MFC r360836:

loader: vdev_read() can corrupt memory

When reading less than sector size but from sector boundary,
the vdev_read() will read full sector into the provided buffer
and therefore corrupting memory past buffer end.

MFC r355940:

Move all sources from the llvm project into contrib/llvm-project.

This uses the new layout of the upstream repository, which was recently
migrated to GitHub, and converted into a "monorepo". That is, most of
the earlier separate sub-projects with their own branches and tags were
consolidated into one top-level directory, and are now branched and
tagged together.

Updating the vendor area to match this layout is next.

MFC r354673:

Logging improvements to loader::nfs

Include the server IP address when logging nfs_open(), add a few missing
"\n"s, and correct a typo.

MFC r351408-r351410: reduce pollution from mips machine/regnum.h

r351408:
libsa: mips: use _JB_* from machine/asm.h, remove regnum dep

This brings the libsa/mips _setjmp implementation closer to parity with the
libc version.

r351409:
mips: hide regnum definitions behind _KERNEL/_WANT_MIPS_REGNUM

machine/regnum.h ends up being included by sys/procfs.h and sys/ptrace.h via
machine/reg.h. Many of the regnum definitions are too short and too generic
to be exposing to any userland application including one of these two
headers. Moreover, these actively cause build failures in googletest
(template <typename T1 ...> expanding to template <typename 9 ...>).

Hide the definitions behind _KERNEL or _WANT_MIPS_REGNUM, and patch all of
the userland consumers to define as needed.

r351410:
libsa: mips: fix typo that had slipped into the diff on local machine

MFC r351119, r351135-r351136, r351412: stand xtoolchain-llvm90 fixes

r351119:
stand: push LIBC_SRC up into defs.mk

Other parts of stand/ that don't use libsa will need to grab bits from libc
shortly. Push LIBC_SRC up to defs.mk in advance of this so that they can use
it, and rename it to LIBCSRC to match the convention of the rest of the *SRC
variables in this file.

r351135:
stand: boot2: fix build with xtoolchain-llvm90

ufsread.c grows a dependency on __ashldi3 with llvm90. Grab ashldi3.c out of
compiler-rt rather than trying to link against libsa (for now).
-Wno-missing-prototypes is necessary to compile ashldi3.c standalone.

r351136:
stand: gptboot: fix build with xtoolchain-llvm90

ufsread.c grows a dependency on __ashldi3 with llvm90. For gptboot, just
start pulling in ashldi3.c ashrdi3.c lshrdi3.c into libsa for all archs as
the number of archs requiring one or more of them keeps growing. qdivrem.c
and quad.h can be trivially kicked out of libsa if we start pulling these
from compiler-rt as qdivrem was only used to implement umoddi3, divdi3,
moddi3 (also in qdivrem.c).

r351412:
stand: boot2: fix amd64-xtoolchain-gcc build

-Wno-missing-declarations is the GCC equivalent of
-Wno-missing-prototypes... this was overlooked in r351135.

MFC r351078, r351085, r351088: mostly a nop (two commits + revert of two)

This commit is mostly a nop, but ends up renumbering #4 clause to #3 in one
copy of quad.h... this is OK; stand/ situation in stable/11 is pretty murky
and the commit that renumbered the clause got lost somewhere. quad.h will be
disappearing in a not-so-distant future MFC.

r351078:
stand: kick out quad.h

Use quad.h from libc instead for the time being. This reduces the number of
nearly-identical-quad.h we have in tree to two with only minor changes.

Prototypes for some *sh*di3 have been added to match the copy in libkern.
The differences between the two are likely few enough that they can perhaps
be merged with little additional effort to bring us down to 1.

r351085:
libc quad.h: one last _STANDALONE correction

r351088:
Revert r351078, r351085: stand/quad.h eviction

It did not go well; further examination is required...

MFC r348471: stand: zfs: Free bouncebuf on error path in vdev_read

r344226 inadvertently added this path in which we return from failure on an
lseek and do not free bouncebuf on the way out.

Partial revert r350338: stable/11 part

The stand/libsa changes were not supposed to ride along with this revision;
backing out the stable/11 part and re-applying the MFC.

Pointy hat: kevans

MFC r348328: bectl(8): Address Coverity complaints

CID 1400451: case 0 is missing a break/return and falling through to the
default case. waitpid(0, ...) makes little sense in the child, we likely
wanted to terminate immediately.

CID 1400453: size argument uses sizeof(char **) instead of sizeof(char *)
and is assigned to a char **; sizeof's match but "this isn't a portable
assumption".

CID: 1400451, 1400453

MFC r347244:

Move contrib/zlib to sys/contrib/zlib so that we can use it in kernel.
This is a prerequisite of unifying kernel zlib instances.

Submitted by: Yoshihiro Ota <ota at j.email.ne.jp>
Approved by: re (kib)

MFC r337871, r339970, r342151, r342161, r343123-r343124, r344226, r344234,
r344248, r344387

r337871:
pkgfs_init: Initialize pkg

new_package may not set *pp if it errors out, leaving pkg uninitialized.

r339970:
Remove unnecessary include from libstand.

r342151:
loader: zfs reader should not probe partitionless disks

First of all, normal setups can not boot such pools as the tools
do not support installing boot programs.

Secondly, for proper pool configuration detection, we need to checks all
four label copies on disk, 2 from front and 2 from the end of the disk,
but zfs label does not contain the size of the disk - so we depend on
firmware to report the correct disk size or use information from the
partition table.

Without partition table, we only can rely on firmware to report and support
disk IO properly.

There is a specific case: 8TB disks are reported by BIOS to have 4294967295
sectors (0x00000000ffffffff), the sectors reported by OS is 15628053168
(0x00000003a3812ab0), so the reported size is less than actual but is hitting
32-bit max. Unfortuantely the real limit must be even lower because probing
this disk in this system will wnd up with hung system.

UEFI boot of this system seems not to be affected.

r342161:
loader: zfs reader should not probe partitionless disks (UEFI case)

With r342151 I did fix the BIOS version of zfs_probe_dev() from accessing
the whole disk, but the fix was not complete - we actually did not check
if the device name was really for whole disk. Since UEFI version
is only calling the zfs_probe_dev() with partitions and not with whole
disk, the UEFI loader was not able to find the zfs pools.

This update does correct the issue by calling archsw.arch_getdev() to
translate the device name back to dev_desc, and we have whole disk when both
partition and slice values are -1.

r343123:
loader should ignore active multi_vdev_crash_dump feature on zpool

Since the loader zfs reader does not need to read the dump zvol, we can
just enable the feature.

illumos issue #9051 https://www.illumos.org/issues/9051

r343124:
libsa: add asprintf()

asprintf() is a nice tool for string processing.

r344226:
Fix memory corruption bug introduced in r325310

The bug occurred when a bounce buffer was used and the requested read
size was greater than the size of the bounce buffer. This commit also
rewrites the read logic so that it is easier to systematically verify
all alignment and size cases.

r344234:
It turns out r344226 narrowed the overrun bug but did not eliminate it entirely

This commit fixes a remaining output buffer overrun in the
single-sector case when there is a non-zero tail.

r344248:
cd9660: dirmatch fails to unmatch when name is prefix for directory record

Loader does fail to properly match the file name in directory record and
does open file based on prefix match.

For fix, we check the name lengths first.

r344387:
loader: really fix cd9660 dirmatch

The cd9660_open() does pass whole path to dirmatch() and we need to
compare only the current path component, not full path.

Additinally, skip over duplicate / (if any) and check if the last component
in the path was meant to be directory (having trailing /). If it is in fact
a file, error out.

MFC r341253, r341328, r342619, r342626, r342707, r342785, r342865

r341253:
The libstand's panic() appends its own '\n' to the message, so that users of the API
don't need to supply one.

r341328:
loader: create separate lists for fd, cd and hd, merge bioscd with biosdisk

Create unified block IO implementation in BIOS version, like it is done in UEFI
side. Implement fd, disk and cd device lists, this will split floppy devices
from disks and will allow us to have consistent, predictable device naming
(modulo BIOS issues).

r342619:
loader: create bio_alloc and bio_free for bios bounce buffer

We do have 16KB buffer space defined in pxe.c, move it to bio.c and implement
bio_alloc()/bio_free() interface to make it possible to use this space for
other BIOS calls (notably, from biosdisk.c).

r342626:
Add Copyright.

r342707:
i386_parsedev() needs to support fd devices

r342785:
With buggy int13 ah=15, we can mis-identify the floppy devices.

We have no option than trust INT13 ah=08 return code during the init phase.

r342865:
biospci_write_config args were backwards

biospci_write_config args swapped length and value to write. Some
hardware coped just fine, while other hardware had issues.

