Update to FreeBSD stable/12 2019-03-27

Git mirror commit 43a38f188ca2e936ec78104c30ea3e24d9c1606b.

33 files changed, 781 insertions, 69 deletions

diff --git a/freebsd-org b/freebsd-org
-Subproject 735fe7a0a5f9c265040e2e6654a01b081d6354f
+Subproject 43a38f188ca2e936ec78104c30ea3e24d9c1606
diff --git a/freebsd/sbin/ifconfig/af_inet.c b/freebsd/sbin/ifconfig/af_inet.c
index 960b800f..6e09c21c 100644
--- a/freebsd/sbin/ifconfig/af_inet.c
+++ b/freebsd/sbin/ifconfig/af_inet.c
@@ -119,16 +119,16 @@ in_status(int s __unused, const struct ifaddrs *ifa)
 			if (cidr == 0)
 				break;
 		}
-		printf("/%d ", cidr);
+		printf("/%d", cidr);
 	} else if (f_inet != NULL && strcmp(f_inet, "dotted") == 0)
-		printf(" netmask %s ", inet_ntoa(sin->sin_addr));
+		printf(" netmask %s", inet_ntoa(sin->sin_addr));
 	else
-		printf(" netmask 0x%lx ", (unsigned long)ntohl(sin->sin_addr.s_addr));
+		printf(" netmask 0x%lx", (unsigned long)ntohl(sin->sin_addr.s_addr));
 
 	if (ifa->ifa_flags & IFF_BROADCAST) {
 		sin = (struct sockaddr_in *)ifa->ifa_broadaddr;
 		if (sin != NULL && sin->sin_addr.s_addr != 0)
-			printf("broadcast %s ", inet_ntoa(sin->sin_addr));
+			printf(" broadcast %s", inet_ntoa(sin->sin_addr));
 	}
 
 	print_vhid(ifa, " ");
diff --git a/freebsd/sbin/ifconfig/af_inet6.c b/freebsd/sbin/ifconfig/af_inet6.c
index cae6c326..b95bc72b 100644
--- a/freebsd/sbin/ifconfig/af_inet6.c
+++ b/freebsd/sbin/ifconfig/af_inet6.c
@@ -259,49 +259,49 @@ in6_status(int s __unused, const struct ifaddrs *ifa)
 	if (sin == NULL)
 		sin = &null_sin;
 	if (f_inet6 != NULL && strcmp(f_inet6, "cidr") == 0)
-		printf("/%d ", prefix(&sin->sin6_addr,
+		printf("/%d", prefix(&sin->sin6_addr,
 			sizeof(struct in6_addr)));
 	else
-		printf(" prefixlen %d ", prefix(&sin->sin6_addr,
+		printf(" prefixlen %d", prefix(&sin->sin6_addr,
 			sizeof(struct in6_addr)));
 
 	if ((flags6 & IN6_IFF_ANYCAST) != 0)
-		printf("anycast ");
+		printf(" anycast");
 	if ((flags6 & IN6_IFF_TENTATIVE) != 0)
-		printf("tentative ");
+		printf(" tentative");
 	if ((flags6 & IN6_IFF_DUPLICATED) != 0)
-		printf("duplicated ");
+		printf(" duplicated");
 	if ((flags6 & IN6_IFF_DETACHED) != 0)
-		printf("detached ");
+		printf(" detached");
 	if ((flags6 & IN6_IFF_DEPRECATED) != 0)
-		printf("deprecated ");
+		printf(" deprecated");
 	if ((flags6 & IN6_IFF_AUTOCONF) != 0)
-		printf("autoconf ");
+		printf(" autoconf");
 	if ((flags6 & IN6_IFF_TEMPORARY) != 0)
-		printf("temporary ");
+		printf(" temporary");
 	if ((flags6 & IN6_IFF_PREFER_SOURCE) != 0)
-		printf("prefer_source ");
+		printf(" prefer_source");
 
 	if (((struct sockaddr_in6 *)(ifa->ifa_addr))->sin6_scope_id)
-		printf("scopeid 0x%x ",
+		printf(" scopeid 0x%x",
 		    ((struct sockaddr_in6 *)(ifa->ifa_addr))->sin6_scope_id);
 
 	if (ip6lifetime && (lifetime.ia6t_preferred || lifetime.ia6t_expire)) {
-		printf("pltime ");
+		printf(" pltime");
 		if (lifetime.ia6t_preferred) {
-			printf("%s ", lifetime.ia6t_preferred < now.tv_sec
+			printf(" %s", lifetime.ia6t_preferred < now.tv_sec
 			    ? "0" :
 			    sec2str(lifetime.ia6t_preferred - now.tv_sec));
 		} else
-			printf("infty ");
+			printf(" infty");
 
-		printf("vltime ");
+		printf(" vltime");
 		if (lifetime.ia6t_expire) {
-			printf("%s ", lifetime.ia6t_expire < now.tv_sec
+			printf(" %s", lifetime.ia6t_expire < now.tv_sec
 			    ? "0" :
 			    sec2str(lifetime.ia6t_expire - now.tv_sec));
 		} else
-			printf("infty ");
+			printf(" infty");
 	}
 
 	print_vhid(ifa, " ");
diff --git a/freebsd/sbin/ifconfig/ifconfig.c b/freebsd/sbin/ifconfig/ifconfig.c
index dad7ace8..c0907866 100644
--- a/freebsd/sbin/ifconfig/ifconfig.c
+++ b/freebsd/sbin/ifconfig/ifconfig.c
@@ -1490,7 +1490,7 @@ print_vhid(const struct ifaddrs *ifa, const char *s)
 	if (ifd->ifi_vhid == 0)
 		return;
 	
-	printf("vhid %d ", ifd->ifi_vhid);
+	printf(" vhid %d", ifd->ifi_vhid);
 }
 
 void
diff --git a/freebsd/sbin/ifconfig/ifgroup.c b/freebsd/sbin/ifconfig/ifgroup.c
index a487f060..fc1b826c 100644
--- a/freebsd/sbin/ifconfig/ifgroup.c
+++ b/freebsd/sbin/ifconfig/ifgroup.c
@@ -135,9 +135,9 @@ getifgroups(int s)
 		len -= sizeof(struct ifg_req);
 		if (strcmp(ifg->ifgrq_group, "all")) {
 			if (cnt == 0)
-				printf("\tgroups: ");
+				printf("\tgroups:");
 			cnt++;
-			printf("%s ", ifg->ifgrq_group);
+			printf(" %s", ifg->ifgrq_group);
 		}
 	}
 	if (cnt)
diff --git a/freebsd/sys/dev/rtwn/rtl8192c/r92c_reg.h b/freebsd/sys/dev/rtwn/rtl8192c/r92c_reg.h
index 2c494b49..c3def33e 100644
--- a/freebsd/sys/dev/rtwn/rtl8192c/r92c_reg.h
+++ b/freebsd/sys/dev/rtwn/rtl8192c/r92c_reg.h
@@ -148,6 +148,7 @@
 #define R92C_RD_RESP_PKT_TH		0x463
 #define R92C_INIRTS_RATE_SEL		0x480
 #define R92C_INIDATA_RATE_SEL(macid)	(0x484 + (macid))
+#define R92C_POWER_STATUS		0x4a4
 #define R92C_QUEUE_CTRL			0x4c6
 #define R92C_MAX_AGGR_NUM		0x4ca
 #define R92C_BAR_MODE_CTRL		0x4cc
diff --git a/freebsd/sys/dev/rtwn/rtl8192c/r92c_tx.c b/freebsd/sys/dev/rtwn/rtl8192c/r92c_tx.c
index a020c21f..36450e80 100644
--- a/freebsd/sys/dev/rtwn/rtl8192c/r92c_tx.c
+++ b/freebsd/sys/dev/rtwn/rtl8192c/r92c_tx.c
@@ -213,6 +213,12 @@ r92c_tx_setup_macid(void *buf, int id)
 	struct r92c_tx_desc *txd = (struct r92c_tx_desc *)buf;
 
 	txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, id));
+
+	/* XXX does not belong here */
+	/* XXX temporary (I hope) */
+	/* Force CCK1 for RTS / CTS frames (driver bug) */
+	txd->txdw4 &= ~htole32(SM(R92C_TXDW4_RTSRATE, R92C_TXDW4_RTSRATE_M));
+	txd->txdw4 &= ~htole32(R92C_TXDW4_RTS_SHORT);
 }
 
 void
diff --git a/freebsd/sys/dev/rtwn/rtl8192c/usb/r92cu_init.c b/freebsd/sys/dev/rtwn/rtl8192c/usb/r92cu_init.c
index 61dd1aa0..08259875 100644
--- a/freebsd/sys/dev/rtwn/rtl8192c/usb/r92cu_init.c
+++ b/freebsd/sys/dev/rtwn/rtl8192c/usb/r92cu_init.c
@@ -359,6 +359,8 @@ void
 r92cu_post_init(struct rtwn_softc *sc)
 {
 
