserved2;                  /* 06h */
-    U8                      MsgFlags;                   /* 07h */
-    U32                     MsgContext;                 /* 08h */
-    U32                     Flags;                      /* 0Ch */
-    U32                     Reserved3;                  /* 10h */
-    SGE_SIMPLE_UNION        SGL;                        /* 14h */
-} MSG_TOOLBOX_DIAG_DATA_UPLOAD_REQUEST, MPI_POINTER PTR_MSG_TOOLBOX_DIAG_DATA_UPLOAD_REQUEST,
-  ToolboxDiagDataUploadRequest_t, MPI_POINTER pToolboxDiagDataUploadRequest_t;
-
-typedef struct _DIAG_DATA_UPLOAD_HEADER
-{
-    U32                     DiagDataLength;             /* 00h */
-    U8                      FormatCode;                 /* 04h */
-    U8                      Reserved;                   /* 05h */
-    U16                     Reserved1;                  /* 06h */
-} DIAG_DATA_UPLOAD_HEADER, MPI_POINTER PTR_DIAG_DATA_UPLOAD_HEADER,
-  DiagDataUploadHeader_t, MPI_POINTER pDiagDataUploadHeader_t;
-
-#define MPI_TB_DIAG_FORMAT_SCSI_PRINTF_1            (0x01)
-#define MPI_TB_DIAG_FORMAT_SCSI_2                   (0x02)
-#define MPI_TB_DIAG_FORMAT_SCSI_3                   (0x03)
-#define MPI_TB_DIAG_FORMAT_FC_TRACE_1               (0x04)
-
-
-/****************************************************************************/
-/* Toolbox ISTWI Read Write request                                         */
-/****************************************************************************/
-
-typedef struct _MSG_TOOLBOX_ISTWI_READ_WRITE_REQUEST
-{
-    U8                      Tool;                       /* 00h */
-    U8                      Reserved;                   /* 01h */
-    U8                      ChainOffset;                /* 02h */
-    U8                      Function;                   /* 03h */
-    U16                     Reserved1;                  /* 04h */
-    U8                      Reserved2;                  /* 06h */
-    U8                      MsgFlags;                   /* 07h */
-    U32                     MsgContext;                 /* 08h */
-    U8                      Flags;                      /* 0Ch */
-    U8                      BusNum;                     /* 0Dh */
-    U16                     Reserved3;                  /* 0Eh */
-    U8                      NumAddressBytes;            /* 10h */
-    U8                      Reserved4;                  /* 11h */
-    U16                     DataLength;                 /* 12h */
-    U8                      DeviceAddr;                 /* 14h */
-    U8                      Addr1;                      /* 15h */
-    U8                      Addr2;                      /* 16h */
-    U8                      Addr3;                      /* 17h */
-    U32                     Reserved5;                  /* 18h */
-    SGE_SIMPLE_UNION        SGL;                        /* 1Ch */
-} MSG_TOOLBOX_ISTWI_READ_WRITE_REQUEST, MPI_POINTER PTR_MSG_TOOLBOX_ISTWI_READ_WRITE_REQUEST,
-  ToolboxIstwiReadWriteRequest_t, MPI_POINTER pToolboxIstwiReadWriteRequest_t;
-
-#define MPI_TB_ISTWI_FLAGS_WRITE                    (0x00)
-#define MPI_TB_ISTWI_FLAGS_READ                     (0x01)
-
-
-/****************************************************************************/
-/* Toolbox FC Management request                                            */
-/****************************************************************************/
-
-/* ActionInfo for Bus and TargetId */
-typedef struct _MPI_TB_FC_MANAGE_BUS_TID_AI
-{
-    U16                     Reserved;                   /* 00h */
-    U8                      Bus;                        /* 02h */
-    U8                      TargetId;                   /* 03h */
-} MPI_TB_FC_MANAGE_BUS_TID_AI, MPI_POINTER PTR_MPI_TB_FC_MANAGE_BUS_TID_AI,
-  MpiTbFcManageBusTidAi_t, MPI_POINTER pMpiTbFcManageBusTidAi_t;
-
-/* ActionInfo for port identifier */
-typedef struct _MPI_TB_FC_MANAGE_PID_AI
-{
-    U32                     PortIdentifier;             /* 00h */
-} MPI_TB_FC_MANAGE_PID_AI, MPI_POINTER PTR_MPI_TB_FC_MANAGE_PID_AI,
-  MpiTbFcManagePidAi_t, MPI_POINTER pMpiTbFcManagePidAi_t;
-
-/* ActionInfo for set max frame size */
-typedef struct _MPI_TB_FC_MANAGE_FRAME_SIZE_AI
-{
-    U16                     FrameSize;                  /* 00h */
-    U8                      PortNum;                    /* 02h */
-    U8                      Reserved1;                  /* 03h */
-} MPI_TB_FC_MANAGE_FRAME_SIZE_AI, MPI_POINTER PTR_MPI_TB_FC_MANAGE_FRAME_SIZE_AI,
-  MpiTbFcManageFrameSizeAi_t, MPI_POINTER pMpiTbFcManageFrameSizeAi_t;
-
-/* union of ActionInfo */
-typedef union _MPI_TB_FC_MANAGE_AI_UNION
-{
-    MPI_TB_FC_MANAGE_BUS_TID_AI     BusTid;
-    MPI_TB_FC_MANAGE_PID_AI         Port;
-    MPI_TB_FC_MANAGE_FRAME_SIZE_AI  FrameSize;
-} MPI_TB_FC_MANAGE_AI_UNION, MPI_POINTER PTR_MPI_TB_FC_MANAGE_AI_UNION,
-  MpiTbFcManageAiUnion_t, MPI_POINTER pMpiTbFcManageAiUnion_t;
-
-typedef struct _MSG_TOOLBOX_FC_MANAGE_REQUEST
-{
-    U8                          Tool;                   /* 00h */
-    U8                          Reserved;               /* 01h */
-    U8                          ChainOffset;            /* 02h */
-    U8                          Function;               /* 03h */
-    U16                         Reserved1;              /* 04h */
-    U8                          Reserved2;              /* 06h */
-    U8                          MsgFlags;               /* 07h */
-    U32                         MsgContext;             /* 08h */
-    U8                          Action;                 /* 0Ch */
-    U8                          Reserved3;              /* 0Dh */
-    U16                         Reserved4;              /* 0Eh */
-    MPI_TB_FC_MANAGE_AI_UNION   ActionInfo;             /* 10h */
-} MSG_TOOLBOX_FC_MANAGE_REQUEST, MPI_POINTER PTR_MSG_TOOLBOX_FC_MANAGE_REQUEST,
-  ToolboxFcManageRequest_t, MPI_POINTER pToolboxFcManageRequest_t;
-
-/* defines for the Action field */
-#define MPI_TB_FC_MANAGE_ACTION_DISC_ALL            (0x00)
-#define MPI_TB_FC_MANAGE_ACTION_DISC_PID            (0x01)
-#define MPI_TB_FC_MANAGE_ACTION_DISC_BUS_TID        (0x02)
-#define MPI_TB_FC_MANAGE_ACTION_SET_MAX_FRAME_SIZE  (0x03)
-
-
-/****************************************************************************/