PR: 155441, 234460

MFC Loader Interpreter Coexistance: r337806, r337868, r337914, r337927,
r337989, r338052, r338064, r338407, r338418, r338474

r337806:
Create a loader for each interpreter for x86 BIOS and all EFI

Create loader_{4th,lua,simp}{,.efi}. All of these are installed by
default. Create LOADER_DEFAULT_INTERP to specify the default
interpreter when no other is specified. LOADER_INTERP is the current
interpreter language building. Turn building of lua on by default to
match 4th. simploader is a simplified loader build w/o any interpreter
language (but with a simple loader). This is the historic behavir you
got with WITHOUT_FORTH. Make a hard link to the default loader. This
has to be a hard link rather than the more desirable soft link because
older zfsboot blocks don't support symlinks.

r337868:
stand: Use -Oz/-Os for all loader/stand builds.

While we're not super size constrained, the x86 BIOS /boot/loader has
to be less than about 520k-530k to be reliable. The LUA loader is at
this size today. -Oz saves 15-20% on the size, keeping us safely small
enough (comparable to where we were with the 4th loader). This will
also help with sjg's work on bringing in bearssl, though we may again
be looking for space in the LUA loader.

Size table for clang 6.0.0:
default -O1 -Os -Oz
4th 442368 417792 389120 376832
lua 524288 479232 446464 430080

r337914:
Install links for loader.efi.

r337927:
Add ashldi3 and ashrdi3 to mips.

Now that we're using -Os, mips needs these routines.

r337989:
Copy the boot loader from the new location for the co-existing
loaders.

r338052:
libsa: Add lshrdi3.c for powerpc* and mips

r338064:
Turn back the clock just a little: make userboot.so always be 4th

Turns out there was a hidden dependency we hasn't counted upon. The
host load /boot/userboot.so to boot the VMs it runs. This means that
the change to lua meant suddently that nobody could run their older
VMs because LUA wasn't in 10.0, last month's HardenedBSD, 11.2 or
whatever. Even more than for the /boot/loader* binaries, we need a
good coexistance strategy for this. While that's being designed and
implemented, drop back to always 4th for userboot.so. This will fail
safe in all but the most extreme environments (but lua-only hacks
to .lua files won't be processes in VMs until we fix it).

r338407:
lualoader: Print error messages from command failures at the prompt

Previously lualoader would remain silent, rather than printing
command_errmsg or noting that a command had failed or was not found.

r338418:
userboot: handle guest interpreter mismatches more intelligently

The switch to lualoader creates a problem with userboot: the host is
inclined to build userboot with Lua, but the host userboot's interpreter
must match what's available on the guest. For almost all FreeBSD guests in
the wild, Lua is not yet available and a Lua-based userboot will fail.

This revision updates userboot protocol to version 5, which adds a
swap_interpreter callback to request a different interpreter, and tries to
determine the proper interpreter to be used based on how the guest
/boot/loader is compiled. This is still a bit of a guess, but it's likely
the best possible guess we can make in order to get it right. The
interpreter is now embedded in the resulting executable, so we can open
/boot/loader on the guest and hunt that down to derive the interpreter it
was built with.

Using -l with bhyveload will not allow an intepreter swap, even if the
loader specified happens to be a userboot with the wrong interpreter. We'll
simply complain about the mismatch and bail out.

For legacy guests without the interpreter marker, we assume they're 4th.
For new guests with the interpreter marker, we'll read it and swap over
to the proper interpreter if it doesn't match what the userboot we're using
was compiled with.

Both flavors of userboot are installed by default, userboot_4th.so and
userboot_lua.so. This fixes the build WITHOUT_FORTH as a coincidence, which
was broken by userboot being forced to 4th.

r338474:
Be a little conservative about when to force size optimizations.

Reports have come in that there's issue with powerpc and sparc64 since
we've switched to using -Oz / -Os. We don't strictly need them for
!x86, so be conservative about when we enable them.

MFC various libsa fixes: r337037-r337039, r337065, r337412-r337413, r337874,
r338535, r338540, r339651, r339992-r339993, r340026

r337037:
libsa: pointer differs in signedness

A small cleanup, fix the argument type and while there, replace (char *)0 with
NULL.

r337038:
libsa: bootp is using pointers with different sign

Just change bp_file to char and same for variable s.

r337039:
libsa: assignment to char * from u_char *

Cast to char * instead of u_char *

r337065:
libsa: dereferencing type-punned pointer in cd9660

The warning is given by gcc build, but it is good to fix anyhow.
use bcopy instead of direct assignment.

r337412:
libsa: dos_checksum() should take unsigned chars

Fix pointers to integers with different sign issue.

r337413:
libsa: gzipfs.c converts pointers to integer types with different sign

Signed versus unsigned char.

r337874:
libsa: zfs_probe() needs to set spa to NULL

Silence the warning about possibly uninitialized use of spa.

r338535:
libsa: memory leak in tftp_open()

tftpfile is allocated just above and needs to be freed.

r338540:
libsa: validate tftp_makereq() after we did reset the read

The name check referred in the comment is not the only possible error source,
we need to validate the result.

r339651:
libsa: re-send ACK for older data packets in tftp

In current tftp code we drop out-of-order packets; however, we should play
nice and re-send ACK for older data packets we are receiving. This will
hopefully stop server repeating those packets we already have received.
Note we do not answer duplicates from "previous" session (that is, session
with different port number), those will eventually time out.

r339992:
libsa: tftp should not read past file end

When we have the file size via tsize option, use it to make sure we
will not attempt to read past file end.

r339993:
libsa: tftp should use calloc

instead of malloc() memset(), use calloc().

r340026:
libsa: cstyle cleanup tftp.c

No functinal changes intended.

MFC GELI Loader Improvements: r336252, r336254, r336256, r336354,
r336532-r336534, r336537, r336626, r337326, r337349, r341071, r341160,
r341420, r341473, r341651, r342793

Note that this MFC contains some seemingly unrelated zfsloader bits -- this
was needed in order to pull in some later fixes for GELI hand-off w/ ZFS
bits included.

r336252:
Extend loader(8) geli support to all architectures and all disk-like devices.

This moves the bulk of the geli support from lib386/biosdisk.c into a new
geli/gelidev.c which implements a devsw-type device whose dv_strategy()
function handles geli decryption. Support for all arches comes from moving
the taste-and-attach code to the devopen() function in libsa.

After opening any DEVT_DISK device, devopen() calls the new function
geli_probe_and_attach(), which will "attach" the geli code to the open_file
struct by creating a geli_devdesc instance to replace the disk_devdesc
instance in the open_file. That routes all IO for the device through the
geli code.

A new public geli_add_key() function is added, to allow arch/vendor-specific
code to add keys obtained from custom hardware or other sources.

With these changes, geli support will be compiled into all variations of
loader(8) on all arches because the default is WITH_LOADER_GELI.

r336254:
Use if rather than case for a simple boolean. gcc thinks blks is
undefined sometimes with the case, but enc is always 0 or 1, so
and if / else is better anyway.

r336256:
Fix glitched indentation (and rewrap as needed due to deeper indent).
No functional changes.

r336354:
zfsboot: fix build with WITHOUT_LOADER_GELI

r336532:
Collapse zfsloader functionality back down into loader.

We no longer really need a separate zfsloader. It was useful when we
were first supporting ZFS and had limited ability to properly boot off
of ZFS without the special boot loader. Now that the boot loader has
matured, go the way loader.efi pioneered and just build one
binary. Change the name of the loader to load in the secondary boot
blocks to be just /boot/loader. Provide a symbolic link from zfsloader
to loader so people who have not upgraded their boot blocks are not
affected. This has the happy benefit of making coexistence easier as
well (fewer binaries in the matrix).

r336533:
Eliminate zfsloader man page.

Remove all cross references to zfsloader.8 and /boot/zfsloader.
Move ZFS specific info into loader.8.

r336534:
NM and OBJCOPY are already defined for all builds. There's no need to
conditionally define them here.

r336537:
Mention zfsloader being folded into loader in UPDATING.

r336626:
Older zfs boot blocks don't support symlinks. install the link to
zfsloader as a hard link. While newer ones do, the whole point of the
link was to transition to the new world order smoothly. A hard link is
less flexible, but it works and will result in fewer bumps. Adjust
UPDATING entry to match.

r337326:
loader: biosdisk.c has leftover geli header.

A small cleanup, remove unneeded #include.

r337349:
zfsboot: Fix startup crash

On a FreeNAS mini XL, with geli encrypted drives the loader crashed in
geli_read().

When we iterate over the list of disks and allocate the zfsdsk structures we
don’t zero out the gdev pointer. In one case that resulted in geli_read()
(called on the bogus pointer) dividing by zero.

Use calloc() to ensure the zfsdsk structure is always zeroed, so the pointer is
initialised to NULL. As a side benefit it gets rid of one #ifdef
LOADER_GELI_SUPPORT.

r341071:
Restore the ability to override the disk unit/partition at the boot: prompt
in gptboot.