+	rtwn_write_4(sc, R92C_POWER_STATUS, 0x5);
+
 	/* Perform LO and IQ calibrations. */
 	r92c_iq_calib(sc);
 	/* Perform LC calibration. */
diff --git a/freebsd/sys/dev/usb/quirk/usb_quirk.c b/freebsd/sys/dev/usb/quirk/usb_quirk.c
index 1f58aa21..6857c319 100644
--- a/freebsd/sys/dev/usb/quirk/usb_quirk.c
+++ b/freebsd/sys/dev/usb/quirk/usb_quirk.c
@@ -281,6 +281,7 @@ static struct usb_quirk_entry usb_quirks[USB_DEV_QUIRKS_MAX] = {
 	USB_QUIRK(IOMEGA, ZIP100, 0x0000, 0xffff, UQ_MSC_FORCE_WIRE_BBB,
 	    UQ_MSC_FORCE_PROTO_SCSI,
 	    UQ_MSC_NO_TEST_UNIT_READY), /* XXX ZIP drives can also use ATAPI */
+	USB_QUIRK(JMICRON, JMS566, 0x0000, 0xffff, UQ_MSC_NO_GETMAXLUN),
 	USB_QUIRK(JMICRON, JMS567, 0x0000, 0xffff, UQ_MSC_NO_GETMAXLUN),
 	USB_QUIRK(JMICRON, JM20337, 0x0000, 0xffff, UQ_MSC_FORCE_WIRE_BBB,
 	    UQ_MSC_FORCE_PROTO_SCSI,
@@ -565,6 +566,7 @@ static struct usb_quirk_entry usb_quirks[USB_DEV_QUIRKS_MAX] = {
 	USB_QUIRK(MAUDIO, FASTTRACKULTRA8R, 0x0000, 0xffff, UQ_AU_VENDOR_CLASS),
 	USB_QUIRK(CMEDIA, CM6206, 0x0000, 0xffff, UQ_AU_SET_SPDIF_CM6206),
 	USB_QUIRK(PLOYTEC, SPL_CRIMSON_1, 0x0000, 0xffff, UQ_CFG_INDEX_1),
+	USB_QUIRK(ROLAND, UA25EX_AD, 0x0000, 0xffff, UQ_AU_VENDOR_CLASS),
 
 	/*
 	 * Quirks for manufacturers which USB devices does not respond
diff --git a/freebsd/sys/dev/usb/wlan/if_urtw.c b/freebsd/sys/dev/usb/wlan/if_urtw.c
index 3a89160b..84f28d56 100644
--- a/freebsd/sys/dev/usb/wlan/if_urtw.c
+++ b/freebsd/sys/dev/usb/wlan/if_urtw.c
@@ -672,6 +672,7 @@ static void		urtw_scan_end(struct ieee80211com *);
 static void		urtw_getradiocaps(struct ieee80211com *, int, int *,
 			   struct ieee80211_channel[]);
 static void		urtw_set_channel(struct ieee80211com *);
+static void		urtw_update_promisc(struct ieee80211com *);
 static void		urtw_update_mcast(struct ieee80211com *);
 static int		urtw_tx_start(struct urtw_softc *,
 			    struct ieee80211_node *, struct mbuf *,
@@ -898,6 +899,7 @@ urtw_attach(device_t dev)
 	ic->ic_updateslot = urtw_updateslot;
 	ic->ic_vap_create = urtw_vap_create;
 	ic->ic_vap_delete = urtw_vap_delete;
+	ic->ic_update_promisc = urtw_update_promisc;
 	ic->ic_update_mcast = urtw_update_mcast;
 	ic->ic_parent = urtw_parent;
 	ic->ic_transmit = urtw_transmit;
@@ -1633,6 +1635,17 @@ fail:
 }
 
 static void
+urtw_update_promisc(struct ieee80211com *ic)
+{
+	struct urtw_softc *sc = ic->ic_softc;
+
+	URTW_LOCK(sc);
+	if (sc->sc_flags & URTW_RUNNING)
+		urtw_rx_setconf(sc);
+	URTW_UNLOCK(sc);
+}
+
+static void
 urtw_update_mcast(struct ieee80211com *ic)
 {
 
@@ -3879,7 +3892,6 @@ urtw_rx_setconf(struct urtw_softc *sc)
 	if (sc->sc_flags & URTW_RTL8187B) {
 		data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA |
 		    URTW_RX_FILTER_MCAST | URTW_RX_FILTER_BCAST |
-		    URTW_RX_FILTER_NICMAC | URTW_RX_CHECK_BSSID |
 		    URTW_RX_FIFO_THRESHOLD_NONE |
 		    URTW_MAX_RX_DMA_2048 |
 		    URTW_RX_AUTORESETPHY | URTW_RCR_ONLYERLPKT;
@@ -3894,14 +3906,6 @@ urtw_rx_setconf(struct urtw_softc *sc)
 		if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
 			data = data | URTW_RX_FILTER_CRCERR;
 
-		if (ic->ic_opmode == IEEE80211_M_MONITOR ||
-		    ic->ic_promisc > 0 || ic->ic_allmulti > 0) {
-			data = data | URTW_RX_FILTER_ALLMAC;
-		} else {
-			data = data | URTW_RX_FILTER_NICMAC;
-			data = data | URTW_RX_CHECK_BSSID;
-		}
-
 		data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
 		data = data | URTW_RX_FIFO_THRESHOLD_NONE |
 		    URTW_RX_AUTORESETPHY;
@@ -3909,6 +3913,16 @@ urtw_rx_setconf(struct urtw_softc *sc)
 		data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
 	}
 
+	/* XXX allmulti should not be checked here... */
+	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
+	    ic->ic_promisc > 0 || ic->ic_allmulti > 0) {
+		data = data | URTW_RX_FILTER_CTL;
+		data = data | URTW_RX_FILTER_ALLMAC;
+	} else {
+		data = data | URTW_RX_FILTER_NICMAC;
+		data = data | URTW_RX_CHECK_BSSID;
+	}
+
 	urtw_write32_m(sc, URTW_RX, data);
 fail:
 	return (error);
diff --git a/freebsd/sys/kern/uipc_socket.c b/freebsd/sys/kern/uipc_socket.c
index 37578ff4..77356b83 100644
--- a/freebsd/sys/kern/uipc_socket.c
+++ b/freebsd/sys/kern/uipc_socket.c
@@ -1199,7 +1199,6 @@ soabort(struct socket *so)
 	KASSERT(so->so_count == 0, ("soabort: so_count"));
 	KASSERT((so->so_state & SS_PROTOREF) == 0, ("soabort: SS_PROTOREF"));
 	KASSERT(so->so_state & SS_NOFDREF, ("soabort: !SS_NOFDREF"));
-	KASSERT(so->so_qstate == SQ_NONE, ("soabort: !SQ_NONE"));
 	VNET_SO_ASSERT(so);
 
 	if (so->so_proto->pr_usrreqs->pru_abort != NULL)
diff --git a/freebsd/sys/net/if_tun.c b/freebsd/sys/net/if_tun.c
index 328b1963..ee5c78b0 100644
--- a/freebsd/sys/net/if_tun.c
+++ b/freebsd/sys/net/if_tun.c
@@ -43,6 +43,7 @@
 #include <sys/uio.h>
 #include <sys/malloc.h>
 #include <sys/random.h>
+#include <sys/ctype.h>
 
 #include <net/if.h>
 #include <net/if_var.h>
@@ -107,6 +108,7 @@ struct tun_softc {
  * which is static after setup.
  */
 static struct mtx tunmtx;
+static eventhandler_tag tag;
 static const char tunname[] = "tun";
 static MALLOC_DEFINE(M_TUN, tunname, "Tunnel Interface");
 static int tundebug = 0;
@@ -131,9 +133,12 @@ static int	tunoutput(struct ifnet *, struct mbuf *,
 		    const struct sockaddr *, struct route *ro);
 static void	tunstart(struct ifnet *);
 
-static int	tun_clone_create(struct if_clone *, int, caddr_t);
-static void	tun_clone_destroy(struct ifnet *);
-static struct if_clone *tun_cloner;
+static int	tun_clone_match(struct if_clone *ifc, const char *name);
+static int	tun_clone_create(struct if_clone *, char *, size_t, caddr_t);
+static int	tun_clone_destroy(struct if_clone *, struct ifnet *);
+static struct unrhdr	*tun_unrhdr;
+VNET_DEFINE_STATIC(struct if_clone *, tun_cloner);
+#define V_tun_cloner VNET(tun_cloner)
 
 static d_open_t		tunopen;
 static d_close_t	tunclose;
@@ -175,10 +180,34 @@ static struct cdevsw tun_cdevsw = {
 };
 
 static int
-tun_clone_create(struct if_clone *ifc, int unit, caddr_t params)
+tun_clone_match(struct if_clone *ifc, const char *name)
+{
+	if (strncmp(tunname, name, 3) == 0 &&
+	    (name[3] == '\0' || isdigit(name[3])))
+		return (1);
+
+	return (0);
+}
+
+static int
+tun_clone_create(struct if_clone *ifc, char *name, size_t len, caddr_t params)
 {
 	struct cdev *dev;
-	int i;
+	int err, unit, i;
+
+	err = ifc_name2unit(name, &unit);
+	if (err != 0)
+		return (err);
+
+	if (unit != -1) {
+		/* If this unit number is still available that/s okay. */
+		if (alloc_unr_specific(tun_unrhdr, unit) == -1)
+			return (EEXIST);
+	} else {
+		unit = alloc_unr(tun_unrhdr);
+	}
+
+	snprintf(name, IFNAMSIZ, "%s%d", tunname, unit);
 
 	/* find any existing device, or allocate new unit number */
 	i = clone_create(&tunclones, &tun_cdevsw, &unit, &dev, 0);
@@ -254,6 +283,7 @@ tun_destroy(struct tun_softc *tp)
 	dev = tp->tun_dev;
 	bpfdetach(TUN2IFP(tp));
 	if_detach(TUN2IFP(tp));
+	free_unr(tun_unrhdr, TUN2IFP(tp)->if_dunit);
 	if_free(TUN2IFP(tp));
 	destroy_dev(dev);
 	seldrain(&tp->tun_rsel);
@@ -265,8 +295,8 @@ tun_destroy(struct tun_softc *tp)
 	CURVNET_RESTORE();
 }
 
-static void
-tun_clone_destroy(struct ifnet *ifp)
+static int
+tun_clone_destroy(struct if_clone *ifc, struct ifnet *ifp)
 {
 	struct tun_softc *tp = ifp->if_softc;
 