-/* Toolbox Beacon Tool request                                               */
-/****************************************************************************/
-
-typedef struct _MSG_TOOLBOX_BEACON_REQUEST
-{
-    U8                      Tool;                       /* 00h */
-    U8                      Reserved;                   /* 01h */
-    U8                      ChainOffset;                /* 02h */
-    U8                      Function;                   /* 03h */
-    U16                     Reserved1;                  /* 04h */
-    U8                      Reserved2;                  /* 06h */
-    U8                      MsgFlags;                   /* 07h */
-    U32                     MsgContext;                 /* 08h */
-    U8                      ConnectNum;                 /* 0Ch */
-    U8                      PortNum;                    /* 0Dh */
-    U8                      Reserved3;                  /* 0Eh */
-    U8                      Flags;                      /* 0Fh */
-} MSG_TOOLBOX_BEACON_REQUEST, MPI_POINTER PTR_MSG_TOOLBOX_BEACON_REQUEST,
-  ToolboxBeaconRequest_t, MPI_POINTER pToolboxBeaconRequest_t;
-
-#define MPI_TOOLBOX_FLAGS_BEACON_MODE_OFF       (0x00)
-#define MPI_TOOLBOX_FLAGS_BEACON_MODE_ON        (0x01)
-
-
-/****************************************************************************/
-/* Diagnostic Buffer Post request                                           */
-/****************************************************************************/
-
-typedef struct _MSG_DIAG_BUFFER_POST_REQUEST
-{
-    U8                      TraceLevel;                 /* 00h */
-    U8                      BufferType;                 /* 01h */
-    U8                      ChainOffset;                /* 02h */
-    U8                      Function;                   /* 03h */
-    U16                     Reserved1;                  /* 04h */
-    U8                      Reserved2;                  /* 06h */
-    U8                      MsgFlags;                   /* 07h */
-    U32                     MsgContext;                 /* 08h */
-    U32                     ExtendedType;               /* 0Ch */
-    U32                     BufferLength;               /* 10h */
-    U32                     ProductSpecific[4];         /* 14h */
-    U32                     Reserved3;                  /* 24h */
-    U64                     BufferAddress;              /* 28h */
-} MSG_DIAG_BUFFER_POST_REQUEST, MPI_POINTER PTR_MSG_DIAG_BUFFER_POST_REQUEST,
-  DiagBufferPostRequest_t, MPI_POINTER pDiagBufferPostRequest_t;
-
-#define MPI_DIAG_BUF_TYPE_TRACE                     (0x00)
-#define MPI_DIAG_BUF_TYPE_SNAPSHOT                  (0x01)
-#define MPI_DIAG_BUF_TYPE_EXTENDED                  (0x02)
-/* count of the number of buffer types */
-#define MPI_DIAG_BUF_TYPE_COUNT                     (0x03)
-
-#define MPI_DIAG_EXTENDED_QTAG                      (0x00000001)
-
-
-/* Diagnostic Buffer Post reply */
-typedef struct _MSG_DIAG_BUFFER_POST_REPLY
-{
-    U8                      Reserved1;                  /* 00h */
-    U8                      BufferType;                 /* 01h */
-    U8                      MsgLength;                  /* 02h */
-    U8                      Function;                   /* 03h */
-    U16                     Reserved2;                  /* 04h */
-    U8                      Reserved3;                  /* 06h */
-    U8                      MsgFlags;                   /* 07h */
-    U32                     MsgContext;                 /* 08h */
-    U16                     Reserved4;                  /* 0Ch */
-    U16                     IOCStatus;                  /* 0Eh */
-    U32                     IOCLogInfo;                 /* 10h */
-    U32                     TransferLength;             /* 14h */
-} MSG_DIAG_BUFFER_POST_REPLY, MPI_POINTER PTR_MSG_DIAG_BUFFER_POST_REPLY,
-  DiagBufferPostReply_t, MPI_POINTER pDiagBufferPostReply_t;
-
-
-/****************************************************************************/
-/* Diagnostic Release request                                               */
-/****************************************************************************/
-
-typedef struct _MSG_DIAG_RELEASE_REQUEST
-{
-    U8                      Reserved1;                  /* 00h */
-    U8                      BufferType;                 /* 01h */
-    U8                      ChainOffset;                /* 02h */
-    U8                      Function;                   /* 03h */
-    U16                     Reserved2;                  /* 04h */
-    U8                      Reserved3;                  /* 06h */
-    U8                      MsgFlags;                   /* 07h */
-    U32                     MsgContext;                 /* 08h */
-} MSG_DIAG_RELEASE_REQUEST, MPI_POINTER PTR_MSG_DIAG_RELEASE_REQUEST,
-  DiagReleaseRequest_t, MPI_POINTER pDiagReleaseRequest_t;
-
-
-/* Diagnostic Release reply */
-typedef struct _MSG_DIAG_RELEASE_REPLY
-{
-    U8                      Reserved1;                  /* 00h */
-    U8                      BufferType;                 /* 01h */
-    U8                      MsgLength;                  /* 02h */
-    U8                      Function;                   /* 03h */
-    U16                     Reserved2;                  /* 04h */
-    U8                      Reserved3;                  /* 06h */
-    U8                      MsgFlags;                   /* 07h */
-    U32                     MsgContext;                 /* 08h */
-    U16                     Reserved4;                  /* 0Ch */
-    U16                     IOCStatus;                  /* 0Eh */
-    U32                     IOCLogInfo;                 /* 10h */
-} MSG_DIAG_RELEASE_REPLY, MPI_POINTER PTR_MSG_DIAG_RELEASE_REPLY,
-  DiagReleaseReply_t, MPI_POINTER pDiagReleaseReply_t;
-
-
-#endif
@@ -298,6 +298,7 @@ random_yarrow_read(void *buf, int count)
 				random_state.outputblocks = 0;
 			}
 			retval += (int)tomove;
+			cur = 0;
 		}
 	}
 	else {
@@ -1038,11 +1038,18 @@ smbfs_advlock(ap)
 static int
 smbfs_pathcheck(struct smbmount *smp, const char *name, int nmlen, int nameiop)
 {
-	static const char *badchars = "*/\\:<>;?";
+	static const char *badchars = "*/:<>;?";
 	static const char *badchars83 = " +|,[]=";
 	const char *cp;
 	int i, error;

