diff --git a/sys/conf/files b/sys/conf/files
index 9f0b3cf3831a..c91b1f89f921 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -1,5239 +1,5239 @@
 #
 # The long compile-with and dependency lines are required because of
 # limitations in config: backslash-newline doesn't work in strings, and
 # dependency lines other than the first are silently ignored.
 #
 acpi_quirks.h			optional acpi				   \
 	dependency	"$S/tools/acpi_quirks2h.awk $S/dev/acpica/acpi_quirks" \
 	compile-with	"${AWK} -f $S/tools/acpi_quirks2h.awk $S/dev/acpica/acpi_quirks" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"acpi_quirks.h"
 bhnd_nvram_map.h		optional bhnd				   \
 	dependency	"$S/dev/bhnd/tools/nvram_map_gen.sh $S/dev/bhnd/tools/nvram_map_gen.awk $S/dev/bhnd/nvram/nvram_map" \
 	compile-with	"sh $S/dev/bhnd/tools/nvram_map_gen.sh $S/dev/bhnd/nvram/nvram_map -h" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"bhnd_nvram_map.h"
 bhnd_nvram_map_data.h		optional bhnd				   \
 	dependency	"$S/dev/bhnd/tools/nvram_map_gen.sh $S/dev/bhnd/tools/nvram_map_gen.awk $S/dev/bhnd/nvram/nvram_map" \
 	compile-with	"sh $S/dev/bhnd/tools/nvram_map_gen.sh $S/dev/bhnd/nvram/nvram_map -d" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"bhnd_nvram_map_data.h"
 fdt_static_dtb.h		optional fdt fdt_dtb_static \
 	compile-with "sh -c 'MACHINE=${MACHINE} $S/tools/fdt/make_dtbh.sh ${FDT_DTS_FILE} ${.CURDIR}'" \
 	dependency	"${FDT_DTS_FILE:T:R}.dtb" \
 	no-obj no-implicit-rule before-depend \
 	clean		"fdt_static_dtb.h"
 feeder_eq_gen.h			optional sound				   \
 	dependency	"$S/tools/sound/feeder_eq_mkfilter.awk"		   \
 	compile-with	"${AWK} -f $S/tools/sound/feeder_eq_mkfilter.awk -- ${FEEDER_EQ_PRESETS} > feeder_eq_gen.h" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"feeder_eq_gen.h"
 feeder_rate_gen.h		optional sound				   \
 	dependency	"$S/tools/sound/feeder_rate_mkfilter.awk"	   \
 	compile-with	"${AWK} -f $S/tools/sound/feeder_rate_mkfilter.awk -- ${FEEDER_RATE_PRESETS} > feeder_rate_gen.h" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"feeder_rate_gen.h"
 font.h				optional	sc_dflt_font		\
 	compile-with	"uudecode < ${SRCTOP}/share/syscons/fonts/${SC_DFLT_FONT}-8x16.fnt && file2c 'u_char dflt_font_16[16*256] = {' '};' < ${SC_DFLT_FONT}-8x16 > font.h && uudecode < ${SRCTOP}/share/syscons/fonts/${SC_DFLT_FONT}-8x14.fnt && file2c 'u_char dflt_font_14[14*256] = {' '};' < ${SC_DFLT_FONT}-8x14 >> font.h && uudecode < ${SRCTOP}/share/syscons/fonts/${SC_DFLT_FONT}-8x8.fnt && file2c 'u_char dflt_font_8[8*256] = {' '};' < ${SC_DFLT_FONT}-8x8 >> font.h"									\
 	no-obj no-implicit-rule before-depend				\
 	clean		"font.h ${SC_DFLT_FONT}-8x14 ${SC_DFLT_FONT}-8x16 ${SC_DFLT_FONT}-8x8"
 snd_fxdiv_gen.h			optional sound				   \
 	dependency	"$S/tools/sound/snd_fxdiv_gen.awk"		   \
 	compile-with	"${AWK} -f $S/tools/sound/snd_fxdiv_gen.awk -- > snd_fxdiv_gen.h" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"snd_fxdiv_gen.h"
 miidevs.h			optional miibus | mii			   \
 	dependency	"$S/tools/miidevs2h.awk $S/dev/mii/miidevs"	   \
 	compile-with	"${AWK} -f $S/tools/miidevs2h.awk $S/dev/mii/miidevs" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"miidevs.h"
 kbdmuxmap.h			optional	kbdmux_dflt_keymap 	   \
 	compile-with	"${KEYMAP} -L ${KBDMUX_DFLT_KEYMAP} | ${KEYMAP_FIX} > ${.TARGET}" \
 	no-obj no-implicit-rule before-depend				\
 	clean		"kbdmuxmap.h"
 teken_state.h		optional sc | vt				   \
 	dependency	"$S/teken/gensequences $S/teken/sequences" \
 	compile-with	"${AWK} -f $S/teken/gensequences $S/teken/sequences > teken_state.h" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"teken_state.h"
 ukbdmap.h			optional	ukbd_dflt_keymap	\
 	compile-with	"${KEYMAP} -L ${UKBD_DFLT_KEYMAP} | ${KEYMAP_FIX} > ${.TARGET}" \
 	no-obj no-implicit-rule before-depend				\
 	clean		"ukbdmap.h"
 usbdevs.h			optional usb | hid			   \
 	dependency	"$S/tools/usbdevs2h.awk $S/dev/usb/usbdevs" \
 	compile-with	"${AWK} -f $S/tools/usbdevs2h.awk $S/dev/usb/usbdevs -h" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"usbdevs.h"
 usbdevs_data.h			optional usb				   \
 	dependency	"$S/tools/usbdevs2h.awk $S/dev/usb/usbdevs" \
 	compile-with	"${AWK} -f $S/tools/usbdevs2h.awk $S/dev/usb/usbdevs -d" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"usbdevs_data.h"
 sdiodevs.h			optional mmccam				   \
 	dependency	"$S/tools/sdiodevs2h.awk $S/dev/sdio/sdiodevs" \
 	compile-with	"${AWK} -f $S/tools/sdiodevs2h.awk $S/dev/sdio/sdiodevs -h" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"sdiodevs.h"
 sdiodevs_data.h			optional mmccam				   \
 	dependency	"$S/tools/sdiodevs2h.awk $S/dev/sdio/sdiodevs" \
 	compile-with	"${AWK} -f $S/tools/sdiodevs2h.awk $S/dev/sdio/sdiodevs -d" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"sdiodevs_data.h"
 cam/cam.c			optional scbus
 cam/cam_compat.c		optional scbus
 cam/cam_iosched.c		optional scbus
 cam/cam_periph.c		optional scbus
 cam/cam_queue.c			optional scbus
 cam/cam_sim.c			optional scbus
 cam/cam_xpt.c			optional scbus
 cam/ata/ata_all.c		optional scbus
 cam/ata/ata_xpt.c		optional scbus
 cam/ata/ata_pmp.c		optional scbus
 cam/nvme/nvme_all.c		optional scbus
 cam/nvme/nvme_da.c		optional nda | da
 cam/nvme/nvme_xpt.c		optional scbus
 cam/scsi/scsi_xpt.c		optional scbus
 cam/scsi/scsi_all.c		optional scbus
 cam/scsi/scsi_cd.c		optional cd
 cam/scsi/scsi_ch.c		optional ch
 cam/ata/ata_da.c		optional ada | da
 cam/ctl/ctl.c			optional ctl
 cam/ctl/ctl_backend.c		optional ctl
 cam/ctl/ctl_backend_block.c	optional ctl
 cam/ctl/ctl_backend_ramdisk.c	optional ctl
 cam/ctl/ctl_cmd_table.c		optional ctl
 cam/ctl/ctl_frontend.c		optional ctl
 cam/ctl/ctl_frontend_cam_sim.c	optional ctl
 cam/ctl/ctl_frontend_ioctl.c	optional ctl
 cam/ctl/ctl_frontend_iscsi.c	optional ctl cfiscsi
 cam/ctl/ctl_ha.c		optional ctl
 cam/ctl/ctl_scsi_all.c		optional ctl
 cam/ctl/ctl_tpc.c		optional ctl
 cam/ctl/ctl_tpc_local.c		optional ctl
 cam/ctl/ctl_error.c		optional ctl
 cam/ctl/ctl_util.c		optional ctl
 cam/ctl/scsi_ctl.c		optional ctl
 cam/mmc/mmc_xpt.c		optional scbus mmccam
 cam/mmc/mmc_sim.c		optional scbus mmccam
 cam/mmc/mmc_sim_if.m		optional scbus mmccam
 cam/mmc/mmc_da.c		optional scbus mmccam da
 cam/scsi/scsi_da.c		optional da
 cam/scsi/scsi_pass.c		optional pass
 cam/scsi/scsi_pt.c		optional pt
 cam/scsi/scsi_sa.c		optional sa
 cam/scsi/scsi_enc.c		optional ses
 cam/scsi/scsi_enc_ses.c		optional ses
 cam/scsi/scsi_enc_safte.c	optional ses
 cam/scsi/scsi_sg.c		optional sg
 cam/scsi/scsi_targ_bh.c		optional targbh
 cam/scsi/scsi_target.c		optional targ
 cam/scsi/smp_all.c		optional scbus
 
 # shared between zfs and dtrace
 cddl/compat/opensolaris/kern/opensolaris.c		optional dtrace compile-with "${CDDL_C}"
 cddl/compat/opensolaris/kern/opensolaris_proc.c		optional zfs | dtrace compile-with "${CDDL_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_misc.c		optional zfs | dtrace compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_cmn_err.c		optional zfs | dtrace compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_taskq.c		optional zfs | dtrace compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_kmem.c		optional zfs | dtrace compile-with "${ZFS_C}"
 
 #zfs solaris portability layer
 contrib/openzfs/module/os/freebsd/spl/acl_common.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/callb.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/list.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_acl.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_dtrace.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_kstat.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_policy.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_procfs_list.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_string.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_sunddi.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_sysevent.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_uio.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_vfs.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_vm.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_zlib.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/spl/spl_zone.c		optional zfs compile-with "${ZFS_C}"
 
 
 
 # zfs specific
 
 #zfs avl
 contrib/openzfs/module/avl/avl.c				optional zfs compile-with "${ZFS_C}"
 
 # zfs lua support
 contrib/openzfs/module/lua/lapi.c			optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lauxlib.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lbaselib.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lcode.c			optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lcompat.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lcorolib.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lctype.c			optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/ldebug.c			optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/ldo.c			optional zfs compile-with "${ZFS_C} ${NO_WINFINITE_RECURSION}"
 contrib/openzfs/module/lua/lfunc.c			optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lgc.c			optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/llex.c			optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lmem.c			optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lobject.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lopcodes.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lparser.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lstate.c			optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lstring.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lstrlib.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/ltable.c			optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/ltablib.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/ltm.c			optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lvm.c			optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/lua/lzio.c			optional zfs compile-with "${ZFS_C}"
 
 # zfs nvpair support
 contrib/openzfs/module/nvpair/fnvpair.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/nvpair/nvpair.c		optional zfs compile-with "${ZFS_RPC_C} ${NO_WSTRINGOP_OVERREAD}"
 contrib/openzfs/module/nvpair/nvpair_alloc_fixed.c	optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/nvpair/nvpair_alloc_spl.c	optional zfs compile-with "${ZFS_C}"
 
 #zfs platform compatibility code
 contrib/openzfs/module/os/freebsd/zfs/abd_os.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/arc_os.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/crypto_os.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/dmu_os.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/event_os.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/hkdf.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/kmod_core.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/spa_os.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/sysctl_os.c		optional zfs compile-with "${ZFS_C}  -include $S/modules/zfs/zfs_config.h"
 contrib/openzfs/module/os/freebsd/zfs/vdev_file.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/vdev_label_os.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/vdev_geom.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zfs_acl.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zfs_ctldir.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zfs_debug.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zfs_dir.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zfs_file_os.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zfs_ioctl_compat.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zfs_ioctl_os.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zfs_racct.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zfs_vfsops.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zfs_vnops_os.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zfs_znode.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zio_crypt.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/os/freebsd/zfs/zvol_os.c		optional zfs compile-with "${ZFS_C}"
 
 #zfs unicode support
 contrib/openzfs/module/unicode/uconv.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/unicode/u8_textprep.c		optional zfs compile-with "${ZFS_C}"
 
 #zfs checksums / zcommon
 contrib/openzfs/module/zcommon/cityhash.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zcommon/zfeature_common.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zcommon/zfs_comutil.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zcommon/zfs_deleg.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zcommon/zfs_fletcher.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zcommon/zfs_fletcher_superscalar.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zcommon/zfs_fletcher_superscalar4.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zcommon/zfs_namecheck.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zcommon/zfs_prop.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zcommon/zpool_prop.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zcommon/zprop_common.c		optional zfs compile-with "${ZFS_C}"
 
 # zfs edon-r hash support
 contrib/openzfs/module/icp/algs/edonr/edonr.c		optional zfs compile-with "${ZFS_C}"
 
 # zfs blake3 hash support
 contrib/openzfs/module/icp/algs/blake3/blake3.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/icp/algs/blake3/blake3_generic.c	optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/icp/algs/blake3/blake3_impl.c	optional zfs compile-with "${ZFS_C}"
 
 # zfs sha2 hash support
 contrib/openzfs/module/icp/algs/sha2/sha2_generic.c	optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/icp/algs/sha2/sha256_impl.c	optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/icp/algs/sha2/sha512_impl.c	optional zfs compile-with "${ZFS_C}"
 
 #zfs core common code
 contrib/openzfs/module/zfs/abd.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/aggsum.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/arc.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/blake3_zfs.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/blkptr.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/bplist.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/bpobj.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/bptree.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/brt.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/btree.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/bqueue.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dbuf.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dbuf_stats.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dataset_kstats.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/ddt.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/ddt_zap.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dmu.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dmu_diff.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dmu_object.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dmu_objset.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dmu_recv.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dmu_redact.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dmu_send.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dmu_traverse.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dmu_tx.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dmu_zfetch.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dnode.c		optional zfs compile-with "${ZFS_C} ${NO_WUNUSED_BUT_SET_VARIABLE}" \
 	warning "kernel contains CDDL licensed ZFS filesystem"
 contrib/openzfs/module/zfs/dnode_sync.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dsl_bookmark.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dsl_crypt.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dsl_dataset.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dsl_deadlist.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dsl_deleg.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dsl_destroy.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dsl_dir.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dsl_pool.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dsl_prop.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dsl_scan.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dsl_synctask.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/dsl_userhold.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/edonr_zfs.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/fm.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/gzip.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/lzjb.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/lz4.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/lz4_zfs.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/metaslab.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/mmp.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/multilist.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/objlist.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/pathname.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/range_tree.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/refcount.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/rrwlock.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/sa.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/sha2_zfs.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/skein_zfs.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/spa.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/spa_checkpoint.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/spa_config.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/spa_errlog.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/spa_history.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/spa_log_spacemap.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/spa_misc.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/spa_stats.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/space_map.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/space_reftree.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/txg.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/uberblock.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/unique.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_draid.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_draid_rand.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_indirect.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_indirect_births.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_indirect_mapping.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_initialize.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_label.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_mirror.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_missing.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_queue.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_raidz.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_raidz_math.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_raidz_math_scalar.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_rebuild.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_removal.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_root.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/vdev_trim.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zap.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zap_leaf.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zap_micro.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zcp.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zcp_get.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zcp_global.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zcp_iter.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zcp_set.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zcp_synctask.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfeature.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_byteswap.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_chksum.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_fm.c		optional zfs compile-with "${ZFS_C} ${NO_WUNUSED_BUT_SET_VARIABLE}"
 contrib/openzfs/module/zfs/zfs_fuid.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_impl.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_ioctl.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_log.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_onexit.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_quota.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_ratelimit.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_replay.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_rlock.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_sa.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zfs_vnops.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zstd/zfs_zstd.c		optional zfs zstdio compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zil.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zio.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zio_checksum.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zio_compress.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zio_inject.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zle.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zrlock.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zthr.c		optional zfs compile-with "${ZFS_C}"
 contrib/openzfs/module/zfs/zvol.c		optional zfs compile-with "${ZFS_C}"
 