@@ -274,39 +304,64 @@ tun_clone_destroy(struct ifnet *ifp)
 	TAILQ_REMOVE(&tunhead, tp, tun_list);
 	mtx_unlock(&tunmtx);
 	tun_destroy(tp);
+
+	return (0);
+}
+
+static void
+vnet_tun_init(const void *unused __unused)
+{
+	V_tun_cloner = if_clone_advanced(tunname, 0, tun_clone_match,
+			tun_clone_create, tun_clone_destroy);
+}
+VNET_SYSINIT(vnet_tun_init, SI_SUB_PROTO_IF, SI_ORDER_ANY,
+		vnet_tun_init, NULL);
+
+static void
+vnet_tun_uninit(const void *unused __unused)
+{
+	if_clone_detach(V_tun_cloner);
+}
+VNET_SYSUNINIT(vnet_tun_uninit, SI_SUB_PROTO_IF, SI_ORDER_ANY,
+    vnet_tun_uninit, NULL);
+
+static void
+tun_uninit(const void *unused __unused)
+{
+	struct tun_softc *tp;
+
+	EVENTHANDLER_DEREGISTER(dev_clone, tag);
+	drain_dev_clone_events();
+
+	mtx_lock(&tunmtx);
+	while ((tp = TAILQ_FIRST(&tunhead)) != NULL) {
+		TAILQ_REMOVE(&tunhead, tp, tun_list);
+		mtx_unlock(&tunmtx);
+		tun_destroy(tp);
+		mtx_lock(&tunmtx);
+	}
+	mtx_unlock(&tunmtx);
+	delete_unrhdr(tun_unrhdr);
+	clone_cleanup(&tunclones);
+	mtx_destroy(&tunmtx);
 }
+SYSUNINIT(tun_uninit, SI_SUB_PROTO_IF, SI_ORDER_ANY, tun_uninit, NULL);
 
 static int
 tunmodevent(module_t mod, int type, void *data)
 {
-	static eventhandler_tag tag;
-	struct tun_softc *tp;
 
 	switch (type) {
 	case MOD_LOAD:
 		mtx_init(&tunmtx, "tunmtx", NULL, MTX_DEF);
 		clone_setup(&tunclones);
+		tun_unrhdr = new_unrhdr(0, IF_MAXUNIT, &tunmtx);
 		tag = EVENTHANDLER_REGISTER(dev_clone, tunclone, 0, 1000);
 		if (tag == NULL)
 			return (ENOMEM);
-		tun_cloner = if_clone_simple(tunname, tun_clone_create,
-		    tun_clone_destroy, 0);
 		break;
 	case MOD_UNLOAD:
-		if_clone_detach(tun_cloner);
-		EVENTHANDLER_DEREGISTER(dev_clone, tag);
-		drain_dev_clone_events();
-
-		mtx_lock(&tunmtx);
-		while ((tp = TAILQ_FIRST(&tunhead)) != NULL) {
-			TAILQ_REMOVE(&tunhead, tp, tun_list);
-			mtx_unlock(&tunmtx);
-			tun_destroy(tp);
-			mtx_lock(&tunmtx);
-		}
-		mtx_unlock(&tunmtx);
-		clone_cleanup(&tunclones);
-		mtx_destroy(&tunmtx);
+		/* See tun_uninit, so it's done after the vnet_sysuninit() */
 		break;
 	default:
 		return EOPNOTSUPP;
diff --git a/freebsd/sys/netpfil/ipfw/ip_fw_private.h b/freebsd/sys/netpfil/ipfw/ip_fw_private.h
index dcd38eb8..491350d1 100644
--- a/freebsd/sys/netpfil/ipfw/ip_fw_private.h
+++ b/freebsd/sys/netpfil/ipfw/ip_fw_private.h
@@ -61,6 +61,7 @@ enum {
 	IP_FW_NGTEE,
 	IP_FW_NAT,
 	IP_FW_REASS,
+	IP_FW_NAT64,
 };
 
 /*
diff --git a/freebsd/sys/netpfil/pf/if_pfsync.c b/freebsd/sys/netpfil/pf/if_pfsync.c
index ec07bd80..4eea494b 100644
--- a/freebsd/sys/netpfil/pf/if_pfsync.c
+++ b/freebsd/sys/netpfil/pf/if_pfsync.c
@@ -365,7 +365,7 @@ pfsync_clone_create(struct if_clone *ifc, int unit, caddr_t param)
 	    M_PFSYNC, M_ZERO | M_WAITOK);
 	for (c = 0; c < pfsync_buckets; c++) {
 		b = &sc->sc_buckets[c];
-		mtx_init(&b->b_mtx, pfsyncname, NULL, MTX_DEF);
+		mtx_init(&b->b_mtx, "pfsync bucket", NULL, MTX_DEF);
 
 		b->b_id = c;
 		b->b_sc = sc;
diff --git a/freebsd/sys/netpfil/pf/pf.c b/freebsd/sys/netpfil/pf/pf.c
index 98e339a1..015b2571 100644
--- a/freebsd/sys/netpfil/pf/pf.c
+++ b/freebsd/sys/netpfil/pf/pf.c
@@ -4608,7 +4608,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 {
 	struct pf_addr  *saddr = pd->src, *daddr = pd->dst;
 	u_int16_t	 icmpid = 0, *icmpsum;
-	u_int8_t	 icmptype;
+	u_int8_t	 icmptype, icmpcode;
 	int		 state_icmp = 0;
 	struct pf_state_key_cmp key;
 
@@ -4617,6 +4617,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 #ifdef INET
 	case IPPROTO_ICMP:
 		icmptype = pd->hdr.icmp->icmp_type;
+		icmpcode = pd->hdr.icmp->icmp_code;
 		icmpid = pd->hdr.icmp->icmp_id;
 		icmpsum = &pd->hdr.icmp->icmp_cksum;
 
@@ -4631,6 +4632,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 #ifdef INET6
 	case IPPROTO_ICMPV6:
 		icmptype = pd->hdr.icmp6->icmp6_type;
+		icmpcode = pd->hdr.icmp6->icmp6_code;
 		icmpid = pd->hdr.icmp6->icmp6_id;
 		icmpsum = &pd->hdr.icmp6->icmp6_cksum;
 
@@ -4829,6 +4831,23 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 #endif /* INET6 */
 		}
 
+		if (PF_ANEQ(pd->dst, pd2.src, pd->af)) {
+			if (V_pf_status.debug >= PF_DEBUG_MISC) {
+				printf("pf: BAD ICMP %d:%d outer dst: ",
+				    icmptype, icmpcode);
+				pf_print_host(pd->src, 0, pd->af);
+				printf(" -> ");
+				pf_print_host(pd->dst, 0, pd->af);
+				printf(" inner src: ");
+				pf_print_host(pd2.src, 0, pd2.af);
+				printf(" -> ");
+				pf_print_host(pd2.dst, 0, pd2.af);
+				printf("\n");
+			}
+			REASON_SET(reason, PFRES_BADSTATE);
+			return (PF_DROP);
+		}
+
 		switch (pd2.proto) {
 		case IPPROTO_TCP: {
 			struct tcphdr		 th;
@@ -4885,7 +4904,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 			    !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)))) {
 				if (V_pf_status.debug >= PF_DEBUG_MISC) {
 					printf("pf: BAD ICMP %d:%d ",
-					    icmptype, pd->hdr.icmp->icmp_code);
+					    icmptype, icmpcode);
 					pf_print_host(pd->src, 0, pd->af);
 					printf(" -> ");
 					pf_print_host(pd->dst, 0, pd->af);
@@ -4898,7 +4917,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
 			} else {
 				if (V_pf_status.debug >= PF_DEBUG_MISC) {
 					printf("pf: OK ICMP %d:%d ",
-					    icmptype, pd->hdr.icmp->icmp_code);
+					    icmptype, icmpcode);
 					pf_print_host(pd->src, 0, pd->af);
 					printf(" -> ");
 					pf_print_host(pd->dst, 0, pd->af);
diff --git a/freebsd/sys/netpfil/pf/pf_ioctl.c b/freebsd/sys/netpfil/pf/pf_ioctl.c
index bf195c73..05cb3ccd 100644
--- a/freebsd/sys/netpfil/pf/pf_ioctl.c
+++ b/freebsd/sys/netpfil/pf/pf_ioctl.c
@@ -3766,6 +3766,8 @@ DIOCCHANGEADDR_error:
 			break;
 		}
 