+	/*
+	 * Backslash characters, being a path delimiter, are prohibited
+	 * within a path component even for LOOKUP operations.
+	 */
+	if (index(name, '\\') != NULL)
+		return ENOENT;
+
 	if (nameiop == LOOKUP)
 		return 0;
 	error = ENOENT;
@@ -2014,7 +2014,7 @@ _fgetvp(struct thread *td, int fd, struct vnode **vpp, int flags)
 	GIANT_REQUIRED;		/* VFS */

 	*vpp = NULL;
-	if ((error = _fget(td, fd, &fp, 0, 0)) != 0)
+	if ((error = _fget(td, fd, &fp, flags, 0)) != 0)
 		return (error);
 	if (fp->f_vnode == NULL) {
 		error = EINVAL;
@@ -2330,7 +2330,8 @@ sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)

 	/* pass 1: check for things that need to be rejected */
 	p = (void*) (h+1);
-	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+	for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+	    len-=p[1], p+=p[1]) {
 		if (debug)
 			log(-1, " %s ", sppp_lcp_opt_name(*p));
 		switch (*p) {
@@ -2409,7 +2410,8 @@ sppp_lcp_RCR(struct sppp *sp, struct lcp_header *h, int len)

 	p = (void*) (h+1);
 	len = origlen;
-	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+	for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+	    len-=p[1], p+=p[1]) {
 		if (debug)
 			log(-1, " %s ", sppp_lcp_opt_name(*p));
 		switch (*p) {
@@ -2551,7 +2553,8 @@ sppp_lcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
 		    SPP_ARGS(ifp));