When arch-independent geli support was added, a new static 'gdsk' struct
was added, but there was still a static 'dsk' struct, and when you typed
in an alternate disk/partition, the string was parsed into that struct,
which was then never used for anything. Now the string gets parsed into
gdsk.dsk, the struct that's actually used.

r341160:
Add comments describing the bootargs handoff between loader(8) and gptboot
or zfsboot, when loader(8) is the BTX loader. No functional changes.

r341420:
Eliminate duplicated code and struct member definitions in the handoff
of args data between gptboot/zfsboot and loader(8).

Despite what seems like a lot of changes here, there are no actual
changes in behavior, or in the data layout in the structures involved.
This is just eliminating identical code pasted into multiple locations.

In detail, the changes are...

- Move struct zfs_boot_args definition from libsa/zfs/libzfs.h to
i386/common/bootargs.h because it is specific to x86 booting and the
handoff between zfsboot and loader, and has no relation to the zfs
library code in general.

- The geli_boot_args and zfs_boot_args structs both contain an identical
set of member variables containing geli information. Extract this out
to a new geli_boot_data struct, and embed it in the arg-passing structs.

- Provide new routines geli_import_boot_data() and geli_export_boot_data()
that can be shared between gptboot, zfsboot, and loader instead of
pasting identical code into several different .c files.

- Remove some checks for a NULL pointer that can never be true because the
pointer being tested was set using pointer math (kargs + 1) and that can
never result in NULL in this code.

r341473:
Fix args cross-threading between gptboot(8) and loader(8) with zfs support.

When loader(8) is built with zfs support enabled, it assumes that any extarg
data present is a zfs_boot_args struct, but if the first-stage loader was
gptboot(8) the extarg data is actually a geli_boot_args struct. Luckily,
zfsboot(8) and gptzfsboot(8) have always passed KARGS_FLAGS_ZFS along with
KARGS_FLAGS_EXTARG, so we can use KARGS_FLAGS_ZFS to decide whether the
extarg data is a zfs_boot_args struct.

To avoid similar problems in the future, gptboot(8) now passes a new
KARGS_FLAGS_GELI to indicate that extarg data is geli_boot_args. In
loader(8), if the neither KARGS_FLAGS_ZFS nor KARGS_FLAGS_GELI is set but
extarg data is present (which will be the case for gptboot compiled before
this change), we now check for the known size of the geli_boot_args struct
passed by the older versions of gptboot as a way of confirming what type of
extarg data is present.

In a semi-related tidying up, since loader's main() has already decided
what type of extarg data is present and set the global 'zargs' var
accordingly, don't repeat the check in extract_currdev, just check whether
zargs is NULL or not.

r341651:
Don't reference zfs-specific variables if LOADER_ZFS_SUPPORT is undefined
because the variables will be undefined too.

r342793:
MK_ZFS -> {MK_ZFS|MK_LOADER_ZFS}, this is so we can diable userland / kernel
ZFS but keep the boot-loaders when using ZoL port.

Relnotes: yes (GELI support extended)
Relnotes: yes (zfsloader has been collapsed into loader and may be
removed after boot blocks have been updated)

MFC r316312, r332361, r333438-r333439, r339804: GELI dry-run

r316312:
sys/geom/eli: Switch bzero() to explicit_bzero() for sensitive data

In GELI, anywhere we are zeroing out possibly sensitive data, like
the metadata struct, the metadata sector (both contain the encrypted
master key), the user key, or the master key, use explicit_bzero.

Didn't touch the bzero() used to initialize structs.

r332361:
Introduce dry run option for attaching the device.
This will allow us to verify if passphrase and key is valid without
decrypting whole device.

r333438:
Change option dry-run from 'n' to 'C' in geli attach command.

'n' is used in other commands to define the key index.
We should be consistent with that.
'C' option is used by patch(1) to perform dryrun so lets use that.

r333439:
Introduce the 'n' flag for the geli attach command.

If the 'n' flag is provided the provided key number will be used to
decrypt device. This can be used combined with dryrun to verify if the key
is set correctly. This can be also used to determine which key slot we want to
change on already attached device.

r339804:
Restore backward compatibility for "attach" verb.

In r332361 and r333439, two new parameters were added to geli attach
verb using gctl_get_paraml, which requires the value to be present.
This would prevent old geli(8) binary from attaching geli(4) device
as they have no knowledge about the new parameters.

Restore backward compatibility by treating the absense of these two
values as seeing the default value supplied by userland.

MFC r336244, r336246-r336247: Standardize boot arg parsing

r336244:
Create helper functions for parsing boot args.

boot_parse_arg to parse a single arg
boot_parse_cmdline to parse a command line string
boot_parse_args to parse all the args in a vector
boot_howto_to_env Convert howto bits to env vars
boot_env_to_howto Return howto mask mased on what's set in the environment.

All these routines return an int that's the bitmask of the args
translated to RB_* flags. As a special case, the 'S' flag sets the
comconsole_speed env var. Any arg that looks like a=b will set the env
key 'a' to value 'b'. If =b is omitted, 'a' is set to '1'. This
should help us reduce the number of redundant copies of these routines
in the tree. It should also give a more uniform experience between
platforms.

Also, invent a new flag RB_PROBE that's set when 'P' is parsed. On
x86 + BIOS, this means 'probe for the keyboard, and if it's not there
set both RB_MULTIPLE and RB_SERIAL (which means show the output on
both video and serial consoles, but make serial primary). Others it
may be some similar concept of probing, but it's loader dependent
what, exactly, it means.

These routines are suitable for /boot/loader and/or the kernel,
though they may not be suitable for the tightly hand-rolled-for-space
environments like boot2.

r336246:
Eliminate boot loader copies of boot arg parsing.

Eliminate 4 of the copies of the arg parsing in /boot/laoder
by using boot_parse_cmdline.

r336247:
Transition to boot_env_to_howto and boot_howto_to_env in the boot
loader.

MFC r336084-r336085, r336118: Move zfs impl into libsa

r336084:
Move ZFS files into libsa

Move the libzfs stuff into libsa. There's no need for it to be a
separate library. The separate library adds to the issues of build
ordering that we see from time to time. Move the filesystem support
into libsa, like all the other filesystem support rather than making
zfs the odd-duck out.

Discussed with: allanjude@

r336085:
Stop using ../zfs/libzfs.h but instead use libzfs.h.

While ../zfs/libzfs.h mostly works, there are a few situations where
it does not. Eliminate the problem by using plain libzfs.h, like we do
for ufs support. This fixes the weird cases, and is easier to
understand. It also follows the general style convetion of avoiding
../ in #includes.

r336118:
Remove dirs that git svn should have removed but didn't.

MFC r304850, r305480, r324550-r324551, r324655, r324684: correct mis-merge

Some of these commits were improperly MFC'd in the sys/boot => stand
mega-MFC, others were simply missed. Correct that mistake now by manually
merging the few that were missed and record-only merge on the others.

r304850:
Unused variables and cstyle fix for loader dosfs

r305480:
Renumber the advertising clause.

r324550:
Add $FreeBSD$ to ancient sources that it's missing from.

r324551:
Move lib/libstand to sys/boot/libsa

Move the sources to sys/boot. Make adjustments related to the
move. Kill LIBSTAND_SRC since it's no longer needed.

r324655:
Remove the libstand directory which is now empty.

r324684:
Remove lib/libstand again, accidentally readded in r324683

MFC r335321, r335336: stand: move libgeliboot into libsa

r335321:
stand: move libgeliboot into libsa.

Reduce by 1 the number of crazy libraries we need in stand by moving
geli into libsa (where architecturally it belonged all along). This
just moves things around without any code changes.

r335336:
Remove now-empty geli directory

MFC r335337: Remove stray debugging line.

MFC r335125-r335127, r335148, r335224

r335125:
libsa: cstyle cleanup for open/close/read/write sources

r335126:
libsa: f_rabuf could be NULL

It is possible that we will not get RA buffer from open(), therefore
we must validate RA.

r335127:
libsa: remobe unneeded check before free()

free() is checking for NULL, remove duplicate check.

r335148:
libsa: open() should use NULL instead of typecasted 0

r335224:
Remove empty directory

MFC r335069-r335071, r335110, r335116: stand housecleaning

r335069:
Remove fail: label. It's unused.

r335070:
Remove unused variables.

[kevans@: removed ufs.c modifications; those depend on ufs rewrite bits]

r335071:
Initialize variables we later free so they aren't used
uninitialized in the error path.
Remove unused variables.

r335110:
Remove redundant defs.mk includes. They aren't needed.

r335116:
Use bool for vargood, since it's a boolean.

MFC r334868: Add st_mtime, st_ino and st_dev for ufs_stat

MFC r332170, r332173: light cd9660 cleanup

r332170:
libsa: cd9660: warning: 'lenskip' may be used uninitialized in this function

We better provide value for lenskip in both instances.

r332173:
libsa: name is not used in dirmatch()

Seems like variable 'name' is leftover.