+		nr = 0;
+
 		p = pstore = malloc(psn->psn_len, M_TEMP, M_WAITOK);
 		for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask;
 		    i++, sh++) {
diff --git a/freebsd/sys/opencrypto/cbc_mac.c b/freebsd/sys/opencrypto/cbc_mac.c
new file mode 100644
index 00000000..e68525ef
--- /dev/null
+++ b/freebsd/sys/opencrypto/cbc_mac.c
@@ -0,0 +1,270 @@
+#include <machine/rtems-bsd-kernel-space.h>
+
+/*
+ * Copyright (c) 2018-2019 iXsystems Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/param.h>
+#include <sys/endian.h>
+#include <opencrypto/cbc_mac.h>
+#include <opencrypto/xform_auth.h>
+
+/*
+ * Given two CCM_CBC_BLOCK_LEN blocks, xor
+ * them into dst, and then encrypt dst.
+ */
+static void
+xor_and_encrypt(struct aes_cbc_mac_ctx *ctx,
+		const uint8_t *src, uint8_t *dst)
+{
+	const uint64_t *b1;
+	uint64_t *b2;
+	uint64_t temp_block[CCM_CBC_BLOCK_LEN/sizeof(uint64_t)];
+
+	b1 = (const uint64_t*)src;
+	b2 = (uint64_t*)dst;
+
+	for (size_t count = 0;
+	     count < CCM_CBC_BLOCK_LEN/sizeof(uint64_t);
+	     count++) {
+		temp_block[count] = b1[count] ^ b2[count];
+	}
+	rijndaelEncrypt(ctx->keysched, ctx->rounds, (void*)temp_block, dst);
+}
+
+void
+AES_CBC_MAC_Init(struct aes_cbc_mac_ctx *ctx)
+{
+	bzero(ctx, sizeof(*ctx));
+}
+
+void
+AES_CBC_MAC_Setkey(struct aes_cbc_mac_ctx *ctx, const uint8_t *key, uint16_t klen)
+{
+	ctx->rounds = rijndaelKeySetupEnc(ctx->keysched, key, klen * 8);
+}
+
+/*
+ * This is called to set the nonce, aka IV.
+ * Before this call, the authDataLength and cryptDataLength fields
+ * MUST have been set.  Sadly, there's no way to return an error.
+ *
+ * The CBC-MAC algorithm requires that the first block contain the
+ * nonce, as well as information about the sizes and lengths involved.
+ */
+void
+AES_CBC_MAC_Reinit(struct aes_cbc_mac_ctx *ctx, const uint8_t *nonce, uint16_t nonceLen)
+{
+	uint8_t b0[CCM_CBC_BLOCK_LEN];
+	uint8_t *bp = b0, flags = 0;
+	uint8_t L = 0;
+	uint64_t dataLength = ctx->cryptDataLength;
+	
+	KASSERT(ctx->authDataLength != 0 || ctx->cryptDataLength != 0,
+	    ("Auth Data and Data lengths cannot both be 0"));
+
+	KASSERT(nonceLen >= 7 && nonceLen <= 13,
+	    ("nonceLen must be between 7 and 13 bytes"));
+
+	ctx->nonce = nonce;
+	ctx->nonceLength = nonceLen;
+	
+	ctx->authDataCount = 0;
+	ctx->blockIndex = 0;
+	explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block));
+	
+	/*
+	 * Need to determine the L field value.  This is the number of
+	 * bytes needed to specify the length of the message; the length
+	 * is whatever is left in the 16 bytes after specifying flags and
+	 * the nonce.
+	 */
+	L = 15 - nonceLen;
+	
+	flags = ((ctx->authDataLength > 0) << 6) +
+	    (((AES_CBC_MAC_HASH_LEN - 2) / 2) << 3) +
+	    L - 1;
+	/*
+	 * Now we need to set up the first block, which has flags, nonce,
+	 * and the message length.
+	 */
+	b0[0] = flags;
+	bcopy(nonce, b0 + 1, nonceLen);
+	bp = b0 + 1 + nonceLen;
+
+	/* Need to copy L' [aka L-1] bytes of cryptDataLength */
+	for (uint8_t *dst = b0 + sizeof(b0) - 1; dst >= bp; dst--) {
+		*dst = dataLength;
+		dataLength >>= 8;
+	}
+	/* Now need to encrypt b0 */
+	rijndaelEncrypt(ctx->keysched, ctx->rounds, b0, ctx->block);
+	/* If there is auth data, we need to set up the staging block */
+	if (ctx->authDataLength) {
+		size_t addLength;
+		if (ctx->authDataLength < ((1<<16) - (1<<8))) {
+			uint16_t sizeVal = htobe16(ctx->authDataLength);
+			bcopy(&sizeVal, ctx->staging_block, sizeof(sizeVal));
+			addLength = sizeof(sizeVal);
+		} else if (ctx->authDataLength < (1ULL<<32)) {
+			uint32_t sizeVal = htobe32(ctx->authDataLength);
+			ctx->staging_block[0] = 0xff;
+			ctx->staging_block[1] = 0xfe;
+			bcopy(&sizeVal, ctx->staging_block+2, sizeof(sizeVal));
+			addLength = 2 + sizeof(sizeVal);
+		} else {
+			uint64_t sizeVal = htobe64(ctx->authDataLength);
+			ctx->staging_block[0] = 0xff;
+			ctx->staging_block[1] = 0xff;
+			bcopy(&sizeVal, ctx->staging_block+2, sizeof(sizeVal));
+			addLength = 2 + sizeof(sizeVal);
+		}
+		ctx->blockIndex = addLength;
+		/*
+		 * The length descriptor goes into the AAD buffer, so we
+		 * need to account for it.
+		 */
+		ctx->authDataLength += addLength;
+		ctx->authDataCount = addLength;
+	}
+}
+
+int
+AES_CBC_MAC_Update(struct aes_cbc_mac_ctx *ctx, const uint8_t *data,
+    uint16_t length)
+{
+	size_t copy_amt;
+	
+	/*
+	 * This will be called in one of two phases:
+	 * (1)  Applying authentication data, or
+	 * (2)  Applying the payload data.
+	 *
+	 * Because CBC-MAC puts the authentication data size before the
+	 * data, subsequent calls won't be block-size-aligned.  Which
+	 * complicates things a fair bit.
+	 *
+	 * The payload data doesn't have that problem.
+	 */
+				
+	if (ctx->authDataCount < ctx->authDataLength) {
+		/*
+		 * We need to process data as authentication data.
+		 * Since we may be out of sync, we may also need
+		 * to pad out the staging block.
+		 */
+		const uint8_t *ptr = data;
+		while (length > 0) {
+
+			copy_amt = MIN(length,
+			    sizeof(ctx->staging_block) - ctx->blockIndex);
+
+			bcopy(ptr, ctx->staging_block + ctx->blockIndex,
+			    copy_amt);
+			ptr += copy_amt;
+			length -= copy_amt;
+			ctx->authDataCount += copy_amt;
+			ctx->blockIndex += copy_amt;
+			ctx->blockIndex %= sizeof(ctx->staging_block);
+
+			if (ctx->blockIndex == 0 ||
+			    ctx->authDataCount == ctx->authDataLength) {
+				/*
+				 * We're done with this block, so we
+				 * xor staging_block with block, and then
+				 * encrypt it.
+				 */
+				xor_and_encrypt(ctx, ctx->staging_block, ctx->block);
+				bzero(ctx->staging_block, sizeof(ctx->staging_block));
+				ctx->blockIndex = 0;
+				if (ctx->authDataCount >= ctx->authDataLength)
+					break;
+			}
+		}
+		/*
+		 * We'd like to be able to check length == 0 and return
+		 * here, but the way OCF calls us, length is always
+		 * blksize (16, in this case).  So we have to count on
+		 * the fact that OCF calls us separately for the AAD and
+		 * for the real data.
+		 */
+		return (0);
+	}
+	/*
+	 * If we're here, then we're encoding payload data.
+	 * This is marginally easier, except that _Update can
+	 * be called with non-aligned update lengths. As a result,
+	 * we still need to use the staging block.
+	 */
+	KASSERT((length + ctx->cryptDataCount) <= ctx->cryptDataLength,
+	    ("More encryption data than allowed"));
+
+	while (length) {
+		uint8_t *ptr;
+		
+		copy_amt = MIN(sizeof(ctx->staging_block) - ctx->blockIndex,
+		    length);
+		ptr = ctx->staging_block + ctx->blockIndex;
+		bcopy(data, ptr, copy_amt);
+		data += copy_amt;
+		ctx->blockIndex += copy_amt;
+		ctx->cryptDataCount += copy_amt;
+		length -= copy_amt;
+		if (ctx->blockIndex == sizeof(ctx->staging_block)) {
+			/* We've got a full block */
+			xor_and_encrypt(ctx, ctx->staging_block, ctx->block);
+			ctx->blockIndex = 0;
+			bzero(ctx->staging_block, sizeof(ctx->staging_block));
+		}
+	}
+	return (0);
+}
+
+void
+AES_CBC_MAC_Final(uint8_t *buf, struct aes_cbc_mac_ctx *ctx)
+{
+	uint8_t s0[CCM_CBC_BLOCK_LEN];
+	
+	/*
+	 * We first need to check to see if we've got any data
+	 * left over to encrypt.
+	 */
+	if (ctx->blockIndex != 0) {
+		xor_and_encrypt(ctx, ctx->staging_block, ctx->block);
+		ctx->cryptDataCount += ctx->blockIndex;
+		ctx->blockIndex = 0;
+		explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block));
+	}
+	bzero(s0, sizeof(s0));
+	s0[0] = (15 - ctx->nonceLength) - 1;
+	bcopy(ctx->nonce, s0 + 1, ctx->nonceLength);
+	rijndaelEncrypt(ctx->keysched, ctx->rounds, s0, s0);
+	for (size_t indx = 0; indx < AES_CBC_MAC_HASH_LEN; indx++)
+		buf[indx] = ctx->block[indx] ^ s0[indx];
+	explicit_bzero(s0, sizeof(s0));
+}
diff --git a/freebsd/sys/opencrypto/cbc_mac.h b/freebsd/sys/opencrypto/cbc_mac.h
new file mode 100644
index 00000000..33e61cc1
--- /dev/null
+++ b/freebsd/sys/opencrypto/cbc_mac.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) 2014 The FreeBSD Foundation
+ * Copyright (c) 2018, iXsystems Inc.
+ * All rights reserved.
+ *
+ * This software was developed by Sean Eric Fagan, with lots of references
+ * to existing AES-CCM (gmac) code.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *	$FreeBSD$
+ *
+ */
+
+#ifndef _CBC_CCM_H
+# define _CBC_CCM_H
+
+# include <sys/types.h>
+# include <crypto/rijndael/rijndael.h>
+
+# define CCM_CBC_BLOCK_LEN	16	/* 128 bits */
+# define CCM_CBC_MAX_DIGEST_LEN	16
+# define CCM_CBC_MIN_DIGEST_LEN	4
+
+/*
+ * This is the authentication context structure;
+ * the encryption one is similar.
+ */
+struct aes_cbc_mac_ctx {
+	uint64_t	authDataLength, authDataCount;
+	uint64_t	cryptDataLength, cryptDataCount;
+	int		blockIndex;
+	uint8_t		staging_block[CCM_CBC_BLOCK_LEN];
+	uint8_t		block[CCM_CBC_BLOCK_LEN];
+	const uint8_t	*nonce;
+	int		nonceLength;	/* This one is in bytes, not bits! */
+	/* AES state data */
+	int		rounds;
+	uint32_t	keysched[4*(RIJNDAEL_MAXNR+1)];
+};
+
+void AES_CBC_MAC_Init(struct aes_cbc_mac_ctx *);
+void AES_CBC_MAC_Setkey(struct aes_cbc_mac_ctx *, const uint8_t *, uint16_t);
+void AES_CBC_MAC_Reinit(struct aes_cbc_mac_ctx *, const uint8_t *, uint16_t);
+int AES_CBC_MAC_Update(struct aes_cbc_mac_ctx *, const uint8_t *, uint16_t);
+void AES_CBC_MAC_Final(uint8_t *, struct aes_cbc_mac_ctx *);
+
+#endif /* _CBC_CCM_H */
diff --git a/freebsd/sys/opencrypto/cryptodev.c b/freebsd/sys/opencrypto/cryptodev.c
index b569cbf7..797616b5 100644
--- a/freebsd/sys/opencrypto/cryptodev.c
+++ b/freebsd/sys/opencrypto/cryptodev.c
@@ -450,6 +450,9 @@ cryptof_ioctl(
 		case CRYPTO_CHACHA20:
 			txform = &enc_xform_chacha20;
 			break;
+		case CRYPTO_AES_CCM_16:
+			txform = &enc_xform_ccm;
+			break;
 
