7 files changed, 103 insertions, 49 deletions

diff --git a/contrib/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h b/contrib/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h
index 1a9805332398..d66ded6004bf 100644
--- a/contrib/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h
+++ b/contrib/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h
@@ -78,10 +78,9 @@ namespace __sanitizer {
 #elif defined(__powerpc64__)
   const unsigned struct_kernel_stat_sz = 144;
   const unsigned struct_kernel_stat64_sz = 104;
-#elif defined(__riscv)
-  /* RISCVTODO: check that these values are correct */
+#elif defined(__riscv) && __riscv_xlen == 64
   const unsigned struct_kernel_stat_sz = 128;
-  const unsigned struct_kernel_stat64_sz = 128;
+  const unsigned struct_kernel_stat64_sz = 104;
 #elif defined(__mips__)
   const unsigned struct_kernel_stat_sz =
                  SANITIZER_ANDROID ? FIRST_32_SECOND_64(104, 128) :
diff --git a/contrib/elftoolchain/cxxfilt/cxxfilt.c b/contrib/elftoolchain/cxxfilt/cxxfilt.c
index 9a051fb4151c..21535ff21d5a 100644
--- a/contrib/elftoolchain/cxxfilt/cxxfilt.c
+++ b/contrib/elftoolchain/cxxfilt/cxxfilt.c
@@ -25,6 +25,8 @@
  */
 
 #include <sys/param.h>
+
+#include <capsicum_helpers.h>
 #include <ctype.h>
 #include <err.h>
 #include <getopt.h>
@@ -165,6 +167,11 @@ main(int argc, char **argv)
 	argv += optind;
 	argc -= optind;
 
+	if (caph_limit_stdio() < 0)
+		err(EXIT_FAILURE, "failed to limit stdio rights");
+	if (caph_enter() < 0)
+		err(EXIT_FAILURE, "failed to enter capability mode");
+
 	if (*argv != NULL) {
 		for (n = 0; n < argc; n++) {
 			if ((dem = demangle(argv[n])) == NULL)
diff --git a/contrib/elftoolchain/elfcopy/binary.c b/contrib/elftoolchain/elfcopy/binary.c
index 64a851d96b05..a83992d2459b 100644
--- a/contrib/elftoolchain/elfcopy/binary.c
+++ b/contrib/elftoolchain/elfcopy/binary.c
@@ -49,22 +49,24 @@ create_binary(int ifd, int ofd)
 	Elf *e;
 	Elf_Scn *scn;
 	Elf_Data *d;
+	Elf64_Addr baseaddr;
 	GElf_Shdr sh;
-	off_t base, off;
+	off_t baseoff, off;
 	int elferr;
 
 	if ((e = elf_begin(ifd, ELF_C_READ, NULL)) == NULL)
 		errx(EXIT_FAILURE, "elf_begin() failed: %s",
 		    elf_errmsg(-1));
 
-	base = 0;
-	if (lseek(ofd, base, SEEK_SET) < 0)
+	baseaddr = 0;
+	baseoff = 0;
+	if (lseek(ofd, baseoff, SEEK_SET) < 0)
 		err(EXIT_FAILURE, "lseek failed");
 
 	/*
 	 * Find base offset in the first iteration.
 	 */
-	base = -1;
+	baseoff = -1;
 	scn = NULL;
 	while ((scn = elf_nextscn(e, scn)) != NULL) {
 		if (gelf_getshdr(scn, &sh) == NULL) {
@@ -76,14 +78,16 @@ create_binary(int ifd, int ofd)
 		    sh.sh_type == SHT_NOBITS ||
 		    sh.sh_size == 0)
 			continue;
-		if (base == -1 || (off_t) sh.sh_offset < base)
-			base = sh.sh_offset;
+		if (baseoff == -1 || (off_t) sh.sh_offset < baseoff) {
+			baseoff = sh.sh_offset;
+			baseaddr = sh.sh_addr;
+		}
 	}
 	elferr = elf_errno();
 	if (elferr != 0)
 		warnx("elf_nextscn failed: %s", elf_errmsg(elferr));
 
-	if (base == -1)
+	if (baseoff == -1)
 		return;
 
 	/*
@@ -110,8 +114,8 @@ create_binary(int ifd, int ofd)
 		if (d->d_buf == NULL || d->d_size == 0)
 			continue;
 