 # dtrace specific
 cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c	optional dtrace compile-with "${DTRACE_C}" \
 							warning "kernel contains CDDL licensed DTRACE"
 cddl/contrib/opensolaris/uts/common/dtrace/dtrace_xoroshiro128_plus.c	optional dtrace compile-with "${DTRACE_C}"
 cddl/dev/dtmalloc/dtmalloc.c		optional dtmalloc        | dtraceall compile-with "${CDDL_C}"
 cddl/dev/profile/profile.c		optional dtrace_profile  | dtraceall compile-with "${CDDL_C}"
 cddl/dev/sdt/sdt.c			optional dtrace_sdt      | dtraceall compile-with "${CDDL_C}"
 cddl/dev/fbt/fbt.c			optional dtrace_fbt      | dtraceall compile-with "${FBT_C}"
 cddl/dev/systrace/systrace.c		optional dtrace_systrace | dtraceall compile-with "${CDDL_C}"
 cddl/dev/prototype.c			optional dtrace_prototype | dtraceall compile-with "${CDDL_C}"
 fs/nfsclient/nfs_clkdtrace.c		optional dtnfscl nfscl   | dtraceall nfscl compile-with "${CDDL_C}"
 compat/freebsd32/freebsd32_abort2.c	optional compat_freebsd32
 compat/freebsd32/freebsd32_capability.c	optional compat_freebsd32
 compat/freebsd32/freebsd32_ioctl.c	optional compat_freebsd32
 compat/freebsd32/freebsd32_misc.c	optional compat_freebsd32
 compat/freebsd32/freebsd32_syscalls.c	optional compat_freebsd32
 compat/freebsd32/freebsd32_sysent.c	optional compat_freebsd32
 contrib/ck/src/ck_array.c				standard compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 contrib/ck/src/ck_barrier_centralized.c			standard compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 contrib/ck/src/ck_barrier_combining.c			standard compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 contrib/ck/src/ck_barrier_dissemination.c		standard compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 contrib/ck/src/ck_barrier_mcs.c				standard compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 contrib/ck/src/ck_barrier_tournament.c			standard compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 contrib/ck/src/ck_epoch.c				standard compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 contrib/ck/src/ck_hp.c					standard compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 contrib/ck/src/ck_hs.c					standard compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 contrib/ck/src/ck_ht.c					standard compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 contrib/ck/src/ck_rhs.c					standard compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 contrib/dev/acpica/common/ahids.c			optional acpi acpi_debug
 contrib/dev/acpica/common/ahuuids.c			optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbcmds.c		optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbconvert.c	optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbdisply.c	optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbexec.c		optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbhistry.c	optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbinput.c	optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbmethod.c	optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbnames.c	optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbobject.c	optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbstats.c	optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbtest.c		optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbutils.c	optional acpi acpi_debug
 contrib/dev/acpica/components/debugger/dbxface.c	optional acpi acpi_debug
 contrib/dev/acpica/components/disassembler/dmbuffer.c	optional acpi acpi_debug
 contrib/dev/acpica/components/disassembler/dmcstyle.c	optional acpi acpi_debug
 contrib/dev/acpica/components/disassembler/dmdeferred.c	optional acpi acpi_debug
 contrib/dev/acpica/components/disassembler/dmnames.c	optional acpi acpi_debug
 contrib/dev/acpica/components/disassembler/dmopcode.c	optional acpi acpi_debug
 contrib/dev/acpica/components/disassembler/dmresrc.c	optional acpi acpi_debug
 contrib/dev/acpica/components/disassembler/dmresrcl.c	optional acpi acpi_debug
 contrib/dev/acpica/components/disassembler/dmresrcl2.c	optional acpi acpi_debug
 contrib/dev/acpica/components/disassembler/dmresrcs.c	optional acpi acpi_debug
 contrib/dev/acpica/components/disassembler/dmutils.c	optional acpi acpi_debug
 contrib/dev/acpica/components/disassembler/dmwalk.c	optional acpi acpi_debug
 contrib/dev/acpica/components/dispatcher/dsargs.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dscontrol.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dsdebug.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dsfield.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dsinit.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dsmethod.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dsmthdat.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dsobject.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dsopcode.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dspkginit.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dsutils.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dswexec.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dswload.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dswload2.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dswscope.c	optional acpi
 contrib/dev/acpica/components/dispatcher/dswstate.c	optional acpi
 contrib/dev/acpica/components/events/evevent.c		optional acpi
 contrib/dev/acpica/components/events/evglock.c		optional acpi
 contrib/dev/acpica/components/events/evgpe.c		optional acpi
 contrib/dev/acpica/components/events/evgpeblk.c		optional acpi
 contrib/dev/acpica/components/events/evgpeinit.c	optional acpi
 contrib/dev/acpica/components/events/evgpeutil.c	optional acpi
 contrib/dev/acpica/components/events/evhandler.c	optional acpi
 contrib/dev/acpica/components/events/evmisc.c		optional acpi
 contrib/dev/acpica/components/events/evregion.c		optional acpi
 contrib/dev/acpica/components/events/evrgnini.c		optional acpi
 contrib/dev/acpica/components/events/evsci.c		optional acpi
 contrib/dev/acpica/components/events/evxface.c		optional acpi
 contrib/dev/acpica/components/events/evxfevnt.c		optional acpi
 contrib/dev/acpica/components/events/evxfgpe.c		optional acpi
 contrib/dev/acpica/components/events/evxfregn.c		optional acpi
 contrib/dev/acpica/components/executer/exconcat.c	optional acpi
 contrib/dev/acpica/components/executer/exconfig.c	optional acpi
 contrib/dev/acpica/components/executer/exconvrt.c	optional acpi
 contrib/dev/acpica/components/executer/excreate.c	optional acpi
 contrib/dev/acpica/components/executer/exdebug.c	optional acpi
 contrib/dev/acpica/components/executer/exdump.c		optional acpi
 contrib/dev/acpica/components/executer/exfield.c	optional acpi
 contrib/dev/acpica/components/executer/exfldio.c	optional acpi
 contrib/dev/acpica/components/executer/exmisc.c		optional acpi
 contrib/dev/acpica/components/executer/exmutex.c	optional acpi
 contrib/dev/acpica/components/executer/exnames.c	optional acpi
 contrib/dev/acpica/components/executer/exoparg1.c	optional acpi
 contrib/dev/acpica/components/executer/exoparg2.c	optional acpi
 contrib/dev/acpica/components/executer/exoparg3.c	optional acpi
 contrib/dev/acpica/components/executer/exoparg6.c	optional acpi
 contrib/dev/acpica/components/executer/exprep.c		optional acpi
 contrib/dev/acpica/components/executer/exregion.c	optional acpi
 contrib/dev/acpica/components/executer/exresnte.c	optional acpi
 contrib/dev/acpica/components/executer/exresolv.c	optional acpi
 contrib/dev/acpica/components/executer/exresop.c	optional acpi
 contrib/dev/acpica/components/executer/exserial.c	optional acpi
 contrib/dev/acpica/components/executer/exstore.c	optional acpi
 contrib/dev/acpica/components/executer/exstoren.c	optional acpi
 contrib/dev/acpica/components/executer/exstorob.c	optional acpi
 contrib/dev/acpica/components/executer/exsystem.c	optional acpi
 contrib/dev/acpica/components/executer/extrace.c	optional acpi
 contrib/dev/acpica/components/executer/exutils.c	optional acpi
 contrib/dev/acpica/components/hardware/hwacpi.c		optional acpi
 contrib/dev/acpica/components/hardware/hwesleep.c	optional acpi
 contrib/dev/acpica/components/hardware/hwgpe.c		optional acpi
 contrib/dev/acpica/components/hardware/hwpci.c		optional acpi
 contrib/dev/acpica/components/hardware/hwregs.c		optional acpi
 contrib/dev/acpica/components/hardware/hwsleep.c	optional acpi
 contrib/dev/acpica/components/hardware/hwtimer.c	optional acpi
 contrib/dev/acpica/components/hardware/hwvalid.c	optional acpi
 contrib/dev/acpica/components/hardware/hwxface.c	optional acpi
 contrib/dev/acpica/components/hardware/hwxfsleep.c	optional acpi
 contrib/dev/acpica/components/namespace/nsaccess.c	optional acpi \
 	compile-with "${NORMAL_C} ${NO_WUNUSED_BUT_SET_VARIABLE}"
 contrib/dev/acpica/components/namespace/nsalloc.c	optional acpi
 contrib/dev/acpica/components/namespace/nsarguments.c	optional acpi
 contrib/dev/acpica/components/namespace/nsconvert.c	optional acpi
 contrib/dev/acpica/components/namespace/nsdump.c	optional acpi
 contrib/dev/acpica/components/namespace/nseval.c	optional acpi
 contrib/dev/acpica/components/namespace/nsinit.c	optional acpi
 contrib/dev/acpica/components/namespace/nsload.c	optional acpi
 contrib/dev/acpica/components/namespace/nsnames.c	optional acpi
 contrib/dev/acpica/components/namespace/nsobject.c	optional acpi
 contrib/dev/acpica/components/namespace/nsparse.c	optional acpi
 contrib/dev/acpica/components/namespace/nspredef.c	optional acpi
 contrib/dev/acpica/components/namespace/nsprepkg.c	optional acpi
 contrib/dev/acpica/components/namespace/nsrepair.c	optional acpi
 contrib/dev/acpica/components/namespace/nsrepair2.c	optional acpi
 contrib/dev/acpica/components/namespace/nssearch.c	optional acpi
 contrib/dev/acpica/components/namespace/nsutils.c	optional acpi
 contrib/dev/acpica/components/namespace/nswalk.c	optional acpi
 contrib/dev/acpica/components/namespace/nsxfeval.c	optional acpi
 contrib/dev/acpica/components/namespace/nsxfname.c	optional acpi
 contrib/dev/acpica/components/namespace/nsxfobj.c	optional acpi
 contrib/dev/acpica/components/parser/psargs.c		optional acpi
 contrib/dev/acpica/components/parser/psloop.c		optional acpi
 contrib/dev/acpica/components/parser/psobject.c		optional acpi
 contrib/dev/acpica/components/parser/psopcode.c		optional acpi
 contrib/dev/acpica/components/parser/psopinfo.c		optional acpi
 contrib/dev/acpica/components/parser/psparse.c		optional acpi
 contrib/dev/acpica/components/parser/psscope.c		optional acpi
 contrib/dev/acpica/components/parser/pstree.c		optional acpi
 contrib/dev/acpica/components/parser/psutils.c		optional acpi
 contrib/dev/acpica/components/parser/pswalk.c		optional acpi
 contrib/dev/acpica/components/parser/psxface.c		optional acpi
 contrib/dev/acpica/components/resources/rsaddr.c	optional acpi
 contrib/dev/acpica/components/resources/rscalc.c	optional acpi
 contrib/dev/acpica/components/resources/rscreate.c	optional acpi
 contrib/dev/acpica/components/resources/rsdump.c	optional acpi acpi_debug
 contrib/dev/acpica/components/resources/rsdumpinfo.c	optional acpi
 contrib/dev/acpica/components/resources/rsinfo.c	optional acpi
 contrib/dev/acpica/components/resources/rsio.c		optional acpi
 contrib/dev/acpica/components/resources/rsirq.c		optional acpi
 contrib/dev/acpica/components/resources/rslist.c	optional acpi
 contrib/dev/acpica/components/resources/rsmemory.c	optional acpi
 contrib/dev/acpica/components/resources/rsmisc.c	optional acpi
 contrib/dev/acpica/components/resources/rsserial.c	optional acpi
 contrib/dev/acpica/components/resources/rsutils.c	optional acpi
 contrib/dev/acpica/components/resources/rsxface.c	optional acpi
 contrib/dev/acpica/components/tables/tbdata.c		optional acpi
 contrib/dev/acpica/components/tables/tbfadt.c		optional acpi
 contrib/dev/acpica/components/tables/tbfind.c		optional acpi
 contrib/dev/acpica/components/tables/tbinstal.c		optional acpi
 contrib/dev/acpica/components/tables/tbprint.c		optional acpi
 contrib/dev/acpica/components/tables/tbutils.c		optional acpi
 contrib/dev/acpica/components/tables/tbxface.c		optional acpi
 contrib/dev/acpica/components/tables/tbxfload.c		optional acpi
 contrib/dev/acpica/components/tables/tbxfroot.c		optional acpi
 contrib/dev/acpica/components/utilities/utaddress.c	optional acpi
 contrib/dev/acpica/components/utilities/utalloc.c	optional acpi
 contrib/dev/acpica/components/utilities/utascii.c	optional acpi
 contrib/dev/acpica/components/utilities/utbuffer.c	optional acpi
 contrib/dev/acpica/components/utilities/utcache.c	optional acpi
 contrib/dev/acpica/components/utilities/utcksum.c	optional acpi
 contrib/dev/acpica/components/utilities/utcopy.c	optional acpi
 contrib/dev/acpica/components/utilities/utdebug.c	optional acpi
 contrib/dev/acpica/components/utilities/utdecode.c	optional acpi
 contrib/dev/acpica/components/utilities/utdelete.c	optional acpi
 contrib/dev/acpica/components/utilities/uterror.c	optional acpi
 contrib/dev/acpica/components/utilities/uteval.c	optional acpi
 contrib/dev/acpica/components/utilities/utexcep.c	optional acpi
 contrib/dev/acpica/components/utilities/utglobal.c	optional acpi
 contrib/dev/acpica/components/utilities/uthex.c		optional acpi
 contrib/dev/acpica/components/utilities/utids.c		optional acpi
 contrib/dev/acpica/components/utilities/utinit.c	optional acpi
 contrib/dev/acpica/components/utilities/utlock.c	optional acpi
 contrib/dev/acpica/components/utilities/utmath.c	optional acpi
 contrib/dev/acpica/components/utilities/utmisc.c	optional acpi
 contrib/dev/acpica/components/utilities/utmutex.c	optional acpi
 contrib/dev/acpica/components/utilities/utnonansi.c	optional acpi
 contrib/dev/acpica/components/utilities/utobject.c	optional acpi
 contrib/dev/acpica/components/utilities/utosi.c		optional acpi
 contrib/dev/acpica/components/utilities/utownerid.c	optional acpi
 contrib/dev/acpica/components/utilities/utpredef.c	optional acpi
 contrib/dev/acpica/components/utilities/utresdecode.c	optional acpi acpi_debug
 contrib/dev/acpica/components/utilities/utresrc.c	optional acpi
 contrib/dev/acpica/components/utilities/utstate.c	optional acpi
 contrib/dev/acpica/components/utilities/utstring.c	optional acpi
 contrib/dev/acpica/components/utilities/utstrsuppt.c	optional acpi
 contrib/dev/acpica/components/utilities/utstrtoul64.c	optional acpi
 contrib/dev/acpica/components/utilities/utuuid.c	optional acpi acpi_debug
 contrib/dev/acpica/components/utilities/utxface.c	optional acpi
 contrib/dev/acpica/components/utilities/utxferror.c	optional acpi
 contrib/dev/acpica/components/utilities/utxfinit.c	optional acpi
 contrib/dev/acpica/os_specific/service_layers/osgendbg.c	optional acpi acpi_debug
 netpfil/ipfilter/netinet/fil.c	optional ipfilter inet \
 	compile-with "${NORMAL_C} ${NO_WSELF_ASSIGN} -Wno-unused -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_auth.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -Wno-unused -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_fil_freebsd.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -Wno-unused -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_frag.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -Wno-unused -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_log.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_nat.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -Wno-unused -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_proxy.c optional ipfilter inet \
 	compile-with "${NORMAL_C} ${NO_WSELF_ASSIGN} -Wno-unused -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_state.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -Wno-unused -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_lookup.c optional ipfilter inet \
 	compile-with "${NORMAL_C} ${NO_WSELF_ASSIGN} -Wno-unused -Wno-error -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_pool.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -Wno-unused -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_htable.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -Wno-unused -I$S/netpfil/ipfilter ${NO_WTAUTOLOGICAL_POINTER_COMPARE}"
 netpfil/ipfilter/netinet/ip_sync.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -Wno-unused -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/mlfk_ipl.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_nat6.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -Wno-unused -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_rules.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_scan.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -Wno-unused -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/ip_dstlist.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -Wno-unused -I$S/netpfil/ipfilter"
 netpfil/ipfilter/netinet/radix_ipf.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/netpfil/ipfilter"
 contrib/libfdt/fdt.c		optional fdt
 contrib/libfdt/fdt_ro.c		optional fdt
 contrib/libfdt/fdt_rw.c		optional fdt
 contrib/libfdt/fdt_strerror.c	optional fdt
 contrib/libfdt/fdt_sw.c		optional fdt
 contrib/libfdt/fdt_wip.c	optional fdt
 contrib/libnv/cnvlist.c		standard
 contrib/libnv/dnvlist.c		standard
 contrib/libnv/nvlist.c		standard
 contrib/libnv/bsd_nvpair.c		standard
 # xz
 dev/xz/xz_mod.c	optional xz \
 	compile-with "${NORMAL_C} -DXZ_USE_CRC64 -I$S/contrib/xz-embedded/freebsd/ -I$S/contrib/xz-embedded/linux/lib/xz/ -I$S/contrib/xz-embedded/linux/include/linux/"
 contrib/xz-embedded/linux/lib/xz/xz_crc32.c	optional xz \
 	compile-with "${NORMAL_C} -DXZ_USE_CRC64 -I$S/contrib/xz-embedded/freebsd/ -I$S/contrib/xz-embedded/linux/lib/xz/ -I$S/contrib/xz-embedded/linux/include/linux/"
 contrib/xz-embedded/linux/lib/xz/xz_crc64.c	optional xz \
 	compile-with "${NORMAL_C} -DXZ_USE_CRC64 -I$S/contrib/xz-embedded/freebsd/ -I$S/contrib/xz-embedded/linux/lib/xz/ -I$S/contrib/xz-embedded/linux/include/linux/"
 contrib/xz-embedded/linux/lib/xz/xz_dec_bcj.c	optional xz \
 	compile-with "${NORMAL_C} -DXZ_USE_CRC64 -I$S/contrib/xz-embedded/freebsd/ -I$S/contrib/xz-embedded/linux/lib/xz/ -I$S/contrib/xz-embedded/linux/include/linux/"
 contrib/xz-embedded/linux/lib/xz/xz_dec_lzma2.c	optional xz \
 	compile-with "${NORMAL_C} -DXZ_USE_CRC64 -I$S/contrib/xz-embedded/freebsd/ -I$S/contrib/xz-embedded/linux/lib/xz/ -I$S/contrib/xz-embedded/linux/include/linux/"
 contrib/xz-embedded/linux/lib/xz/xz_dec_stream.c optional xz \
 	compile-with "${NORMAL_C} -DXZ_USE_CRC64 -I$S/contrib/xz-embedded/freebsd/ -I$S/contrib/xz-embedded/linux/lib/xz/ -I$S/contrib/xz-embedded/linux/include/linux/"
 # Zstd
 contrib/zstd/lib/freebsd/zstd_kmalloc.c		optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/common/zstd_common.c		optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/common/fse_decompress.c	optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/common/entropy_common.c	optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/common/error_private.c		optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/common/xxhash.c		optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/compress/zstd_compress.c	optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/compress/zstd_compress_literals.c	optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/compress/zstd_compress_sequences.c	optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/compress/zstd_compress_superblock.c	optional zstdio compile-with "${ZSTD_C} ${NO_WUNUSED_BUT_SET_VARIABLE}"
 contrib/zstd/lib/compress/fse_compress.c	optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/compress/hist.c		optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/compress/huf_compress.c	optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/compress/zstd_double_fast.c	optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/compress/zstd_fast.c		optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/compress/zstd_lazy.c		optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/compress/zstd_ldm.c		optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/compress/zstd_opt.c		optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/decompress/zstd_ddict.c	optional zstdio compile-with ${ZSTD_C}
 contrib/zstd/lib/decompress/zstd_decompress.c	optional zstdio compile-with ${ZSTD_C}
 # See comment in sys/conf/kern.pre.mk
 contrib/zstd/lib/decompress/zstd_decompress_block.c	optional zstdio \
 	compile-with "${ZSTD_C} ${ZSTD_DECOMPRESS_BLOCK_FLAGS}"
 contrib/zstd/lib/decompress/huf_decompress.c	optional zstdio compile-with "${ZSTD_C} ${NO_WBITWISE_INSTEAD_OF_LOGICAL}"
 # Blake 2
 contrib/libb2/blake2b-ref.c	optional crypto | !random_loadable random_fenestrasx \
 	compile-with "${NORMAL_C} -I$S/crypto/blake2 -Wno-cast-qual -DSUFFIX=_ref -Wno-unused-function"
 contrib/libb2/blake2s-ref.c	optional crypto \
 	compile-with "${NORMAL_C} -I$S/crypto/blake2 -Wno-cast-qual -DSUFFIX=_ref -Wno-unused-function"
 crypto/blake2/blake2-sw.c	optional crypto \
 	compile-with "${NORMAL_C} -I$S/crypto/blake2 -Wno-cast-qual"
 crypto/camellia/camellia.c	optional crypto
 crypto/camellia/camellia-api.c	optional crypto
 crypto/chacha20/chacha.c	standard
 crypto/chacha20/chacha-sw.c	optional crypto
 crypto/chacha20_poly1305.c	optional crypto
 crypto/curve25519.c		optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include -I$S/crypto/libsodium"
 crypto/des/des_ecb.c		optional netsmb
 crypto/des/des_setkey.c		optional netsmb
 crypto/openssl/ossl.c		optional ossl
 crypto/openssl/ossl_aes.c	optional ossl
 crypto/openssl/ossl_chacha20.c	optional ossl
 crypto/openssl/ossl_poly1305.c	optional ossl
 crypto/openssl/ossl_sha1.c	optional ossl
 crypto/openssl/ossl_sha256.c	optional ossl
 crypto/openssl/ossl_sha512.c	optional ossl
 crypto/rc4/rc4.c		optional netgraph_mppc_encryption
 crypto/rijndael/rijndael-alg-fst.c optional crypto | ekcd | geom_bde | \
 	!random_loadable | wlan_ccmp
 crypto/rijndael/rijndael-api-fst.c optional ekcd | geom_bde | !random_loadable
 crypto/rijndael/rijndael-api.c	optional crypto | wlan_ccmp
 crypto/sha1.c			optional carp | crypto | ether | \
 	netgraph_mppc_encryption | sctp
 crypto/sha2/sha256c.c		optional crypto | ekcd | geom_bde | \
 	!random_loadable | sctp | zfs
 crypto/sha2/sha512c.c		optional crypto | geom_bde | zfs
 crypto/skein/skein.c		optional crypto | zfs
 crypto/skein/skein_block.c	optional crypto | zfs
 crypto/siphash/siphash.c	optional inet | inet6 | wg
 crypto/siphash/siphash_test.c	optional inet | inet6 | wg
 ddb/db_access.c			optional ddb
 ddb/db_break.c			optional ddb
 ddb/db_capture.c		optional ddb
 ddb/db_command.c		optional ddb
 ddb/db_examine.c		optional ddb
 ddb/db_expr.c			optional ddb
 ddb/db_input.c			optional ddb
 ddb/db_lex.c			optional ddb
 ddb/db_main.c			optional ddb
 ddb/db_output.c			optional ddb
 ddb/db_print.c			optional ddb
 ddb/db_ps.c			optional ddb
 ddb/db_run.c			optional ddb
 ddb/db_script.c			optional ddb
 ddb/db_sym.c			optional ddb
 ddb/db_thread.c			optional ddb
 ddb/db_textdump.c		optional ddb
 ddb/db_variables.c		optional ddb
 ddb/db_watch.c			optional ddb
 ddb/db_write_cmd.c		optional ddb
 dev/aac/aac.c			optional aac
 dev/aac/aac_cam.c		optional aacp aac
 dev/aac/aac_debug.c		optional aac
 dev/aac/aac_disk.c		optional aac
 dev/aac/aac_pci.c		optional aac pci
 dev/aacraid/aacraid.c		optional aacraid
 dev/aacraid/aacraid_cam.c	optional aacraid scbus
 dev/aacraid/aacraid_debug.c	optional aacraid
 dev/aacraid/aacraid_pci.c	optional aacraid pci
 dev/acpi_support/acpi_wmi.c	optional acpi_wmi acpi
 dev/acpi_support/acpi_asus.c	optional acpi_asus acpi
 dev/acpi_support/acpi_asus_wmi.c	optional acpi_asus_wmi acpi
 dev/acpi_support/acpi_fujitsu.c	optional acpi_fujitsu acpi
 dev/acpi_support/acpi_hp.c	optional acpi_hp acpi
 dev/acpi_support/acpi_ibm.c	optional acpi_ibm acpi
 dev/acpi_support/acpi_panasonic.c optional acpi_panasonic acpi
 dev/acpi_support/acpi_sony.c	optional acpi_sony acpi
 dev/acpi_support/acpi_toshiba.c	optional acpi_toshiba acpi
 dev/acpi_support/atk0110.c	optional aibs acpi
 dev/acpica/Osd/OsdDebug.c	optional acpi
 dev/acpica/Osd/OsdHardware.c	optional acpi
 dev/acpica/Osd/OsdInterrupt.c	optional acpi
 dev/acpica/Osd/OsdMemory.c	optional acpi
 dev/acpica/Osd/OsdSchedule.c	optional acpi
 dev/acpica/Osd/OsdStream.c	optional acpi
 dev/acpica/Osd/OsdSynch.c	optional acpi
 dev/acpica/Osd/OsdTable.c	optional acpi
 dev/acpica/acpi.c		optional acpi
 dev/acpica/acpi_acad.c		optional acpi
 dev/acpica/acpi_apei.c		optional acpi
 dev/acpica/acpi_battery.c	optional acpi
 dev/acpica/acpi_button.c	optional acpi
 dev/acpica/acpi_cmbat.c		optional acpi
 dev/acpica/acpi_cpu.c		optional acpi
 dev/acpica/acpi_ec.c		optional acpi
 dev/acpica/acpi_ged.c		optional acpi_ged acpi
 dev/acpica/acpi_isab.c		optional acpi isa
 dev/acpica/acpi_lid.c		optional acpi
 dev/acpica/acpi_package.c	optional acpi
 dev/acpica/acpi_perf.c		optional acpi
 dev/acpica/acpi_powerres.c	optional acpi
 dev/acpica/acpi_quirk.c		optional acpi
 dev/acpica/acpi_resource.c	optional acpi
 dev/acpica/acpi_container.c	optional acpi
 dev/acpica/acpi_smbat.c		optional acpi
 dev/acpica/acpi_thermal.c	optional acpi
 dev/acpica/acpi_throttle.c	optional acpi
 dev/acpica/acpi_video.c		optional acpi_video acpi
 dev/acpica/acpi_dock.c		optional acpi_dock acpi
 dev/adlink/adlink.c		optional adlink
 dev/ae/if_ae.c			optional ae pci
 dev/age/if_age.c		optional age pci
 dev/agp/agp.c			optional agp pci
 dev/agp/agp_if.m		optional agp pci
 dev/ahci/ahci.c			optional ahci
 dev/ahci/ahciem.c		optional ahci
 dev/ahci/ahci_pci.c		optional ahci pci
 dev/aic7xxx/ahc_isa.c		optional ahc isa
 dev/aic7xxx/ahc_pci.c		optional ahc pci \
 	compile-with "${NORMAL_C} ${NO_WCONSTANT_CONVERSION}"
 dev/aic7xxx/ahd_pci.c		optional ahd pci \
 	compile-with "${NORMAL_C} ${NO_WCONSTANT_CONVERSION}"
 dev/aic7xxx/aic7770.c		optional ahc
 dev/aic7xxx/aic79xx.c		optional ahd pci
 dev/aic7xxx/aic79xx_osm.c	optional ahd pci
 dev/aic7xxx/aic79xx_pci.c	optional ahd pci
 dev/aic7xxx/aic79xx_reg_print.c	optional ahd pci ahd_reg_pretty_print
 dev/aic7xxx/aic7xxx.c		optional ahc
 dev/aic7xxx/aic7xxx_93cx6.c	optional ahc
 dev/aic7xxx/aic7xxx_osm.c	optional ahc
 dev/aic7xxx/aic7xxx_pci.c	optional ahc pci
 dev/aic7xxx/aic7xxx_reg_print.c	optional ahc ahc_reg_pretty_print
 dev/al_eth/al_eth.c				optional al_eth	fdt	\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 dev/al_eth/al_init_eth_lm.c			optional al_eth	fdt	\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 dev/al_eth/al_init_eth_kr.c			optional al_eth	fdt	\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 contrib/alpine-hal/al_hal_iofic.c		optional al_iofic	\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 contrib/alpine-hal/al_hal_serdes_25g.c		optional al_serdes	\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 contrib/alpine-hal/al_hal_serdes_hssp.c		optional al_serdes	\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 contrib/alpine-hal/al_hal_udma_config.c		optional al_udma	\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 contrib/alpine-hal/al_hal_udma_debug.c		optional al_udma	\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 contrib/alpine-hal/al_hal_udma_iofic.c		optional al_udma	\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 contrib/alpine-hal/al_hal_udma_main.c		optional al_udma	\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 contrib/alpine-hal/al_serdes.c			optional al_serdes	\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 contrib/alpine-hal/eth/al_hal_eth_kr.c		optional al_eth		\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 contrib/alpine-hal/eth/al_hal_eth_main.c	optional al_eth		\
 	no-depend	\
 	compile-with "${CC} -c -o ${.TARGET} ${CFLAGS} -I$S/contrib/alpine-hal -I$S/contrib/alpine-hal/eth ${.IMPSRC}"
 dev/alc/if_alc.c		optional alc pci
 dev/ale/if_ale.c		optional ale pci
 dev/alpm/alpm.c			optional alpm pci
 dev/altera/avgen/altera_avgen.c		optional altera_avgen
 dev/altera/avgen/altera_avgen_fdt.c	optional altera_avgen fdt
 dev/altera/avgen/altera_avgen_nexus.c	optional altera_avgen
 dev/altera/msgdma/msgdma.c		optional altera_msgdma xdma
 dev/altera/sdcard/altera_sdcard.c	optional altera_sdcard
 dev/altera/sdcard/altera_sdcard_disk.c	optional altera_sdcard
 dev/altera/sdcard/altera_sdcard_io.c	optional altera_sdcard
 dev/altera/sdcard/altera_sdcard_fdt.c	optional altera_sdcard fdt
 dev/altera/sdcard/altera_sdcard_nexus.c	optional altera_sdcard
 dev/altera/softdma/softdma.c	optional altera_softdma xdma fdt
 dev/altera/pio/pio.c		optional altera_pio
 dev/altera/pio/pio_if.m		optional altera_pio
 dev/amdpm/amdpm.c		optional amdpm pci | nfpm pci
 dev/amdsmb/amdsmb.c		optional amdsmb pci
 #
 dev/ata/ata_if.m		optional ata | atacore
 dev/ata/ata-all.c		optional ata | atacore
 dev/ata/ata-dma.c		optional ata | atacore
 dev/ata/ata-lowlevel.c		optional ata | atacore
 dev/ata/ata-sata.c		optional ata | atacore
 dev/ata/ata-isa.c		optional ata isa | ataisa
 dev/ata/ata-pci.c		optional ata pci | atapci
 dev/ata/chipsets/ata-acard.c	optional ata pci | ataacard
 dev/ata/chipsets/ata-acerlabs.c	optional ata pci | ataacerlabs
 dev/ata/chipsets/ata-amd.c	optional ata pci | ataamd
 dev/ata/chipsets/ata-ati.c	optional ata pci | ataati
 dev/ata/chipsets/ata-cenatek.c	optional ata pci | atacenatek
 dev/ata/chipsets/ata-cypress.c	optional ata pci | atacypress
 dev/ata/chipsets/ata-cyrix.c	optional ata pci | atacyrix
 dev/ata/chipsets/ata-highpoint.c	optional ata pci | atahighpoint
 dev/ata/chipsets/ata-intel.c	optional ata pci | ataintel
 dev/ata/chipsets/ata-ite.c	optional ata pci | ataite
 dev/ata/chipsets/ata-jmicron.c	optional ata pci | atajmicron
 dev/ata/chipsets/ata-marvell.c	optional ata pci | atamarvell
 dev/ata/chipsets/ata-micron.c	optional ata pci | atamicron
 dev/ata/chipsets/ata-national.c	optional ata pci | atanational
 dev/ata/chipsets/ata-netcell.c	optional ata pci | atanetcell
 dev/ata/chipsets/ata-nvidia.c	optional ata pci | atanvidia
 dev/ata/chipsets/ata-promise.c	optional ata pci | atapromise
 dev/ata/chipsets/ata-serverworks.c	optional ata pci | ataserverworks
 dev/ata/chipsets/ata-siliconimage.c	optional ata pci | atasiliconimage | ataati
 dev/ata/chipsets/ata-sis.c	optional ata pci | atasis
 dev/ata/chipsets/ata-via.c	optional ata pci | atavia
 #
 dev/ath/if_ath.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_alq.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_beacon.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_btcoex.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_btcoex_mci.c	optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_debug.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_descdma.c	optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_keycache.c	optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_ioctl.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_led.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_lna_div.c	optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_pci.c		optional ath pci \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_tx.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_tx_edma.c	optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_tx_ht.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_tdma.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_sysctl.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_rx.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_rx_edma.c	optional ath \
 	compile-with "${ATH_C}"
 dev/ath/if_ath_spectral.c	optional ath \
 	compile-with "${ATH_C}"
 dev/ath/ah_osdep.c		optional ath \
 	compile-with "${ATH_C}"
 #
 dev/ath/ath_hal/ah.c		optional ath \
 	compile-with "${ATH_C}"
 dev/ath/ath_hal/ah_eeprom_v1.c	optional ath_hal | ath_ar5210 \
 	compile-with "${ATH_C}"
 dev/ath/ath_hal/ah_eeprom_v3.c	optional ath_hal | ath_ar5211 | ath_ar5212 \
 	compile-with "${ATH_C}"
 dev/ath/ath_hal/ah_eeprom_v14.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 \
 	compile-with "${ATH_C}"
 dev/ath/ath_hal/ah_eeprom_v4k.c \
 	optional ath_hal | ath_ar9285 \
 	compile-with "${ATH_C}"
 dev/ath/ath_hal/ah_eeprom_9287.c \
 	optional ath_hal | ath_ar9287 \
 	compile-with "${ATH_C}"
 dev/ath/ath_hal/ah_regdomain.c	optional ath \
 	compile-with "${ATH_C} ${NO_WSHIFT_COUNT_NEGATIVE} ${NO_WSHIFT_COUNT_OVERFLOW}"
 # ar5210
 dev/ath/ath_hal/ar5210/ar5210_attach.c		optional ath_hal | ath_ar5210 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5210/ar5210_beacon.c		optional ath_hal | ath_ar5210 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5210/ar5210_interrupts.c	optional ath_hal | ath_ar5210 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5210/ar5210_keycache.c	optional ath_hal | ath_ar5210 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5210/ar5210_misc.c		optional ath_hal | ath_ar5210 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5210/ar5210_phy.c		optional ath_hal | ath_ar5210 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5210/ar5210_power.c		optional ath_hal | ath_ar5210 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5210/ar5210_recv.c		optional ath_hal | ath_ar5210 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5210/ar5210_reset.c		optional ath_hal | ath_ar5210 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5210/ar5210_xmit.c		optional ath_hal | ath_ar5210 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 # ar5211
 dev/ath/ath_hal/ar5211/ar5211_attach.c		optional ath_hal | ath_ar5211 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5211/ar5211_beacon.c		optional ath_hal | ath_ar5211 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5211/ar5211_interrupts.c	optional ath_hal | ath_ar5211 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5211/ar5211_keycache.c	optional ath_hal | ath_ar5211 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5211/ar5211_misc.c		optional ath_hal | ath_ar5211 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5211/ar5211_phy.c		optional ath_hal | ath_ar5211 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5211/ar5211_power.c		optional ath_hal | ath_ar5211 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5211/ar5211_recv.c		optional ath_hal | ath_ar5211 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5211/ar5211_reset.c		optional ath_hal | ath_ar5211 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5211/ar5211_xmit.c		optional ath_hal | ath_ar5211 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 # ar5212
 dev/ath/ath_hal/ar5212/ar5212_ani.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_attach.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_beacon.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_eeprom.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_gpio.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_interrupts.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_keycache.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_misc.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_phy.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_power.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_recv.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_reset.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_rfgain.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5212_xmit.c \
 	optional ath_hal | ath_ar5212 | ath_ar5416 | ath_ar9160 | ath_ar9280 | \
 	ath_ar9285 ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 # ar5416 (depends on ar5212)
 dev/ath/ath_hal/ar5416/ar5416_ani.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_attach.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_beacon.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_btcoex.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_cal.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_cal_iq.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_cal_adcgain.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_cal_adcdc.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_eeprom.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_gpio.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_interrupts.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_keycache.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_misc.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_phy.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_power.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_radar.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_recv.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_reset.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_spectral.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar5416_xmit.c \
 	optional ath_hal | ath_ar5416 | ath_ar9160 | ath_ar9280 | ath_ar9285 | \
 	ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 # ar9160 (depends on ar5416)
 dev/ath/ath_hal/ar9001/ar9160_attach.c optional ath_hal | ath_ar9160 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 # ar9280 (depends on ar5416)
 dev/ath/ath_hal/ar9002/ar9280_attach.c optional ath_hal | ath_ar9280 | \
 	ath_ar9285 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar9002/ar9280_olc.c optional ath_hal | ath_ar9280 | \
 	ath_ar9285 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 # ar9285 (depends on ar5416 and ar9280)
 dev/ath/ath_hal/ar9002/ar9285_attach.c optional ath_hal | ath_ar9285 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar9002/ar9285_btcoex.c optional ath_hal | ath_ar9285 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar9002/ar9285_reset.c optional ath_hal | ath_ar9285 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar9002/ar9285_cal.c optional ath_hal | ath_ar9285 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar9002/ar9285_phy.c optional ath_hal | ath_ar9285 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar9002/ar9285_diversity.c optional ath_hal | ath_ar9285 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 # ar9287 (depends on ar5416)
 dev/ath/ath_hal/ar9002/ar9287_attach.c optional ath_hal | ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar9002/ar9287_reset.c optional ath_hal | ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar9002/ar9287_cal.c optional ath_hal | ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar9002/ar9287_olc.c optional ath_hal | ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 
 # ar9300
 contrib/dev/ath/ath_hal/ar9300/ar9300_ani.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_attach.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_beacon.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_eeprom.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal ${NO_WCONSTANT_CONVERSION}"
 contrib/dev/ath/ath_hal/ar9300/ar9300_freebsd.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_gpio.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_interrupts.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_keycache.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_mci.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_misc.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_paprd.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_phy.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_power.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_radar.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_radio.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_recv.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_recv_ds.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_reset.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal ${NO_WSOMETIMES_UNINITIALIZED} -Wno-unused-function"
 contrib/dev/ath/ath_hal/ar9300/ar9300_stub.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_stub_funcs.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_spectral.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_timer.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_xmit.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 contrib/dev/ath/ath_hal/ar9300/ar9300_xmit_ds.c optional ath_hal | ath_ar9300 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal -I$S/contrib/dev/ath/ath_hal"
 