 	p = (void*) (h+1);
-	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+	for (; len >= 2 && p[1] >= 2 && len >= p[1];
+	    len -= p[1], p += p[1]) {
 		if (debug)
 			log(-1, " %s ", sppp_lcp_opt_name(*p));
 		switch (*p) {
@@ -2615,7 +2618,8 @@ sppp_lcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
 		    SPP_ARGS(ifp));

 	p = (void*) (h+1);
-	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+	for (; len >= 2 && p[1] >= 2 && len >= p[1];
+	    len -= p[1], p += p[1]) {
 		if (debug)
 			log(-1, " %s ", sppp_lcp_opt_name(*p));
 		switch (*p) {
@@ -3006,7 +3010,8 @@ sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
 		log(LOG_DEBUG, SPP_FMT "ipcp parse opts: ",
 		    SPP_ARGS(ifp));
 	p = (void*) (h+1);
-	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+	for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+	    len-=p[1], p+=p[1]) {
 		if (debug)
 			log(-1, " %s ", sppp_ipcp_opt_name(*p));
 		switch (*p) {
@@ -3075,7 +3080,8 @@ sppp_ipcp_RCR(struct sppp *sp, struct lcp_header *h, int len)
 		       SPP_ARGS(ifp));
 	p = (void*) (h+1);
 	len = origlen;
-	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+	for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+	    len-=p[1], p+=p[1]) {
 		if (debug)
 			log(-1, " %s ", sppp_ipcp_opt_name(*p));
 		switch (*p) {
@@ -3206,7 +3212,8 @@ sppp_ipcp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
 		    SPP_ARGS(ifp));

 	p = (void*) (h+1);
-	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+	for (; len >= 2 && p[1] >= 2 && len >= p[1];
+	    len -= p[1], p += p[1]) {
 		if (debug)
 			log(-1, " %s ", sppp_ipcp_opt_name(*p));
 		switch (*p) {
@@ -3252,7 +3259,8 @@ sppp_ipcp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
 		    SPP_ARGS(ifp));

 	p = (void*) (h+1);
-	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+	for (; len >= 2 && p[1] >= 2 && len >= p[1];
+	    len -= p[1], p += p[1]) {
 		if (debug)
 			log(-1, " %s ", sppp_ipcp_opt_name(*p));
 		switch (*p) {
@@ -3478,7 +3486,8 @@ sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
 		    SPP_ARGS(ifp));
 	p = (void*) (h+1);
 	ifidcount = 0;
-	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+	for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+	    len-=p[1], p+=p[1]) {
 		if (debug)
 			log(-1, " %s", sppp_ipv6cp_opt_name(*p));
 		switch (*p) {
@@ -3528,7 +3537,8 @@ sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
 	p = (void*) (h+1);
 	len = origlen;
 	type = CONF_ACK;
-	for (rlen=0; len>1 && p[1]; len-=p[1], p+=p[1]) {
+	for (rlen=0; len >= 2 && p[1] >= 2 && len >= p[1];
+	    len-=p[1], p+=p[1]) {
 		if (debug)
 			log(-1, " %s", sppp_ipv6cp_opt_name(*p));
 		switch (*p) {
@@ -3627,7 +3637,8 @@ sppp_ipv6cp_RCN_rej(struct sppp *sp, struct lcp_header *h, int len)
 		    SPP_ARGS(ifp));

 	p = (void*) (h+1);
-	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+	for (; len >= 2 && p[1] >= 2 && len >= p[1];
+	    len -= p[1], p += p[1]) {
 		if (debug)
 			log(-1, " %s", sppp_ipv6cp_opt_name(*p));
 		switch (*p) {
@@ -3673,7 +3684,8 @@ sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
 		    SPP_ARGS(ifp));

 	p = (void*) (h+1);
-	for (; len > 1 && p[1]; len -= p[1], p += p[1]) {
+	for (; len >= 2 && p[1] >= 2 && len >= p[1];
+	    len -= p[1], p += p[1]) {
 		if (debug)
 			log(-1, " %s", sppp_ipv6cp_opt_name(*p));
 		switch (*p) {
@@ -597,7 +597,8 @@ struct ip6_mtuinfo {
 /* to define items, should talk with KAME guys first, for *BSD compatibility */
 /* 42-44 is already used in KAME */
 #define IPV6CTL_STEALTH		45
-#define IPV6CTL_MAXID		46
+#define IPV6CTL_RTHDR0_ALLOWED  46
+#define IPV6CTL_MAXID		47
 #endif /* __BSD_VISIBLE */

 /*
@@ -314,6 +314,8 @@ time_t	ip6_log_time = (time_t)0L;
 #ifdef IPSTEALTH
 int	ip6stealth = 0;
 #endif
+int     ip6_rthdr0_allowed = 0; /* Disallow use of routing header 0 */
+				/* by default. */