 		default:
 			CRYPTDEB("invalid cipher");
@@ -494,6 +497,25 @@ cryptof_ioctl(
 			thash = &auth_hash_nist_gmac_aes_256;
 			break;
 
+		case CRYPTO_AES_CCM_CBC_MAC:
+			switch (sop->keylen) {
+			case 16:
+				thash = &auth_hash_ccm_cbc_mac_128;
+				break;
+			case 24:
+				thash = &auth_hash_ccm_cbc_mac_192;
+				break;
+			case 32:
+				thash = &auth_hash_ccm_cbc_mac_256;
+				break;
+			default:
+				CRYPTDEB("Invalid CBC MAC key size %d",
+				    sop->keylen);
+				SDT_PROBE1(opencrypto, dev, ioctl,
+				    error, __LINE__);
+				return (EINVAL);
+			}
+			break;
 #ifdef notdef
 		case CRYPTO_MD5:
 			thash = &auth_hash_md5;
@@ -1030,12 +1052,13 @@ cryptodev_aead(
 	}
 
 	/*
-	 * For GCM, crd_len covers only the AAD.  For other ciphers
+	 * For GCM/CCM, crd_len covers only the AAD.  For other ciphers
 	 * chained with an HMAC, crd_len covers both the AAD and the
 	 * cipher text.
 	 */
 	crda->crd_skip = 0;
-	if (cse->cipher == CRYPTO_AES_NIST_GCM_16)
+	if (cse->cipher == CRYPTO_AES_NIST_GCM_16 ||
+	    cse->cipher == CRYPTO_AES_CCM_16)
 		crda->crd_len = caead->aadlen;
 	else
 		crda->crd_len = caead->aadlen + caead->len;
diff --git a/freebsd/sys/opencrypto/cryptodev.h b/freebsd/sys/opencrypto/cryptodev.h
index b3f81563..1fe3359a 100644
--- a/freebsd/sys/opencrypto/cryptodev.h
+++ b/freebsd/sys/opencrypto/cryptodev.h
@@ -86,6 +86,7 @@
 #define	SHA1_KPDK_HASH_LEN	20
 #define	AES_GMAC_HASH_LEN	16
 #define	POLY1305_HASH_LEN	16
+#define	AES_CBC_MAC_HASH_LEN	16
 /* Maximum hash algorithm result length */
 #define	HASH_MAX_LEN		SHA2_512_HASH_LEN /* Keep this updated */
 
@@ -107,6 +108,9 @@
 #define	AES_128_GMAC_KEY_LEN		16
 #define	AES_192_GMAC_KEY_LEN		24
 #define	AES_256_GMAC_KEY_LEN		32
+#define	AES_128_CBC_MAC_KEY_LEN		16
+#define	AES_192_CBC_MAC_KEY_LEN		24
+#define	AES_256_CBC_MAC_KEY_LEN		32
 
 #define	POLY1305_KEY_LEN		32
 
@@ -129,6 +133,7 @@
 
 #define	ARC4_IV_LEN		1
 #define	AES_GCM_IV_LEN		12
+#define	AES_CCM_IV_LEN		12
 #define	AES_XTS_IV_LEN		8
 #define	AES_XTS_ALPHA		0x87	/* GF(2^128) generator polynomial */
 
@@ -199,7 +204,9 @@
 #define	CRYPTO_SHA2_384		36
 #define	CRYPTO_SHA2_512		37
 #define	CRYPTO_POLY1305		38
-#define	CRYPTO_ALGORITHM_MAX	38 /* Keep updated - see below */
+#define	CRYPTO_AES_CCM_CBC_MAC	39	/* auth side */
+#define	CRYPTO_AES_CCM_16	40	/* cipher side */
+#define	CRYPTO_ALGORITHM_MAX	40	/* Keep updated - see below */
 
 #define	CRYPTO_ALGO_VALID(x)	((x) >= CRYPTO_ALGORITHM_MIN && \
 				 (x) <= CRYPTO_ALGORITHM_MAX)
diff --git a/freebsd/sys/opencrypto/cryptosoft.c b/freebsd/sys/opencrypto/cryptosoft.c
index 43455b48..5e63167a 100644
--- a/freebsd/sys/opencrypto/cryptosoft.c
+++ b/freebsd/sys/opencrypto/cryptosoft.c
@@ -64,6 +64,9 @@ __FBSDID("$FreeBSD$");
 #include <sys/bus.h>
 #include <rtems/bsd/local/cryptodev_if.h>
 
+_Static_assert(AES_CCM_IV_LEN == AES_GCM_IV_LEN,
+    "AES_GCM_IV_LEN must currently be the same as AES_CCM_IV_LEN");
+
 static	int32_t swcr_id;
 
 u_int8_t hmac_ipad_buffer[HMAC_MAX_BLOCK_LEN];
@@ -508,6 +511,7 @@ swcr_authenc(struct cryptop *crp)
 	caddr_t buf = (caddr_t)crp->crp_buf;
 	uint32_t *blkp;
 	int aadlen, blksz, i, ivlen, len, iskip, oskip, r;
+	int isccm = 0;
 
 	ivlen = blksz = iskip = oskip = 0;
 
@@ -522,13 +526,18 @@ swcr_authenc(struct cryptop *crp)
 
 		sw = &ses->swcr_algorithms[i];
 		switch (sw->sw_alg) {
+		case CRYPTO_AES_CCM_16:
 		case CRYPTO_AES_NIST_GCM_16:
 		case CRYPTO_AES_NIST_GMAC:
 			swe = sw;
 			crde = crd;
 			exf = swe->sw_exf;
-			ivlen = 12;
+			/* AES_CCM_IV_LEN and AES_GCM_IV_LEN are both 12 */
+			ivlen = AES_CCM_IV_LEN;
 			break;
+		case CRYPTO_AES_CCM_CBC_MAC:
+			isccm = 1;
+			/* FALLTHROUGH */
 		case CRYPTO_AES_128_NIST_GMAC:
 		case CRYPTO_AES_192_NIST_GMAC:
 		case CRYPTO_AES_256_NIST_GMAC:
@@ -546,8 +555,26 @@ swcr_authenc(struct cryptop *crp)
 	}
 	if (crde == NULL || crda == NULL)
 		return (EINVAL);
+	/*
+	 * We need to make sure that the auth algorithm matches the
+	 * encr algorithm.  Specifically, for AES-GCM must go with
+	 * AES NIST GMAC, and AES-CCM must go with CBC-MAC.
+	 */
+	if (crde->crd_alg == CRYPTO_AES_NIST_GCM_16) {
+		switch (crda->crd_alg) {
+		case CRYPTO_AES_128_NIST_GMAC:
+		case CRYPTO_AES_192_NIST_GMAC:
+		case CRYPTO_AES_256_NIST_GMAC:
+			break;	/* Good! */
+		default:
+			return (EINVAL);	/* Not good! */
+		}
+	} else if (crde->crd_alg == CRYPTO_AES_CCM_16 &&
+	    crda->crd_alg != CRYPTO_AES_CCM_CBC_MAC)
+		return (EINVAL);
 
-	if (crde->crd_alg == CRYPTO_AES_NIST_GCM_16 &&
+	if ((crde->crd_alg == CRYPTO_AES_NIST_GCM_16 ||
+	     crde->crd_alg == CRYPTO_AES_CCM_16) &&
 	    (crde->crd_flags & CRD_F_IV_EXPLICIT) == 0)
 		return (EINVAL);
 