MFC lualoader: r326353, r328440, r328443, r329166-r329167, r329274, r329329,
r329349-r329352, r329355-r329359, r329366-r329369, r329386-r329387, r329393,
r329413-r329415, r329417, r329424-r329436, r329457, r329473-r329474,
r329496-r329501, r329503-r329504, r329543, r329547-r329551, r329576-r329578,
r329580, r329583, r329585-r329590, r329592-r329596, r329609-r329611,
r329614, r329619, r329621-r329622, r329624, r329626-r329627,
r329629-r329632, r329640-r329641, r329643-r329646, r329649-r329650, r329654,
r329656, r329662, r329669-r329671, r329673-r329674, r329680,
r329684-r329689, r329692-r329693, r329696-r329700, r329709, r329716,
r329731, r329733-r329734, r329747-r329748, r329756, r329779, r329782,
r329784, r329786, r329804, r329806, r329809, r329811, r329836,
r329850-r329852, r329854, r329856-r329858, r329861, r329895,
r329897-r329899, r329901-r329903, r329922-r329924, r329927-r329928,
r329944-r329949, r329986-r329987, r330008-r330010, r330012, r330020,
r330082-r330084, r330087-r330088, r330098-r330101, r330138-r330139,
r330261-r330263, r330267-r330269, r330281-r330284, r330287, r330339-r330342,
r330345-r330346, r330369-r330370, r330434-r330435, r330564, r330616-r330618,
r330620, r330625, r330690, r330701, r330703, r330825, r331211, r331257,
r331259, r331281-r331282, r331304, r331314, r331476-r331477,
r331563-r331564, r331854-r331857, r331859-r331860, r332106, r334723,
r334879, r334891, r334907, r334912, r334939, r334986, r335009, r335371,
r336759, r337711, r337807-r337810, r338054, r338063, r338065-r338067,
r338083, r338085-r338086, r338108, r338167-r338168, r338173, r338203,
r338255, r338259, r338309, r338394, r338438, r338886, r338893, r339173,
r339200, r339218, r339222, r339301, r339307, r339677-r339678, r339702,
r339805, r339831, r339849, r340040, r340152

Some notes for this MFC:
- This is still pre-forth/lua coexistance; that will come shortly-ish so
that forth/lua may be installed together (with forth remaining the default)

- module_blacklist support for lualoader has been MFC'd, but the drm modules
are not blacklisted in this stable branch.