 # rf backends
 dev/ath/ath_hal/ar5212/ar2316.c	optional ath_rf2316 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar2317.c	optional ath_rf2317 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar2413.c	optional ath_hal | ath_rf2413 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar2425.c	optional ath_hal | ath_rf2425 | ath_rf2417 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5111.c	optional ath_hal | ath_rf5111 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5112.c	optional ath_hal | ath_rf5112 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5212/ar5413.c	optional ath_hal | ath_rf5413 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar5416/ar2133.c optional ath_hal | ath_ar5416 | \
 	ath_ar9130 | ath_ar9160 | ath_ar9280 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar9002/ar9280.c optional ath_hal | ath_ar9280 | ath_ar9285 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar9002/ar9285.c optional ath_hal | ath_ar9285 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 dev/ath/ath_hal/ar9002/ar9287.c optional ath_hal | ath_ar9287 \
 	compile-with "${ATH_C} -I$S/dev/ath/ath_hal"
 
 # ath rate control algorithms
 dev/ath/ath_rate/amrr/amrr.c	optional ath_rate_amrr \
 	compile-with "${ATH_C}"
 dev/ath/ath_rate/onoe/onoe.c	optional ath_rate_onoe \
 	compile-with "${ATH_C}"
 dev/ath/ath_rate/sample/sample.c	optional ath_rate_sample \
 	compile-with "${ATH_C}"
 # ath DFS modules
 dev/ath/ath_dfs/null/dfs_null.c	optional ath \
 	compile-with "${ATH_C}"
 #
 dev/backlight/backlight_if.m		optional backlight | compat_linuxkpi
 dev/backlight/backlight.c		optional backlight | compat_linuxkpi
 dev/bce/if_bce.c			optional bce
 dev/bfe/if_bfe.c			optional bfe
 dev/bge/if_bge.c			optional bge
 dev/bhnd/bhnd.c				optional bhnd
 dev/bhnd/bhnd_erom.c			optional bhnd
 dev/bhnd/bhnd_erom_if.m			optional bhnd
 dev/bhnd/bhnd_subr.c			optional bhnd
 dev/bhnd/bhnd_bus_if.m			optional bhnd
 dev/bhnd/bhndb/bhnd_bhndb.c		optional bhndb bhnd
 dev/bhnd/bhndb/bhndb.c			optional bhndb bhnd
 dev/bhnd/bhndb/bhndb_bus_if.m		optional bhndb bhnd
 dev/bhnd/bhndb/bhndb_hwdata.c		optional bhndb bhnd
 dev/bhnd/bhndb/bhndb_if.m		optional bhndb bhnd
 dev/bhnd/bhndb/bhndb_pci.c		optional bhndb_pci bhndb bhnd pci
 dev/bhnd/bhndb/bhndb_pci_hwdata.c 	optional bhndb_pci bhndb bhnd pci
 dev/bhnd/bhndb/bhndb_pci_sprom.c	optional bhndb_pci bhndb bhnd pci
 dev/bhnd/bhndb/bhndb_subr.c		optional bhndb bhnd
 dev/bhnd/bcma/bcma.c			optional bcma bhnd
 dev/bhnd/bcma/bcma_bhndb.c		optional bcma bhnd bhndb
 dev/bhnd/bcma/bcma_erom.c		optional bcma bhnd
 dev/bhnd/bcma/bcma_subr.c		optional bcma bhnd
 dev/bhnd/cores/chipc/bhnd_chipc_if.m	optional bhnd
 dev/bhnd/cores/chipc/bhnd_sprom_chipc.c	optional bhnd
 dev/bhnd/cores/chipc/bhnd_pmu_chipc.c	optional bhnd
 dev/bhnd/cores/chipc/chipc.c		optional bhnd
 dev/bhnd/cores/chipc/chipc_cfi.c	optional bhnd cfi 
 dev/bhnd/cores/chipc/chipc_gpio.c	optional bhnd gpio
 dev/bhnd/cores/chipc/chipc_slicer.c	optional bhnd cfi | bhnd spibus
 dev/bhnd/cores/chipc/chipc_spi.c	optional bhnd spibus
 dev/bhnd/cores/chipc/chipc_subr.c	optional bhnd
 dev/bhnd/cores/chipc/pwrctl/bhnd_pwrctl.c	optional bhnd
 dev/bhnd/cores/chipc/pwrctl/bhnd_pwrctl_if.m	optional bhnd
 dev/bhnd/cores/chipc/pwrctl/bhnd_pwrctl_hostb_if.m	optional bhnd
 dev/bhnd/cores/chipc/pwrctl/bhnd_pwrctl_subr.c	optional bhnd
 dev/bhnd/cores/pci/bhnd_pci.c		optional bhnd pci
 dev/bhnd/cores/pci/bhnd_pci_hostb.c	optional bhndb bhnd pci
 dev/bhnd/cores/pci/bhnd_pcib.c		optional bhnd_pcib bhnd pci
 dev/bhnd/cores/pcie2/bhnd_pcie2.c	optional bhnd pci
 dev/bhnd/cores/pcie2/bhnd_pcie2_hostb.c	optional bhndb bhnd pci
 dev/bhnd/cores/pcie2/bhnd_pcie2b.c	optional bhnd_pcie2b bhnd pci
 dev/bhnd/cores/pmu/bhnd_pmu.c		optional bhnd
 dev/bhnd/cores/pmu/bhnd_pmu_core.c	optional bhnd
 dev/bhnd/cores/pmu/bhnd_pmu_if.m	optional bhnd
 dev/bhnd/cores/pmu/bhnd_pmu_subr.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_data.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_data_bcm.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_data_bcmraw.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_data_btxt.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_data_sprom.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_data_sprom_subr.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_data_tlv.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_if.m		optional bhnd
 dev/bhnd/nvram/bhnd_nvram_io.c		optional bhnd
 dev/bhnd/nvram/bhnd_nvram_iobuf.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_ioptr.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_iores.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_plist.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_store.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_store_subr.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_subr.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_value.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_value_fmts.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_value_prf.c	optional bhnd
 dev/bhnd/nvram/bhnd_nvram_value_subr.c	optional bhnd
 dev/bhnd/nvram/bhnd_sprom.c		optional bhnd
 dev/bhnd/siba/siba.c			optional siba bhnd
 dev/bhnd/siba/siba_bhndb.c		optional siba bhnd bhndb
 dev/bhnd/siba/siba_erom.c		optional siba bhnd
 dev/bhnd/siba/siba_subr.c		optional siba bhnd
 #
 dev/bnxt/bnxt_hwrm.c		optional bnxt iflib pci
 dev/bnxt/bnxt_mgmt.c		optional bnxt iflib pci
 dev/bnxt/bnxt_sysctl.c		optional bnxt iflib pci
 dev/bnxt/bnxt_txrx.c		optional bnxt iflib pci
 dev/bnxt/if_bnxt.c		optional bnxt iflib pci
 dev/bwi/bwimac.c		optional bwi
 dev/bwi/bwiphy.c		optional bwi
 dev/bwi/bwirf.c			optional bwi
 dev/bwi/if_bwi.c		optional bwi
 dev/bwi/if_bwi_pci.c		optional bwi pci
 dev/bwn/if_bwn.c		optional bwn bhnd
 dev/bwn/if_bwn_pci.c		optional bwn pci bhnd bhndb bhndb_pci
 dev/bwn/if_bwn_phy_common.c	optional bwn bhnd
 dev/bwn/if_bwn_phy_g.c		optional bwn bhnd
 dev/bwn/if_bwn_phy_lp.c		optional bwn bhnd
 dev/bwn/if_bwn_phy_n.c		optional bwn bhnd
 dev/bwn/if_bwn_util.c		optional bwn bhnd
 dev/cadence/if_cgem.c		optional cgem fdt
 dev/cardbus/card_if.m		standard
 dev/cardbus/cardbus.c		optional cardbus
 dev/cardbus/cardbus_cis.c	optional cardbus
 dev/cardbus/cardbus_device.c	optional cardbus
 dev/cardbus/power_if.m		standard
 dev/cas/if_cas.c		optional cas
 dev/cfi/cfi_bus_fdt.c		optional cfi fdt
 dev/cfi/cfi_bus_nexus.c		optional cfi
 dev/cfi/cfi_core.c		optional cfi
 dev/cfi/cfi_dev.c		optional cfi
 dev/cfi/cfi_disk.c		optional cfid
 dev/chromebook_platform/chromebook_platform.c	optional chromebook_platform
 dev/ciss/ciss.c			optional ciss
 dev/clk/clk.c			optional clk
 dev/clk/clkdev_if.m		optional clk
 dev/clk/clknode_if.m		optional clk
 dev/clk/clk_bus.c		optional clk fdt
 dev/clk/clk_div.c		optional clk
 dev/clk/clk_fixed.c		optional clk
 dev/clk/clk_gate.c		optional clk
 dev/clk/clk_link.c		optional clk
 dev/clk/clk_mux.c		optional clk
 dev/cpufreq/ichss.c		optional cpufreq pci
 dev/cxgb/cxgb_main.c		optional cxgb pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgb/cxgb_sge.c		optional cxgb pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgb/common/cxgb_mc5.c	optional cxgb pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgb/common/cxgb_vsc7323.c	optional cxgb pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgb/common/cxgb_vsc8211.c	optional cxgb pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgb/common/cxgb_ael1002.c	optional cxgb pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgb/common/cxgb_aq100x.c	optional cxgb pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgb/common/cxgb_mv88e1xxx.c	optional cxgb pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgb/common/cxgb_xgmac.c	optional cxgb pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgb/common/cxgb_t3_hw.c	optional cxgb pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgb/common/cxgb_tn1010.c	optional cxgb pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgb/sys/uipc_mvec.c	optional cxgb pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgb/cxgb_t3fw.c		optional cxgb cxgb_t3fw \
 	compile-with "${NORMAL_C} -I$S/dev/cxgb"
 dev/cxgbe/t4_clip.c		optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/t4_filter.c		optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/t4_if.m		optional cxgbe pci
 dev/cxgbe/t4_iov.c		optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/t4_mp_ring.c		optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/t4_main.c		optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/t4_netmap.c		optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/t4_sched.c		optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/t4_sge.c		optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/t4_smt.c		optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/t4_l2t.c		optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/t4_tracer.c		optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/t4_vf.c		optional cxgbev pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/common/t4_hw.c	optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/common/t4vf_hw.c	optional cxgbev pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/crypto/t6_kern_tls.c	optional cxgbe pci kern_tls \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/crypto/t4_keyctx.c	optional cxgbe pci \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/cudbg/cudbg_common.c	optional cxgbe \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/cudbg/cudbg_flash_utils.c	optional cxgbe \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/cudbg/cudbg_lib.c	optional cxgbe \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/cudbg/cudbg_wtp.c	optional cxgbe \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/cudbg/fastlz.c	optional cxgbe \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cxgbe/cudbg/fastlz_api.c	optional cxgbe \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 t4fw_cfg.c		optional cxgbe					\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk t4fw_cfg.fw:t4fw_cfg t4fw_cfg_uwire.fw:t4fw_cfg_uwire t4fw.fw:t4fw -mt4fw_cfg -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"t4fw_cfg.c"
 t4fw_cfg.fwo		optional cxgbe					\
 	dependency	"t4fw_cfg.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"t4fw_cfg.fwo"
 t4fw_cfg.fw		optional cxgbe					\
 	dependency	"$S/dev/cxgbe/firmware/t4fw_cfg.txt"		\
 	compile-with	"${CP} ${.ALLSRC} ${.TARGET}"			\
 	no-obj no-implicit-rule						\
 	clean		"t4fw_cfg.fw"
 t4fw_cfg_uwire.fwo	optional cxgbe					\
 	dependency	"t4fw_cfg_uwire.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"t4fw_cfg_uwire.fwo"
 t4fw_cfg_uwire.fw	optional cxgbe					\
 	dependency	"$S/dev/cxgbe/firmware/t4fw_cfg_uwire.txt"	\
 	compile-with	"${CP} ${.ALLSRC} ${.TARGET}"			\
 	no-obj no-implicit-rule						\
 	clean		"t4fw_cfg_uwire.fw"
 t4fw.fwo		optional cxgbe					\
 	dependency	"t4fw.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"t4fw.fwo"
 t4fw.fw			optional cxgbe					\
 	dependency	"$S/dev/cxgbe/firmware/t4fw-1.27.5.0.bin"	\
 	compile-with	"${CP} ${.ALLSRC} ${.TARGET}"			\
 	no-obj no-implicit-rule						\
 	clean		"t4fw.fw"
 t5fw_cfg.c		optional cxgbe					\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk t5fw_cfg.fw:t5fw_cfg t5fw_cfg_uwire.fw:t5fw_cfg_uwire t5fw.fw:t5fw -mt5fw_cfg -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"t5fw_cfg.c"
 t5fw_cfg.fwo		optional cxgbe					\
 	dependency	"t5fw_cfg.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"t5fw_cfg.fwo"
 t5fw_cfg.fw		optional cxgbe					\
 	dependency	"$S/dev/cxgbe/firmware/t5fw_cfg.txt"		\
 	compile-with	"${CP} ${.ALLSRC} ${.TARGET}"			\
 	no-obj no-implicit-rule						\
 	clean		"t5fw_cfg.fw"
 t5fw_cfg_uwire.fwo	optional cxgbe					\
 	dependency	"t5fw_cfg_uwire.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"t5fw_cfg_uwire.fwo"
 t5fw_cfg_uwire.fw	optional cxgbe					\
 	dependency	"$S/dev/cxgbe/firmware/t5fw_cfg_uwire.txt"	\
 	compile-with	"${CP} ${.ALLSRC} ${.TARGET}"			\
 	no-obj no-implicit-rule						\
 	clean		"t5fw_cfg_uwire.fw"
 t5fw.fwo		optional cxgbe					\
 	dependency	"t5fw.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"t5fw.fwo"
 t5fw.fw			optional cxgbe					\
 	dependency	"$S/dev/cxgbe/firmware/t5fw-1.27.5.0.bin"	\
 	compile-with	"${CP} ${.ALLSRC} ${.TARGET}"			\
 	no-obj no-implicit-rule						\
 	clean		"t5fw.fw"
 t6fw_cfg.c		optional cxgbe					\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk t6fw_cfg.fw:t6fw_cfg t6fw_cfg_uwire.fw:t6fw_cfg_uwire t6fw.fw:t6fw -mt6fw_cfg -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"t6fw_cfg.c"
 t6fw_cfg.fwo		optional cxgbe					\
 	dependency	"t6fw_cfg.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"t6fw_cfg.fwo"
 t6fw_cfg.fw		optional cxgbe					\
 	dependency	"$S/dev/cxgbe/firmware/t6fw_cfg.txt"		\
 	compile-with	"${CP} ${.ALLSRC} ${.TARGET}"			\
 	no-obj no-implicit-rule						\
 	clean		"t6fw_cfg.fw"
 t6fw_cfg_uwire.fwo	optional cxgbe					\
 	dependency	"t6fw_cfg_uwire.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"t6fw_cfg_uwire.fwo"
 t6fw_cfg_uwire.fw	optional cxgbe					\
 	dependency	"$S/dev/cxgbe/firmware/t6fw_cfg_uwire.txt"	\
 	compile-with	"${CP} ${.ALLSRC} ${.TARGET}"			\
 	no-obj no-implicit-rule						\
 	clean		"t6fw_cfg_uwire.fw"
 t6fw.fwo		optional cxgbe					\
 	dependency	"t6fw.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"t6fw.fwo"
 t6fw.fw			optional cxgbe					\
 	dependency	"$S/dev/cxgbe/firmware/t6fw-1.27.5.0.bin"	\
 	compile-with	"${CP} ${.ALLSRC} ${.TARGET}"			\
 	no-obj no-implicit-rule						\
 	clean		"t6fw.fw"
 dev/cxgbe/crypto/t4_crypto.c	optional ccr \
 	compile-with "${NORMAL_C} -I$S/dev/cxgbe"
 dev/cyapa/cyapa.c		optional cyapa iicbus
 dev/dc/if_dc.c			optional dc pci
 dev/dc/dcphy.c			optional dc pci
 dev/dc/pnphy.c			optional dc pci
 dev/dcons/dcons.c		optional dcons
 dev/dcons/dcons_crom.c		optional dcons_crom
 dev/dcons/dcons_os.c		optional dcons
 dev/dialog/da9063/da9063_if.m	optional da9063_pmic
 dev/dialog/da9063/da9063_iic.c	optional da9063_pmic iicbus fdt
 dev/dialog/da9063/da9063_rtc.c	optional da9063_rtc fdt
 dev/drm2/drm_agpsupport.c	optional drm2
 dev/drm2/drm_auth.c		optional drm2
 dev/drm2/drm_bufs.c		optional drm2
 dev/drm2/drm_buffer.c		optional drm2
 dev/drm2/drm_context.c		optional drm2
 dev/drm2/drm_crtc.c		optional drm2
 dev/drm2/drm_crtc_helper.c	optional drm2
 dev/drm2/drm_dma.c		optional drm2
 dev/drm2/drm_dp_helper.c	optional drm2
 dev/drm2/drm_dp_iic_helper.c	optional drm2
 dev/drm2/drm_drv.c		optional drm2
 dev/drm2/drm_edid.c		optional drm2
 dev/drm2/drm_fb_helper.c	optional drm2
 dev/drm2/drm_fops.c		optional drm2
 dev/drm2/drm_gem.c		optional drm2
 dev/drm2/drm_gem_names.c	optional drm2
 dev/drm2/drm_global.c		optional drm2
 dev/drm2/drm_hashtab.c		optional drm2
 dev/drm2/drm_ioctl.c		optional drm2
 dev/drm2/drm_irq.c		optional drm2
 dev/drm2/drm_linux_list_sort.c	optional drm2
 dev/drm2/drm_lock.c		optional drm2
 dev/drm2/drm_memory.c		optional drm2
 dev/drm2/drm_mm.c		optional drm2
 dev/drm2/drm_modes.c		optional drm2
 dev/drm2/drm_pci.c		optional drm2
 dev/drm2/drm_platform.c		optional drm2
 dev/drm2/drm_scatter.c		optional drm2
 dev/drm2/drm_stub.c		optional drm2
 dev/drm2/drm_sysctl.c		optional drm2
 dev/drm2/drm_vm.c		optional drm2
 dev/drm2/drm_os_freebsd.c	optional drm2
 dev/drm2/ttm/ttm_agp_backend.c	optional drm2
 dev/drm2/ttm/ttm_lock.c		optional drm2
 dev/drm2/ttm/ttm_object.c	optional drm2
 dev/drm2/ttm/ttm_tt.c		optional drm2
 dev/drm2/ttm/ttm_bo_util.c	optional drm2
 dev/drm2/ttm/ttm_bo.c		optional drm2
 dev/drm2/ttm/ttm_bo_manager.c	optional drm2
 dev/drm2/ttm/ttm_execbuf_util.c	optional drm2
 dev/drm2/ttm/ttm_memory.c	optional drm2
 dev/drm2/ttm/ttm_page_alloc.c	optional drm2
 dev/drm2/ttm/ttm_bo_vm.c	optional drm2
 dev/efidev/efidev.c		optional efirt
 dev/efidev/efirt.c		optional efirt
 dev/efidev/efirtc.c		optional efirt
 dev/e1000/if_em.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/em_txrx.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/igb_txrx.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_80003es2lan.c	optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_82540.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_82541.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_82542.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_82543.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_82571.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_82575.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_ich8lan.c	optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_i210.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_api.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_base.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_mac.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_manage.c	optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_nvm.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_phy.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_vf.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_mbx.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/e1000/e1000_osdep.c		optional em \
 	compile-with "${NORMAL_C} -I$S/dev/e1000"
 dev/et/if_et.c			optional et
 dev/ena/ena.c			optional ena \
 	compile-with "${NORMAL_C} -I$S/contrib"
 dev/ena/ena_datapath.c		optional ena \
 	compile-with "${NORMAL_C} -I$S/contrib"
 dev/ena/ena_netmap.c		optional ena \
 	compile-with "${NORMAL_C} -I$S/contrib"
 dev/ena/ena_rss.c		optional ena \
 	compile-with "${NORMAL_C} -I$S/contrib"
 dev/ena/ena_sysctl.c 		optional ena \
 	compile-with "${NORMAL_C} -I$S/contrib"
 contrib/ena-com/ena_com.c	optional ena
 contrib/ena-com/ena_eth_com.c	optional ena
 dev/etherswitch/arswitch/arswitch.c		optional arswitch
 dev/etherswitch/arswitch/arswitch_reg.c		optional arswitch
 dev/etherswitch/arswitch/arswitch_phy.c		optional arswitch
 dev/etherswitch/arswitch/arswitch_8216.c	optional arswitch
 dev/etherswitch/arswitch/arswitch_8226.c	optional arswitch
 dev/etherswitch/arswitch/arswitch_8316.c	optional arswitch
 dev/etherswitch/arswitch/arswitch_8327.c	optional arswitch
 dev/etherswitch/arswitch/arswitch_vlans.c	optional arswitch
 dev/etherswitch/etherswitch.c		optional etherswitch
 dev/etherswitch/etherswitch_if.m	optional etherswitch
 dev/etherswitch/ip17x/ip17x.c		optional ip17x
 dev/etherswitch/ip17x/ip175c.c		optional ip17x
 dev/etherswitch/ip17x/ip175d.c		optional ip17x
 dev/etherswitch/ip17x/ip17x_phy.c	optional ip17x
 dev/etherswitch/ip17x/ip17x_vlans.c	optional ip17x
 dev/etherswitch/miiproxy.c		optional miiproxy
 dev/etherswitch/rtl8366/rtl8366rb.c	optional rtl8366rb
 dev/etherswitch/e6000sw/e6000sw.c	optional e6000sw fdt
 dev/etherswitch/e6000sw/e6060sw.c	optional e6060sw
 dev/etherswitch/infineon/adm6996fc.c	optional adm6996fc
 dev/etherswitch/micrel/ksz8995ma.c	optional ksz8995ma
 dev/etherswitch/ukswitch/ukswitch.c	optional ukswitch
 dev/evdev/cdev.c			optional evdev
 dev/evdev/evdev.c			optional evdev
 dev/evdev/evdev_mt.c			optional evdev
 dev/evdev/evdev_utils.c			optional evdev
 dev/evdev/uinput.c			optional evdev uinput
 dev/exca/exca.c			optional cbb
 dev/fb/fbd.c			optional fbd | vt
 dev/fb/fb_if.m			standard
 dev/fb/splash.c			optional sc splash
 dev/fdt/fdt_clock.c		optional fdt fdt_clock
 dev/fdt/fdt_clock_if.m		optional fdt fdt_clock
 dev/fdt/fdt_common.c		optional fdt
 dev/fdt/fdt_pinctrl.c		optional fdt fdt_pinctrl
 dev/fdt/fdt_pinctrl_if.m	optional fdt fdt_pinctrl
 dev/fdt/fdt_slicer.c		optional fdt cfi | fdt mx25l | fdt n25q | fdt at45d
 dev/fdt/fdt_static_dtb.S	optional fdt fdt_dtb_static \
 	dependency	"${FDT_DTS_FILE:T:R}.dtb"
 dev/fdt/simplebus.c		optional fdt
 dev/fdt/simple_mfd.c		optional syscon fdt
 dev/filemon/filemon.c		optional filemon
 dev/firewire/firewire.c		optional firewire
 dev/firewire/fwcrom.c		optional firewire
 dev/firewire/fwdev.c		optional firewire
 dev/firewire/fwdma.c		optional firewire
 dev/firewire/fwmem.c		optional firewire
 dev/firewire/fwohci.c		optional firewire
 dev/firewire/fwohci_pci.c	optional firewire pci
 dev/firewire/if_fwe.c		optional fwe