-		/* lseek to section offset relative to `base'. */
-		off = sh.sh_offset - base;
+		/* lseek to section offset relative to `baseaddr'. */
+		off = sh.sh_addr - baseaddr;
 		if (lseek(ofd, off, SEEK_SET) < 0)
 			err(EXIT_FAILURE, "lseek failed");
 
diff --git a/contrib/elftoolchain/nm/nm.c b/contrib/elftoolchain/nm/nm.c
index 33ab44295c77..ec8cde6f0670 100644
--- a/contrib/elftoolchain/nm/nm.c
+++ b/contrib/elftoolchain/nm/nm.c
@@ -29,6 +29,7 @@
 #include <sys/stat.h>
 #include <ar.h>
 #include <assert.h>
+#include <capsicum_helpers.h>
 #include <ctype.h>
 #include <dwarf.h>
 #include <err.h>
@@ -46,6 +47,9 @@
 #include <strings.h>
 #include <unistd.h>
 
+#include <libcasper.h>
+#include <casper/cap_fileargs.h>
+
 #include "_elftc.h"
 
 ELFTC_VCSID("$Id: nm.c 3504 2016-12-17 15:33:16Z kaiwang27 $");
@@ -165,6 +169,8 @@ struct nm_prog_options {
 
 	fn_sym_print		value_print_fn;
 	fn_sym_print		size_print_fn;
+
+	fileargs_t		*fileargs;
 };
 
 #define	CHECK_SYM_PRINT_DATA(p)	(p->headp == NULL || p->sh_num == 0 ||	      \
@@ -177,9 +183,10 @@ static int		cmp_name(const void *, const void *);
 static int		cmp_none(const void *, const void *);
 static int		cmp_size(const void *, const void *);
 static int		cmp_value(const void *, const void *);
+static void		enter_cap_mode(int, char **);
 static void		filter_dest(void);
 static int		filter_insert(fn_filter);
-static void		get_opt(int, char **);
+static void		get_opt(int *, char ***);
 static int		get_sym(Elf *, struct sym_head *, int, size_t, size_t,
 			    const char *, const char **, int);
 static const char *	get_sym_name(Elf *, const GElf_Sym *, size_t,
@@ -393,6 +400,36 @@ cmp_value(const void *lp, const void *rp)
 }
 
 static void
+enter_cap_mode(int argc, char **argv)
+{
+	cap_rights_t rights;
+	fileargs_t *fa;
+	char *defaultfn;
+
+	cap_rights_init(&rights, CAP_FSTAT, CAP_MMAP_R);
+
+	if (argc == 0) {
+		defaultfn = strdup(nm_info.def_filename);
+		if (defaultfn == NULL)
+			err(EXIT_FAILURE, "strdup");
+		argc = 1;
+		argv = &defaultfn;
+	}
+
+	fa = fileargs_init(argc, argv, O_RDONLY, 0, &rights, FA_OPEN);
+	if (fa == NULL)
+		err(EXIT_FAILURE, "failed to initialize fileargs");
+
+	caph_cache_catpages();
+	if (caph_limit_stdio() < 0)
+		err(EXIT_FAILURE, "failed to limit stdio rights");
+	if (caph_enter_casper() < 0)
+		err(EXIT_FAILURE, "failed to enter capability mode");
+
+	nm_opts.fileargs = fa;
+}
+
+static void
 filter_dest(void)
 {
 	struct filter_entry *e;
@@ -441,18 +478,18 @@ parse_demangle_option(const char *opt)
 }
 
 static void
-get_opt(int argc, char **argv)
+get_opt(int *argc, char ***argv)
 {
 	int ch;
 	bool is_posix, oflag;
 
-	if (argc <= 0 || argv == NULL)
+	if (*argc <= 0 || *argv == NULL)
 		return;
 
 	oflag = is_posix = false;
 	nm_opts.t = RADIX_HEX;
-	while ((ch = getopt_long(argc, argv, "ABCDF:PSVaefghlnoprst:uvx",
-		    nm_longopts, NULL)) != -1) {
+	while ((ch = getopt_long(*argc, *argv, "ABCDF:PSVaefghlnoprst:uvx",
+	    nm_longopts, NULL)) != -1) {
 		switch (ch) {
 		case 'A':
 			nm_opts.print_name = PRINT_NAME_FULL;
@@ -573,6 +610,8 @@ get_opt(int argc, char **argv)
 			usage(1);
 		}
 	}
+	*argc -= optind;
+	*argv += optind;
 