r326353: Import lua 5.3.4 to contrib
r328440: Preserve the original luaconf.h in a convenient place. Clients will
r328443: Gross hack to omit printing hex floating point when the lua number
r329166: Add Lua as a scripting langauge to /boot/loader
r329167: Add the lua scripts from the lua-bootloader SoC
r329274: stand/lua: Exit sub-menus on backspace
r329329: stand/lua: Always boot on 'enter' keypress in menus
r329349: stand/lua: Reduce magic numbers
r329350: stand/lua: Don't descend into an empty kernels submenu
r329351: stand/lua: Set reasonable ACPI default based on presence
r329352: stand/lua: Consistently use semicolons for line endings
r329355: stand/lua: Move kernel selection into main menu
r329356: stand/lua: Allow menu items to not have explicit aliases
r329357: stand/lua: Remove explicit alias from "Back to main menu"
r329358: stand/lua: Say "loader prompt" instead of "lua interpreter"
r329359: stand/lua: Remove a magic number/string (not a trivial literal)
r329366: stand/lua: Set ACPI's default the proper way (setACPI)
r329367: stand/lua: Create a "carousel" menu entry type
r329368: stand/lua: Create/use some MENU_ constants where applicable
r329369: stand/lua: Remove sneaky kernel assignment
r329386: stand/lua: Correct usage and acceptance of BACKSPACE/DELETE keys
r329387: stand/lua: Chop off the decimal for numbers passed to setcursor
r329393: stand/lua: Use escaped dot instead of single character class
r329413: stand/lua: Allow MENU_RETURN items to have func, fix esc. to prompt
r329414: stand/lua: Don't try to divide by 0; do nothing
r329415: stand/lua: Don't reload kernel config if we only have one kernel
r329417: stand/lua: Make CAROUSEL_ENTRY func parameters consistent with name
r329424: stand/lua: Don't set autoboot_delay=NO in menu autoboot sequence
r329425: stand/lua: Enable menu autoboot; it seems to work
r329426: stand/lua: Correct interpretation of autoboot_delay
r329427: stand/lua: Color non-default kernels blue
r329428: stand/lua: Correct some trivial errors in config
r329429: stand/lua: Add debug method to dump modules
r329430: stand/lua: Address some nits
r329431: stand/lua: Correct test sense, this should have been 'not nil'
r329432: stand/lua: Try to load alternate kernels as directories first
r329433: stand/lua: Add optional GELI passphrase prompt
r329434: stand/lua: Check for nil (GELI prompt)
r329435: stand/lua: Style pass
r329436: stand/lua: Debugging string snuck in...
r329457: stand/lua: dumpModules => lsModules
r329473: liblua: Clean up io/loader C module registration
r329474: liblua: Emulate DIR, opendir, fdopendir, closedir
r329496: stand/lua: Fix verbiage and some typos
r329497: stand/lua: Fix module_path handling with multiple kernels
r329498: stand/lua: Remove some debugging bits that snuck in... gr...
r329499: interp_lua: Register io/loader with regular Lua module system
r329500: Lua loader: Add barebones "lfs" module
r329501: lua loader: Auto detect eligible list of kernels to boot
r329503: liblua: Fix missing '}' in lutil.c after r329499
r329504: stand/lua: More style nits, config.lua
r329543: Create style.lua(9)
r329547: stand/lua: Allow menu items to be conditionally (in)visible
r329548: stand/lua: Addres style.lua(9) concern
r329549: stand/lua: Clear the screen before prompting for passwords
r329550: stand/lua: Store the loaded kernel as config.kernel_loaded
r329551: stand/lua: reload previously loaded kernel at config-load/reload
r329576: stand/lua: Defer kernel/module loading until boot or menu escape
r329577: stand/lua: Rename bootserial for clarity
r329578: stand/lua: Menu style.lua(9) nits
r329580: stand/lua: Remove some unused local declarations
r329583: stand/lua: Store menu entries in an "entries" table
r329585: stand/lua: Add core.isSingleUserBoot
r329586: stand/lua: Call menu_entries if it's a function
r329587: stand/lua: Swap single-/multi- user boot entries as needed
r329588: stand/lua: Re-wrap menu.lua now that I've added indentation...
r329589: stand/lua: Track env changes that come in via loader.conf(5)
r329590: stand/lua: Restore environment upon config reload
r329592: stand/lua: Remove inaccurate comment after r329590
r329593: stand/lua: Change boot menu items' names when swapped
r329594: stand/lua: Round up some more style.lua(9) concerns
r329595: stand/lua: Re-order locals after copyright notice; require first
r329596: stand/lua: Add copyright notice in places
r329609: stand/lua: Cache swapped menu, and don't create locals for swapping
r329610: style.lua(9): Note that wrapping at 80-columns is not rigid
r329611: stand/lua: Wrap tuple assignment earlier for readability
r329614: stand/lua: Don't set ACPI off just because we can't detect it.
r329619: stand/lua: Extract menu handlers out into menu.handlers table
r329621: stand/lua: Add and use drawer.menu_name_handlers
r329622: stand/lua: Move drawer.menu_name_handlers further up
r329624: stand/lua: Reduce exposure of the drawer module
r329626: stand/lua: Refactor logos into drawer.logodefs table
r329627: stand/lua: Refactor brands into drawer.branddefs
r329629: stand/lua: Use 'graphic' instead of 'logo' for depicting graphics
r329630: stand/lua: Stick a copyright notice on drawer.lua
r329631: stand/lua: Insert helpful comment for drawer.branddefs
r329632: style.lua(9): Clarify local variable guideline
r329640: stand/lua: Consistently declare local functions at module scope
r329641: stand/lua: Consistently organize modules
r329643: Implement loader.command
r329644: lualoader: Add ability to intercept cli commands
r329645: lualoader: Move carousel storage out into config
r329646: lualoader: Eliminate global namespace pollution in loader.lua
r329649: Lua lfs.attributes: Provide a more consistent error return
r329650: liblua: Add loader.machine and loader.machine_arch properties
r329654: lualoader: Ignore ACPI bits on !i386
r329656: loader.lua: Expose errno table to lua
r329662: lualoader: Replace invalid construct with valid construct
r329669: lualoader: Prefer selected kernel to currently loaded
r329670: lualoader: Don't try so hard to load a kernel
r329671: lualoader: Prepare for interception of "boot" CLI cmd
r329673: lualoader: Intercept boot cli command
r329674: lualoader: Intercept the 'autoboot' cli command
r329680: lualoader: When restoring environment, only restore unchanged vars
r329684: lualoader: Drop terminating semicolons
r329685: lualoader: Drop excessive parenthesizing
r329686: style.lua(9): Drop notes about semicolons
r329687: lualoader: Drop explicit boolean tests; b or not b
r329688: lualoader: Don't return false for failure to open config on silent
r329689: lualoader: Output "Failed to parse" messages
r329692: lualoader: Bring in local.lua module if it exists
r329693: lualoader: Return only argstr if with_kernel not requested
r329696: lualoader: Add "menu.default", initialized to menu.welcome
r329697: lualoader: Drop name requirement for menu separators
r329698: lualoader: Directly reference submenu definition with submenu key
r329699: lualoader: Simplify menu definitions a little further
r329700: lualoader: Allow carousel 'items' to be a table as well
r329709: lualoader: Don't autodetect kernels if 'kernels' is explicitly set
r329716: lualoader: Use the key that interrupts autoboot as a menu choice
r329731: lualoader: Add boot environment support
r329733: lualoader: Make kernel autodetect. contingent on loader.conf(5) var
r329734: lualoader: Don't execute menu.autoboot() for every opened menu
r329747: lualoader: Replace 8-space indentation with a single tab
r329748: lualoader: Drop password length restrictions
r329756: lualoader: Remove nasty hack for not printing out ".0"
r329779: lualoader: Split cli bits out into a cli module
r329782: lualoader: Unbreak 'boot [kernel]' by including config
r329784: lualoader: Pull argument extraction for cli funcs to cli.arguments
r329786: lualoader: Attach cli command functions to cli module
r329804: lualoader: Eliminate some unused locals
r329806: lualoader: Consistently use double quotes
r329809: lualoader: Address some 'luacheck' concerns
r329811: lualoader: Clear up an empty conditional branch
r329836: lualoader: Attend to some 80-col issues, pointed out by luacheck
r329850: lualoader: Drop unused return values; we'll only use the first
r329851: Add SPDX tags to lua files
r329852: Add copyright notice to core.lua
r329854: lualoader: shallowCopyTable => deepCopyTable
r329856: lualoader: Use "local function x()" instead "local x = function()"
r329857: Centralize lua defines
r329858: When the LUA_FLOAT_TYPE != LUA_FLOAT_INT64, we can't ref. float
r329861: lualoader: Track effective line number, use it for drawing
r329895: liblua: Implement write support
r329897: lualoader: Add nextboot support
r329898: lualoader: Plug file handle not properly closed
r329899: lualoader: Correct test and name
r329901: lualoader: Add comment on trailing space, don't operate on nil
r329902: lualoader: Remove unused variable; we now use effective line number
r329903: lualoader: Explain nextboot stuff a little bit more
r329922: lualoader: Split config file I/O out into a separate function
r329923: lualoader: Strip config.parse of its I/O privileges
r329924: lualoader: throw out nextboot's usage of standard config processing
r329927: lualoader: Clean up naming conventions a little bit
r329928: lualoader: Remove inaccurate part of comment
r329944: lualoader: Don't explicitly index tables without reason
r329945: lualoader: menu: Terminate final values in tables with a comma
r329946: lualoader: Clean up menu handling a little bit
r329947: lualoader: Pull menu redrawing specifics out of menu.process
r329948: lualoader: Pull autoboot handling out into menu.run()
r329949: lualoader: Explain deviation from naming guidelines
r329986: lualoader: Invalidate the screen from menu perspective mnu exit
r329987: lualoader: Track the menu currently drawn, instead of validity
r330008: lualoader: A little more general menu cleanup
r330009: lualoader: More argument name expansion, part 2
r330010: lualoader: screen argument fixes
r330012: style.lua(9): Add some additional notes about naming and commas
r330020: lualoader: Re-work menu skipping bits
r330082: lualoader: Add a twiddle at password prompt
r330083: lualoader: Remove remnants of testing...
r330084: lualoader: Replace instances of \027 with KEYSTR_ESCAPE
r330087: lualoader: Convert instances of KEYSTR_ESCAPE .. "[" -> KEYSTR_CSI
r330088: lualoader: Correct test sense, comments, and add some more comments
r330098: lualoader: Re-do twiddle
r330099: lualoader: Further screen cleanup
r330100: lualoader: Remove debug function
r330101: lualoader: Add note that \027 is a decimal representation
r330138: lualoader: Dedup these "Return to main menu" entries
r330139: lualoader: config: Pull some messages out into constants
r330261: lualoader: Fix some lint-mentioned errors
r330262: lualoader: Use #str instead of tracking length with 'n'
r330263: lualoader: Use string literal \xNN instead of string.char()
r330267: Add core.lua(8), but do not add to distribution
r330268: Add menu.lua(8), but do not add to distribution
r330269: core.lua(8): Add missing note about core.KEYSTR_CSI
r330281: lualoader: Steamroll the box-drawing
r330282: lualoader: Register loader.printc as global printc
r330283: lualoader: Use global printc instead of loader.printc
r330284: liblua: Use putc instead of printf for printc
r330287: lualoader: Reset the cursor position after the menu is drawn
r330339: liblua: Add loader.interpret
r330340: lualoader: Execute menu_timeout_command at the end of menu autoboot
r330341: lualoader: Respect loader_menu_title, prepare for align
r330342: lualoader: Respect loader_menu_title_align
r330345: lualoader: Tweak positioning and fix an off-by-one
r330346: lualoader: Shift menu+brand even for logo=none with customized pos
r330369: lualoader: Return meaningful value in cli_execute
r330370: lualoader: logdef -> logodef typo
r330434: lualoader: Add note about importance of including cli module early
r330435: lualoader: Use FILESDIR instead of BINDIR
r330564: lualoader: Only loadelf before boot/autoboot if no kernel loaded
r330616: lualoader: Expose loader.parse and add cli_execute_unparsed
r330617: lualoader: Fix name, cli.execute_unparsed -> cli_execute_unparsed
r330618: lualoader: Use cli_execute_unparsed instead of loader.interpret
r330620: lualoader: Use cli_execute_unparsed for commands via loader.conf
r330625: lualoader: Return status in cli_execute_unparsed properly
r330690: stand: Fix copy-paste-o, unbreaks libi386 lualoader build
r330701: lualoader: Don't redraw the autoboot message every .05s
r330703: lualoader: Cache kernel list
r330825: lualoader: Sprinkle some verbose_loading salt
r331211: lualoader: Setup default color scheme if we're using colors
r331257: lualoader: Reset attributes and color scheme with color.highlight()
r331259: lualoader: Use less atomic options for resetting colors/attributes
r331281: lualoader: Add primitive hook module to untangle bogus reference
r331282: core.lua(8): Update to reflect recently added function
r331304: lualoader: Clear up some possible naming confusion
r331314: lualoader: Use printc when we expect ANSI escape sequences
r331476: lualoader: Make config env-related bits private API
r331477: lualoader: Privatize some more config.lua bits
r331563: lualoader: Implement try_include and use it for including local
r331564: lualoader: Actually re-raise error in try_include
r331854: lualoader: Do case-insensitive comparison of "yes"
r331855: lualoader: Don't assume that {module}_load is set
r331856: lualoader: revert whitespace change that snuck in
r331857: lualoader: Simplify some expressions
r331859: lualoader: Split logodefs out into logo-* files
r331860: lualoader: Don't try to lookup a nil logo
r332106: lualoader: Fix menu skipping with loader.conf(5) vars
r334723: lualoader: Add a loaded hook for others to execute upon config load
r334879: lualoader: Add hook.lua(8) to tree
r334891: lualoader: Add cli.lua(8) to the tree
r334907: lualoader: Process loader_conf_files properly
r334912: lualoader: Support variable substitution in env var settings
r334939: lualoader: Allow brand-*.lua for adding new brands
r334986: lualoader: More black-on-white fixes
r335009: lualoader: Match Forth module-loading behavior w.r.t flags
r335371: lualoader: Correct kernel_options handling
r336759: lualoader: "nextboot_file" should be spelled "nextboot_conf"
r337711: lualoader: Fix parsing of negative number loader.conf(5) variables
r337807: Prevent a wanring about checkdp being unused.
r337808: When the LUA floating point model is INT64, we don't need to do the
r337809: For our INT64 implementation, we can compare integers and numbers
r337810: MFV r337586: lua: Update to 5.3.5
r338054: Add config.lua(8) to the tree
r338063: lualoader: Stop exporting drawer.draw
r338065: lualoader: Hide most of the internal drawing functions
r338066: lualoader: Hide the rest of the private interfaces
r338067: lualoader: Add drawer-exported variables for default logodefs
r338083: Add drawer.lua(8)
r338085: Add color.lua(8), password.lua(8), and screen.lua(8)
r338086: lualoader: Install all manpages
r338108: Serial console menus for lua.
r338167: lualoader: Just compare expression directly
r338168: lualoader: Refactor config line expressions
r338173: lualoader: Fix loader.conf(5) EOL validation for 'exec' lines
r338203: Turn off LOADER_GELI and LOADER_LUA for sparc64, until functional
r338255: lualoader: Fix (add) Xen support
r338259: lualoader: Accept that people use unquoted values in loader.conf
r338309: lualoader: Fix override of module_path on loader prompt
r338394: lualoader: fix color usage
r338438: lualoader: Handle comma-separated kernels as well
r338886: Improve loader passwords:
r338893: Set the default loader for powerpc(32- and 64-bit) back to to forth
r339173: Set the default loader for powerpc64 back to to forth too.
r339200: lualoader: Don't draw loader menu with autoboot_delay=-1
r339218: lualoader: Create a module blacklist, add DRM modules to it
r339222: lualoader: Honor boot_* variables at lua init
r339301: Loader GELI support, like lua loader, seems to be broken on PowerPC
r339307: lualoader: Provide a 'menu' command to redraw the menu at prompt
r339677: lualoader: unload upon kernel change if a kernel was loaded
r339678: menu.lua: Abort autoboot sequence on failed command
r339702: lualoader: Improve module loading diagnostics
r339805: lualoader: Always return a proper dictionary for blacklist
r339831: Move LUA_ROOT to /boot/lua
r339849: lualoader: Fix try_include error handling
r340040: lualoader: Implement boot-conf
r340152: lualoader: Add chainload menu entry