 dev/firewire/if_fwip.c		optional fwip
 dev/firewire/sbp.c		optional sbp
 dev/firewire/sbp_targ.c		optional sbp_targ
 dev/flash/at45d.c		optional at45d
 dev/flash/cqspi.c		optional cqspi fdt xdma
 dev/flash/mx25l.c		optional mx25l
 dev/flash/n25q.c		optional n25q fdt
 dev/flash/qspi_if.m		optional cqspi fdt | n25q fdt
 dev/fxp/if_fxp.c		optional fxp
 dev/fxp/inphy.c			optional fxp
 dev/gem/if_gem.c		optional gem
 dev/gem/if_gem_pci.c		optional gem pci
 dev/gve/gve_adminq.c		optional gve
 dev/gve/gve_main.c		optional gve
 dev/gve/gve_qpl.c		optional gve
 dev/gve/gve_rx.c		optional gve
 dev/gve/gve_sysctl.c		optional gve
 dev/gve/gve_tx.c		optional gve
 dev/gve/gve_utils.c		optional gve
 dev/goldfish/goldfish_rtc.c	optional goldfish_rtc fdt
 dev/gpio/dwgpio/dwgpio.c	optional gpio dwgpio fdt
 dev/gpio/dwgpio/dwgpio_bus.c	optional gpio dwgpio fdt
 dev/gpio/dwgpio/dwgpio_if.m	optional gpio dwgpio fdt
 dev/gpio/gpiobacklight.c	optional gpiobacklight fdt
 dev/gpio/gpiokeys.c		optional gpiokeys fdt
 dev/gpio/gpiokeys_codes.c	optional gpiokeys fdt
 dev/gpio/gpiobus.c		optional gpio				\
 	dependency	"gpiobus_if.h"
 dev/gpio/gpioc.c		optional gpio				\
 	dependency	"gpio_if.h"
 dev/gpio/gpioiic.c		optional gpioiic
 dev/gpio/gpioled.c		optional gpioled !fdt
 dev/gpio/gpioled_fdt.c		optional gpioled fdt
 dev/gpio/gpiomdio.c		optional gpiomdio mii_bitbang
 dev/gpio/gpiopower.c		optional gpiopower fdt
 dev/gpio/gpioregulator.c	optional gpioregulator fdt
 dev/gpio/gpiospi.c		optional gpiospi
 dev/gpio/gpioths.c		optional gpioths
 dev/gpio/gpio_if.m		optional gpio
 dev/gpio/gpiobus_if.m		optional gpio
 dev/gpio/gpiopps.c		optional gpiopps fdt
 dev/gpio/ofw_gpiobus.c		optional fdt gpio
 dev/hid/bcm5974.c		optional bcm5974
 dev/hid/hconf.c			optional hconf
 dev/hid/hcons.c			optional hcons
 dev/hid/hgame.c			optional hgame
 dev/hid/hid.c			optional hid
 dev/hid/hid_if.m		optional hid
 dev/hid/hidbus.c		optional hidbus
 dev/hid/hidmap.c		optional hidmap
 dev/hid/hidquirk.c		optional hid
 dev/hid/hidraw.c		optional hidraw
 dev/hid/hkbd.c			optional hkbd
 dev/hid/hms.c			optional hms
 dev/hid/hmt.c			optional hmt hconf
 dev/hid/hpen.c			optional hpen
 dev/hid/hsctrl.c		optional hsctrl
 dev/hid/ietp.c			optional ietp
 dev/hid/ps4dshock.c		optional ps4dshock
 dev/hid/xb360gp.c		optional xb360gp
 dev/hifn/hifn7751.c		optional hifn
 dev/hptiop/hptiop.c		optional hptiop scbus
 dev/hwpmc/hwpmc_logging.c	optional hwpmc
 dev/hwpmc/hwpmc_mod.c		optional hwpmc
 dev/hwpmc/hwpmc_soft.c		optional hwpmc
 dev/hwreset/hwreset.c		optional hwreset
 dev/hwreset/hwreset_array.c	optional hwreset
 dev/hwreset/hwreset_if.m	optional hwreset
 dev/ichiic/ig4_acpi.c		optional ig4 acpi iicbus
 dev/ichiic/ig4_iic.c		optional ig4 iicbus
 dev/ichiic/ig4_pci.c		optional ig4 pci iicbus
 dev/ichsmb/ichsmb.c		optional ichsmb
 dev/ichsmb/ichsmb_pci.c		optional ichsmb pci
 dev/ida/ida.c			optional ida
 dev/ida/ida_disk.c		optional ida
 dev/ida/ida_pci.c		optional ida pci
 dev/iicbus/acpi_iicbus.c	optional acpi iicbus | acpi compat_linuxkpi
 dev/iicbus/icee.c		optional icee
 dev/iicbus/if_ic.c		optional ic
 dev/iicbus/iic.c		optional iic
 dev/iicbus/iic_recover_bus.c	optional iicbus | compat_linuxkpi
 dev/iicbus/iicbb.c		optional iicbb | compat_linuxkpi
 dev/iicbus/iicbb_if.m		optional iicbb | compat_linuxkpi
 dev/iicbus/iicbus.c		optional iicbus | compat_linuxkpi
 dev/iicbus/iicbus_if.m		optional iicbus | compat_linuxkpi
 dev/iicbus/iichid.c		optional iichid acpi hid iicbus
 dev/iicbus/iiconf.c		optional iicbus | compat_linuxkpi
 dev/iicbus/iicsmb.c		optional iicsmb				\
 	dependency	"iicbus_if.h"
 dev/iicbus/adc/ad7418.c		optional ad7418
 dev/iicbus/adc/ads111x.c	optional ads111x
 dev/iicbus/adc/pcf8591.c	optional pcf8591
 dev/iicbus/controller/opencores/iicoc.c	optional iicoc
 dev/iicbus/controller/opencores/iicoc_fdt.c	optional iicoc fdt
 dev/iicbus/controller/opencores/iicoc_pci.c	optional iicoc pci
 dev/iicbus/mux/iicmux.c		optional iicmux
 dev/iicbus/mux/iicmux_if.m	optional iicmux
 dev/iicbus/mux/iic_gpiomux.c	optional iic_gpiomux fdt
 dev/iicbus/mux/ltc430x.c	optional ltc430x
 dev/iicbus/mux/pca954x.c	optional pca954x iicbus iicmux
 dev/iicbus/ofw_iicbus.c		optional fdt iicbus
 dev/iicbus/ofw_iicbus_if.m	optional fdt iicbus
 dev/iicbus/rtc/ds1307.c		optional ds1307
 dev/iicbus/rtc/ds13rtc.c	optional ds13rtc | ds133x | ds1374
 dev/iicbus/rtc/ds1672.c		optional ds1672
 dev/iicbus/rtc/ds3231.c		optional ds3231
 dev/iicbus/rtc/isl12xx.c	optional isl12xx
 dev/iicbus/rtc/nxprtc.c		optional nxprtc | pcf8563
 dev/iicbus/rtc/pcf85063.c	optional pcf85063 iicbus fdt
 dev/iicbus/rtc/rtc8583.c	optional rtc8583
 dev/iicbus/rtc/rv3032.c		optional rv3032 iicbus fdt
 dev/iicbus/rtc/rx8803.c		optional rx8803 iicbus fdt
 dev/iicbus/rtc/s35390a.c	optional s35390a
 dev/iicbus/sensor/htu21.c	optional htu21
 dev/iicbus/sensor/lm75.c	optional lm75
 dev/iicbus/sensor/max44009.c	optional max44009
 dev/iicbus/gpio/pcf8574.c	optional pcf8574
 dev/iicbus/gpio/tca64xx.c	optional tca64xx fdt gpio
 dev/iicbus/pmic/fan53555.c	optional fan53555 fdt | tcs4525 fdt
 dev/iicbus/pmic/silergy/sy8106a.c	optional sy8106a fdt
 dev/iicbus/pmic/silergy/syr827.c	optional syr827 fdt
 dev/igc/if_igc.c		optional igc iflib pci
 dev/igc/igc_api.c		optional igc iflib pci
 dev/igc/igc_base.c		optional igc iflib pci
 dev/igc/igc_i225.c		optional igc iflib pci
 dev/igc/igc_mac.c		optional igc iflib pci
 dev/igc/igc_nvm.c		optional igc iflib pci
 dev/igc/igc_phy.c		optional igc iflib pci
 dev/igc/igc_txrx.c		optional igc iflib pci
 dev/intpm/intpm.c		optional intpm pci
 # XXX Work around clang warning, until maintainer approves fix.
 dev/ips/ips.c			optional ips \
 	compile-with "${NORMAL_C} ${NO_WSOMETIMES_UNINITIALIZED}"
 dev/ips/ips_commands.c		optional ips
 dev/ips/ips_disk.c		optional ips
 dev/ips/ips_ioctl.c		optional ips
 dev/ips/ips_pci.c		optional ips pci
 dev/ipw/if_ipw.c		optional ipw
 ipwbssfw.c			optional ipwbssfw | ipwfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk ipw_bss.fw:ipw_bss:130 -lintel_ipw -mipw_bss -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"ipwbssfw.c"
 ipw_bss.fwo			optional ipwbssfw | ipwfw		\
 	dependency	"ipw_bss.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"ipw_bss.fwo"
 ipw_bss.fw			optional ipwbssfw | ipwfw		\
 	dependency	"$S/contrib/dev/ipw/ipw2100-1.3.fw.uu"		\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"ipw_bss.fw"
 ipwibssfw.c			optional ipwibssfw | ipwfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk ipw_ibss.fw:ipw_ibss:130 -lintel_ipw -mipw_ibss -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"ipwibssfw.c"
 ipw_ibss.fwo			optional ipwibssfw | ipwfw		\
 	dependency	"ipw_ibss.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"ipw_ibss.fwo"
 ipw_ibss.fw			optional ipwibssfw | ipwfw		\
 	dependency	"$S/contrib/dev/ipw/ipw2100-1.3-i.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"ipw_ibss.fw"
 ipwmonitorfw.c			optional ipwmonitorfw | ipwfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk ipw_monitor.fw:ipw_monitor:130 -lintel_ipw -mipw_monitor -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"ipwmonitorfw.c"
 ipw_monitor.fwo			optional ipwmonitorfw | ipwfw		\
 	dependency	"ipw_monitor.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"ipw_monitor.fwo"
 ipw_monitor.fw			optional ipwmonitorfw | ipwfw		\
 	dependency	"$S/contrib/dev/ipw/ipw2100-1.3-p.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"ipw_monitor.fw"
 dev/iscsi/icl.c			optional iscsi
 dev/iscsi/icl_conn_if.m		optional cfiscsi | iscsi
 dev/iscsi/icl_soft.c		optional iscsi
 dev/iscsi/icl_soft_proxy.c	optional iscsi
 dev/iscsi/iscsi.c		optional iscsi scbus
 dev/ismt/ismt.c			optional ismt
 dev/isl/isl.c			optional isl iicbus
 dev/isp/isp.c			optional isp
 dev/isp/isp_freebsd.c		optional isp
 dev/isp/isp_library.c		optional isp
 dev/isp/isp_pci.c		optional isp pci
 dev/isp/isp_target.c		optional isp
 dev/ispfw/ispfw.c		optional ispfw
 dev/iwi/if_iwi.c		optional iwi
 iwibssfw.c			optional iwibssfw | iwifw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwi_bss.fw:iwi_bss:300 -lintel_iwi -miwi_bss -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwibssfw.c"
 iwi_bss.fwo			optional iwibssfw | iwifw		\
 	dependency	"iwi_bss.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwi_bss.fwo"
 iwi_bss.fw			optional iwibssfw | iwifw		\
 	dependency	"$S/contrib/dev/iwi/ipw2200-bss.fw.uu"		\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwi_bss.fw"
 iwiibssfw.c			optional iwiibssfw | iwifw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwi_ibss.fw:iwi_ibss:300 -lintel_iwi -miwi_ibss -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwiibssfw.c"
 iwi_ibss.fwo			optional iwiibssfw | iwifw		\
 	dependency	"iwi_ibss.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwi_ibss.fwo"
 iwi_ibss.fw			optional iwiibssfw | iwifw		\
 	dependency	"$S/contrib/dev/iwi/ipw2200-ibss.fw.uu"		\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwi_ibss.fw"
 iwimonitorfw.c			optional iwimonitorfw | iwifw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwi_monitor.fw:iwi_monitor:300 -lintel_iwi -miwi_monitor -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwimonitorfw.c"
 iwi_monitor.fwo			optional iwimonitorfw | iwifw		\
 	dependency	"iwi_monitor.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwi_monitor.fwo"
 iwi_monitor.fw			optional iwimonitorfw | iwifw		\
 	dependency	"$S/contrib/dev/iwi/ipw2200-sniffer.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwi_monitor.fw"
 dev/iwm/if_iwm.c		optional iwm
 dev/iwm/if_iwm_7000.c		optional iwm
 dev/iwm/if_iwm_8000.c		optional iwm
 dev/iwm/if_iwm_9000.c		optional iwm
 dev/iwm/if_iwm_9260.c		optional iwm
 dev/iwm/if_iwm_binding.c	optional iwm
 dev/iwm/if_iwm_fw.c		optional iwm
 dev/iwm/if_iwm_led.c		optional iwm
 dev/iwm/if_iwm_mac_ctxt.c	optional iwm
 dev/iwm/if_iwm_notif_wait.c	optional iwm
 dev/iwm/if_iwm_pcie_trans.c	optional iwm
 dev/iwm/if_iwm_phy_ctxt.c	optional iwm
 dev/iwm/if_iwm_phy_db.c		optional iwm
 dev/iwm/if_iwm_power.c		optional iwm
 dev/iwm/if_iwm_scan.c		optional iwm
 dev/iwm/if_iwm_sf.c		optional iwm
 dev/iwm/if_iwm_sta.c		optional iwm
 dev/iwm/if_iwm_time_event.c	optional iwm
 dev/iwm/if_iwm_util.c		optional iwm
 iwm3160fw.c			optional iwm3160fw | iwmfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwm3160.fw:iwm3160fw -miwm3160fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwm3160fw.c"
 iwm3160fw.fwo			optional iwm3160fw | iwmfw		\
 	dependency	"iwm3160.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwm3160fw.fwo"
 iwm3160.fw			optional iwm3160fw | iwmfw		\
 	dependency	"$S/contrib/dev/iwm/iwm-3160-17.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwm3160.fw"
 iwm3168fw.c			optional iwm3168fw | iwmfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwm3168.fw:iwm3168fw -miwm3168fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwm3168fw.c"
 iwm3168fw.fwo			optional iwm3168fw | iwmfw		\
 	dependency	"iwm3168.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwm3168fw.fwo"
 iwm3168.fw			optional iwm3168fw | iwmfw		\
 	dependency	"$S/contrib/dev/iwm/iwm-3168-22.fw.uu"		\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwm3168.fw"
 iwm7260fw.c			optional iwm7260fw | iwmfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwm7260.fw:iwm7260fw -miwm7260fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwm7260fw.c"
 iwm7260fw.fwo			optional iwm7260fw | iwmfw		\
 	dependency	"iwm7260.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwm7260fw.fwo"
 iwm7260.fw			optional iwm7260fw | iwmfw		\
 	dependency	"$S/contrib/dev/iwm/iwm-7260-17.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwm7260.fw"
 iwm7265fw.c			optional iwm7265fw | iwmfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwm7265.fw:iwm7265fw -miwm7265fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwm7265fw.c"
 iwm7265fw.fwo			optional iwm7265fw | iwmfw		\
 	dependency	"iwm7265.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwm7265fw.fwo"
 iwm7265.fw			optional iwm7265fw | iwmfw		\
 	dependency	"$S/contrib/dev/iwm/iwm-7265-17.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwm7265.fw"
 iwm7265Dfw.c			optional iwm7265Dfw | iwmfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwm7265D.fw:iwm7265Dfw -miwm7265Dfw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwm7265Dfw.c"
 iwm7265Dfw.fwo			optional iwm7265Dfw | iwmfw		\
 	dependency	"iwm7265D.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwm7265Dfw.fwo"
 iwm7265D.fw			optional iwm7265Dfw | iwmfw		\
 	dependency	"$S/contrib/dev/iwm/iwm-7265D-17.fw.uu"		\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwm7265D.fw"
 iwm8000Cfw.c			optional iwm8000Cfw | iwmfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwm8000C.fw:iwm8000Cfw -miwm8000Cfw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwm8000Cfw.c"
 iwm8000Cfw.fwo			optional iwm8000Cfw | iwmfw		\
 	dependency	"iwm8000C.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwm8000Cfw.fwo"
 iwm8000C.fw			optional iwm8000Cfw | iwmfw		\
 	dependency	"$S/contrib/dev/iwm/iwm-8000C-16.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwm8000C.fw"
 iwm8265.fw			optional iwm8265fw | iwmfw		\
 	dependency	"$S/contrib/dev/iwm/iwm-8265-22.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwm8265.fw"
 iwm8265fw.c			optional iwm8265fw | iwmfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwm8265.fw:iwm8265fw -miwm8265fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwm8265fw.c"
 iwm8265fw.fwo			optional iwm8265fw | iwmfw		\
 	dependency	"iwm8265.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwm8265fw.fwo"
 dev/iwn/if_iwn.c		optional iwn
 iwn1000fw.c			optional iwn1000fw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn1000.fw:iwn1000fw -miwn1000fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn1000fw.c"
 iwn1000fw.fwo			optional iwn1000fw | iwnfw		\
 	dependency	"iwn1000.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn1000fw.fwo"
 iwn1000.fw			optional iwn1000fw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwlwifi-1000-39.31.5.1.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn1000.fw"
 iwn100fw.c			optional iwn100fw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn100.fw:iwn100fw -miwn100fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn100fw.c"
 iwn100fw.fwo			optional iwn100fw | iwnfw		\
 	dependency	"iwn100.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn100fw.fwo"
 iwn100.fw			optional iwn100fw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwlwifi-100-39.31.5.1.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn100.fw"
 iwn105fw.c			optional iwn105fw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn105.fw:iwn105fw -miwn105fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn105fw.c"
 iwn105fw.fwo			optional iwn105fw | iwnfw		\
 	dependency	"iwn105.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn105fw.fwo"
 iwn105.fw			optional iwn105fw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwlwifi-105-6-18.168.6.1.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn105.fw"
 iwn135fw.c			optional iwn135fw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn135.fw:iwn135fw -miwn135fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn135fw.c"
 iwn135fw.fwo			optional iwn135fw | iwnfw		\
 	dependency	"iwn135.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn135fw.fwo"
 iwn135.fw			optional iwn135fw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwlwifi-135-6-18.168.6.1.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn135.fw"
 iwn2000fw.c			optional iwn2000fw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn2000.fw:iwn2000fw -miwn2000fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn2000fw.c"
 iwn2000fw.fwo			optional iwn2000fw | iwnfw		\
 	dependency	"iwn2000.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn2000fw.fwo"
 iwn2000.fw			optional iwn2000fw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwlwifi-2000-18.168.6.1.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn2000.fw"
 iwn2030fw.c			optional iwn2030fw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn2030.fw:iwn2030fw -miwn2030fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn2030fw.c"
 iwn2030fw.fwo			optional iwn2030fw | iwnfw		\
 	dependency	"iwn2030.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn2030fw.fwo"
 iwn2030.fw			optional iwn2030fw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwnwifi-2030-18.168.6.1.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn2030.fw"
 iwn4965fw.c			optional iwn4965fw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn4965.fw:iwn4965fw -miwn4965fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn4965fw.c"
 iwn4965fw.fwo			optional iwn4965fw | iwnfw		\
 	dependency	"iwn4965.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn4965fw.fwo"
 iwn4965.fw			optional iwn4965fw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwlwifi-4965-228.61.2.24.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn4965.fw"
 iwn5000fw.c			optional iwn5000fw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn5000.fw:iwn5000fw -miwn5000fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn5000fw.c"
 iwn5000fw.fwo		optional iwn5000fw | iwnfw			\
 	dependency	"iwn5000.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn5000fw.fwo"
 iwn5000.fw			optional iwn5000fw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwlwifi-5000-8.83.5.1.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn5000.fw"
 iwn5150fw.c			optional iwn5150fw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn5150.fw:iwn5150fw -miwn5150fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn5150fw.c"
 iwn5150fw.fwo			optional iwn5150fw | iwnfw		\
 	dependency	"iwn5150.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn5150fw.fwo"
 iwn5150.fw			optional iwn5150fw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwlwifi-5150-8.24.2.2.fw.uu"\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn5150.fw"
 iwn6000fw.c			optional iwn6000fw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn6000.fw:iwn6000fw -miwn6000fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn6000fw.c"
 iwn6000fw.fwo			optional iwn6000fw | iwnfw		\
 	dependency	"iwn6000.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn6000fw.fwo"
 iwn6000.fw			optional iwn6000fw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwlwifi-6000-9.221.4.1.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn6000.fw"
 iwn6000g2afw.c			optional iwn6000g2afw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn6000g2a.fw:iwn6000g2afw -miwn6000g2afw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn6000g2afw.c"
 iwn6000g2afw.fwo		optional iwn6000g2afw | iwnfw		\
 	dependency	"iwn6000g2a.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn6000g2afw.fwo"
 iwn6000g2a.fw			optional iwn6000g2afw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwlwifi-6000g2a-18.168.6.1.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn6000g2a.fw"
 iwn6000g2bfw.c			optional iwn6000g2bfw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn6000g2b.fw:iwn6000g2bfw -miwn6000g2bfw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn6000g2bfw.c"
 iwn6000g2bfw.fwo		optional iwn6000g2bfw | iwnfw		\
 	dependency	"iwn6000g2b.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn6000g2bfw.fwo"
 iwn6000g2b.fw			optional iwn6000g2bfw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwlwifi-6000g2b-18.168.6.1.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn6000g2b.fw"
 iwn6050fw.c			optional iwn6050fw | iwnfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk iwn6050.fw:iwn6050fw -miwn6050fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"iwn6050fw.c"
 iwn6050fw.fwo			optional iwn6050fw | iwnfw		\
 	dependency	"iwn6050.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"iwn6050fw.fwo"
 iwn6050.fw			optional iwn6050fw | iwnfw		\
 	dependency	"$S/contrib/dev/iwn/iwlwifi-6050-41.28.5.1.fw.uu" \
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"iwn6050.fw"
 dev/ixgbe/if_ix.c		optional ix inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe -DSMP"