 /* icmp6 */
 /*
@@ -452,6 +454,9 @@ SYSCTL_INT(_net_inet6_ip6, IPV6CTL_MAXFRAGS,
 SYSCTL_INT(_net_inet6_ip6, IPV6CTL_STEALTH, stealth, CTLFLAG_RW,
 	&ip6stealth, 0, "");
 #endif
+SYSCTL_INT(_net_inet6_ip6, IPV6CTL_RTHDR0_ALLOWED, 
+	   rthdr0_allowed, CTLFLAG_RW, &ip6_rthdr0_allowed, 0, "");
+

 /* net.inet6.icmp6 */
 SYSCTL_INT(_net_inet6_icmp6, ICMPV6CTL_REDIRACCEPT,
@@ -258,7 +258,7 @@ ipcomp6_input(mp, offp, proto)
 	off = *offp;

 	md = m_pulldown(m, off, sizeof(*ipcomp), NULL);
-	if (!m) {
+	if (!md) {
 		m = NULL;	/* already freed */
 		ipseclog((LOG_DEBUG, "IPv6 IPComp input: assumption failed "
 		    "(pulldown failure)\n"));
@@ -48,6 +48,8 @@

 #include <netinet/icmp6.h>

+extern int ip6_rthdr0_allowed;
+
 static int ip6_rthdr0 __P((struct mbuf *, struct ip6_hdr *,
    struct ip6_rthdr0 *));

@@ -87,6 +89,8 @@ route6_input(mp, offp, proto)

 	switch (rh->ip6r_type) {
 	case IPV6_RTHDR_TYPE_0:
+		if (!ip6_rthdr0_allowed)
+			return (IPPROTO_DONE);
 		rhlen = (rh->ip6r_len + 1) << 3;
 #ifndef PULLDOWN_TEST
 		/*
@@ -55,7 +55,7 @@
 * scheme is:  <major><two digit minor><0 if release branch, otherwise 1>xx
 */
 #undef __FreeBSD_version
-#define __FreeBSD_version 504105	/* Master, propagated to newvers */
+#define __FreeBSD_version 505000	/* Master, propagated to newvers */

 #ifndef LOCORE
 #include <sys/types.h>
@@ -1,12 +0,0 @@
-/*
- * Ukrainian calendar files
- *
- * $FreeBSD$
- */
-
-#ifndef _calendar_ukrainian_
-#define _calendar_ukrainian_
-
-#include <uk_UA.KOI8-U/calendar.all>
-
-#endif /* !_calendar_ukrainian_ */
@@ -1,14 +0,0 @@
-/*
- * õËÒÁ§ÎÓØËÉÊ ËÁÌÅÎÄÁÒ
- *
- * $FreeBSD$
- */
-
-#ifndef _uk_UA_KOI8_U_all_
-#define _uk_UA_KOI8_U_all_
-
-#include <uk_UA.KOI8-U/calendar.holiday>
-#include <uk_UA.KOI8-U/calendar.orthodox>
-#include <uk_UA.KOI8-U/calendar.misc>
-
-#endif /* !_uk_UA_KOI8_U_all_ */
@@ -1,22 +0,0 @@
-/*
- * �ﾒﾁｧﾎﾓﾘﾋｦ ﾄﾅﾒﾖﾁﾗﾎｦ ﾓﾗﾑﾔﾁ
- *
- * $FreeBSD$
- */
-
-#ifndef _uk_UA_KOI8_U_holiday_
-#define _uk_UA_KOI8_U_holiday_
-
-LANG=uk_UA.KOI8-U
-Paskha=�ﾌﾉﾋﾄﾅﾎﾘ
-
-�ﾞ 01	隝ﾗﾉﾊ �ﾋ
-�ﾞ 07	�ﾚﾄﾗﾏ 靨ﾉﾓﾔﾏﾗﾅ
-簀ﾒ 08	8 簀ﾒﾅﾚﾎﾑ - 惲ﾖﾎﾁﾒﾏﾄﾎﾉﾊ �ﾎﾏﾞﾉﾊ 菁ﾎﾘ
-�ﾁ 01	1 �ﾁﾗﾎﾑ - 菁ﾎﾘ �ﾁﾃｦ
-�ﾁ 09	菁ﾎﾘ �ﾒﾅﾍﾏﾇﾉ
-�ﾌﾉﾋﾄﾅﾎﾘ+49	�ｦﾊﾃﾑ
-�ﾅﾒ 28	菁ﾎﾘ �ﾎﾓﾔﾉﾔﾕﾃｦｧ �ﾒﾁｧﾎﾉ
-�ﾒ 24	菁ﾎﾘ 鎤ﾚﾁﾌﾅﾖﾎﾏﾓﾔｦ �ﾒﾁｧﾎﾉ
-
-#endif /* !_uk_UA_KOI8_U_holiday_ */
@@ -1,18 +0,0 @@
-/*
- * ╤нш╕ ц╕кав╕ дати
- *
- * $FreeBSD$
- */
-
-#ifndef _uk_UA_KOI8_U_misc_
-#define _uk_UA_KOI8_U_misc_
-
-LANG=uk_UA.KOI8-U
-
-/* Постанова Каб╕нету М╕н╕стр╕в Укра╖ни в╕д 13 травня 1996 р. N 509
- * "Про порядок обчислення часу на територ╕╖ Укра╖ни"
- */
-Бер Нд-1	Перех╕д на л╕тн╕й час (остання нед╕ля березня)
-Жов Нд-1	Перех╕д на зимовий час (остання нед╕ля жовтня)
-
-#endif /* !_uk_UA_KOI8_U_misc_ */
@@ -1,35 +0,0 @@
-/*
- * Православн╕ свята
- *
- * $FreeBSD$
- */
-
-#ifndef _uk_UA_KOI8_U_orthodox_
-#define _uk_UA_KOI8_U_orthodox_
-
-LANG=uk_UA.KOI8-U
-Paskha=Великдень
-
- 7 С╕ч	Р╕здво Христове
-19 С╕ч	Богоявлення або Хрещення Господн╓
-15 Лют	Стр╕тення Господн╓
-Великдень-46	Великий П╕ст
-Великдень-7	Вербна Нед╕ля
-Великдень-3	Великий Четвер
-Великдень-2	Страсна П'ятниця
-Великдень	Воскрес╕ння Христове
-Великдень+39	Вознес╕ння Господн╓
-Великдень+49	День Свято╖ Тр╕йц╕, П'ятидесятниця
-Великдень+60	Свято т╕ла Христового
- 7 Кв╕	Благов╕щення Пресвято╖ Д╕ви Мар╕╖
- 7 Лип	Р╕здво святого ╤вана Хрестителя
-12 Лип	Святих Верховних апостол╕в Петра ╕ Павла
-19 Сер	Преображення Господн╓
-28 Сер	Успення Пресвято╖ Богородиц╕
-11 Вер	Ус╕кновення чесно╖ голови святого ╤вана Хрестителя
-21 Вер	Р╕здво Пресвято╖ Богородиц╕
-27 Вер	Воздвиження Чесного Хреста
-14 Жов	Покрова Пресвято╖ Богородиц╕
- 4 Гру	Введення до храму Пресвято╖ Богородиц╕
-
-#endif /* !_uk_UA_KOI8_U_orthodox_ */
@@ -73,6 +73,7 @@ struct {
 	{ 502010, 502099, "/packages-5.2.1-release" },
 	{ 503000, 503099, "/packages-5.3-release" },
 	{ 504000, 504099, "/packages-5.4-release" },
+	{ 505000, 505099, "/packages-5.5-release" },
 	{ 300000, 399000, "/packages-3-stable" },
 	{ 400000, 499000, "/packages-4-stable" },
 	{ 503100, 599000, "/packages-5-stable" },
@@ -87,12 +87,6 @@ const char *yp_procs[] = {
 	"ypproc_maplist"
 };

