Remove check for presence of PACKET_TAG_IPSEC_PENDING_TDB and
PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED mbuf tags. They aren't used in FreeBSD.

Instead check presence of PACKET_TAG_IPSEC_OUT_DONE mbuf tag. If it
is found, bypass security policy lookup as described in the comment.

PACKET_TAG_IPSEC_OUT_DONE tag added to mbuf when IPSEC code finishes
ESP/AH processing. Since it was already finished, this means the security
policy placed in the tdb_ident was already checked. And there is no reason
to check it again here.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Remove PACKET_TAG_IPSEC_IN_DONE mbuf tag lookup and usage of its
security policy. The changed block of code in ip*_ipsec_input() is
called when packet has ESP/AH header. Presence of
PACKET_TAG_IPSEC_IN_DONE mbuf tag in the same time means that
packet was already handled by IPSEC and reinjected in the netisr,
and it has another ESP/AH headers (encrypted twice?).
Since it was already processed by IPSEC code, the AH/ESP headers
was already stripped (and probably outer IP header was stripped too)
and security policy from the tdb_ident was applied to those headers.
It is incorrect to apply this security policy to current headers.

Also make ip_ipsec_input() prototype similar to ip6_ipsec_input().

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Move ip_ipsec_fwd() from ip_input() into ip_forward().

Remove check for presence PACKET_TAG_IPSEC_IN_DONE mbuf tag from
ip_ipsec_fwd(). PACKET_TAG_IPSEC_IN_DONE tag means that packet is
already handled by IPSEC code. This means that before IPSEC processing
it was destined to our address and security policy was checked in
the ip_ipsec_input(). After IPSEC processing packet has new IP
addresses and destination address isn't our own. So, anyway we can't
check security policy from the mbuf tag, because it corresponds
to different addresses.

We should check security policy that corresponds to packet
attributes in both cases - when it has a mbuf tag and when it has not.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Remove unused mtag variable.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Remove code related to PACKET_TAG_IPSEC_IN_CRYPTO_DONE mbuf tag.
It isn't used in FreeBSD.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Remove now unused mtag argument from ipsec*_common_input_cb.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Remove flags and tunalready arguments from ipsec4_process_packet()
and make its prototype similar to ipsec6_process_packet.
The flags argument isn't used here, tunalready is always zero.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
handle "Kana" and "Eisu" keys on Apple Wireless Keyboard (JIS)

PR:		187470
Submitted by:	naito.yuichiro
MFC after:	1 week
Remove flag/flags argument from the following functions:
 ipsec_getpolicybyaddr()
 ipsec4_checkpolicy()
 ip_ipsec_output()
 ip6_ipsec_output()

The only flag used here was IP_FORWARDING.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Initialize error variable.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Treat errors when retrieving security policy as policy violation.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Use ipsec4_in_reject() to simplify ip_ipsec_fwd() and ip_ipsec_input().
ipsec4_in_reject() does the same things, also it counts policy violation
errors.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Add myself.
Use ipsec6_in_reject() to simplify ip6_ipsec_fwd() and ip6_ipsec_input().
ipsec6_in_reject() does the same things, also it counts policy violation
errors.

Do IPSEC check in the ip6_forward() after addresses checks.
Also use ip6_ipsec_fwd() to make code similar to IPv4 implementation.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Do not count security policy violation twice.
ipsec*_in_reject() do this by their own.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
Add new PowerPC relocations to binutils

Summary:
LLVM/Clang generates relocations that our binutils doesn't understand, but newer
binutils does.  I got permission from the author of a series of patches to
relicense them as GPLv2 for use in FreeBSD.  The upstream git hashes are:

ac2df442ac7901f00af15b272fc48b594b433713
2b95367962dc14f69d3c338c4d54195266e2e169
102890f04c44b64cf5cef4588267dd9f24086ac7
b7fcf6f6bb53b5027e111107f5416769cb9a5798
1d483afedd5a628dc84fb58d1d570f79fdfbfa7b
90aecf7a80c1cefeb45fc10a6cd02c8338e34b4c
3a71aa26df2a372a58e9c11ef9ba51fd0e83320a
727fc41e077139570ea8b8ddfd6c546b2a55627c

With the import of clang 3.5, and a few backported patches, we should be able to
move powerpc and powerpc64 to clang-as-cc soon.

Test Plan: Passes make tinderbox, so no regressions.  Binaries built with clang
run on powerpc64.

Reviewers: #committers, dim

Reviewed By: dim

Differential Revision: https://reviews.freebsd.org/D1297

Obtained from:	Alan Modra, upstream binutils-gdb git
MFC after:	3 weeks
Relnotes:	yes
The size of the first level reference count table is given in terms of the
number of clusters it occupies. It's not the number of entries in the table,
as it is for the L1 cluster table.

For small images, the two are the same. With the unit tests based on small
images, this change has therefore no effect on the unit test.  For larger
images (like the FreeBSD 10.1-RELEASE image), this gives a discrepancy that
actually shows up when running "qemu-img check".

Bump the version number of mkimg.

While here, fix a white-space bug.

MFC after: 1 week
For architectures where time_t is wide enough, in particular, 64bit
platforms, avoid overflow after year 2038 in clock_ct_to_ts().

PR:	195868
Reviewed by:	bde
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Add virtio bus 'poll' method allowing us to inform backend we are
going to poll virtqueue.

Use on BERI soft-core to invalidate cpu caches.

Reviewed by:	bryanv
Sponsored by:	DARPA, AFRL
Increase the buffer size to keep the list of programm names when
parsing programm specification. It is safe to not check out of bounds
access, because !isprint(p[i]) check will stop reading, when '\0'
character will be read from the input string.

Obtained from:	Yandex LLC
MFC after:	1 week
Sponsored by:	Yandex LLC