 dev/ixgbe/if_ixv.c		optional ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe -DSMP"
 dev/ixgbe/if_bypass.c		optional ix inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/if_fdir.c		optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/if_sriov.c		optional ix inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ix_txrx.c		optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_osdep.c		optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_phy.c		optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_api.c		optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_common.c	optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_mbx.c		optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_vf.c		optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_82598.c		optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_82599.c		optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_x540.c		optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_x550.c		optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_dcb.c		optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_dcb_82598.c	optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/ixgbe/ixgbe_dcb_82599.c	optional ix inet | ixv inet \
 	compile-with "${NORMAL_C} -I$S/dev/ixgbe"
 dev/jedec_dimm/jedec_dimm.c	optional jedec_dimm smbus
 dev/jme/if_jme.c		optional jme pci
 dev/kbd/kbd.c			optional atkbd | pckbd | sc | ukbd | vt | hkbd
 dev/kbdmux/kbdmux.c		optional kbdmux
 dev/ksyms/ksyms.c		optional ksyms
 dev/le/am7990.c			optional le
 dev/le/am79900.c		optional le
 dev/le/if_le_pci.c		optional le pci
 dev/le/lance.c			optional le
 dev/led/led.c			standard
 dev/lge/if_lge.c		optional lge
 dev/liquidio/base/cn23xx_pf_device.c		optional lio	\
 	compile-with "${NORMAL_C}				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/base/lio_console.c			optional lio	\
 	compile-with "${NORMAL_C}				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/base/lio_ctrl.c			optional lio	\
 	compile-with "${NORMAL_C} 				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/base/lio_device.c			optional lio	\
 	compile-with "${NORMAL_C} 				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/base/lio_droq.c			optional lio	\
 	compile-with "${NORMAL_C} 				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/base/lio_mem_ops.c			optional lio	\
 	compile-with "${NORMAL_C} 				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/base/lio_request_manager.c		optional lio	\
 	compile-with "${NORMAL_C} 				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/base/lio_response_manager.c	optional lio	\
 	compile-with "${NORMAL_C} 				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/lio_core.c				optional lio	\
 	compile-with "${NORMAL_C} 				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/lio_ioctl.c			optional lio	\
 	compile-with "${NORMAL_C} 				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/lio_main.c				optional lio	\
 	compile-with "${NORMAL_C} 				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/lio_rss.c				optional lio	\
 	compile-with "${NORMAL_C} 				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/lio_rxtx.c				optional lio	\
 	compile-with "${NORMAL_C} 				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 dev/liquidio/lio_sysctl.c			optional lio	\
 	compile-with "${NORMAL_C} 				\
 	-I$S/dev/liquidio -I$S/dev/liquidio/base -DSMP"
 lio.c	optional lio						\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk lio_23xx_nic.bin.fw:lio_23xx_nic.bin -mlio_23xx_nic.bin -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local	\
 	clean		"lio.c"
 lio_23xx_nic.bin.fw.fwo optional lio				\
 	dependency	"lio_23xx_nic.bin.fw"			\
 	compile-with	"${NORMAL_FWO}"				\
 	no-implicit-rule					\
 	clean		"lio_23xx_nic.bin.fw.fwo"
 lio_23xx_nic.bin.fw	optional lio					\
 	dependency	"$S/contrib/dev/liquidio/lio_23xx_nic.bin.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"lio_23xx_nic.bin.fw"
 dev/malo/if_malo.c		optional malo
 dev/malo/if_malohal.c		optional malo
 dev/malo/if_malo_pci.c		optional malo pci
 dev/md/md.c			optional md
 dev/mdio/mdio_if.m		optional miiproxy | mdio
 dev/mdio/mdio.c			optional miiproxy | mdio
 dev/mem/memdev.c		optional mem
 dev/mem/memutil.c		optional mem
 dev/mfi/mfi.c			optional mfi
 dev/mfi/mfi_debug.c		optional mfi
 dev/mfi/mfi_pci.c		optional mfi pci
 dev/mfi/mfi_disk.c		optional mfi
 dev/mfi/mfi_syspd.c		optional mfi
 dev/mfi/mfi_tbolt.c		optional mfi
 dev/mfi/mfi_cam.c		optional mfip scbus
 dev/mii/acphy.c			optional miibus | acphy
 dev/mii/amphy.c			optional miibus | amphy
 dev/mii/atphy.c			optional miibus | atphy
 dev/mii/axphy.c			optional miibus | axphy
 dev/mii/bmtphy.c		optional miibus | bmtphy
 dev/mii/brgphy.c		optional miibus | brgphy
 dev/mii/ciphy.c			optional miibus | ciphy
 dev/mii/dp83822phy.c		optional miibus | dp83822phy
 dev/mii/dp83867phy.c		optional miibus | dp83867phy
 dev/mii/e1000phy.c		optional miibus | e1000phy
 dev/mii/gentbi.c		optional miibus | gentbi
 dev/mii/icsphy.c		optional miibus | icsphy
 dev/mii/ip1000phy.c		optional miibus | ip1000phy
 dev/mii/jmphy.c			optional miibus | jmphy
 dev/mii/lxtphy.c		optional miibus | lxtphy
 dev/mii/mcommphy.c		optional miibus | mcommphy
 dev/mii/micphy.c		optional miibus fdt | micphy fdt
 dev/mii/mii.c			optional miibus | mii
 dev/mii/mii_bitbang.c		optional miibus | mii_bitbang
 dev/mii/mii_physubr.c		optional miibus | mii
 dev/mii/mii_fdt.c		optional miibus fdt | mii fdt
 dev/mii/miibus_if.m		optional miibus | mii
 dev/mii/mv88e151x.c		optional miibus | mv88e151x
 dev/mii/nsgphy.c		optional miibus | nsgphy
 dev/mii/nsphy.c			optional miibus | nsphy
 dev/mii/nsphyter.c		optional miibus | nsphyter
 dev/mii/pnaphy.c		optional miibus | pnaphy
 dev/mii/qsphy.c			optional miibus | qsphy
 dev/mii/rdcphy.c		optional miibus | rdcphy
 dev/mii/rgephy.c		optional miibus | rgephy
 dev/mii/rlphy.c			optional miibus | rlphy
 dev/mii/rlswitch.c		optional rlswitch
 dev/mii/smcphy.c		optional miibus | smcphy
 dev/mii/smscphy.c		optional miibus | smscphy
 dev/mii/tdkphy.c		optional miibus | tdkphy
 dev/mii/truephy.c		optional miibus | truephy
 dev/mii/ukphy.c			optional miibus | mii
 dev/mii/ukphy_subr.c		optional miibus | mii
 dev/mii/vscphy.c		optional miibus | vscphy
 dev/mii/xmphy.c			optional miibus | xmphy
 dev/mlxfw/mlxfw_fsm.c			optional mlxfw \
 	compile-with "${MLXFW_C}"
 dev/mlxfw/mlxfw_mfa2.c			optional mlxfw \
 	compile-with "${MLXFW_C}"
 dev/mlxfw/mlxfw_mfa2_tlv_multi.c	optional mlxfw \
 	compile-with "${MLXFW_C}"
 dev/mlx/mlx.c			optional mlx
 dev/mlx/mlx_disk.c		optional mlx
 dev/mlx/mlx_pci.c		optional mlx pci
 dev/mmc/mmc_subr.c		optional mmc | mmcsd !mmccam
 dev/mmc/mmc.c			optional mmc !mmccam
 dev/mmc/mmcbr_if.m		standard
 dev/mmc/mmcbus_if.m		standard
 dev/mmc/mmcsd.c			optional mmcsd !mmccam
 dev/mmc/mmc_fdt_helpers.c	optional mmc regulator clk fdt | mmccam regulator clk fdt
 dev/mmc/mmc_helpers.c		optional mmc gpio regulator clk | mmccam gpio regulator clk
 dev/mmc/mmc_pwrseq.c		optional mmc clk regulator fdt | mmccam clk regulator fdt
 dev/mmc/mmc_pwrseq_if.m		optional mmc clk regulator fdt | mmccam clk regulator fdt
 dev/mmcnull/mmcnull.c		optional mmcnull
 dev/mpr/mpr.c			optional mpr
 dev/mpr/mpr_config.c		optional mpr
 # XXX Work around clang warning, until maintainer approves fix.
 dev/mpr/mpr_mapping.c		optional mpr \
 	compile-with "${NORMAL_C} ${NO_WSOMETIMES_UNINITIALIZED}"
 dev/mpr/mpr_pci.c		optional mpr pci
 dev/mpr/mpr_sas.c		optional mpr \
 	compile-with "${NORMAL_C} ${NO_WUNNEEDED_INTERNAL_DECL}"
 dev/mpr/mpr_sas_lsi.c		optional mpr
 dev/mpr/mpr_table.c		optional mpr
 dev/mpr/mpr_user.c		optional mpr
 dev/mps/mps.c			optional mps
 dev/mps/mps_config.c		optional mps
 # XXX Work around clang warning, until maintainer approves fix.
 dev/mps/mps_mapping.c		optional mps \
 	compile-with "${NORMAL_C} ${NO_WSOMETIMES_UNINITIALIZED}"
 dev/mps/mps_pci.c		optional mps pci
 dev/mps/mps_sas.c		optional mps \
 	compile-with "${NORMAL_C} ${NO_WUNNEEDED_INTERNAL_DECL}"
 dev/mps/mps_sas_lsi.c		optional mps
 dev/mps/mps_table.c		optional mps
 dev/mps/mps_user.c		optional mps
 dev/mpt/mpt.c			optional mpt
 dev/mpt/mpt_cam.c		optional mpt
 dev/mpt/mpt_debug.c		optional mpt
 dev/mpt/mpt_pci.c		optional mpt pci
 dev/mpt/mpt_raid.c		optional mpt
 dev/mpt/mpt_user.c		optional mpt
 dev/mrsas/mrsas.c		optional mrsas
 dev/mrsas/mrsas_cam.c		optional mrsas
 dev/mrsas/mrsas_ioctl.c		optional mrsas
 dev/mrsas/mrsas_fp.c		optional mrsas
 dev/msk/if_msk.c		optional msk
 dev/mvs/mvs.c			optional mvs
 dev/mvs/mvs_if.m		optional mvs
 dev/mvs/mvs_pci.c		optional mvs pci
 dev/mwl/if_mwl.c		optional mwl
 dev/mwl/if_mwl_pci.c		optional mwl pci
 dev/mwl/mwlhal.c		optional mwl
 mwlfw.c				optional mwlfw				\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk mw88W8363.fw:mw88W8363fw mwlboot.fw:mwlboot -mmwl -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"mwlfw.c"
 mw88W8363.fwo		optional mwlfw					\
 	dependency	"mw88W8363.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"mw88W8363.fwo"
 mw88W8363.fw		optional mwlfw					\
 	dependency	"$S/contrib/dev/mwl/mw88W8363.fw.uu"		\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"mw88W8363.fw"
 mwlboot.fwo		optional mwlfw					\
 	dependency	"mwlboot.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"mwlboot.fwo"
 mwlboot.fw		optional mwlfw					\
 	dependency	"$S/contrib/dev/mwl/mwlboot.fw.uu"		\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"mwlboot.fw"
 dev/mxge/if_mxge.c		optional mxge pci
 dev/mxge/mxge_eth_z8e.c		optional mxge pci
 dev/mxge/mxge_ethp_z8e.c	optional mxge pci
 dev/mxge/mxge_rss_eth_z8e.c	optional mxge pci
 dev/mxge/mxge_rss_ethp_z8e.c	optional mxge pci
 dev/my/if_my.c			optional my
 dev/netmap/if_ptnet.c		optional netmap inet
 dev/netmap/netmap.c		optional netmap
 dev/netmap/netmap_bdg.c		optional netmap
 dev/netmap/netmap_freebsd.c	optional netmap
 dev/netmap/netmap_generic.c	optional netmap
 dev/netmap/netmap_kloop.c	optional netmap
 dev/netmap/netmap_legacy.c	optional netmap
 dev/netmap/netmap_mbq.c		optional netmap
 dev/netmap/netmap_mem2.c	optional netmap
 dev/netmap/netmap_monitor.c	optional netmap
 dev/netmap/netmap_null.c	optional netmap
 dev/netmap/netmap_offloadings.c	optional netmap
 dev/netmap/netmap_pipe.c	optional netmap
 dev/netmap/netmap_vale.c	optional netmap
 # compile-with "${NORMAL_C} -Wconversion -Wextra"
 dev/nfsmb/nfsmb.c		optional nfsmb pci
 dev/nge/if_nge.c		optional nge
 dev/nmdm/nmdm.c			optional nmdm
 dev/null/null.c			standard
 dev/nvd/nvd.c			optional nvd nvme
 dev/nvme/nvme.c			optional nvme
 dev/nvme/nvme_ahci.c		optional nvme ahci
 dev/nvme/nvme_ctrlr.c		optional nvme
 dev/nvme/nvme_ctrlr_cmd.c	optional nvme
 dev/nvme/nvme_ns.c		optional nvme
 dev/nvme/nvme_ns_cmd.c		optional nvme
 dev/nvme/nvme_pci.c		optional nvme pci
 dev/nvme/nvme_qpair.c		optional nvme
 dev/nvme/nvme_sim.c		optional nvme scbus
 dev/nvme/nvme_sysctl.c		optional nvme
 dev/nvme/nvme_test.c		optional nvme
 dev/nvme/nvme_util.c		optional nvme
 dev/nvmem/nvmem.c		optional nvmem fdt
 dev/nvmem/nvmem_if.m		optional nvmem
 dev/oce/oce_hw.c		optional oce pci
 dev/oce/oce_if.c		optional oce pci
 dev/oce/oce_mbox.c		optional oce pci
 dev/oce/oce_queue.c		optional oce pci
 dev/oce/oce_sysctl.c		optional oce pci
 dev/oce/oce_util.c		optional oce pci
 dev/ocs_fc/ocs_gendump.c	optional ocs_fc pci
 dev/ocs_fc/ocs_pci.c		optional ocs_fc pci
 dev/ocs_fc/ocs_ioctl.c		optional ocs_fc pci
 dev/ocs_fc/ocs_os.c		optional ocs_fc pci
 dev/ocs_fc/ocs_utils.c		optional ocs_fc pci
 dev/ocs_fc/ocs_hw.c		optional ocs_fc pci
 dev/ocs_fc/ocs_hw_queues.c	optional ocs_fc pci
 dev/ocs_fc/sli4.c		optional ocs_fc pci
 dev/ocs_fc/ocs_sm.c		optional ocs_fc pci
 dev/ocs_fc/ocs_device.c		optional ocs_fc pci
 dev/ocs_fc/ocs_xport.c		optional ocs_fc pci
 dev/ocs_fc/ocs_domain.c		optional ocs_fc pci
 dev/ocs_fc/ocs_sport.c		optional ocs_fc pci
 dev/ocs_fc/ocs_els.c		optional ocs_fc pci
 dev/ocs_fc/ocs_fabric.c		optional ocs_fc pci
 dev/ocs_fc/ocs_io.c		optional ocs_fc pci
 dev/ocs_fc/ocs_node.c		optional ocs_fc pci
 dev/ocs_fc/ocs_scsi.c		optional ocs_fc pci
 dev/ocs_fc/ocs_unsol.c		optional ocs_fc pci
 dev/ocs_fc/ocs_ddump.c		optional ocs_fc pci
 dev/ocs_fc/ocs_mgmt.c		optional ocs_fc pci
 dev/ocs_fc/ocs_cam.c		optional ocs_fc pci
 dev/ofw/ofw_bus_if.m		optional fdt
 dev/ofw/ofw_bus_subr.c		optional fdt
 dev/ofw/ofw_cpu.c		optional fdt
 dev/ofw/ofw_fdt.c		optional fdt
 dev/ofw/ofw_firmware.c		optional fdt
 dev/ofw/ofw_if.m		optional fdt
 dev/ofw/ofw_graph.c		optional fdt
 dev/ofw/ofw_subr.c		optional fdt
 dev/ofw/ofwbus.c		optional fdt
 dev/ofw/openfirm.c		optional fdt
 dev/ofw/openfirmio.c		optional fdt
 dev/ow/ow.c			optional ow				\
 	dependency	"owll_if.h"					\
 	dependency	"own_if.h"
 dev/ow/owll_if.m		optional ow
 dev/ow/own_if.m			optional ow
 dev/ow/ow_temp.c		optional ow_temp
 dev/ow/owc_gpiobus.c		optional owc gpio
 dev/pbio/pbio.c			optional pbio isa
 dev/pccbb/pccbb.c		optional cbb
 dev/pccbb/pccbb_pci.c		optional cbb pci
 dev/pcf/pcf.c			optional pcf
 dev/pci/fixup_pci.c		optional pci
 dev/pci/hostb_pci.c		optional pci
 dev/pci/ignore_pci.c		optional pci
 dev/pci/isa_pci.c		optional pci isa
 dev/pci/pci.c			optional pci
 dev/pci/pci_if.m		standard
 dev/pci/pci_iov.c		optional pci pci_iov
 dev/pci/pci_iov_if.m		standard
 dev/pci/pci_iov_schema.c	optional pci pci_iov
 dev/pci/pci_pci.c		optional pci
 dev/pci/pci_subr.c		optional pci
 dev/pci/pci_user.c		optional pci
 dev/pci/pcib_if.m		standard
 dev/pci/pcib_support.c		standard
 dev/pci/vga_pci.c		optional pci
 dev/phy/phy.c			optional phy
 dev/phy/phydev_if.m		optional phy fdt
 dev/phy/phynode_if.m		optional phy
 dev/phy/phy_usb.c		optional phy
 dev/phy/phynode_usb_if.m	optional phy
 dev/pms/freebsd/driver/ini/src/agtiapi.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/sadisc.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/mpi.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/saframe.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/sahw.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/sainit.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/saint.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/sampicmd.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/sampirsp.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/saphy.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/saport.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/sasata.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/sasmp.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/sassp.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/satimer.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/sautil.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/saioctlcmd.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sallsdk/spc/mpidebug.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/discovery/dm/dminit.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/discovery/dm/dmsmp.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/discovery/dm/dmdisc.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/discovery/dm/dmport.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/discovery/dm/dmtimer.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/discovery/dm/dmmisc.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sat/src/sminit.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sat/src/smmisc.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sat/src/smsat.c				optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sat/src/smsatcb.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sat/src/smsathw.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/sat/src/smtimer.c			optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/common/tdinit.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/common/tdmisc.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/common/tdesgl.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/common/tdport.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/common/tdint.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/common/tdioctl.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/common/tdhw.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/common/ossacmnapi.c	optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/common/tddmcmnapi.c	optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/common/tdsmcmnapi.c	optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/common/tdtimers.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/sas/ini/itdio.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/sas/ini/itdcb.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/sas/ini/itdinit.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/sas/ini/itddisc.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/sata/host/sat.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/sata/host/ossasat.c	optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/pms/RefTisa/tisa/sassata/sata/host/sathw.c		optional pmspcv \
 	compile-with "${NORMAL_C} -Wunused-variable -Woverflow -Wparentheses -w"
 dev/ppbus/if_plip.c		optional plip
 dev/ppbus/lpbb.c		optional lpbb
 dev/ppbus/lpt.c			optional lpt
 dev/ppbus/pcfclock.c		optional pcfclock
 dev/ppbus/ppb_1284.c		optional ppbus
 dev/ppbus/ppb_base.c		optional ppbus
 dev/ppbus/ppb_msq.c		optional ppbus
 dev/ppbus/ppbconf.c		optional ppbus
 dev/ppbus/ppbus_if.m		optional ppbus
 dev/ppbus/ppi.c			optional ppi
 dev/ppbus/pps.c			optional pps
 dev/ppc/ppc.c			optional ppc
 dev/ppc/ppc_acpi.c		optional ppc acpi
 dev/ppc/ppc_isa.c		optional ppc isa
 dev/ppc/ppc_pci.c		optional ppc pci
 dev/ppc/ppc_puc.c		optional ppc puc
 dev/proto/proto_bus_isa.c	optional proto acpi | proto isa
 dev/proto/proto_bus_pci.c	optional proto pci
 dev/proto/proto_busdma.c	optional proto
 dev/proto/proto_core.c		optional proto
 dev/pst/pst-iop.c		optional pst
 dev/pst/pst-pci.c		optional pst pci
 dev/pst/pst-raid.c		optional pst
 dev/pty/pty.c			optional pty
 dev/puc/puc.c			optional puc
 dev/puc/puc_cfg.c		optional puc
 dev/puc/puc_pci.c		optional puc pci
 dev/pwm/pwmc.c			optional pwm | pwmc
 dev/pwm/pwmbus.c		optional pwm | pwmbus
 dev/pwm/pwmbus_if.m		optional pwm | pwmbus
 dev/pwm/ofw_pwm.c		optional pwm fdt | pwmbus fdt
 dev/pwm/ofw_pwmbus.c		optional pwm fdt | pwmbus fdt
 dev/pwm/pwm_backlight.c		optional pwm pwm_backlight fdt backlight
 dev/quicc/quicc_core.c		optional quicc
 dev/ral/rt2560.c		optional ral
 dev/ral/rt2661.c		optional ral
 dev/ral/rt2860.c		optional ral
 dev/ral/if_ral_pci.c		optional ral pci
 rt2561fw.c			optional rt2561fw | ralfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rt2561.fw:rt2561fw -mrt2561 -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rt2561fw.c"
 rt2561fw.fwo			optional rt2561fw | ralfw		\
 	dependency	"rt2561.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rt2561fw.fwo"
 rt2561.fw			optional rt2561fw | ralfw		\
 	dependency	"$S/contrib/dev/ral/rt2561.fw.uu"		\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rt2561.fw"
 rt2561sfw.c			optional rt2561sfw | ralfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rt2561s.fw:rt2561sfw -mrt2561s -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rt2561sfw.c"
 rt2561sfw.fwo			optional rt2561sfw | ralfw		\
 	dependency	"rt2561s.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rt2561sfw.fwo"
 rt2561s.fw			optional rt2561sfw | ralfw		\
 	dependency	"$S/contrib/dev/ral/rt2561s.fw.uu"		\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rt2561s.fw"
 rt2661fw.c			optional rt2661fw | ralfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rt2661.fw:rt2661fw -mrt2661 -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rt2661fw.c"
 rt2661fw.fwo			optional rt2661fw | ralfw		\
 	dependency	"rt2661.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rt2661fw.fwo"
 rt2661.fw			optional rt2661fw | ralfw		\
 	dependency	"$S/contrib/dev/ral/rt2661.fw.uu"		\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rt2661.fw"
 rt2860fw.c			optional rt2860fw | ralfw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rt2860.fw:rt2860fw -mrt2860 -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rt2860fw.c"