@@ -578,6 +605,15 @@ swcr_authenc(struct cryptop *crp)
 		}
 	}
 
+	if (swa->sw_alg == CRYPTO_AES_CCM_CBC_MAC) {
+		/*
+		 * AES CCM-CBC needs to know the length of
+		 * both the auth data, and payload data, before
+		 * doing the auth computation.
+		 */
+		ctx.aes_cbc_mac_ctx.authDataLength = crda->crd_len;
+		ctx.aes_cbc_mac_ctx.cryptDataLength = crde->crd_len;
+	}
 	/* Supply MAC with IV */
 	if (axf->Reinit)
 		axf->Reinit(&ctx, iv, ivlen);
@@ -612,16 +648,30 @@ swcr_authenc(struct cryptop *crp)
 			bzero(blk, blksz);
 		crypto_copydata(crp->crp_flags, buf, crde->crd_skip + i, len,
 		    blk);
+		/*
+		 * One of the problems with CCM+CBC is that the authentication
+		 * is done on the unecncrypted data.  As a result, we have
+		 * to do the authentication update at different times,
+		 * depending on whether it's CCM or not.
+		 */
 		if (crde->crd_flags & CRD_F_ENCRYPT) {
+			if (isccm)
+				axf->Update(&ctx, blk, len);
 			if (exf->encrypt_multi != NULL)
 				exf->encrypt_multi(swe->sw_kschedule, blk,
 				    len);
 			else
 				exf->encrypt(swe->sw_kschedule, blk);
-			axf->Update(&ctx, blk, len);
+			if (!isccm)
+				axf->Update(&ctx, blk, len);
 			crypto_copyback(crp->crp_flags, buf,
 			    crde->crd_skip + i, len, blk);
 		} else {
+			if (isccm) {
+				KASSERT(exf->encrypt_multi == NULL,
+				    ("assume CCM is single-block only"));
+				exf->decrypt(swe->sw_kschedule, blk);
+			}
 			axf->Update(&ctx, blk, len);
 		}
 	}
@@ -652,6 +702,11 @@ swcr_authenc(struct cryptop *crp)
 		r = timingsafe_bcmp(aalg, uaalg, axf->hashsize);
 		if (r == 0) {
 			/* tag matches, decrypt data */
+			if (isccm) {
+				KASSERT(exf->reinit != NULL,
+				    ("AES-CCM reinit function must be set"));
+				exf->reinit(swe->sw_kschedule, iv);
+			}
 			for (i = 0; i < crde->crd_len; i += blksz) {
 				len = MIN(crde->crd_len - i, blksz);
 				if (len < blksz)
@@ -801,6 +856,9 @@ swcr_newsession(device_t dev, crypto_session_t cses, struct cryptoini *cri)
 		case CRYPTO_AES_NIST_GCM_16:
 			txf = &enc_xform_aes_nist_gcm;
 			goto enccommon;
+		case CRYPTO_AES_CCM_16:
+			txf = &enc_xform_ccm;
+			goto enccommon;
 		case CRYPTO_AES_NIST_GMAC:
 			txf = &enc_xform_aes_nist_gmac;
 			swd->sw_exf = txf;
@@ -945,6 +1003,22 @@ swcr_newsession(device_t dev, crypto_session_t cses, struct cryptoini *cri)
 			swd->sw_axf = axf;
 			break;
 
+		case CRYPTO_AES_CCM_CBC_MAC:
+			switch (cri->cri_klen) {
+			case 128:
+				axf = &auth_hash_ccm_cbc_mac_128;
+				break;
+			case 192:
+				axf = &auth_hash_ccm_cbc_mac_192;
+				break;
+			case 256:
+				axf = &auth_hash_ccm_cbc_mac_256;
+				break;
+			default:
+				swcr_freesession(dev, cses);
+				return EINVAL;
+			}
+			goto auth4common;
 		case CRYPTO_AES_128_NIST_GMAC:
 			axf = &auth_hash_nist_gmac_aes_128;
 			goto auth4common;
@@ -1044,6 +1118,7 @@ swcr_freesession(device_t dev, crypto_session_t cses)
 		case CRYPTO_CAMELLIA_CBC:
 		case CRYPTO_NULL_CBC:
 		case CRYPTO_CHACHA20:
+		case CRYPTO_AES_CCM_16:
 			txf = swd->sw_exf;
 
 			if (swd->sw_kschedule)
@@ -1058,6 +1133,7 @@ swcr_freesession(device_t dev, crypto_session_t cses)
 		case CRYPTO_SHA2_512_HMAC:
 		case CRYPTO_RIPEMD160_HMAC:
 		case CRYPTO_NULL_HMAC:
+		case CRYPTO_AES_CCM_CBC_MAC:
 			axf = swd->sw_axf;
 
 			if (swd->sw_ictx) {
@@ -1203,6 +1279,8 @@ swcr_process(device_t dev, struct cryptop *crp, int hint)
 		case CRYPTO_AES_128_NIST_GMAC:
 		case CRYPTO_AES_192_NIST_GMAC:
 		case CRYPTO_AES_256_NIST_GMAC:
+		case CRYPTO_AES_CCM_16:
+		case CRYPTO_AES_CCM_CBC_MAC:
 			crp->crp_etype = swcr_authenc(crp);
 			goto done;
 
@@ -1293,6 +1371,8 @@ swcr_attach(device_t dev)
 	REGISTER(CRYPTO_BLAKE2B);
 	REGISTER(CRYPTO_BLAKE2S);
 	REGISTER(CRYPTO_CHACHA20);
+	REGISTER(CRYPTO_AES_CCM_16);
+	REGISTER(CRYPTO_AES_CCM_CBC_MAC);
 	REGISTER(CRYPTO_POLY1305);
 #undef REGISTER
 
diff --git a/freebsd/sys/opencrypto/xform_aes_icm.c b/freebsd/sys/opencrypto/xform_aes_icm.c
index 8d3694fa..052be5a7 100644
--- a/freebsd/sys/opencrypto/xform_aes_icm.c
+++ b/freebsd/sys/opencrypto/xform_aes_icm.c
@@ -57,6 +57,7 @@ static	void aes_icm_crypt(caddr_t, u_int8_t *);
 static	void aes_icm_zerokey(u_int8_t **);
 static	void aes_icm_reinit(caddr_t, u_int8_t *);
 static	void aes_gcm_reinit(caddr_t, u_int8_t *);
+static	void aes_ccm_reinit(caddr_t, u_int8_t *);
 
 /* Encryption instances */
 struct enc_xform enc_xform_aes_icm = {
@@ -79,6 +80,18 @@ struct enc_xform enc_xform_aes_nist_gcm = {
 	aes_gcm_reinit,
 };
 
+struct enc_xform enc_xform_ccm = {
+	.type = CRYPTO_AES_CCM_16,
+	.name = "AES-CCM",
+	.blocksize = AES_ICM_BLOCK_LEN, .ivsize = AES_CCM_IV_LEN,
+	.minkey = AES_MIN_KEY, .maxkey = AES_MAX_KEY,
+	.encrypt = aes_icm_crypt,
+	.decrypt = aes_icm_crypt,
+	.setkey = aes_icm_setkey,
+	.zerokey = aes_icm_zerokey,
+	.reinit = aes_ccm_reinit,
+};
+
 /*
  * Encryption wrapper routines.
  */
@@ -105,6 +118,21 @@ aes_gcm_reinit(caddr_t key, u_int8_t *iv)
 }
 
 static void
+aes_ccm_reinit(caddr_t key, u_int8_t *iv)
+{
+	struct aes_icm_ctx *ctx;
+
+	ctx = (struct aes_icm_ctx*)key;
+
+	/* CCM has flags, then the IV, then the counter, which starts at 1 */
+	bzero(ctx->ac_block, sizeof(ctx->ac_block));
+	/* 3 bytes for length field; this gives a nonce of 12 bytes */
+	ctx->ac_block[0] = (15 - AES_CCM_IV_LEN) - 1;
+	bcopy(iv, ctx->ac_block+1, AES_CCM_IV_LEN);
+	ctx->ac_block[AESICM_BLOCKSIZE - 1] = 1;
+}
+
+static void
 aes_icm_crypt(caddr_t key, u_int8_t *data)
 {
 	struct aes_icm_ctx *ctx;
diff --git a/freebsd/sys/opencrypto/xform_auth.h b/freebsd/sys/opencrypto/xform_auth.h
index 9af0f8e6..9b072625 100644
--- a/freebsd/sys/opencrypto/xform_auth.h
+++ b/freebsd/sys/opencrypto/xform_auth.h
@@ -42,6 +42,7 @@
 #include <crypto/sha2/sha512.h>
 #include <opencrypto/rmd160.h>
 #include <opencrypto/gmac.h>
+#include <opencrypto/cbc_mac.h>
 
 #include <opencrypto/cryptodev.h>
 #include <opencrypto/xform_userland.h>
@@ -85,6 +86,9 @@ extern struct auth_hash auth_hash_nist_gmac_aes_256;
 extern struct auth_hash auth_hash_blake2b;
 extern struct auth_hash auth_hash_blake2s;
 extern struct auth_hash auth_hash_poly1305;
+extern struct auth_hash auth_hash_ccm_cbc_mac_128;
+extern struct auth_hash auth_hash_ccm_cbc_mac_192;
+extern struct auth_hash auth_hash_ccm_cbc_mac_256;
 
 union authctx {
 	MD5_CTX md5ctx;
@@ -95,6 +99,7 @@ union authctx {
 	SHA384_CTX sha384ctx;
 	SHA512_CTX sha512ctx;
 	struct aes_gmac_ctx aes_gmac_ctx;
+	struct aes_cbc_mac_ctx aes_cbc_mac_ctx;
 };
 