Relnotes: yes ("lualoader has been merged to stable/11, off by
default, to facilitate testing")

MFC r337523: libsa: exit on EOF in ngets

It was possible in some rare circumstances for ngets to behave terribly with
bhyveload and some form of redirecting user input over a pipe.

PR: 198706

MFC r334878: libsa(3): Correct statement about FS Write-support, name change

- jhb implemented UFS write support a little over 16 years ago.
- Update the library name while we're here.

MFC r334656, r334665, r334695

r334656:
Add vsnprintf() to libsa. Alpha-sort the printf prototypes in stand.h.

r334665:
Make the v*printf() functions in libsa return int instead of void.
This makes them compatible with the C standard signatures, avoiding
spurious mismatch errors in the places where the oddball requirements
of standalone code end up putting two declarations of the same function
in play.

r334695:
Remove comments and assertions that are no longer valid after r330809.

r330809 replaced duplication of devdesc struct fields with an embedded copy
of the devdesc struct, to avoid fragility. That means all the scattered
comments indicating that structs must match are no longer valid. Likewise
asserts that attempted to mitigate some of the old fragility.

Reviewed by: imp@

MFC r332084

Add isoboot(8) for booting BIOS systems from HDDs containing ISO images.

This is part of a project for adding the ability to create hybrid CD/USB boot
images. In the BIOS case when booting from something that isn't a CD we need
some extra boot code to actually find our next stage (loader) within an
ISO9660 filesystem. This code will reside in a GPT partition (similar to
gptboot(8) from which it is derived) and looks for /boot/loader in an
ISO9660 filesystem on the image.

Sponsored by: iXsystems, Inc.

MFC r330806-r330815, r330837, r330864, r330883

pc98 changes associated with the named commits are also included in this
commit, despite not having been made with the original commits due to its
removal in head.

r330806:
Minor cosmetic changes.

Make sure { on the same line as struct for all struct *devdesc. Move
some type definitions to next to the dv_type define, since that's what
sets the d_type.

r330807:
We can't use d_opendata for blkio storage.

open_disk uses d_opendata for it's own purpse. We can't store blkio
there. Fortunately, blkio is stored elsewhere and we never actually
retrieve blkio from d_opendata. Eliminate it as a source of confusion.
Eliminate all stores of d_opendata in efi since this layer doesn't own
that field.

r330808:
Make struct libi386_devdesc match the struct devdesc better

Move data to top and call it d_opendata.

r330809:
Use the actual struct devdesc at the start of all *_devdesc structs

The current system is fragile and requires very careful layout of all
*_devdesc structures. It also makes it hard to change the base
devdesc. Take a page from CAM and put the 'header' in all the derived
classes and adjust the code to match.

For OFW, move the iHandle h_handle out of a slot conflicting with
d_opendata. Due to quirks in the alignment rules, this worked.
However changing the code to use d_opendata storage now that it's a
pointer is hard, so just have a separate field for it.

All other cleanups were to make the *_devdesc structures match where
they'd taken some liberties that were none-the-less compatible enough
to work.

r330810:
Remove d_type from devdesc. It's not needed as we can fetch it from
d_dev->dv_type when we need it.

r330811:
GC unused routines.

Sponsored by: Netflix

r330812:
Use the one-line-per-file pattern here, and sort the file names.

Sponsored by: Netflix

r330813:
Move the env convenience routines out of boot1.c.

These routines are more generally useful. Even though boot1 is on its
way out, it's better to make these common during the transition than
copy them.

r330814:
Star BootCurrent entry when booting.

Sponsored by: Netflix

r330815:
Print the load and device path as well as BootCurrent and BootOrder

Sponsored by: Netflix

r330837:
biosdisk.c should not set d_opendata.

Same as 330807, d_opendata is owned by open_disk and we should not
set it.

M stand/i386/libi386/biosdisk.c

r330864:
Prefer uintXX_t to u_intXX_t

A foolish consistency is the hobgoblin of little minds, adored by
little statesmen and philosophers and divines. With consistency a
great soul has simply nothing to do. -- Ralph Waldo Emerson

r330883:
Fix typo that misteriously passes compilation.

MFC r330056: libsa: replace remaining _write callbacks by null_write

There are some _write callbacks left only returning EROFS, replace them
by null_write. return EROFS from null_write().

MFC r330026: libsa: Move MAXWAIT from net.h to net.c

It's not a setting that has any effect or use outside of the net.c context.

MFC r329879, r329892

r329879:
libsa: Const-ify buffer argument of write(2) analog

r329892:
libsa: Change write(2)-alike prototype to match definition

Broken in r329879.

Apparently old GCC detects this, but modern GCC didn't. Mea culpa.

MFC r329345: Eliminate bsd.stand.mk and -fPIC 32-bit intel builds

OK. We don't really need a bsd.stand.mk, and it was causing a -fPIC
for the toolchain to be added (bogusly) when building on amd64. Pull
all relevant defs back into defs.mk and delete bsd.stand.mk.

This saves about 15-20k on i386 loader and zfsloader which when
combined with Lua give us a lot more stack space in those constrained
environments.

MFC r330023, r330028: Add MAXWAIT for configuring pxeboot timeout

r330023: libsa: Add MAXWAIT to net for establishing max total timeout

Current timeout behavior is to progress in timeout values from MINTMO to
MAXTMO in MINTMO steps before finally timing out. This results in a fairly
long time before operations finally timeout, which may not be ideal for some
use-cases.

Add MAXWAIT that may be configured along with MINTMO/MAXTMO. If we attempt
to start our send/recv cycle over again but MAXWAIT > 0 and MAXWAIT seconds
have already passed, then go ahead and timeout.

This is intended for those that just want to say "timeout after 180 seconds"
rather than calculate and tweak MINTMO/MAXTMO to get their desired timeout.
The default is 0, or "progress from MINTMO to MAXTMO with no exception."

This has been modified since review to allow for it to be defined via CFLAGS
and doing appropriate error checking. Future work may add some Makefile foo
to respect LOADER_NET_MAXWAIT if it's specified in the environment and pass
it in as MAXWAIT accordingly.

r330028: libsa: Partially revert r330023

The removal of tmo >= MAXTMO check should not have been done; this is
specifically what handles timeout if MAXWAIT == 0.

MFC r329339: libsa: Consolidate tftp sendrecv into net.c sendrecv

bootp/arp/rarp/rpc all use the sendrecv implementation in net.c. tftp has
its own implementation because it passes an extra parameter into the recv
callback for the received payload type to be held.

These sendrecv implementations are otherwise equivalent, so consolidate
them. The other users of sendrecv won't be using the extra argument to recv,
but this gives us only one place to worry about respecting timeouts and one
consistent timeout behavior.

MFC r329264: libsa: Fix IP recv timeout

[This is slightly modified to not set `t` in the middle of the loop so that
the connection will eventually timeout after MAXTMO]

readip() doesn't, at the moment, properly indicate to callers that it has
timed out. One can tell that it's timed out if errno == EAGAIN when it
returns, but this is not ideal. Restructure it a little bit to explicitly
set errno to ETIMEDOUT if we've exhausted tleft.