 	/*
 	 * In POSIX mode, the '-o' option controls the output radix.
@@ -764,6 +803,7 @@ global_init(void)
 	nm_opts.elem_print_fn = &sym_elem_print_all;
 	nm_opts.value_print_fn = &sym_value_dec_print;
 	nm_opts.size_print_fn = &sym_size_dec_print;
+	nm_opts.fileargs = NULL;
 	SLIST_INIT(&nm_out_filter);
 }
 
@@ -1467,7 +1507,7 @@ read_object(const char *filename)
 
 	assert(filename != NULL && "filename is null");
 
-	if ((fd = open(filename, O_RDONLY)) == -1) {
+	if ((fd = fileargs_open(nm_opts.fileargs, filename)) == -1) {
 		warn("'%s'", filename);
 		return (1);
 	}
@@ -2115,8 +2155,9 @@ main(int argc, char **argv)
 	int rtn;
 
 	global_init();
-	get_opt(argc, argv);
-	rtn = read_files(argc - optind, argv + optind);
+	get_opt(&argc, &argv);
+	enter_cap_mode(argc, argv);
+	rtn = read_files(argc, argv);
 	global_dest();
 
 	exit(rtn);
diff --git a/contrib/ipfilter/man/ippool.8 b/contrib/ipfilter/man/ippool.8
index 9e39f297dd67..ea9664c37d6c 100644
--- a/contrib/ipfilter/man/ippool.8
+++ b/contrib/ipfilter/man/ippool.8
@@ -9,7 +9,7 @@ ippool \- user interface to the IPFilter pools
 -a [-dnv] [-m <name>] [-o <role>] [-t <type>] [-T ttl] -i <ipaddr>[/<netmask>]
 .br
 .B ippool
--A [-dnv] [-m <name>] [-o <role>] [-S <seed>] [-t <type>]
+-A [-dnv] [-m <name>] [-o <role>] [-S <seed>] -t <type>
 .br
 .B ippool
 -f <file> [-dnuv]
@@ -96,11 +96,8 @@ retrieving statistical information.
 .TP
 .B -o <role>
 Sets the role with which this pool is to be used.  Currently only
-.B ipf,
-.B auth
-and
-.B count
-are accepted as arguments to this option.
+.B ipf
+(the default) is accepted as arguments to this option.
 .TP
 .B -S <seed>
 Sets the hashing seed to the number specified.  Only for use with
@@ -108,7 +105,7 @@ Sets the hashing seed to the number specified.  Only for use with
 type pools.
 .TP
 .B -t <type>
-Sets the type of pool being defined.  Myst be one of
+Sets the type of pool being defined.  Must be one of
 .B tree,
 .B hash,
 .B group-map.
diff --git a/contrib/ipfilter/tools/ippool.c b/contrib/ipfilter/tools/ippool.c
index 01d8fe236e5a..4785d65c8db4 100644
--- a/contrib/ipfilter/tools/ippool.c
+++ b/contrib/ipfilter/tools/ippool.c
@@ -145,7 +145,7 @@ poolnodecommand(remove, argc, argv)
 	bzero((char *)&pnode, sizeof(pnode));
 	bzero((char *)&hnode, sizeof(hnode));
 
-	while ((c = getopt(argc, argv, "di:m:no:Rt:T:v")) != -1)
+	while ((c = getopt(argc, argv, "di:m:no:t:T:v")) != -1)
 		switch (c)
 		{
 		case 'd' :
@@ -172,9 +172,6 @@ poolnodecommand(remove, argc, argv)
 			if (role == IPL_LOGNONE)
 				return -1;
 			break;
-		case 'R' :
-			opts |= OPT_NORESOLVE;
-			break;
 		case 't' :
 			if (ipset == 1) {
 				fprintf(stderr,
@@ -260,7 +257,7 @@ poolcommand(remove, argc, argv)
 	char *argv[];
 {
 	int type, role, c, err;
-	char *poolname;
+	char *poolname, *typearg = NULL;
 	iphtable_t iph;
 	ip_pool_t pool;
 