 #endif /* _CRYPTO_XFORM_AUTH_H_ */
diff --git a/freebsd/sys/opencrypto/xform_cbc_mac.c b/freebsd/sys/opencrypto/xform_cbc_mac.c
new file mode 100644
index 00000000..1de2e976
--- /dev/null
+++ b/freebsd/sys/opencrypto/xform_cbc_mac.c
@@ -0,0 +1,57 @@
+#include <machine/rtems-bsd-kernel-space.h>
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <opencrypto/cbc_mac.h>
+#include <opencrypto/xform_auth.h>
+
+/* Authentication instances */
+struct auth_hash auth_hash_ccm_cbc_mac_128 = {
+	.type = CRYPTO_AES_CCM_CBC_MAC,
+	.name = "CBC-CCM-AES-128",
+	.keysize = AES_128_CBC_MAC_KEY_LEN,
+	.hashsize = AES_CBC_MAC_HASH_LEN,
+	.ctxsize = sizeof(struct aes_cbc_mac_ctx),
+	.blocksize = CCM_CBC_BLOCK_LEN,
+	.Init = (void (*)(void *)) AES_CBC_MAC_Init,
+	.Setkey =
+	    (void (*)(void *, const u_int8_t *, u_int16_t))AES_CBC_MAC_Setkey,
+	.Reinit =
+	    (void (*)(void *, const u_int8_t *, u_int16_t)) AES_CBC_MAC_Reinit,
+	.Update =
+	    (int  (*)(void *, const u_int8_t *, u_int16_t)) AES_CBC_MAC_Update,
+	.Final = (void (*)(u_int8_t *, void *)) AES_CBC_MAC_Final,
+};
+struct auth_hash auth_hash_ccm_cbc_mac_192 = {
+	.type = CRYPTO_AES_CCM_CBC_MAC,
+	.name = "CBC-CCM-AES-192",
+	.keysize = AES_192_CBC_MAC_KEY_LEN,
+	.hashsize = AES_CBC_MAC_HASH_LEN,
+	.ctxsize = sizeof(struct aes_cbc_mac_ctx),
+	.blocksize = CCM_CBC_BLOCK_LEN,
+	.Init = (void (*)(void *)) AES_CBC_MAC_Init,
+	.Setkey =
+	    (void (*)(void *, const u_int8_t *, u_int16_t)) AES_CBC_MAC_Setkey,
+	.Reinit =
+	    (void (*)(void *, const u_int8_t *, u_int16_t)) AES_CBC_MAC_Reinit,
+	.Update =
+	    (int  (*)(void *, const u_int8_t *, u_int16_t)) AES_CBC_MAC_Update,
+	.Final = (void (*)(u_int8_t *, void *)) AES_CBC_MAC_Final,
+};
+struct auth_hash auth_hash_ccm_cbc_mac_256 = {
+	.type = CRYPTO_AES_CCM_CBC_MAC,
+	.name = "CBC-CCM-AES-256",
+	.keysize = AES_256_CBC_MAC_KEY_LEN,
+	.hashsize = AES_CBC_MAC_HASH_LEN,
+	.ctxsize = sizeof(struct aes_cbc_mac_ctx),
+	.blocksize = CCM_CBC_BLOCK_LEN,
+	.Init = (void (*)(void *)) AES_CBC_MAC_Init,
+	.Setkey =
+	    (void (*)(void *, const u_int8_t *, u_int16_t)) AES_CBC_MAC_Setkey,
+	.Reinit =
+	    (void (*)(void *, const u_int8_t *, u_int16_t)) AES_CBC_MAC_Reinit,
+	.Update =
+	    (int  (*)(void *, const u_int8_t *, u_int16_t)) AES_CBC_MAC_Update,
+	.Final = (void (*)(u_int8_t *, void *)) AES_CBC_MAC_Final,
+};
diff --git a/freebsd/sys/opencrypto/xform_enc.h b/freebsd/sys/opencrypto/xform_enc.h
index 545e0ec2..2797ca98 100644
--- a/freebsd/sys/opencrypto/xform_enc.h
+++ b/freebsd/sys/opencrypto/xform_enc.h
@@ -84,6 +84,7 @@ extern struct enc_xform enc_xform_aes_xts;
 extern struct enc_xform enc_xform_arc4;
 extern struct enc_xform enc_xform_camellia;
 extern struct enc_xform enc_xform_chacha20;
+extern struct enc_xform enc_xform_ccm;
 
 struct aes_icm_ctx {
 	u_int32_t	ac_ek[4*(RIJNDAEL_MAXNR + 1)];
diff --git a/freebsd/sys/sys/mount.h b/freebsd/sys/sys/mount.h
index 7d12d574..c2780bb9 100644
--- a/freebsd/sys/sys/mount.h
+++ b/freebsd/sys/sys/mount.h
@@ -974,11 +974,15 @@ void	syncer_resume(void);
 struct stat;
 
 __BEGIN_DECLS
+int	fhlink(struct fhandle *, const char *);
+int	fhlinkat(struct fhandle *, int, const char *);
 int	fhopen(const struct fhandle *, int);
+int	fhreadlink(struct fhandle *, char *, size_t);
 int	fhstat(const struct fhandle *, struct stat *);
 int	fhstatfs(const struct fhandle *, struct statfs *);
 int	fstatfs(int, struct statfs *);
 int	getfh(const char *, fhandle_t *);
+int	getfhat(int, char *, struct fhandle *, int);
 int	getfsstat(struct statfs *, long, int);
 int	getmntinfo(struct statfs **, int);
 int	lgetfh(const char *, fhandle_t *);
diff --git a/freebsd/sys/sys/proc.h b/freebsd/sys/sys/proc.h
index f0c677b3..f27f5502 100644
--- a/freebsd/sys/sys/proc.h
+++ b/freebsd/sys/sys/proc.h
@@ -731,6 +731,7 @@ struct proc {
 	LIST_ENTRY(proc) p_orphan;	/* (e) List of orphan processes. */
 	LIST_HEAD(, proc) p_orphans;	/* (e) Pointer to list of orphans. */
 	uint32_t	p_fctl0;	/* (x) ABI feature control, ELF note */
+	u_int		p_amd64_md_flags; /* (c) md process flags P_MD */
 #endif /* __rtems__ */
 };
 
@@ -802,6 +803,9 @@ struct proc {
 #define	P2_AST_SU	0x00000008	/* Handles SU ast for kthreads. */
 #define	P2_PTRACE_FSTP	0x00000010 /* SIGSTOP from PT_ATTACH not yet handled. */
 #define	P2_TRAPCAP	0x00000020	/* SIGTRAP on ENOTCAPABLE */
+#define	P2_ASLR_ENABLE	0x00000040	/* Force enable ASLR. */
+#define	P2_ASLR_DISABLE	0x00000080	/* Force disable ASLR. */
+#define	P2_ASLR_IGNSTART 0x00000100	/* Enable ASLR to consume sbrk area. */
 
 /* Flags protected by proctree_lock, kept in p_treeflags. */
 #define	P_TREE_ORPHANED		0x00000001	/* Reparented, on orphan list */
@@ -1150,9 +1154,12 @@ void	userret(struct thread *, struct trapframe *);
 void	cpu_exit(struct thread *);
 void	exit1(struct thread *, int, int) __dead2;
 void	cpu_copy_thread(struct thread *td, struct thread *td0);
+bool	cpu_exec_vmspace_reuse(struct proc *p, struct vm_map *map);
 int	cpu_fetch_syscall_args(struct thread *td);
 void	cpu_fork(struct thread *, struct proc *, struct thread *, int);
 void	cpu_fork_kthread_handler(struct thread *, void (*)(void *), void *);
+int	cpu_procctl(struct thread *td, int idtype, id_t id, int com,
+	    void *data);
 void	cpu_set_syscall_retval(struct thread *, int);
 #ifndef __rtems__
 void	cpu_set_upcall(struct thread *, void (*)(void *), void *,
diff --git a/freebsd/sys/sys/sysproto.h b/freebsd/sys/sys/sysproto.h
index 0d20a4d0..82249d38 100644
--- a/freebsd/sys/sys/sysproto.h
+++ b/freebsd/sys/sys/sysproto.h
@@ -1822,6 +1822,26 @@ struct getrandom_args {
 	char buflen_l_[PADL_(size_t)]; size_t buflen; char buflen_r_[PADR_(size_t)];
 	char flags_l_[PADL_(unsigned int)]; unsigned int flags; char flags_r_[PADR_(unsigned int)];
 };
+struct getfhat_args {
+	char fd_l_[PADL_(int)]; int fd; char fd_r_[PADR_(int)];
+	char path_l_[PADL_(char *)]; char * path; char path_r_[PADR_(char *)];
+	char fhp_l_[PADL_(struct fhandle *)]; struct fhandle * fhp; char fhp_r_[PADR_(struct fhandle *)];
+	char flags_l_[PADL_(int)]; int flags; char flags_r_[PADR_(int)];
+};
+struct fhlink_args {
+	char fhp_l_[PADL_(struct fhandle *)]; struct fhandle * fhp; char fhp_r_[PADR_(struct fhandle *)];
+	char to_l_[PADL_(const char *)]; const char * to; char to_r_[PADR_(const char *)];
+};
+struct fhlinkat_args {
+	char fhp_l_[PADL_(struct fhandle *)]; struct fhandle * fhp; char fhp_r_[PADR_(struct fhandle *)];
+	char tofd_l_[PADL_(int)]; int tofd; char tofd_r_[PADR_(int)];
+	char to_l_[PADL_(const char *)]; const char * to; char to_r_[PADR_(const char *)];
+};
+struct fhreadlink_args {
+	char fhp_l_[PADL_(struct fhandle *)]; struct fhandle * fhp; char fhp_r_[PADR_(struct fhandle *)];
+	char buf_l_[PADL_(char *)]; char * buf; char buf_r_[PADR_(char *)];
+	char bufsize_l_[PADL_(size_t)]; size_t bufsize; char bufsize_r_[PADR_(size_t)];
+};
 int	nosys(struct thread *, struct nosys_args *);
 void	sys_sys_exit(struct thread *, struct sys_exit_args *);
 int	sys_fork(struct thread *, struct fork_args *);
@@ -2202,6 +2222,10 @@ int	sys_kevent(struct thread *, struct kevent_args *);
 int	sys_cpuset_getdomain(struct thread *, struct cpuset_getdomain_args *);
 int	sys_cpuset_setdomain(struct thread *, struct cpuset_setdomain_args *);
 int	sys_getrandom(struct thread *, struct getrandom_args *);
+int	sys_getfhat(struct thread *, struct getfhat_args *);
+int	sys_fhlink(struct thread *, struct fhlink_args *);
+int	sys_fhlinkat(struct thread *, struct fhlinkat_args *);
+int	sys_fhreadlink(struct thread *, struct fhreadlink_args *);
 