I found two places that care about where it timed out or not: sendrecv in
net.c and sendrecv_tftp. Both are structured to pass smaller timeout values
to readip while tracking a larger timeout. Neither of them were able to do
this properly with readip not indicating ETIMEDOUT, so fix it.

While here, straighten out the time (t/t1) usage in sendrecv_tftp.

This would have manifested itself in periodic failures to NFS/TFTP boot for
no apparent reason because MINTMO/MAXTMO were not actually being respected
properly. Problems were not reported with NFS, only TFTP.

MFC Loader Fixes Final: r327612,r327703,r327704,r327878,r327879,r327881,
r328007,r328029,r328030,r328031,r328061,r328156,r328169,r328288,r328289,
r328290,r328291,r328292,r328411,r328536,r328603,r328614,r328642,r328769,
r328779,r328780,r328781,r328782,r328783,r328806,r328808,r328826,r328835,
r328911,r328986,r328987,r328990,r328999,r329000,r329019,r329050,r329054,
r329060

r327612: Invent new #defines for the biospci_{read,write}_config function

r327703: Define __dmadat after #include'ing ufsread.c.

r327704: Fix printf missing format variables warnings.

r327878: Add GUID for UEFI boot manager variables.

r327879: Report the boot order and where we are in that boot order.

r327881: Allow this file to be included

r328007: Fix booting on some arm64 systems after r327879 by fixing the call
to utf8_to_ucs2

r328029: When returning an error and freeing allocated memory from
ucs2_to_utf8, NULL the return pointer.

r328030: Check the return value from utf8_to_ucs2 instead of whether or not
uv is NULL.

r328031: Need to free uv after we're done using it.

r328061: utf8_to_ucs2() should check for malloc failure

r328156: stand: Move sections around to fix stand/ build with ld.lld on
armv7

r328169: Remove extra copy of bootinfo.c. It's a bit rotted copy of the one
in efi/loader.

r328288: Fix some resource leaks.

r328289: Don't leak memory when displaying help.

r328290: On malloc failure, be sure to close the include file that triggered
it.

r328291: getenv does not return tainted data in the boot loader. Attempt to
clue Coverity into that fact.

r328292: There's no tainted data here, tag it as such to avoid false
positives.

r328411: loader.efi: add missing EFI GUIDs

r328536: loader: support for mixed-endianness ELF/loader and POWER8

r328603: Add missing non-POWERPC case to give the scr value something
non-zero.

r328614: Move libstand.3 to libsa.3. Update libsa.3 to include functions

r328642: Break out the interpreters (simple and forth) w/o ifdefs.

r328769: Centralize several variables.

r328779: Retire pnp.4th and the code needed only for 4th words used here.

r328780: These 4th words were an attempt to allow integration into the boot
loader scripts. However, that path won't be taken after all it
seems.

r328781: Remove pcibios forth support.

r328782: Now that we no longer conditionally compile some files outside of
ficl

r328783: Invent new LDR_INTERP for the loader interpreter to use.

r328806: We need more heap space to properly load newer powerpc kernels.

r328808: Implement strcoll as strcmp.

r328826: Make cross-endian loader changes apply only to powerpc

r328835: Fix regression introduced in r328806, preventing boot on many
platforms.

r328911: Ignore relocation tables for non-memory-resident sections.

r328986: Fix relative location of USB sources after recent move.

r328987: A more definitions to kernel emulation shim in order to build
stand/usb.

r328990: Move the stand/usb test loader into its own directory.

r328999: Fix indentation to FreeBSD standard for interp files

r329000: Move simple interpreter 'perform' into interp.c and call it

r329019: Move to tabs for indentation and to 8-space notches, per style(9).

r329050: Fix build of userboot.so

r329054: Set script.lang in the environment to either 'forth' or 'simple' to
reflect what scripting language was compiled into the loader.

r329060: loader: fix endianness conversion

PR: 225323

MFC Loader Fixes 2017q4p7: r324844,r326089,r326926,r326440,r326484,r326494,
r326588,r326708,r326784,r326914,r327390,r328446,r326090,r326143,r326144,
r326182,r326384,r326421,r326440,r326441,r326442,r326443,r326444,r326445,
r326446,r326447,r326448,r326484,r326485,r326486,r326487,r326488,r326490,
r326491,r326492,r326493,r326494,r326495,r326504,r326507,r326509,r326584,
r326585,r326586,r326587,r326588,r326589,r326590,r326591,r326592,r326593,
r326594,r326600,r326616,r326671,r326707,r326708,r326709,r326710,r326711,
r326712,r326714,r326720,r326768,r326772,r326784,r326792,r326812,r326854,
r326855,r326856,r326858,r326886,r326887,r326914,r326926,r326927,r326960,
r326961,r326962,r326963,r327351,r327453,r327390,r327523,r327524,r326489,
r327880,r328437,r328438,r328439,r328441,r328446,r328448,r328449,r328612,
r328613,r328615

While here, undo our libfdt hack of not including <stdlib.h> if we're
compiling _STANDALONE.

r324844: When building standalone, don't define errno. Let the definition from
stand.h override. This is similar to what we do in the kernel.

r326089: loader.efi: efipart does not recognize partitionless disks

r326090: net_parse_rootpath() has no parameters

r326143: Fix theoretical integer overflow issues. If the product here is

r326144: Mark the func pointer as __dead2. It looks up loader_main, which

r326182: Modify all FreeBSD bootloaders on PowerPC AIM (Book-S) systems

r326384: Use const pointers to avoid casting away constness.

r326421: loader.efi: efipart should exclude iPXE stub block protocol

r326440: Remove stale dependency on ufsread.c

r326441: Minor flags cleanup

r326442: Cleanup CFALGS usage here

r326443: We don't need both _STAND and _STANDALONE, use the latter.

r326444: Move geli to common DO32 stuff

r326445: Fix random() and srandom() prototypes to match the standard.

r326446: Undefine _STANDALONE since this is test code.

r326447: Tweaks to the beri boot loader so that it builds w/o warnings.

r326448: Fix all warnings related to geli and ZFS support on x86.

r326484: Const poison the propname.

r326485: Delcare md_load in libofw.h. Make all prototypes match for ofw

r326486: Include machine/md_var to pick up __syncicache prototype.

r326487: Cast mdp (a vm_offset_t) to void * to match prototype.

r326488: e_entry can be smaller than a pointer. Cast it to an intptr_t

r326490: Declare our strange brand of main().

r326491: Disconnet ps3 from the build. There's too many warnings to fix.

r326492: Cast void * pointer to char * so the arg matches the %s format.

r326493: Provide a md_load64 prototype.

r326494: Mark two things as unused (since they are only sometimes used)

r326495: Now it's safe to bump WARNS to 1.

r326504: Switch to proper MK_LOADER_GELI tests.

r326507: increase maximum size of zfsboot

r326509: loader.efi: add note about iPXE into the efipart.c

r326584: When building standalone, include stand.h rather than the kernel

r326585: Include ficl.h before anything else

r326586: No need to include the userland md5.h, the kernel one is just fine.

r326587: Use the kernel relative paths, rather than the userland relative
paths

r326588: Need to include skein in the include path

r326589: Make sure we include the right path for skein.h

r326590: Prefer stdint.h to inttypes.h

r326591: This isn't NetBSD specific code. Include these for any kernel /

r326592: Don't inherit CFLAGS. This a specialized test program.

r326593: Stop building with the standard system headers.

r326594: Now that we offer a semi-sane standards-ish set of #include files,
stop hacking includes with sed.

r326600: Since this is contrib code, create an upstreamable version of my

r326616: dhcp_try_rfc1048() is not used any more

r326671: Avoid setting -Wno-tentative-definition-incomplete-type with gcc.

r326707: Add partial support signal.h functioanlity. Pull in
machine/signal.h

r326708: Remove _KERNEL hack now that errno.h does the right thing when
built standalone.

r326709: Provide implementations for iscntrl, ispunct and isgraph.

r326710: Put the files we're copying over into a few variables and clean
hings up.

r326711: Const poison a couple of interfaces.

r326712: Create interp class.

r326714: boot1.c needs EFI_ZFS_BOOT too, so add it globally.

r326720: This path belongs in ficl/Makefile, not the common defines for
users

r326768: Fix a comment to be more accurate

r326772: Fix regression with lua import

r326784: Revert part of 362772. It was causing problems for includes

r326792: Attempt to unbreak buildworld

r326812: Revert r326792, r326784, r326772, r326712

r326854: libefi: make efichar.h more usable in stand code

r326855: Cargo cut a fix for the regressions r326585 caused.

r326856: Fix comments after bump in size.

r326858: Revert r326855: Cargo cut a fix for the regressions r326585 caused.

r326886: Panic in sbrk if setheap hasn't been called yet. This is preferable
o a mysterious crash

r326887: Remove the 'mini libstand in libstand' that util.[ch] provided.

r326914: Move loader-only defines to loader.mk from defs.mk

r326926: Move loader help file definitions to being 100% inside of
loader.mk.