 rt2860fw.fwo			optional rt2860fw | ralfw		\
 	dependency	"rt2860.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rt2860fw.fwo"
 rt2860.fw			optional rt2860fw | ralfw		\
 	dependency	"$S/contrib/dev/ral/rt2860.fw.uu"		\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rt2860.fw"
 dev/random/random_infra.c	standard
 dev/random/random_harvestq.c	standard
 dev/random/randomdev.c		optional !random_loadable
 dev/random/fenestrasX/fx_brng.c	optional !random_loadable random_fenestrasx
 dev/random/fenestrasX/fx_main.c	optional !random_loadable random_fenestrasx \
 	compile-with "${NORMAL_C} -I$S/crypto/blake2"
 dev/random/fenestrasX/fx_pool.c	optional !random_loadable random_fenestrasx \
 	compile-with "${NORMAL_C} -I$S/crypto/blake2"
 dev/random/fenestrasX/fx_rng.c	optional !random_loadable random_fenestrasx \
 	compile-with "${NORMAL_C} -I$S/crypto/blake2"
 dev/random/fortuna.c		optional !random_loadable !random_fenestrasx
 dev/random/hash.c		optional !random_loadable
 dev/rccgpio/rccgpio.c		optional rccgpio gpio
 dev/re/if_re.c			optional re
 dev/regulator/regdev_if.m	optional regulator fdt
 dev/regulator/regnode_if.m	optional regulator
 dev/regulator/regulator.c	optional regulator
 dev/regulator/regulator_bus.c	optional regulator fdt
 dev/regulator/regulator_fixed.c	optional regulator
 dev/rl/if_rl.c			optional rl pci
 dev/rndtest/rndtest.c		optional rndtest
 #
 dev/rtsx/rtsx.c			optional rtsx pci
 #
 dev/rtwn/if_rtwn.c		optional rtwn
 dev/rtwn/if_rtwn_beacon.c	optional rtwn
 dev/rtwn/if_rtwn_calib.c	optional rtwn
 dev/rtwn/if_rtwn_cam.c		optional rtwn
 dev/rtwn/if_rtwn_efuse.c	optional rtwn
 dev/rtwn/if_rtwn_fw.c		optional rtwn
 dev/rtwn/if_rtwn_rx.c		optional rtwn
 dev/rtwn/if_rtwn_task.c		optional rtwn
 dev/rtwn/if_rtwn_tx.c		optional rtwn
 #
 dev/rtwn/pci/rtwn_pci_attach.c	optional rtwn_pci pci
 dev/rtwn/pci/rtwn_pci_reg.c	optional rtwn_pci pci
 dev/rtwn/pci/rtwn_pci_rx.c	optional rtwn_pci pci
 dev/rtwn/pci/rtwn_pci_tx.c	optional rtwn_pci pci
 #
 dev/rtwn/usb/rtwn_usb_attach.c	optional rtwn_usb
 dev/rtwn/usb/rtwn_usb_ep.c	optional rtwn_usb
 dev/rtwn/usb/rtwn_usb_reg.c	optional rtwn_usb
 dev/rtwn/usb/rtwn_usb_rx.c	optional rtwn_usb
 dev/rtwn/usb/rtwn_usb_tx.c	optional rtwn_usb
 # RTL8188E
 dev/rtwn/rtl8188e/r88e_beacon.c	optional rtwn
 dev/rtwn/rtl8188e/r88e_calib.c	optional rtwn
 dev/rtwn/rtl8188e/r88e_chan.c	optional rtwn
 dev/rtwn/rtl8188e/r88e_fw.c	optional rtwn
 dev/rtwn/rtl8188e/r88e_init.c	optional rtwn
 dev/rtwn/rtl8188e/r88e_led.c	optional rtwn
 dev/rtwn/rtl8188e/r88e_tx.c	optional rtwn
 dev/rtwn/rtl8188e/r88e_rf.c	optional rtwn
 dev/rtwn/rtl8188e/r88e_rom.c	optional rtwn
 dev/rtwn/rtl8188e/r88e_rx.c	optional rtwn
 dev/rtwn/rtl8188e/pci/r88ee_attach.c	optional rtwn_pci pci
 dev/rtwn/rtl8188e/pci/r88ee_init.c	optional rtwn_pci pci
 dev/rtwn/rtl8188e/pci/r88ee_rx.c	optional rtwn_pci pci
 dev/rtwn/rtl8188e/usb/r88eu_attach.c	optional rtwn_usb
 dev/rtwn/rtl8188e/usb/r88eu_init.c	optional rtwn_usb
 # RTL8192C
 dev/rtwn/rtl8192c/r92c_attach.c	optional rtwn
 dev/rtwn/rtl8192c/r92c_beacon.c	optional rtwn
 dev/rtwn/rtl8192c/r92c_calib.c	optional rtwn
 dev/rtwn/rtl8192c/r92c_chan.c	optional rtwn
 dev/rtwn/rtl8192c/r92c_fw.c	optional rtwn
 dev/rtwn/rtl8192c/r92c_init.c	optional rtwn
 dev/rtwn/rtl8192c/r92c_llt.c	optional rtwn
 dev/rtwn/rtl8192c/r92c_rf.c	optional rtwn
 dev/rtwn/rtl8192c/r92c_rom.c	optional rtwn
 dev/rtwn/rtl8192c/r92c_rx.c	optional rtwn
 dev/rtwn/rtl8192c/r92c_tx.c	optional rtwn
 dev/rtwn/rtl8192c/pci/r92ce_attach.c	optional rtwn_pci pci
 dev/rtwn/rtl8192c/pci/r92ce_calib.c	optional rtwn_pci pci
 dev/rtwn/rtl8192c/pci/r92ce_fw.c	optional rtwn_pci pci
 dev/rtwn/rtl8192c/pci/r92ce_init.c	optional rtwn_pci pci
 dev/rtwn/rtl8192c/pci/r92ce_led.c	optional rtwn_pci pci
 dev/rtwn/rtl8192c/pci/r92ce_rx.c	optional rtwn_pci pci
 dev/rtwn/rtl8192c/pci/r92ce_tx.c	optional rtwn_pci pci
 dev/rtwn/rtl8192c/usb/r92cu_attach.c	optional rtwn_usb
 dev/rtwn/rtl8192c/usb/r92cu_init.c	optional rtwn_usb
 dev/rtwn/rtl8192c/usb/r92cu_led.c	optional rtwn_usb
 dev/rtwn/rtl8192c/usb/r92cu_rx.c	optional rtwn_usb
 dev/rtwn/rtl8192c/usb/r92cu_tx.c	optional rtwn_usb
 # RTL8192E
 dev/rtwn/rtl8192e/r92e_chan.c	optional rtwn
 dev/rtwn/rtl8192e/r92e_fw.c	optional rtwn
 dev/rtwn/rtl8192e/r92e_init.c	optional rtwn
 dev/rtwn/rtl8192e/r92e_led.c	optional rtwn
 dev/rtwn/rtl8192e/r92e_rf.c	optional rtwn
 dev/rtwn/rtl8192e/r92e_rom.c	optional rtwn
 dev/rtwn/rtl8192e/r92e_rx.c	optional rtwn
 dev/rtwn/rtl8192e/usb/r92eu_attach.c	optional rtwn_usb
 dev/rtwn/rtl8192e/usb/r92eu_init.c	optional rtwn_usb
 # RTL8812A
 dev/rtwn/rtl8812a/r12a_beacon.c	optional rtwn
 dev/rtwn/rtl8812a/r12a_calib.c	optional rtwn
 dev/rtwn/rtl8812a/r12a_caps.c	optional rtwn
 dev/rtwn/rtl8812a/r12a_chan.c	optional rtwn
 dev/rtwn/rtl8812a/r12a_fw.c	optional rtwn
 dev/rtwn/rtl8812a/r12a_init.c	optional rtwn
 dev/rtwn/rtl8812a/r12a_led.c	optional rtwn
 dev/rtwn/rtl8812a/r12a_rf.c	optional rtwn
 dev/rtwn/rtl8812a/r12a_rom.c	optional rtwn
 dev/rtwn/rtl8812a/r12a_rx.c	optional rtwn
 dev/rtwn/rtl8812a/r12a_tx.c	optional rtwn
 dev/rtwn/rtl8812a/usb/r12au_attach.c	optional rtwn_usb
 dev/rtwn/rtl8812a/usb/r12au_init.c	optional rtwn_usb
 dev/rtwn/rtl8812a/usb/r12au_rx.c	optional rtwn_usb
 dev/rtwn/rtl8812a/usb/r12au_tx.c	optional rtwn_usb
 # RTL8821A
 dev/rtwn/rtl8821a/r21a_beacon.c	optional rtwn
 dev/rtwn/rtl8821a/r21a_calib.c	optional rtwn
 dev/rtwn/rtl8821a/r21a_chan.c	optional rtwn
 dev/rtwn/rtl8821a/r21a_fw.c	optional rtwn
 dev/rtwn/rtl8821a/r21a_init.c	optional rtwn
 dev/rtwn/rtl8821a/r21a_led.c	optional rtwn
 dev/rtwn/rtl8821a/r21a_rom.c	optional rtwn
 dev/rtwn/rtl8821a/r21a_rx.c	optional rtwn
 dev/rtwn/rtl8821a/usb/r21au_attach.c	optional rtwn_usb
 dev/rtwn/rtl8821a/usb/r21au_dfs.c	optional rtwn_usb
 dev/rtwn/rtl8821a/usb/r21au_init.c	optional rtwn_usb
 rtwn-rtl8188eefw.c		optional rtwn-rtl8188eefw | rtwnfw	\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rtwn-rtl8188eefw.fw:rtwn-rtl8188eefw:111 -mrtwn-rtl8188eefw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rtwn-rtl8188eefw.c"
 rtwn-rtl8188eefw.fwo		optional rtwn-rtl8188eefw | rtwnfw	\
 	dependency	"rtwn-rtl8188eefw.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rtwn-rtl8188eefw.fwo"
 rtwn-rtl8188eefw.fw		optional rtwn-rtl8188eefw | rtwnfw	\
 	dependency	"$S/contrib/dev/rtwn/rtwn-rtl8188eefw.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rtwn-rtl8188eefw.fw"
 rtwn-rtl8188eufw.c		optional rtwn-rtl8188eufw | rtwnfw	\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rtwn-rtl8188eufw.fw:rtwn-rtl8188eufw:111 -mrtwn-rtl8188eufw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rtwn-rtl8188eufw.c"
 rtwn-rtl8188eufw.fwo		optional rtwn-rtl8188eufw | rtwnfw	\
 	dependency	"rtwn-rtl8188eufw.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rtwn-rtl8188eufw.fwo"
 rtwn-rtl8188eufw.fw		optional rtwn-rtl8188eufw | rtwnfw	\
 	dependency	"$S/contrib/dev/rtwn/rtwn-rtl8188eufw.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rtwn-rtl8188eufw.fw"
 rtwn-rtl8192cfwE.c		optional rtwn-rtl8192cfwE | rtwnfw	\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rtwn-rtl8192cfwE.fw:rtwn-rtl8192cfwE:111 -mrtwn-rtl8192cfwE -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rtwn-rtl8192cfwE.c"
 rtwn-rtl8192cfwE.fwo		optional rtwn-rtl8192cfwE | rtwnfw	\
 	dependency	"rtwn-rtl8192cfwE.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rtwn-rtl8192cfwE.fwo"
 rtwn-rtl8192cfwE.fw		optional rtwn-rtl8192cfwE | rtwnfw	\
 	dependency	"$S/contrib/dev/rtwn/rtwn-rtl8192cfwE.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rtwn-rtl8192cfwE.fw"
 rtwn-rtl8192cfwE_B.c		optional rtwn-rtl8192cfwE_B | rtwnfw	\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rtwn-rtl8192cfwE_B.fw:rtwn-rtl8192cfwE_B:111 -mrtwn-rtl8192cfwE_B -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rtwn-rtl8192cfwE_B.c"
 rtwn-rtl8192cfwE_B.fwo		optional rtwn-rtl8192cfwE_B | rtwnfw	\
 	dependency	"rtwn-rtl8192cfwE_B.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rtwn-rtl8192cfwE_B.fwo"
 rtwn-rtl8192cfwE_B.fw		optional rtwn-rtl8192cfwE_B | rtwnfw	\
 	dependency	"$S/contrib/dev/rtwn/rtwn-rtl8192cfwE_B.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rtwn-rtl8192cfwE_B.fw"
 rtwn-rtl8192cfwT.c		optional rtwn-rtl8192cfwT | rtwnfw	\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rtwn-rtl8192cfwT.fw:rtwn-rtl8192cfwT:111 -mrtwn-rtl8192cfwT -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rtwn-rtl8192cfwT.c"
 rtwn-rtl8192cfwT.fwo		optional rtwn-rtl8192cfwT | rtwnfw	\
 	dependency	"rtwn-rtl8192cfwT.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rtwn-rtl8192cfwT.fwo"
 rtwn-rtl8192cfwT.fw		optional rtwn-rtl8192cfwT | rtwnfw	\
 	dependency	"$S/contrib/dev/rtwn/rtwn-rtl8192cfwT.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rtwn-rtl8192cfwT.fw"
 rtwn-rtl8192cfwU.c		optional rtwn-rtl8192cfwU | rtwnfw	\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rtwn-rtl8192cfwU.fw:rtwn-rtl8192cfwU:111 -mrtwn-rtl8192cfwU -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rtwn-rtl8192cfwU.c"
 rtwn-rtl8192cfwU.fwo		optional rtwn-rtl8192cfwU | rtwnfw	\
 	dependency	"rtwn-rtl8192cfwU.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rtwn-rtl8192cfwU.fwo"
 rtwn-rtl8192cfwU.fw		optional rtwn-rtl8192cfwU | rtwnfw	\
 	dependency	"$S/contrib/dev/rtwn/rtwn-rtl8192cfwU.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rtwn-rtl8192cfwU.fw"
 rtwn-rtl8192eufw.c		optional rtwn-rtl8192eufw | rtwnfw	\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rtwn-rtl8192eufw.fw:rtwn-rtl8192eufw:111 -mrtwn-rtl8192eufw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rtwn-rtl8192eufw.c"
 rtwn-rtl8192eufw.fwo		optional rtwn-rtl8192eufw | rtwnfw	\
 	dependency	"rtwn-rtl8192eufw.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rtwn-rtl8192eufw.fwo"
 rtwn-rtl8192eufw.fw		optional rtwn-rtl8192eufw | rtwnfw	\
 	dependency	"$S/contrib/dev/rtwn/rtwn-rtl8192eufw.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rtwn-rtl8192eufw.fw"
 rtwn-rtl8812aufw.c		optional rtwn-rtl8812aufw | rtwnfw	\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rtwn-rtl8812aufw.fw:rtwn-rtl8812aufw:111 -mrtwn-rtl8812aufw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rtwn-rtl8812aufw.c"
 rtwn-rtl8812aufw.fwo		optional rtwn-rtl8812aufw | rtwnfw	\
 	dependency	"rtwn-rtl8812aufw.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rtwn-rtl8812aufw.fwo"
 rtwn-rtl8812aufw.fw		optional rtwn-rtl8812aufw | rtwnfw	\
 	dependency	"$S/contrib/dev/rtwn/rtwn-rtl8812aufw.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rtwn-rtl8812aufw.fw"
 rtwn-rtl8821aufw.c		optional rtwn-rtl8821aufw | rtwnfw	\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rtwn-rtl8821aufw.fw:rtwn-rtl8821aufw:111 -mrtwn-rtl8821aufw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rtwn-rtl8821aufw.c"
 rtwn-rtl8821aufw.fwo		optional rtwn-rtl8821aufw | rtwnfw	\
 	dependency	"rtwn-rtl8821aufw.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rtwn-rtl8821aufw.fwo"
 rtwn-rtl8821aufw.fw		optional rtwn-rtl8821aufw | rtwnfw	\
 	dependency	"$S/contrib/dev/rtwn/rtwn-rtl8821aufw.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rtwn-rtl8821aufw.fw"
 dev/safe/safe.c			optional safe
 dev/scc/scc_if.m		optional scc
 dev/scc/scc_bfe_quicc.c		optional scc quicc
 dev/scc/scc_core.c		optional scc
 dev/scc/scc_dev_quicc.c		optional scc quicc
 dev/scc/scc_dev_z8530.c		optional scc
 dev/sdhci/sdhci.c		optional sdhci
 dev/sdhci/sdhci_fdt.c		optional sdhci fdt regulator clk
 dev/sdhci/sdhci_fdt_gpio.c	optional sdhci fdt gpio
 dev/sdhci/sdhci_fsl_fdt.c	optional sdhci fdt gpio regulator clk
 dev/sdhci/sdhci_if.m		optional sdhci
 dev/sdhci/sdhci_acpi.c		optional sdhci acpi
 dev/sdhci/sdhci_pci.c		optional sdhci pci
 dev/sdio/sdio_if.m		optional mmccam
 dev/sdio/sdio_subr.c		optional mmccam
 dev/sdio/sdiob.c		optional mmccam
 dev/sff/sff_if.m		optional sff
 dev/sff/sfp_fdt.c		optional sff fdt
 dev/sge/if_sge.c		optional sge pci
 dev/siis/siis.c			optional siis pci
 dev/sis/if_sis.c		optional sis pci
 dev/sk/if_sk.c			optional sk pci
 dev/smbios/smbios.c		optional smbios
 dev/smbus/smb.c			optional smb
 dev/smbus/smbconf.c		optional smbus
 dev/smbus/smbus.c		optional smbus
 dev/smbus/smbus_if.m		optional smbus
 dev/smc/if_smc.c		optional smc
 dev/smc/if_smc_acpi.c		optional smc acpi
 dev/smc/if_smc_fdt.c		optional smc fdt
 dev/snp/snp.c			optional snp
 dev/sound/clone.c		optional sound
 dev/sound/unit.c		optional sound
 dev/sound/pci/als4000.c		optional snd_als4000 pci
 dev/sound/pci/atiixp.c		optional snd_atiixp pci
 dev/sound/pci/cmi.c		optional snd_cmi pci
 dev/sound/pci/cs4281.c		optional snd_cs4281 pci
 dev/sound/pci/csa.c		optional snd_csa pci
 dev/sound/pci/csapcm.c		optional snd_csa pci
 dev/sound/pci/emu10k1.c		optional snd_emu10k1 pci
 dev/sound/pci/emu10kx.c		optional snd_emu10kx pci
 dev/sound/pci/emu10kx-pcm.c	optional snd_emu10kx pci
 dev/sound/pci/emu10kx-midi.c	optional snd_emu10kx pci
 dev/sound/pci/envy24.c		optional snd_envy24 pci
 dev/sound/pci/envy24ht.c	optional snd_envy24ht pci
 dev/sound/pci/es137x.c		optional snd_es137x pci
 dev/sound/pci/fm801.c		optional snd_fm801 pci
 dev/sound/pci/ich.c		optional snd_ich pci
 dev/sound/pci/maestro3.c	optional snd_maestro3 pci
 dev/sound/pci/neomagic.c	optional snd_neomagic pci
 dev/sound/pci/solo.c		optional snd_solo pci
 dev/sound/pci/spicds.c		optional snd_spicds pci
 dev/sound/pci/t4dwave.c		optional snd_t4dwave pci
 dev/sound/pci/via8233.c		optional snd_via8233 pci
 dev/sound/pci/via82c686.c	optional snd_via82c686 pci
 dev/sound/pci/vibes.c		optional snd_vibes pci
 dev/sound/pci/hda/hdaa.c	optional snd_hda pci
 dev/sound/pci/hda/hdaa_patches.c	optional snd_hda pci
 dev/sound/pci/hda/hdac.c	optional snd_hda pci
 dev/sound/pci/hda/hdac_if.m	optional snd_hda pci
 dev/sound/pci/hda/hdacc.c	optional snd_hda pci
 dev/sound/pci/hdspe.c		optional snd_hdspe pci
 dev/sound/pci/hdspe-pcm.c	optional snd_hdspe pci
 dev/sound/pcm/ac97.c		optional sound
 dev/sound/pcm/ac97_if.m		optional sound
 dev/sound/pcm/ac97_patch.c	optional sound
 dev/sound/pcm/buffer.c		optional sound	\
 	dependency	"snd_fxdiv_gen.h"
 dev/sound/pcm/channel.c		optional sound
 dev/sound/pcm/channel_if.m	optional sound
 dev/sound/pcm/dsp.c		optional sound
 dev/sound/pcm/feeder.c		optional sound
 dev/sound/pcm/feeder_chain.c	optional sound
 dev/sound/pcm/feeder_eq.c	optional sound	\
 	dependency	"feeder_eq_gen.h"	\
 	dependency	"snd_fxdiv_gen.h"
 dev/sound/pcm/feeder_if.m	optional sound
 dev/sound/pcm/feeder_format.c	optional sound  \
 	dependency	"snd_fxdiv_gen.h"
 dev/sound/pcm/feeder_matrix.c	optional sound  \
 	dependency	"snd_fxdiv_gen.h"
 dev/sound/pcm/feeder_mixer.c	optional sound  \
 	dependency	"snd_fxdiv_gen.h"
 dev/sound/pcm/feeder_rate.c	optional sound	\
 	dependency	"feeder_rate_gen.h"	\
 	dependency	"snd_fxdiv_gen.h"
 dev/sound/pcm/feeder_volume.c	optional sound  \
 	dependency	"snd_fxdiv_gen.h"
 dev/sound/pcm/mixer.c		optional sound
 dev/sound/pcm/mixer_if.m	optional sound
 dev/sound/pcm/sndstat.c		optional sound
 dev/sound/pcm/sound.c		optional sound
 dev/sound/pcm/vchan.c		optional sound
 dev/sound/usb/uaudio.c		optional snd_uaudio usb
 dev/sound/usb/uaudio_pcm.c	optional snd_uaudio usb
 dev/sound/midi/midi.c		optional sound
 dev/sound/midi/mpu401.c		optional sound
 dev/sound/midi/mpu_if.m		optional sound
 dev/sound/midi/mpufoi_if.m	optional sound
 dev/sound/midi/sequencer.c	optional sound
 dev/sound/midi/synth_if.m	optional sound
 dev/spibus/acpi_spibus.c	optional acpi spibus
 dev/spibus/ofw_spibus.c		optional fdt spibus
 dev/spibus/spibus.c		optional spibus				\
 	dependency	"spibus_if.h"
 dev/spibus/spigen.c		optional spigen
 dev/spibus/spibus_if.m		optional spibus
 dev/ste/if_ste.c		optional ste pci
 dev/stge/if_stge.c		optional stge
 dev/sym/sym_hipd.c		optional sym				\
 	dependency	"$S/dev/sym/sym_{conf,defs}.h"
 dev/syscon/syscon.c		optional syscon
 dev/syscon/syscon_generic.c	optional syscon fdt
 dev/syscon/syscon_if.m		optional syscon
 dev/syscon/syscon_power.c	optional syscon syscon_power
 dev/syscons/blank/blank_saver.c	optional blank_saver
 dev/syscons/daemon/daemon_saver.c optional daemon_saver
 dev/syscons/dragon/dragon_saver.c optional dragon_saver
 dev/syscons/fade/fade_saver.c	optional fade_saver
 dev/syscons/fire/fire_saver.c	optional fire_saver
 dev/syscons/green/green_saver.c	optional green_saver
 dev/syscons/logo/logo.c		optional logo_saver
 dev/syscons/logo/logo_saver.c	optional logo_saver
 dev/syscons/rain/rain_saver.c	optional rain_saver
 dev/syscons/schistory.c		optional sc
 dev/syscons/scmouse.c		optional sc
 dev/syscons/scterm.c		optional sc
 dev/syscons/scterm-dumb.c	optional sc !SC_NO_TERM_DUMB
 dev/syscons/scterm-sc.c		optional sc !SC_NO_TERM_SC
 dev/syscons/scterm-teken.c	optional sc !SC_NO_TERM_TEKEN
 dev/syscons/scvidctl.c		optional sc
 dev/syscons/scvtb.c		optional sc
 dev/syscons/snake/snake_saver.c	optional snake_saver
 dev/syscons/star/star_saver.c	optional star_saver
 dev/syscons/syscons.c		optional sc
 dev/syscons/sysmouse.c		optional sc
 dev/syscons/warp/warp_saver.c	optional warp_saver
 dev/tcp_log/tcp_log_dev.c	optional tcp_blackbox inet | tcp_blackbox inet6
 dev/tdfx/tdfx_pci.c		optional tdfx pci
 dev/ti/if_ti.c			optional ti pci
 dev/tws/tws.c			optional tws
 dev/tws/tws_cam.c		optional tws
 dev/tws/tws_hdm.c		optional tws
 dev/tws/tws_services.c		optional tws
 dev/tws/tws_user.c		optional tws
 dev/uart/uart_bus_acpi.c	optional uart acpi
 dev/uart/uart_bus_fdt.c		optional uart fdt
 dev/uart/uart_bus_isa.c		optional uart isa
 dev/uart/uart_bus_pci.c		optional uart pci
 dev/uart/uart_bus_puc.c		optional uart puc
 dev/uart/uart_bus_scc.c		optional uart scc
 dev/uart/uart_core.c		optional uart
 dev/uart/uart_cpu_acpi.c	optional uart acpi
 dev/uart/uart_dbg.c		optional uart gdb
 dev/uart/uart_dev_imx.c		optional uart uart_imx fdt
 dev/uart/uart_dev_msm.c		optional uart uart_msm fdt
 dev/uart/uart_dev_mvebu.c	optional uart uart_mvebu fdt
 dev/uart/uart_dev_ns8250.c	optional uart uart_ns8250 | uart uart_snps
 dev/uart/uart_dev_pl011.c	optional uart pl011
 dev/uart/uart_dev_quicc.c	optional uart quicc
 dev/uart/uart_dev_snps.c	optional uart uart_snps fdt
 dev/uart/uart_dev_z8530.c	optional uart uart_z8530 | uart scc
 dev/uart/uart_if.m		optional uart
 dev/uart/uart_subr.c		optional uart
 dev/uart/uart_tty.c		optional uart
 #
 # USB controller drivers
 #
 dev/usb/controller/musb_otg.c		optional musb
 dev/usb/controller/dwc_otg.c		optional dwcotg
 dev/usb/controller/dwc_otg_fdt.c	optional dwcotg fdt
 dev/usb/controller/dwc_otg_acpi.c	optional dwcotg acpi
 dev/usb/controller/ehci.c		optional ehci
 dev/usb/controller/ehci_msm.c		optional ehci_msm fdt
 dev/usb/controller/ehci_pci.c		optional ehci pci
 dev/usb/controller/ohci.c		optional ohci
 dev/usb/controller/ohci_pci.c		optional ohci pci
 dev/usb/controller/uhci.c		optional uhci
 dev/usb/controller/uhci_pci.c		optional uhci pci
 dev/usb/controller/xhci.c		optional xhci
 dev/usb/controller/xhci_pci.c		optional xhci pci
 dev/usb/controller/saf1761_otg.c	optional saf1761otg
 dev/usb/controller/saf1761_otg_fdt.c	optional saf1761otg fdt
 dev/usb/controller/uss820dci.c		optional uss820dci
 dev/usb/controller/usb_controller.c	optional usb
 #
 # USB storage drivers
 #
 dev/usb/storage/cfumass.c	optional cfumass ctl
 dev/usb/storage/umass.c		optional umass
 dev/usb/storage/urio.c		optional urio
 dev/usb/storage/ustorage_fs.c	optional usfs
 #
 # USB core
 #
 dev/usb/usb_busdma.c		optional usb
 dev/usb/usb_core.c		optional usb
 dev/usb/usb_debug.c		optional usb
 dev/usb/usb_dev.c		optional usb
 dev/usb/usb_device.c		optional usb
 dev/usb/usb_dynamic.c		optional usb
 dev/usb/usb_error.c		optional usb
 dev/usb/usb_fdt_support.c	optional usb fdt
 dev/usb/usb_generic.c		optional usb
 dev/usb/usb_handle_request.c	optional usb
 dev/usb/usb_hid.c		optional usb
 dev/usb/usb_hub.c		optional usb
 dev/usb/usb_hub_acpi.c		optional uacpi acpi
 dev/usb/usb_if.m		optional usb
 dev/usb/usb_lookup.c		optional usb
 dev/usb/usb_mbuf.c		optional usb
 dev/usb/usb_msctest.c		optional usb