-#ifdef TCP_WRAPPER
-void
-load_securenets(void)
-{
-}
-#else
 struct securenet {
 	struct in_addr net;
 	struct in_addr mask;
@@ -177,7 +171,6 @@ load_securenets(void)
 	fclose(fp);

 }
-#endif

 /*
 * Access control functions.
@@ -219,11 +212,12 @@ yp_access(const char *map, const struct svc_req *rqstp)
 #endif
 {
 	struct sockaddr_in *rqhost;
-	int status = 0;
-	static unsigned long oldaddr = 0;
-#ifndef TCP_WRAPPER
-	struct securenet *tmp;
+	int status_securenets = 0;
+#ifdef TCP_WRAPPER
+	int status_tcpwrap;
 #endif
+	static unsigned long oldaddr = 0;
+	struct securenet *tmp;
 	const char *yp_procedure = NULL;
 	char procbuf[50];

@@ -274,21 +268,34 @@ not privileged", map, inet_ntoa(rqhost->sin_addr), ntohs(rqhost->sin_port));
 	}

 #ifdef TCP_WRAPPER
-	status = hosts_ctl("ypserv", STRING_UNKNOWN,
+	status_tcpwrap = hosts_ctl("ypserv", STRING_UNKNOWN,
 			   inet_ntoa(rqhost->sin_addr), "");
-#else
+#endif
 	tmp = securenets;
 	while (tmp) {
 		if (((rqhost->sin_addr.s_addr & ~tmp->mask.s_addr)
 		    | tmp->net.s_addr) == rqhost->sin_addr.s_addr) {
-			status = 1;
+			status_securenets = 1;
 			break;
 		}
 		tmp = tmp->next;
 	}
-#endif

