Use ipsec6_in_reject() to simplify ip6_ipsec_fwd() and ip6_ipsec_input().
ipsec6_in_reject() does the same things, also it counts policy violation
errors.

Do IPSEC check in the ip6_forward() after addresses checks.
Also use ip6_ipsec_fwd() to make code similar to IPv4 implementation.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Do not count security policy violation twice.
ipsec*_in_reject() do this by their own.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Add new PowerPC relocations to binutils

Summary:
LLVM/Clang generates relocations that our binutils doesn't understand, but newer
binutils does.  I got permission from the author of a series of patches to
relicense them as GPLv2 for use in FreeBSD.  The upstream git hashes are:

ac2df442ac7901f00af15b272fc48b594b433713
2b95367962dc14f69d3c338c4d54195266e2e169
102890f04c44b64cf5cef4588267dd9f24086ac7
b7fcf6f6bb53b5027e111107f5416769cb9a5798
1d483afedd5a628dc84fb58d1d570f79fdfbfa7b
90aecf7a80c1cefeb45fc10a6cd02c8338e34b4c
3a71aa26df2a372a58e9c11ef9ba51fd0e83320a
727fc41e077139570ea8b8ddfd6c546b2a55627c

With the import of clang 3.5, and a few backported patches, we should be able to
move powerpc and powerpc64 to clang-as-cc soon.

Test Plan: Passes make tinderbox, so no regressions.  Binaries built with clang
run on powerpc64.

Reviewers: #committers, dim

Reviewed By: dim

Differential Revision: https://reviews.freebsd.org/D1297

Obtained from:	Alan Modra, upstream binutils-gdb git
MFC after:	3 weeks
Relnotes:	yes
The size of the first level reference count table is given in terms of the
number of clusters it occupies. It's not the number of entries in the table,
as it is for the L1 cluster table.

For small images, the two are the same. With the unit tests based on small
images, this change has therefore no effect on the unit test.  For larger
images (like the FreeBSD 10.1-RELEASE image), this gives a discrepancy that
actually shows up when running "qemu-img check".

Bump the version number of mkimg.

While here, fix a white-space bug.

MFC after: 1 week
For architectures where time_t is wide enough, in particular, 64bit
platforms, avoid overflow after year 2038 in clock_ct_to_ts().

PR:	195868
Reviewed by:	bde
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Add virtio bus 'poll' method allowing us to inform backend we are
going to poll virtqueue.

Use on BERI soft-core to invalidate cpu caches.

Reviewed by:	bryanv
Sponsored by:	DARPA, AFRL
Increase the buffer size to keep the list of programm names when
parsing programm specification. It is safe to not check out of bounds
access, because !isprint(p[i]) check will stop reading, when '\0'
character will be read from the input string.

Obtained from:	Yandex LLC
MFC after:	1 week
Sponsored by:	Yandex LLC
Provide a dead version of if_get_counter.

Submitted by:	glebius
Reported by:	np
Fix typo in comments.

Noticed by: brooks@
Add some new modes to OpenCrypto.  These modes are AES-ICM (can be used
for counter mode), and AES-GCM.  Both of these modes have been added to
the aesni module.

Included is a set of tests to validate that the software and aesni
module calculate the correct values.  These use the NIST KAT test
vectors.  To run the test, you will need to install a soon to be
committed port, nist-kat that will install the vectors.  Using a port
is necessary as the test vectors are around 25MB.

All the man pages were updated.  I have added a new man page, crypto.7,
which includes a description of how to use each mode.  All the new modes
and some other AES modes are present.  It would be good for someone
else to go through and document the other modes.

A new ioctl was added to support AEAD modes which AES-GCM is one of them.
Without this ioctl, it is not possible to test AEAD modes from userland.

Add a timing safe bcmp for use to compare MACs.  Previously we were using
bcmp which could leak timing info and result in the ability to forge
messages.

Add a minor optimization to the aesni module so that single segment
mbufs don't get copied and instead are updated in place.  The aesni
module needs to be updated to support blocked IO so segmented mbufs
don't have to be copied.

We require that the IV be specified for all calls for both GCM and ICM.
This is to ensure proper use of these functions.

Obtained from:	p4: //depot/projects/opencrypto
Relnotes:	yes
Sponsored by:	FreeBSD Foundation
Sponsored by:	NetGate
Move KTR_CXGBE from t4_tom.h to adapter.h so that the base if_cxgbe
code can use it too.

MFC after:	1 week
MFV r275542:

If a dnode has a spill block and there is an error while accessing
a data block then traverse_dnode() loses information about that error
and returns a status of visiting the spill block.

This issue is discovered by Spectra Logic.

Illumos issue:
    5311 traverse_dnode may report success when it should not

Original author:	gibbs
MFC after:		2 weeks
MFV r275543:

Remove always true tests for ds->ds_phys' presence.

Clean up assertions in dsl_dataset_disown.

Remove unreachable code in dsl_dataset_disown().

Illumos issue:
    5310 Remove always true tests for non-NULL ds->ds_phys

MFC after:	2 weeks
MFV r275544:

Clean up some duplicated code in dnode_sync() around freeing spill blocks.

Illumos issue:
    5350 clean up code in dnode_sync()

MFC after:	2 weeks
MFV r275545:

If zio_checksum_error() returns other than ECKSUM (e.g. EINVAL), it does not
fill in the "zio_bad_cksum_t *info" parameter. Caller should not attempt to
use it in this case.

Illumos issue:
    5348 zio_checksum_error() only fills in info if ECKSUM

MFC after:	2 weeks
MFV r275546:

Reduce scrub activities when system there is enough dirty data, namely when
dirty data is more than zfs_vdev_async_write_active_min_dirty_percent (once
we start to increase the number of concurrent async writes).

While there also correct rounding error which would make scrub end up
pausing for (zfs_txg_timeout + 1) seconds instead of the desired
zfs_txg_timeout seconds.

Illumos issue:
    5351 scrub goes for an extra second each txg
    5352 scrub should pause when there is some dirty data

MFC after:	2 weeks
MFV r275547:

Port Illumos 'zfs allow' examples update.  While I'm there also fix
a typo.

Illumos issue:
    4181 zfs(1m): 'zfs allow' examples in the man page are outdated

MFC after:	2 weeks
MFV r275548:

Verify that the block pointer is structurally valid, before attempting to
read it in.  It can only be invalid in the case of a ZFS bug, but this
change will help identify such bugs in a more transparent way, by
panic'ing with a relevant message, rather than indexing off the end of an
array or something.

Illumos issue:
    5349 verify that block pointer is plausible before reading

MFC after:	2 weeks
The vinactive() call in vgonel() may start writes for the dirty pages,
creating delayed write buffers belonging to the reclaimed vnode.  Put
the buffer cleanup code after inactivation.

Add asserts that ensure that buffer queues are empty and add BO_DEAD
flag for bufobj to check that no buffers are added after the cleanup.
BO_DEAD is only used by INVARIANTS-enabled kernels.

Reported and tested by:	pho (previous version)
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Only sleep interruptible while waiting for suspension end when
filesystem specified VFCF_SBDRY flag, i.e. for NFS.

There are two issues with the sleeps.  First, applications may get
unexpected EINTR from the disk i/o syscalls.  Second, interruptible
sleep allows the stop of the process, and since mount point is
referenced while thread sleeps, unmount cannot free mount point
structure' memory, blocking unmount indefinitely.

Even for NFS, it is probably only reasonable to enable PCATCH for intr
mounts, but this information is currently not available at VFS level.

Reported and tested by:	pho (previous version)
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week