 dev/usb/usb_parse.c		optional usb
 dev/usb/usb_pf.c		optional usb
 dev/usb/usb_process.c		optional usb
 dev/usb/usb_request.c		optional usb
 dev/usb/usb_transfer.c		optional usb
 dev/usb/usb_util.c		optional usb
 #
 # USB network drivers
 #
 dev/usb/net/if_aue.c		optional aue
 dev/usb/net/if_axe.c		optional axe
 dev/usb/net/if_axge.c		optional axge
 dev/usb/net/if_cdce.c		optional cdce
 dev/usb/net/if_cdceem.c		optional cdceem
 dev/usb/net/if_cue.c		optional cue
 dev/usb/net/if_ipheth.c		optional ipheth
 dev/usb/net/if_kue.c		optional kue
 dev/usb/net/if_mos.c		optional mos
 dev/usb/net/if_muge.c		optional muge
 dev/usb/net/if_rue.c		optional rue
 dev/usb/net/if_smsc.c		optional smsc
 dev/usb/net/if_udav.c		optional udav
 dev/usb/net/if_ure.c		optional ure
 dev/usb/net/if_usie.c		optional usie
 dev/usb/net/if_urndis.c		optional urndis
 dev/usb/net/ruephy.c		optional rue
 dev/usb/net/usb_ethernet.c	optional uether | aue | axe | axge | cdce | \
 					 cdceem | cue | ipheth | kue | mos | \
 					 rue | smsc | udav | ure | urndis | muge
 dev/usb/net/uhso.c		optional uhso
 #
 # USB WLAN drivers
 #
 dev/usb/wlan/if_rsu.c		optional rsu
 rsu-rtl8712fw.c			optional rsu-rtl8712fw | rsufw		\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk rsu-rtl8712fw.fw:rsu-rtl8712fw:120 -mrsu-rtl8712fw -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"rsu-rtl8712fw.c"
 rsu-rtl8712fw.fwo		optional rsu-rtl8712fw | rsufw		\
 	dependency	"rsu-rtl8712fw.fw"				\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"rsu-rtl8712fw.fwo"
 rsu-rtl8712fw.fw		optional rsu-rtl8712.fw | rsufw		\
 	dependency	"$S/contrib/dev/rsu/rsu-rtl8712fw.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"rsu-rtl8712fw.fw"
 dev/usb/wlan/if_rum.c		optional rum
 dev/usb/wlan/if_run.c		optional run
 runfw.c				optional runfw							\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk run.fw:runfw -mrunfw -c${.TARGET}"	\
 	no-ctfconvert no-implicit-rule before-depend local					\
 	clean		"runfw.c"
 runfw.fwo			optional runfw							\
 	dependency	"run.fw"								\
 	compile-with	"${NORMAL_FWO}"								\
 	no-implicit-rule									\
 	clean		"runfw.fwo"
 run.fw				optional runfw							\
 	dependency	"$S/contrib/dev/run/rt2870.fw.uu"					\
 	compile-with	"${NORMAL_FW}"								\
 	no-obj no-implicit-rule									\
 	clean		"run.fw"
 dev/usb/wlan/if_uath.c		optional uath
 dev/usb/wlan/if_upgt.c		optional upgt
 dev/usb/wlan/if_ural.c		optional ural
 dev/usb/wlan/if_urtw.c		optional urtw
 dev/usb/wlan/if_zyd.c		optional zyd
 #
 # USB serial and parallel port drivers
 #
 dev/usb/serial/u3g.c		optional u3g
 dev/usb/serial/uark.c		optional uark
 dev/usb/serial/ubsa.c		optional ubsa
 dev/usb/serial/ubser.c		optional ubser
 dev/usb/serial/uchcom.c		optional uchcom
 dev/usb/serial/ucycom.c		optional ucycom
 dev/usb/serial/ufoma.c		optional ufoma
 dev/usb/serial/uftdi.c		optional uftdi
 dev/usb/serial/ugensa.c		optional ugensa
 dev/usb/serial/uipaq.c		optional uipaq
 dev/usb/serial/ulpt.c		optional ulpt
 dev/usb/serial/umcs.c		optional umcs
 dev/usb/serial/umct.c		optional umct
 dev/usb/serial/umodem.c		optional umodem
 dev/usb/serial/umoscom.c	optional umoscom
 dev/usb/serial/uplcom.c		optional uplcom
 dev/usb/serial/uslcom.c		optional uslcom
 dev/usb/serial/uvisor.c		optional uvisor
 dev/usb/serial/uvscom.c		optional uvscom
 dev/usb/serial/usb_serial.c 	optional ucom | u3g | uark | ubsa | ubser | \
 					 uchcom | ucycom | ufoma | uftdi | \
 					 ugensa | uipaq | umcs | umct | \
 					 umodem | umoscom | uplcom | usie | \
 					 uslcom | uvisor | uvscom
 #
 # USB misc drivers
 #
 dev/usb/misc/cp2112.c		optional cp2112
 dev/usb/misc/udbp.c		optional udbp
 dev/usb/misc/ugold.c		optional ugold
 dev/usb/misc/uled.c		optional uled
 #
 # USB input drivers
 #
 dev/usb/input/atp.c		optional atp
 dev/usb/input/uep.c		optional uep
 dev/usb/input/uhid.c		optional uhid
 dev/usb/input/uhid_snes.c	optional uhid_snes
 dev/usb/input/ukbd.c		optional ukbd
 dev/usb/input/ums.c		optional ums
 dev/usb/input/usbhid.c		optional usbhid
 dev/usb/input/wmt.c		optional wmt
 dev/usb/input/wsp.c		optional wsp
 #
 # USB quirks
 #
 dev/usb/quirk/usb_quirk.c	optional usb
 #
 # USB templates
 #
 dev/usb/template/usb_template.c		optional usb_template
 dev/usb/template/usb_template_audio.c	optional usb_template
 dev/usb/template/usb_template_cdce.c	optional usb_template
 dev/usb/template/usb_template_kbd.c	optional usb_template
 dev/usb/template/usb_template_modem.c	optional usb_template
 dev/usb/template/usb_template_mouse.c	optional usb_template
 dev/usb/template/usb_template_msc.c	optional usb_template
 dev/usb/template/usb_template_mtp.c	optional usb_template
 dev/usb/template/usb_template_phone.c	optional usb_template
 dev/usb/template/usb_template_serialnet.c	optional usb_template
 dev/usb/template/usb_template_midi.c	optional usb_template
 dev/usb/template/usb_template_multi.c	optional usb_template
 dev/usb/template/usb_template_cdceem.c	optional usb_template
 #
 # USB video drivers
 #
 dev/usb/video/udl.c			optional udl
 #
 # USB END
 #
 dev/videomode/videomode.c		optional videomode
 dev/videomode/edid.c			optional videomode
 dev/videomode/pickmode.c		optional videomode
 dev/videomode/vesagtf.c			optional videomode
 dev/veriexec/verified_exec.c	optional mac_veriexec
 dev/vge/if_vge.c		optional vge
 dev/viapm/viapm.c		optional viapm pci
 dev/virtio/virtio.c			optional	virtio
 dev/virtio/virtqueue.c			optional	virtio
 dev/virtio/virtio_bus_if.m		optional	virtio
 dev/virtio/virtio_if.m			optional	virtio
 dev/virtio/pci/virtio_pci.c		optional	virtio_pci
 dev/virtio/pci/virtio_pci_if.m		optional	virtio_pci
 dev/virtio/pci/virtio_pci_legacy.c	optional	virtio_pci
 dev/virtio/pci/virtio_pci_modern.c	optional	virtio_pci
 dev/virtio/mmio/virtio_mmio.c		optional	virtio_mmio
 dev/virtio/mmio/virtio_mmio_acpi.c	optional	virtio_mmio acpi
 dev/virtio/mmio/virtio_mmio_cmdline.c	optional	virtio_mmio
 dev/virtio/mmio/virtio_mmio_fdt.c	optional	virtio_mmio fdt
 dev/virtio/mmio/virtio_mmio_if.m	optional	virtio_mmio
 dev/virtio/network/if_vtnet.c		optional	vtnet
 dev/virtio/block/virtio_blk.c		optional	virtio_blk
 dev/virtio/balloon/virtio_balloon.c	optional	virtio_balloon
 dev/virtio/gpu/virtio_gpu.c		optional	virtio_gpu
 dev/virtio/scsi/virtio_scsi.c		optional	virtio_scsi
 dev/virtio/random/virtio_random.c	optional	virtio_random
 dev/virtio/console/virtio_console.c	optional	virtio_console
 dev/vkbd/vkbd.c			optional vkbd
 dev/vmgenc/vmgenc_acpi.c	optional acpi
 dev/vmware/vmxnet3/if_vmx.c		optional vmx
 dev/vmware/vmci/vmci.c			optional vmci
 dev/vmware/vmci/vmci_datagram.c		optional vmci
 dev/vmware/vmci/vmci_doorbell.c		optional vmci
 dev/vmware/vmci/vmci_driver.c		optional vmci
 dev/vmware/vmci/vmci_event.c		optional vmci
 dev/vmware/vmci/vmci_hashtable.c	optional vmci
 dev/vmware/vmci/vmci_kernel_if.c	optional vmci
 dev/vmware/vmci/vmci_qpair.c		optional vmci
 dev/vmware/vmci/vmci_queue_pair.c	optional vmci
 dev/vmware/vmci/vmci_resource.c		optional vmci
 dev/vmware/pvscsi/pvscsi.c		optional pvscsi
 dev/vr/if_vr.c			optional vr pci
 dev/vt/colors/vt_termcolors.c	optional vt
 dev/vt/font/vt_font_default.c	optional vt
 dev/vt/font/vt_mouse_cursor.c	optional vt
 dev/vt/hw/efifb/efifb.c		optional vt_efifb
 dev/vt/hw/simplefb/simplefb.c	optional vt_simplefb fdt
 dev/vt/hw/vbefb/vbefb.c		optional vt_vbefb
 dev/vt/hw/fb/vt_fb.c		optional vt
 dev/vt/hw/vga/vt_vga.c		optional vt vt_vga
 dev/vt/logo/logo_freebsd.c	optional vt splash
 dev/vt/logo/logo_beastie.c	optional vt splash
 dev/vt/vt_buf.c			optional vt
 dev/vt/vt_consolectl.c		optional vt
 dev/vt/vt_core.c		optional vt
 dev/vt/vt_cpulogos.c		optional vt splash
 dev/vt/vt_font.c		optional vt
 dev/vt/vt_sysmouse.c		optional vt
 dev/vte/if_vte.c		optional vte pci
 dev/watchdog/watchdog.c		standard
 dev/wg/if_wg.c			optional wg				\
 	compile-with "${NORMAL_C} -include $S/dev/wg/compat.h"
 dev/wg/wg_cookie.c		optional wg				\
 	compile-with "${NORMAL_C} -include $S/dev/wg/compat.h"
 dev/wg/wg_crypto.c		optional wg				\
 	compile-with "${NORMAL_C} -include $S/dev/wg/compat.h"
 dev/wg/wg_noise.c		optional wg				\
 	compile-with "${NORMAL_C} -include $S/dev/wg/compat.h"
 dev/wpi/if_wpi.c		optional wpi pci
 wpifw.c			optional wpifw					\
 	compile-with	"${AWK} -f $S/tools/fw_stub.awk wpi.fw:wpifw:153229 -mwpi -c${.TARGET}" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean		"wpifw.c"
 wpifw.fwo			optional wpifw				\
 	dependency	"wpi.fw"					\
 	compile-with	"${NORMAL_FWO}"					\
 	no-implicit-rule						\
 	clean		"wpifw.fwo"
 wpi.fw			optional wpifw					\
 	dependency	"$S/contrib/dev/wpi/iwlwifi-3945-15.32.2.9.fw.uu"	\
 	compile-with	"${NORMAL_FW}"					\
 	no-obj no-implicit-rule						\
 	clean		"wpi.fw"
 dev/xdma/controller/pl330.c	optional xdma pl330 fdt
 dev/xdma/xdma.c			optional xdma
 dev/xdma/xdma_bank.c		optional xdma
 dev/xdma/xdma_bio.c		optional xdma
 dev/xdma/xdma_fdt_test.c	optional xdma xdma_test fdt
 dev/xdma/xdma_if.m		optional xdma
 dev/xdma/xdma_iommu.c		optional xdma
 dev/xdma/xdma_mbuf.c		optional xdma
 dev/xdma/xdma_queue.c		optional xdma
 dev/xdma/xdma_sg.c		optional xdma
 dev/xdma/xdma_sglist.c		optional xdma
 dev/xen/balloon/balloon.c	optional xenhvm
 dev/xen/blkfront/blkfront.c	optional xenhvm
 dev/xen/blkback/blkback.c	optional xenhvm
 dev/xen/bus/xen_intr.c		optional xenhvm
 dev/xen/bus/xenpv.c		optional xenhvm
 dev/xen/console/xen_console.c	optional xenhvm
 dev/xen/control/control.c	optional xenhvm
 dev/xen/cpu/xen_acpi_cpu.c	optional xenhvm acpi
 dev/xen/efi/pvefi.c		optional xenhvm xenefi efirt
 dev/xen/grant_table/grant_table.c	optional xenhvm
 dev/xen/netback/netback.c	optional xenhvm
 dev/xen/netfront/netfront.c	optional xenhvm
 dev/xen/timer/xen_timer.c	optional xenhvm xentimer
 dev/xen/xenpci/xenpci.c		optional xenpci
 dev/xen/xenstore/xenstore.c	optional xenhvm
 dev/xen/xenstore/xenstore_dev.c	optional xenhvm
 dev/xen/xenstore/xenstored_dev.c	optional xenhvm
 dev/xen/evtchn/evtchn_dev.c	optional xenhvm
 dev/xen/privcmd/privcmd.c	optional xenhvm
 dev/xen/gntdev/gntdev.c		optional xenhvm
 dev/xen/debug/debug.c		optional xenhvm
 dev/xl/if_xl.c			optional xl pci
 dev/xl/xlphy.c			optional xl pci
 fs/autofs/autofs.c		optional autofs
 fs/autofs/autofs_vfsops.c	optional autofs
 fs/autofs/autofs_vnops.c	optional autofs
 fs/deadfs/dead_vnops.c		standard
 fs/devfs/devfs_devs.c		standard
 fs/devfs/devfs_dir.c		standard
 fs/devfs/devfs_rule.c		standard
 fs/devfs/devfs_vfsops.c		standard
 fs/devfs/devfs_vnops.c		standard
 fs/fdescfs/fdesc_vfsops.c	optional fdescfs
 fs/fdescfs/fdesc_vnops.c	optional fdescfs
 fs/fifofs/fifo_vnops.c		standard
 fs/cuse/cuse.c			optional cuse
 fs/fuse/fuse_device.c		optional fusefs
 fs/fuse/fuse_file.c		optional fusefs
 fs/fuse/fuse_internal.c		optional fusefs
 fs/fuse/fuse_io.c		optional fusefs
 fs/fuse/fuse_ipc.c		optional fusefs
 fs/fuse/fuse_main.c		optional fusefs
 fs/fuse/fuse_node.c		optional fusefs
 fs/fuse/fuse_vfsops.c		optional fusefs
 fs/fuse/fuse_vnops.c		optional fusefs
 fs/mntfs/mntfs_vnops.c		standard
 fs/msdosfs/msdosfs_conv.c	optional msdosfs
 fs/msdosfs/msdosfs_denode.c	optional msdosfs
 fs/msdosfs/msdosfs_fat.c	optional msdosfs
 fs/msdosfs/msdosfs_iconv.c	optional msdosfs_iconv
 fs/msdosfs/msdosfs_lookup.c	optional msdosfs
 fs/msdosfs/msdosfs_vfsops.c	optional msdosfs
 fs/msdosfs/msdosfs_vnops.c	optional msdosfs
 fs/nfs/nfs_commonkrpc.c		optional nfscl | nfslockd | nfsd
 fs/nfs/nfs_commonsubs.c		optional nfscl | nfslockd | nfsd
 fs/nfs/nfs_commonport.c		optional nfscl | nfslockd | nfsd
 fs/nfs/nfs_commonacl.c		optional nfscl | nfslockd | nfsd
 fs/nfsclient/nfs_clcomsubs.c	optional nfscl
 fs/nfsclient/nfs_clsubs.c	optional nfscl
 fs/nfsclient/nfs_clstate.c	optional nfscl
 fs/nfsclient/nfs_clkrpc.c	optional nfscl
 fs/nfsclient/nfs_clrpcops.c	optional nfscl
 fs/nfsclient/nfs_clvnops.c	optional nfscl
 fs/nfsclient/nfs_clnode.c	optional nfscl
 fs/nfsclient/nfs_clvfsops.c	optional nfscl
 fs/nfsclient/nfs_clport.c	optional nfscl
 fs/nfsclient/nfs_clbio.c	optional nfscl
 fs/nfsclient/nfs_clnfsiod.c	optional nfscl
 fs/nfsserver/nfs_fha_new.c	optional nfsd inet
 fs/nfsserver/nfs_nfsdsocket.c	optional nfsd inet
 fs/nfsserver/nfs_nfsdsubs.c	optional nfsd inet
 fs/nfsserver/nfs_nfsdstate.c	optional nfsd inet
 fs/nfsserver/nfs_nfsdkrpc.c	optional nfsd inet
 fs/nfsserver/nfs_nfsdserv.c	optional nfsd inet
 fs/nfsserver/nfs_nfsdport.c	optional nfsd inet
 fs/nfsserver/nfs_nfsdcache.c	optional nfsd inet
 fs/nullfs/null_subr.c		optional nullfs
 fs/nullfs/null_vfsops.c		optional nullfs
 fs/nullfs/null_vnops.c		optional nullfs
 fs/procfs/procfs.c		optional procfs
 fs/procfs/procfs_dbregs.c	optional procfs
 fs/procfs/procfs_fpregs.c	optional procfs
 fs/procfs/procfs_map.c		optional procfs
 fs/procfs/procfs_mem.c		optional procfs
 fs/procfs/procfs_note.c		optional procfs
 fs/procfs/procfs_osrel.c	optional procfs
 fs/procfs/procfs_regs.c		optional procfs
 fs/procfs/procfs_rlimit.c	optional procfs
 fs/procfs/procfs_status.c	optional procfs
 fs/procfs/procfs_type.c		optional procfs
 fs/pseudofs/pseudofs.c		optional pseudofs
 fs/pseudofs/pseudofs_fileno.c	optional pseudofs
 fs/pseudofs/pseudofs_vncache.c	optional pseudofs
 fs/pseudofs/pseudofs_vnops.c	optional pseudofs
 fs/smbfs/smbfs_io.c		optional smbfs
 fs/smbfs/smbfs_node.c		optional smbfs
 fs/smbfs/smbfs_smb.c		optional smbfs
 fs/smbfs/smbfs_subr.c		optional smbfs
 fs/smbfs/smbfs_vfsops.c		optional smbfs
 fs/smbfs/smbfs_vnops.c		optional smbfs
 fs/tarfs/tarfs_io.c		optional tarfs compile-with "${NORMAL_C} -I$S/contrib/zstd/lib/freebsd"
 fs/tarfs/tarfs_subr.c		optional tarfs
 fs/tarfs/tarfs_vfsops.c		optional tarfs
 fs/tarfs/tarfs_vnops.c		optional tarfs
 fs/udf/osta.c			optional udf
 fs/udf/udf_iconv.c		optional udf_iconv
 fs/udf/udf_vfsops.c		optional udf
 fs/udf/udf_vnops.c		optional udf
 fs/unionfs/union_subr.c		optional unionfs
 fs/unionfs/union_vfsops.c	optional unionfs
 fs/unionfs/union_vnops.c	optional unionfs
 fs/tmpfs/tmpfs_vnops.c		optional tmpfs
 fs/tmpfs/tmpfs_fifoops.c 	optional tmpfs
 fs/tmpfs/tmpfs_vfsops.c 	optional tmpfs
 fs/tmpfs/tmpfs_subr.c 		optional tmpfs
 gdb/gdb_cons.c			optional gdb
 gdb/gdb_main.c			optional gdb
 gdb/gdb_packet.c		optional gdb
 gdb/netgdb.c			optional ddb debugnet gdb netgdb inet
 geom/bde/g_bde.c		optional geom_bde
 geom/bde/g_bde_crypt.c		optional geom_bde
 geom/bde/g_bde_lock.c		optional geom_bde
 geom/bde/g_bde_work.c		optional geom_bde
 geom/cache/g_cache.c		optional geom_cache
 geom/concat/g_concat.c		optional geom_concat
 geom/eli/g_eli.c		optional geom_eli
 geom/eli/g_eli_crypto.c		optional geom_eli
 geom/eli/g_eli_ctl.c		optional geom_eli
 geom/eli/g_eli_hmac.c		optional geom_eli
 geom/eli/g_eli_integrity.c	optional geom_eli
 geom/eli/g_eli_key.c		optional geom_eli
 geom/eli/g_eli_key_cache.c	optional geom_eli
 geom/eli/g_eli_privacy.c	optional geom_eli
 geom/eli/pkcs5v2.c		optional geom_eli
 geom/gate/g_gate.c		optional geom_gate
 geom/geom_bsd_enc.c		optional geom_part_bsd
 geom/geom_ccd.c			optional ccd | geom_ccd
 geom/geom_ctl.c			standard
 geom/geom_dev.c			standard
 geom/geom_disk.c		standard
 geom/geom_dump.c		standard
 geom/geom_event.c		standard
 geom/geom_flashmap.c		optional fdt cfi | fdt mx25l | mmcsd | fdt n25q | fdt at45d
 geom/geom_io.c			standard
 geom/geom_kern.c		standard
 geom/geom_slice.c		standard
 geom/geom_subr.c		standard
 geom/geom_vfs.c			standard
 geom/journal/g_journal.c	optional geom_journal
 geom/journal/g_journal_ufs.c	optional geom_journal
 geom/label/g_label.c		optional geom_label | geom_label_gpt
 geom/label/g_label_ext2fs.c	optional geom_label
 geom/label/g_label_flashmap.c	optional geom_label
 geom/label/g_label_iso9660.c	optional geom_label
 geom/label/g_label_msdosfs.c	optional geom_label
 geom/label/g_label_ntfs.c	optional geom_label
 geom/label/g_label_reiserfs.c	optional geom_label
 geom/label/g_label_ufs.c	optional geom_label
 geom/label/g_label_gpt.c	optional geom_label | geom_label_gpt
 geom/label/g_label_disk_ident.c	optional geom_label
 geom/linux_lvm/g_linux_lvm.c	optional geom_linux_lvm
 geom/mirror/g_mirror.c		optional geom_mirror
 geom/mirror/g_mirror_ctl.c	optional geom_mirror
 geom/mountver/g_mountver.c	optional geom_mountver
 geom/multipath/g_multipath.c	optional geom_multipath
 geom/nop/g_nop.c		optional geom_nop
 geom/part/g_part.c		standard
 geom/part/g_part_if.m		standard
 geom/part/g_part_apm.c		optional geom_part_apm
 geom/part/g_part_bsd.c		optional geom_part_bsd
 geom/part/g_part_bsd64.c	optional geom_part_bsd64
 geom/part/g_part_ebr.c		optional geom_part_ebr
 geom/part/g_part_gpt.c		optional geom_part_gpt
 geom/part/g_part_ldm.c		optional geom_part_ldm
 geom/part/g_part_mbr.c		optional geom_part_mbr
 geom/raid/g_raid.c		optional geom_raid
 geom/raid/g_raid_ctl.c		optional geom_raid
 geom/raid/g_raid_md_if.m	optional geom_raid
 geom/raid/g_raid_tr_if.m	optional geom_raid
 geom/raid/md_ddf.c		optional geom_raid
 geom/raid/md_intel.c		optional geom_raid
 geom/raid/md_jmicron.c		optional geom_raid
 geom/raid/md_nvidia.c		optional geom_raid
 geom/raid/md_promise.c		optional geom_raid
 geom/raid/md_sii.c		optional geom_raid
 geom/raid/tr_concat.c		optional geom_raid
 geom/raid/tr_raid0.c		optional geom_raid
 geom/raid/tr_raid1.c		optional geom_raid
 geom/raid/tr_raid1e.c		optional geom_raid
 geom/raid/tr_raid5.c		optional geom_raid
 geom/raid3/g_raid3.c		optional geom_raid3
 geom/raid3/g_raid3_ctl.c	optional geom_raid3
 geom/shsec/g_shsec.c		optional geom_shsec
 geom/stripe/g_stripe.c		optional geom_stripe
 geom/union/g_union.c		optional geom_union
 geom/uzip/g_uzip.c		optional geom_uzip
 geom/uzip/g_uzip_lzma.c		optional geom_uzip
 geom/uzip/g_uzip_wrkthr.c	optional geom_uzip
 geom/uzip/g_uzip_zlib.c		optional geom_uzip
 geom/uzip/g_uzip_zstd.c		optional geom_uzip zstdio \
 	compile-with "${NORMAL_C} -I$S/contrib/zstd/lib/freebsd"
 geom/vinum/geom_vinum.c		optional geom_vinum
 geom/vinum/geom_vinum_create.c	optional geom_vinum
 geom/vinum/geom_vinum_drive.c	optional geom_vinum
 geom/vinum/geom_vinum_plex.c	optional geom_vinum
 geom/vinum/geom_vinum_volume.c	optional geom_vinum
 geom/vinum/geom_vinum_subr.c	optional geom_vinum
 geom/vinum/geom_vinum_raid5.c	optional geom_vinum
 geom/vinum/geom_vinum_share.c	optional geom_vinum
 geom/vinum/geom_vinum_list.c	optional geom_vinum
 geom/vinum/geom_vinum_rm.c	optional geom_vinum
 geom/vinum/geom_vinum_init.c	optional geom_vinum
 geom/vinum/geom_vinum_state.c	optional geom_vinum
 geom/vinum/geom_vinum_rename.c	optional geom_vinum
 geom/vinum/geom_vinum_move.c	optional geom_vinum
 geom/vinum/geom_vinum_events.c	optional geom_vinum
 geom/virstor/binstream.c	optional geom_virstor
 geom/virstor/g_virstor.c	optional geom_virstor
 geom/virstor/g_virstor_md.c	optional geom_virstor
 geom/zero/g_zero.c		optional geom_zero
 fs/ext2fs/ext2_acl.c		optional ext2fs
 fs/ext2fs/ext2_alloc.c		optional ext2fs
 fs/ext2fs/ext2_balloc.c		optional ext2fs
 fs/ext2fs/ext2_bmap.c		optional ext2fs
 fs/ext2fs/ext2_csum.c		optional ext2fs
 fs/ext2fs/ext2_extattr.c	optional ext2fs
 fs/ext2fs/ext2_extents.c	optional ext2fs
 fs/ext2fs/ext2_inode.c		optional ext2fs
 fs/ext2fs/ext2_inode_cnv.c	optional ext2fs
 fs/ext2fs/ext2_hash.c		optional ext2fs
 fs/ext2fs/ext2_htree.c		optional ext2fs
 fs/ext2fs/ext2_lookup.c		optional ext2fs
 fs/ext2fs/ext2_subr.c		optional ext2fs
 fs/ext2fs/ext2_vfsops.c		optional ext2fs
 fs/ext2fs/ext2_vnops.c		optional ext2fs
 #
 isa/isa_if.m			standard
 isa/isa_common.c		optional isa
 isa/isahint.c			optional isa
 isa/pnp.c			optional isa isapnp
 isa/pnpparse.c			optional isa isapnp
 fs/cd9660/cd9660_bmap.c	optional cd9660
 fs/cd9660/cd9660_lookup.c	optional cd9660
 fs/cd9660/cd9660_node.c	optional cd9660
 fs/cd9660/cd9660_rrip.c	optional cd9660
 fs/cd9660/cd9660_util.c	optional cd9660
 fs/cd9660/cd9660_vfsops.c	optional cd9660
 fs/cd9660/cd9660_vnops.c	optional cd9660
 fs/cd9660/cd9660_iconv.c	optional cd9660_iconv
 gnu/gcov/gcc_4_7.c		optional gcov  \
 	warning "kernel contains GPL licensed gcov support"
 gnu/gcov/gcov_fs.c		optional gcov  lindebugfs \
 	compile-with "${LINUXKPI_C}"
 gnu/gcov/gcov_subr.c		optional gcov
 