-	if (!status) {
+#ifdef TCP_WRAPPER
+	if (status_securenets == 0 || status_tcpwrap == 0) {
+#else
+	if (status_securenets == 0) {
+#endif
+	/*
+	 * One of the following two events occured:
+	 *
+	 * (1) The /var/yp/securenets exists and the remote host does not
+	 *     match any of the networks specified in it.
+	 * (2) The hosts.allow file has denied access and TCP_WRAPPER is
+	 *     defined.
+	 *
+	 * In either case deny access.
+	 */
 		if (rqhost->sin_addr.s_addr != oldaddr) {
 			yp_error("connect from %s:%d to procedure %s refused",
 					inet_ntoa(rqhost->sin_addr),
Author	SHA1	Message	Date
Colin Percival	d4c364b3dc	Fix logic error in sshd(8) concerning the handling of failed attempts to bind ports for X11 forwarding. Security: FreeBSD-SA-08:05.openssh Approved by: so (cperciva)	2008-04-17 00:00:54 +00:00
Simon L. B. Nielsen	709dbc33b1	Fix sendfile(2) write-only file permission bypass. [08:03.sendfile] Fix IPsec null pointer dereference panic. [SA-08:04.ipsec] Security: FreeBSD-SA-08:03.sendfile Security: FreeBSD-SA-08:04.ipsec Approved by: so (simon)	2008-02-14 11:50:28 +00:00
Colin Percival	fbf69f116f	Fix date of last advisory -- January 14th, not January 18th. Approved by: so (cperciva)	2008-01-15 23:36:53 +00:00
Colin Percival	22bd81bf62	Fix issues which allow snooping on ptys. Security: FreeBSD-SA-08:01.pty Approved by: so (cperciva)	2008-01-14 22:57:19 +00:00
Simon L. B. Nielsen	0ace3a4988	Correct a random value disclosure in random(4). [07:09] Correct a gtar directory traversal vulnerability. [07:10] Security: FreeBSD-SA-07:09.random Security: FreeBSD-SA-07:10.gtar Approved by: so (simon)	2007-11-29 16:09:26 +00:00
Simon L. B. Nielsen	36cf2a86b4	Correct a buffer overflow in OpenSSL SSL_get_shared_ciphers(). Security: FreeBSD-SA-07:08.openssl Approved by: so (simon)	2007-10-03 21:42:32 +00:00
Simon L. B. Nielsen	6c74b7e589	Correct a bug in the patch for FreeBSD-SA-07:01.jail which prevented jails with custom fstab's from starting due to use of incorrect variable. [1] Correct buffer overflow in tcpdump(1). [SA-07:06] Correct predictable query ids in named(8). [SA-07:07] Reported by: Joel Hatton <[email protected]> [1] Security: FreeBSD-SA-07:06.tcpdump Security: FreeBSD-SA-07:07.bind Approved by: so (simon)	2007-08-01 20:48:19 +00:00
Colin Percival	cdf37dd792	Correct multiple security issues in how libarchive handles corrupt tar archives, including a potentially exploitable buffer overflow. Approved by: so (cperciva) Reviewed by: kientzle Security: FreeBSD-SA-07:05.libarchive	2007-07-12 15:01:56 +00:00
Colin Percival	723930a26a	Fix buffer overflow in libmagic(3). Security: FreeBSD-SA-07:04.file Approved by: so (cperciva)	2007-05-23 16:13:20 +00:00
Colin Percival	f64f1bc808	Disable processing of IPv6 type 0 Routing Headers. This behaviour can be changed via the (newly added) net.inet6.ip6.rthdr0_allowed sysctl. Security: FreeBSD-SA-07:03.ipv6 Approved by: so (cperciva)	2007-04-26 23:42:23 +00:00
Colin Percival	1872069d5f	Correct two remote denials of service in BIND involving DNSSEC and recursive DNS queries respectively. Security: FreeBSD-SA-07:02.bind Approved by: so (cperciva)	2007-02-09 20:24:15 +00:00
Simon L. B. Nielsen	a06da17a53	Fix jail rc.d script privilege escalation via symlink attack against /var/log/console.log and mount points. Security: FreeBSD-SA-07:01.jail Approved by: so (simon)	2007-01-11 18:19:33 +00:00
Colin Percival	c9d94646a4	Correct a signedness bug which allowed members of the operator group to read kernel memory. [1] Disable handling of GNUTYPE_NAMES tar file entries by default, since they can be used to extract files outside of the cwd. [2] Security: FreeBSD-SA-06:25.kmem [1] Security: FreeBSD-SA-06:26.gtar [2] Approved by: so (cperciva)	2006-12-06 09:18:02 +00:00
Simon L. B. Nielsen	3bd085e6a7	Correct multiple vulnerabilities in OpenSSH. Security: FreeBSD-SA-06:22.openssh Approved by: so (simon)	2006-09-30 19:58:07 +00:00
Colin Percival	6e0d32a061	Correct problem in the 2006-09-28 patch concerning the handling of excessively large DH moduli. Reported by: Steve Kiernan (Juniper SIRT) Security: FreeBSD-SA-06:23.openssl Approved by: so (cperciva)	2006-09-29 13:46:41 +00:00
Colin Percival	10d388c0e8	Correct multiple vulnerabilities in crypto(3). Limit the size of public keys used in order to protect applications from a denial of service via insane key sizes. Security: FreeBSD-SA-06:23.openssl Approved by: so (cperciva)	2006-09-28 13:06:23 +00:00