@@ -272,7 +269,7 @@ poolcommand(remove, argc, argv)
 	bzero((char *)&iph, sizeof(iph));
 	bzero((char *)&pool, sizeof(pool));
 
-	while ((c = getopt(argc, argv, "dm:no:RS:v")) != -1)
+	while ((c = getopt(argc, argv, "dm:no:S:vt:")) != -1)
 		switch (c)
 		{
 		case 'd' :
@@ -292,15 +289,16 @@ poolcommand(remove, argc, argv)
 				return -1;
 			}
 			break;
-		case 'R' :
-			opts |= OPT_NORESOLVE;
-			break;
 		case 'S' :
 			if (remove == 0)
 				iph.iph_seed = atoi(optarg);
 			else
 				usage(argv[0]);
 			break;
+		case 't' :
+			type = gettype(optarg, &iph.iph_type);
+			typearg = optarg;
+			break;
 		case 'v' :
 			opts |= OPT_VERBOSE;
 			break;
@@ -320,17 +318,22 @@ poolcommand(remove, argc, argv)
 		return -1;
 	}
 
-	type = gettype(argv[optind], &iph.iph_type);
-	if (type == IPLT_NONE) {
-		fprintf(stderr, "unknown type '%s'\n", argv[optind]);
+	if (type == IPLT_NONE && remove == 0) {
+		if (typearg == NULL) {
+			fprintf(stderr, "type must be specified\n");
+			usage(argv[0]);
+		} else {
+			fprintf(stderr, "unknown type '%s'\n", typearg);
+		}
 		return -1;
 	}
 
-	if (type == IPLT_HASH) {
+	if (type == IPLT_HASH || (type == IPLT_NONE && remove == 1)) {
 		strncpy(iph.iph_name, poolname, sizeof(iph.iph_name));
 		iph.iph_name[sizeof(iph.iph_name) - 1] = '\0';
 		iph.iph_unit = role;
-	} else if (type == IPLT_POOL) {
+	}
+	if (type == IPLT_POOL || (type == IPLT_NONE && remove == 1)) {
 		strncpy(pool.ipo_name, poolname, sizeof(pool.ipo_name));
 		pool.ipo_name[sizeof(pool.ipo_name) - 1] = '\0';
 		pool.ipo_unit = role;
@@ -355,6 +358,16 @@ poolcommand(remove, argc, argv)
 		case IPLT_POOL :
 			err = remove_pool(&pool, ioctl);
 			break;
+		case IPLT_NONE :
+			err = 1;
+			{
+				int err_h, err_p;
+				err_h = remove_hash(&iph, ioctl);
+				err_p = remove_pool(&pool, ioctl);
+				if (err_h == 0 || err_p == 0)
+					err = 0;
+			}
+			break;
 		}
 	}
 	return err;
@@ -368,7 +381,7 @@ loadpoolfile(argc, argv, infile)
 {
 	int c;
 
-	while ((c = getopt(argc, argv, "dnRuv")) != -1)
+	while ((c = getopt(argc, argv, "dnuv")) != -1)
 		switch (c)
 		{
 		case 'd' :
@@ -378,9 +391,6 @@ loadpoolfile(argc, argv, infile)
 		case 'n' :
 			opts |= OPT_DONOTHING|OPT_DONTOPEN;
 			break;
-		case 'R' :
-			opts |= OPT_NORESOLVE;
-			break;
 		case 'u' :
 			opts |= OPT_REMOVE;
 			break;
diff --git a/contrib/netbsd-tests/lib/libc/sys/t_mmap.c b/contrib/netbsd-tests/lib/libc/sys/t_mmap.c
index f8f4caa36d80..b62c6299d3c2 100644
--- a/contrib/netbsd-tests/lib/libc/sys/t_mmap.c
+++ b/contrib/netbsd-tests/lib/libc/sys/t_mmap.c
@@ -480,10 +480,6 @@ ATF_TC_BODY(mmap_truncate_signal, tc)
 	int fd, sta;
 	pid_t pid;
 
-#ifdef __FreeBSD__
-	atf_tc_expect_fail("testcase fails with SIGSEGV on FreeBSD; bug # 211924");
-#endif
-
 	fd = open(path, O_RDWR | O_CREAT, 0700);
 
 	if (fd < 0)