r326927: libficl is only ever used in a loader (never a boot) program. Move
it.

r326960: Simplify things a little. The RETURN macro isn't required.

r326961: Interact is always called with NULL. Simplify code a little

r326962: Hoist btx include stuff to i386/Makefile.inc

r326963: No need to use relative paths like this here.

r327351: Fix ubldr. uboot/lib uses defines for the loader.

r327453: Add a validbcd() routine that uses the bcd2bin_data[] array

r327390: Garbage-collect loader.ps3. It is currently disconnected from the
build and kboot replaces.

r327523: Don't clobber system LDFLAGS for beri boot loaders.

r327524: Use 'extern uint8_t' instead of 'extern void' for external symbols.

r326489: Allow this file to be used in libsa without warning...

r327880: Move getsecs() prototype to stand.h from net.h so it can be used

r328437: Split panic routine

r328438: Implement abort() as a call to panic.

r328439: Provide abs form stdlib.h.

r328441: abort() should be marked __dead2 since it won't return.

r328446: Now that exit is __dead2, we need to tag ub_exit() as __dead2.

r328448: Make exit() never return until host_exit can be written.

r328449: Tag unreachable places as such. I left the while (1); in place

r328612: Move strtold wrapper from strtol.c to its own strtold.c.

r328613: Kill copies of strtol and strtoul.

r328615: Update stand.h for changes for strto*l

PR: 223969

MFC r325834,r325997,326502: Move sys/boot to stand/

This is effectively a direct commit to stable/11, due to differences between
stable/11 and head. Changes to DTS in sys/boot/fdt/dts were often
accompanied by kernel changes. Many of these were also risc-v updates that
likely had many more dependencies to MFC.

Because of this, sys/boot/fdt/dts remains as-is while everything else in
sys/boot relocates to stand/.

r325834: Move sys/boot to stand. Fix all references to new location

r325997: Remove empty directories.

r326502: Document the sys/boot -> stand move in hier.7 and the top-level README.

MFC Loader Fixes 2017q4p6: r324649,r324650,r324651,r324652,r324653,r324654,
r324700,r324702,r324709,r324717,r324719,r324841,r324842,r324843,r324845,
r324850,r324876,r324877,r324878,r324879,r324880,r324881,r324883,r324980,
r324981,r324982,r324995,r325014,r325093,r325094,r325114,r325170,r325171,
r325172,r325173,r325174,r325175,r325176,r325248,r325286,r325310,r325332,
r325338,r325339,r325376,r325377,r325379,r325380,r325382,r325478,r325479,
r325480,r325482,r325483,r325484,r325485,r325556,r325641,r325681,r325685,
r325686,r325687,r325688,r325689,r325690,r325691,r325692,r325693,r325694,
r325743,r325744,r325748,r325775,r325779,r325780

r324649: Move common/Makefile.inc to sys/boot/loader.mk.

r324650: tweak style

r324651: create defs.mk for common definitions

r324652: Move all the ficl common code into ficl.mk

r324653: LOADER_foo_SUPPORTED

r324654: Explicitly inlcude SYSDIR in the include path

r324700: loader: initialize dv_cleanup in md.c to eliminate clang warning

r324702: We need to include disk.o in libuboot.a when we're building with
support for disk access.

r324709: Revert "Unify boot1 with loader" change r324646

r324717: libsa/ip.c: misplaced comment, ip_v is half char, not ip_p

r324719: libsa/ip: stop read loop on bad fragments

r324841: Use BOOTDIR more consistently in defs.mk rather than repeat
sys/boot.

r324842: Introduce BOOTOBJ: The top level object directory for the boot tree

r324843: Stopgap fix to the mistmatch between LOADER_GELI_SUPPORT and
LOADER_NO_GELI_SUPPORT.

r324845: Use BOOTOBJ and BOOTDIR to find geli includes and libraries.

r324850: Define LIBSA32 to LIBSA on i386 to fix build.

r324876: Move fdt and uboot defines into common uboot.mk.

r324877: End source directories with SRC rather than a hodgepodge of names

r324878: Make at91 boot loader compile again.

r324879: Prefer SRCTOP paths for bits we're grabbing from libc.

r324880: Use BOOTSRC here.

r324881: Use SYSDIR instead of ${.CURDIR}/../..<etc>/sys.

r324883: Use preferred defined paths, rather than relative paths in fdt.

r324980: Use BOOTDIR consistently.

r324981: Move BINDIR definition to defs.mk, and override where it isn't
/boot

r324982: Remove sys/boot/arm/at91 and ixp425

r324995: loader.efi: Make framebuffer commands available for arm64

r325014: Add a 'place holder' arm struct efi_fb until a real one comes

r325093: Define new EFI variables

r325094: Cleanup non-arch Makefiles

r325114: Use defs.mk defins in most MD code

r325170: Use defs.mk values for userboot

r325171: Use defs.mk name and prefer bsd.init.mk

r325172: Remove the -nostdlib stuff I added. Instead, fix LDFLAGS to be
honored correctly with the new Makefile.inc include order.

r325173: We don't need to build a special ficl for userboot.

r325174: Minor cleanup

r325175: For amd64, compile both zfs and zfs32 libraries.

r325176: Actually add zfs32/Makefile

r325248: loader ptblread() is broken with >512B sectors

r325286: efipart_strategy is using wrong offset with >512B sectors

r325310: zfs.c:vdev_read() needs to be careful about large sectors

r325332: loader: re-enable gzip support for x86

r325338: loader: fix BOOTSRC -> BOOTOBJ in a library path

r325339: This used to have bzip2 support too.

r325376: WIP: centralize machine links

r325377: mostly libsa

r325379: Revert "mostly libsa"

r325380: Revert "WIP: centralize machine links"

r325382: Cleanup stray libstand names to be libsa names.

r325478: Powerpc is a 32-bit boot loader.

r325479: Define LIBFICL32 to be libficl.a on i386 and libficl32.a on amd64.

r325480: Use DO32 for all the places that we need to flag we're building a
32-bit version of a library.

r325482: Move machine and other link creation to defs.mk

r325483: MACHINE can never be powerpc64, so cleanup code that thinks it can.

r325484: Prefer bsd.init.mk to src.opts.mk

r325485: Centralize all 32-bit builds on 64-bit platform stuff.

r325556: loader: set options before including bsd.init.mk

r325641: loader.efi: efi_devpath_is_prefix should return bool

r325681: boot1: avoid using NULL device path

r325685: libsa32 isn't needed for i386. It's already a 32-bit platform.

r325686: Simplify this if to a direct assignment.

r325687: Remove all the empty help files from the powerpc build.

r325688: FDT support doesn't make sense for ps3, remove it.

r325689: Remove LOADER_FDT_SUPPORT as a Makefile variable.

r325690: Remove LOADER_ZFS_SUPPORT as a Makefile variable

r325691: Remove useless PNP define here.

r325692: Replace LOADER_FIREWIRE_SUPPORT variable

r325693: Move LOADER_{NO,}_GELI_SUPPORT to MK_LOADER_GELI

r325694: Install the 4th files in sys/boot/forth instead of each loader

r325743: Make sure the proper loader.rc gets installed.

r325744: boot1: also check for NULL device

r325748: Use proper include file.

r325775: Add loader.conf to the list of files that are MD.

r325779: Add /boot/dts to the list of default modules.

r325780: Don't add /boot/dt*s* but /boot/dt*b*. Stupid think-o.

Fix paths after r329132

This is a direct commit to stable/11 due to svn's handling of merging this
move being less than ideal.

MFC Loader Fixes 2017q4p5: r324557,r324558,r324559,r324646,r324647

r324557: Rename exit to efi_exit to avoid clashing with libsa exit
definition

r324558: Define prototype for exit and ensure references

r324559: Move panic back into libsa. It's documented in libstand(3) to
belong there.

r324646: Unify boot1 with loader.

r324647: Move orphaned man pages into new man directory from common.

MFC Loader Fixes 2017q4p4: r324552,r324553,r324554,r324555,r324556

r324552: Kill the userboot copy of libstand.

r324553: Rename libstand.a to libsa.a and libstand32.a to libsa32.a

r324554: Move crc32.c, util.c and gpt.c over to libsa.

r324555: Honor CFLAGS modifications in Makefile.inc by using += here.

r324556: Move ufsread.c

MFC r324551: Move lib/libstand to sys/boot/libsa

MFC Loader Fixes 2017q4p2: r324453, r324454

r324453: Create sys/boot/libsa and build libstand.a there

r324454: Disconnect libstand from the build.

Create sys/boot/libsa and build libstand.a there

Build libstand from inside the sys/boot build. Redirect all users in
sys/boot to grab it from there. We still build it as libstand.a for
the moment. When lib/libstand is moved here, we'll change the name.

Sponsored by: Netflix