Simon L. B. Nielsen	e1f57900cc	Correct multiple vulnerabilities in gzip(1). Security: FreeBSD-SA-06:21.gzip Approved by: so (simon)	2006-09-19 14:13:53 +00:00
Simon L. B. Nielsen	55c389630a	Correct incorrect PKCS#1 v1.5 padding validation in crypto(3). [1] Correct multiple denial-of-service vulnerabilities in BIND related to SIG Query Processing and Excessive Recursive Queries. [2] Security: FreeBSD-SA-06:19.openssl [1] Security: FreeBSD-SA-06:20.bind [2] Approved by: so (simon)	2006-09-06 21:23:16 +00:00
Colin Percival	82738e4f15	Correct buffer overflow in the handling of LCP options in ppp(4) Security: FreeBSD-SA-06:18.ppp Approved by: so (cperciva)	2006-08-23 22:06:40 +00:00
Colin Percival	5f4c5dadb2	Correct a bug in the handling of multipart messages by sendmail(8) which can allow a malformed message to crash a sendmail queue processing process. Security: FreeBSD-SA-06:17.sendmail Approved by: so (cperciva)	2006-06-14 16:01:20 +00:00
Colin Percival	e682749bfb	Enable inadvertantly disabled "securenet" access controls in ypserv. [1] Correct a bug in the handling of backslash characters in smbfs which can allow an attacker to escape from a chroot(2). [2] Approved by: so (cperciva) Security: FreeBSD-SA-06:15.ypserv [1] Security: FreeBSD-SA-06:16.smbfs [2]	2006-05-31 22:33:41 +00:00
Ken Smith	de7242811f	Looks like we're ready for the release... Approved by: re (implicit)	2006-05-23 04:09:11 +00:00
Bruce A. Mah	8d9de78e04	Add a paragraph documenting 5.5-RELEASE as the last (planned) 5-STABLE release. Some form of this text will also go into the release announcement. Approved by: re (kensmith) Reviewed by: kensmith, cperciva	2006-05-22 17:05:47 +00:00
Pyun YongHyeon	2d3fe1bf18	MFC if_em.c, 1.92 to RELENG_5_5: Add jumbo frame support for architectures with strict alignment. Requested by: wilko Approved by: re (kensmith)	2006-05-21 23:45:56 +00:00
Xin LI	199a4ca516	MFC: Remove reference to -stable@ Approved by: re (hrs)	2006-05-21 14:26:08 +00:00
Hiroki Sato	ed010929d3	Fix &release.url; for 5.5-RELEASE. Approved by: re (implicitly)	2006-05-20 19:10:33 +00:00
Hiroki Sato	5df487bb4a	Remove description about subscribing to stable@. Approved by: re (implicitly)	2006-05-20 19:02:59 +00:00
Ken Smith	f890728dbb	Ready for RC1 builds... Approved by: re (implicit)	2006-05-14 03:23:59 +00:00
Xin LI	45682f4180	MFen: errata/article.sgml: 1.69.2.33 -> 1.69.2.35.2.1 hardware/common/artheader.sgml: 1.5.2.1 -> 1.5.2.2 installation/common/artheader.sgml: 1.5 -> 1.5.2.1 installation/sparc64/article.sgml (fix) relnotes/common/new.sgml: 1.761.2.56 -> 1.761.2.59.2.1 relnotes/sparc64/article.sgml (fix) Obtained from: The FreeBSD Simplified Chinese Project Approved by: re (murray)	2006-05-13 05:24:18 +00:00
Bruce A. Mah	ded1c67d67	MFC: tzdata2006. Also insert missing punctuation. Approved by: re (kensmith)	2006-05-12 18:49:51 +00:00
Bruce A. Mah	2df9f3516a	Trim errata document for 5.5-RELEASE. Also update version number entities in this file (wait, why aren't we using what was in share/sgml/release.ent?). Because this is the last planned release from the RELENG_5 codeline, remove text that implies that further 5.X releases will be forthcoming. Approved by: re (kensmith)	2006-05-12 18:48:47 +00:00
Bruce A. Mah	1af3dd6c74	Update entities to reflect that this set of release documents is a full release, not a snapshot. Approved by: re (kensmith)	2006-05-12 18:43:57 +00:00
Ken Smith	720bb3f7b9	Update for 5.5-RELEASE. Approved by: re (implicit)	2006-05-12 16:05:29 +00:00
Ken Smith	664a104e89	Add packages-5.5-release. Approved by: re (implicit)	2006-05-12 15:51:55 +00:00
Ken Smith	bf8b8f7221	Update FreeBSD_version for 5.5-RELEASE. Approved by: re (implicit)	2006-05-12 15:47:05 +00:00
Ken Smith	25dd903a4a	RELENG_5 -> RELENG_5_5 Approved by: re (implicit)	2006-05-12 15:43:54 +00:00
Ken Smith	7fecf17c90	5.4 -> 5.5 Approved by: re (implicit)	2006-05-12 15:42:35 +00:00
Ken Smith	6cd57f4fb1	Adjust branch tag for updates to RELENG_5_5. Approved by: re (implicit)	2006-05-12 15:37:46 +00:00
Ken Smith	a4543b77c9	Update default OS. Approved by: re (implicit)	2006-05-12 15:36:50 +00:00
cvs2svn	17b6f54a81	This commit was manufactured by cvs2svn to create branch 'RELENG_5_5'.	2006-05-12 01:09:20 +00:00