 #ifdef COMPAT_43
 
@@ -3099,6 +3123,10 @@ int	freebsd11_mknodat(struct thread *, struct freebsd11_mknodat_args *);
 #define	SYS_AUE_cpuset_getdomain	AUE_NULL
 #define	SYS_AUE_cpuset_setdomain	AUE_NULL
 #define	SYS_AUE_getrandom	AUE_NULL
+#define	SYS_AUE_getfhat	AUE_NULL
+#define	SYS_AUE_fhlink	AUE_NULL
+#define	SYS_AUE_fhlinkat	AUE_NULL
+#define	SYS_AUE_fhreadlink	AUE_NULL
 #endif /* __rtems__ */
 
 #undef PAD_
diff --git a/freebsd/sys/sys/user.h b/freebsd/sys/sys/user.h
index 80716460..a46ecd87 100644
--- a/freebsd/sys/sys/user.h
+++ b/freebsd/sys/sys/user.h
@@ -477,6 +477,7 @@ struct kinfo_file {
 #define	KVME_FLAG_SUPER		0x00000008
 #define	KVME_FLAG_GROWS_UP	0x00000010
 #define	KVME_FLAG_GROWS_DOWN	0x00000020
+#define	KVME_FLAG_USER_WIRED	0x00000040
 
 #if defined(__amd64__)
 #define	KINFO_OVMENTRY_SIZE	1168
diff --git a/libbsd.py b/libbsd.py
index 907a2f96..da3c630d 100644
--- a/libbsd.py
+++ b/libbsd.py
@@ -2294,6 +2294,7 @@ class opencrypto(builder.Module):
                 'sys/contrib/libsodium/src/libsodium/include/sodium/utils.h',
                 'sys/opencrypto/cast.h',
                 'sys/opencrypto/castsb.h',
+                'sys/opencrypto/cbc_mac.h',
                 'sys/opencrypto/_cryptodev.h',
                 'sys/opencrypto/cryptodev.h',
                 'sys/opencrypto/cryptosoft.h',
@@ -2333,6 +2334,7 @@ class opencrypto(builder.Module):
                 'sys/contrib/libsodium/src/libsodium/crypto_verify/sodium/verify.c',
                 'sys/crypto/libsodium/utils.c',
                 'sys/opencrypto/cast.c',
+                'sys/opencrypto/cbc_mac.c',
                 'sys/opencrypto/criov.c',
                 'sys/opencrypto/crypto.c',
                 'sys/opencrypto/cryptodeflate.c',
@@ -2343,6 +2345,7 @@ class opencrypto(builder.Module):
                 'sys/opencrypto/rmd160.c',
                 'sys/opencrypto/skipjack.c',
                 'sys/opencrypto/xform.c',
+                'sys/opencrypto/xform_cbc_mac.c',
                 'sys/opencrypto/xform_poly1305.c',
             ],
             mm.generator['source']()
diff --git a/rtemsbsd/include/machine/rtems-bsd-kernel-namespace.h b/rtemsbsd/include/machine/rtems-bsd-kernel-namespace.h
index 1345e7ed..7caead1e 100644
--- a/rtemsbsd/include/machine/rtems-bsd-kernel-namespace.h
+++ b/rtemsbsd/include/machine/rtems-bsd-kernel-namespace.h
@@ -14,6 +14,11 @@
 #define	AddPptp _bsd_AddPptp
 #define	addrsel_policy_init _bsd_addrsel_policy_init
 #define	AddSeq _bsd_AddSeq
+#define	AES_CBC_MAC_Final _bsd_AES_CBC_MAC_Final
+#define	AES_CBC_MAC_Init _bsd_AES_CBC_MAC_Init
+#define	AES_CBC_MAC_Reinit _bsd_AES_CBC_MAC_Reinit
+#define	AES_CBC_MAC_Setkey _bsd_AES_CBC_MAC_Setkey
+#define	AES_CBC_MAC_Update _bsd_AES_CBC_MAC_Update
 #define	AES_GMAC_Final _bsd_AES_GMAC_Final
 #define	AES_GMAC_Init _bsd_AES_GMAC_Init
 #define	AES_GMAC_Reinit _bsd_AES_GMAC_Reinit
@@ -56,6 +61,9 @@
 #define	auth_algorithm_lookup _bsd_auth_algorithm_lookup
 #define	auth_hash_blake2b _bsd_auth_hash_blake2b
 #define	auth_hash_blake2s _bsd_auth_hash_blake2s
+#define	auth_hash_ccm_cbc_mac_128 _bsd_auth_hash_ccm_cbc_mac_128
+#define	auth_hash_ccm_cbc_mac_192 _bsd_auth_hash_ccm_cbc_mac_192
+#define	auth_hash_ccm_cbc_mac_256 _bsd_auth_hash_ccm_cbc_mac_256
 #define	auth_hash_hmac_md5 _bsd_auth_hash_hmac_md5
 #define	auth_hash_hmac_ripemd_160 _bsd_auth_hash_hmac_ripemd_160
 #define	auth_hash_hmac_sha1 _bsd_auth_hash_hmac_sha1
@@ -1111,6 +1119,7 @@
 #define	enc_xform_blf _bsd_enc_xform_blf
 #define	enc_xform_camellia _bsd_enc_xform_camellia
 #define	enc_xform_cast5 _bsd_enc_xform_cast5
+#define	enc_xform_ccm _bsd_enc_xform_ccm
 #define	enc_xform_chacha20 _bsd_enc_xform_chacha20
 #define	enc_xform_des _bsd_enc_xform_des
 #define	enc_xform_null _bsd_enc_xform_null
diff --git a/rtemsbsd/include/rtems/bsd/local/usbdevs.h b/rtemsbsd/include/rtems/bsd/local/usbdevs.h
index f0d49d92..73904347 100644
--- a/rtemsbsd/include/rtems/bsd/local/usbdevs.h
+++ b/rtemsbsd/include/rtems/bsd/local/usbdevs.h
@@ -2653,6 +2653,7 @@
 #define	USB_PRODUCT_JETI_SPC1201	0x04b2		/* FTDI compatible adapter */
 
 /* JMicron products */
+#define	USB_PRODUCT_JMICRON_JMS566	0x3569		/* USB to SATA 3.0Gb/s bridge */
 #define	USB_PRODUCT_JMICRON_JMS567	0x0567		/* USB to SATA 6.0Gb/s bridge */
 #define	USB_PRODUCT_JMICRON_JM20336	0x2336		/* USB to SATA Bridge */
 #define	USB_PRODUCT_JMICRON_JM20337	0x2338		/* USB to ATA/ATAPI Bridge */
@@ -4030,6 +4031,8 @@
 #define	USB_PRODUCT_ROLAND_SD80	0x0029		/* SD-80 MIDI Synth */
 #define	USB_PRODUCT_ROLAND_UA700	0x002b		/* UA-700 Audio I/F */
 #define	USB_PRODUCT_ROLAND_PCR300	0x0033		/* EDIROL PCR-300 MIDI I/F */
+#define	USB_PRODUCT_ROLAND_UA25EX_AD	0x00e6		/* EDIROL UA-25EX (Advanced Driver) */
+#define	USB_PRODUCT_ROLAND_UA25EX_CC	0x00e7		/* EDIROL UA-25EX (Class Compliant) */
 
 /* Rockfire products */
 #define	USB_PRODUCT_ROCKFIRE_GAMEPAD	0x2033		/* gamepad 203USB */
diff --git a/rtemsbsd/include/rtems/bsd/local/usbdevs_data.h b/rtemsbsd/include/rtems/bsd/local/usbdevs_data.h
index 3c7f3345..aa199490 100644
--- a/rtemsbsd/include/rtems/bsd/local/usbdevs_data.h
+++ b/rtemsbsd/include/rtems/bsd/local/usbdevs_data.h
@@ -8294,6 +8294,12 @@ const struct usb_knowndev usb_knowndevs[] = {
 	    "FTDI compatible adapter",
 	},
 	{
+	    USB_VENDOR_JMICRON, USB_PRODUCT_JMICRON_JMS566,
+	    0,
+	    "JMicron",
+	    "USB to SATA 3.0Gb/s bridge",
+	},
+	{
 	    USB_VENDOR_JMICRON, USB_PRODUCT_JMICRON_JMS567,
 	    0,
 	    "JMicron",
@@ -14924,6 +14930,18 @@ const struct usb_knowndev usb_knowndevs[] = {
 	    "EDIROL PCR-300 MIDI I/F",
 	},
 	{
+	    USB_VENDOR_ROLAND, USB_PRODUCT_ROLAND_UA25EX_AD,
+	    0,
+	    "Roland",
+	    "EDIROL UA-25EX (Advanced Driver)",
+	},
+	{
+	    USB_VENDOR_ROLAND, USB_PRODUCT_ROLAND_UA25EX_CC,
+	    0,
+	    "Roland",
+	    "EDIROL UA-25EX (Class Compliant)",
+	},
+	{
 	    USB_VENDOR_ROCKFIRE, USB_PRODUCT_ROCKFIRE_GAMEPAD,
 	    0,
 	    "Rockfire",