 kern/bus_if.m			standard
 kern/clock_if.m			standard
 kern/cpufreq_if.m		standard
 kern/device_if.m		standard
 kern/imgact_binmisc.c		optional imgact_binmisc
 kern/imgact_elf.c		standard
 kern/imgact_elf32.c		optional compat_freebsd32
 kern/imgact_shell.c		standard
 kern/init_main.c		standard
 kern/init_sysent.c		standard
 kern/ksched.c			optional _kposix_priority_scheduling
 kern/kern_acct.c		standard
 kern/kern_alq.c			optional alq
 kern/kern_boottrace.c		standard
 kern/kern_clock.c		standard
 kern/kern_clocksource.c		standard
 kern/kern_condvar.c		standard
 kern/kern_conf.c		standard
 kern/kern_cons.c		standard
 kern/kern_cpu.c			standard
 kern/kern_cpuset.c		standard
 kern/kern_context.c		standard
 kern/kern_descrip.c		standard
 kern/kern_devctl.c		standard
 kern/kern_dtrace.c		optional kdtrace_hooks
 kern/kern_dump.c		standard
 kern/kern_environment.c		standard
 kern/kern_et.c			standard
 kern/kern_event.c		standard
 kern/kern_exec.c		standard
 kern/kern_exit.c		standard
 kern/kern_fail.c		standard
 kern/kern_ffclock.c		standard
 kern/kern_fork.c		standard
 kern/kern_hhook.c		standard
 kern/kern_idle.c		standard
 kern/kern_intr.c		standard
 kern/kern_jail.c		standard
 kern/kern_kcov.c		optional kcov			\
 	compile-with "${NORMAL_C:N-fsanitize*} ${NORMAL_C:M-fsanitize=kernel-memory}"
 kern/kern_khelp.c		standard
 kern/kern_kthread.c		standard
 kern/kern_ktr.c			optional ktr
 kern/kern_ktrace.c		standard
 kern/kern_linker.c		standard
 kern/kern_lock.c		standard
 kern/kern_lockf.c		standard
 kern/kern_lockstat.c		optional kdtrace_hooks
 kern/kern_loginclass.c		standard
 kern/kern_malloc.c		standard
 kern/kern_mbuf.c		standard
 kern/kern_membarrier.c		standard
 kern/kern_mib.c			standard
 kern/kern_module.c		standard
 kern/kern_mtxpool.c		standard
 kern/kern_mutex.c		standard
 kern/kern_ntptime.c		standard
 kern/kern_osd.c			standard
 kern/kern_physio.c		standard
 kern/kern_pmc.c			standard
 kern/kern_poll.c		optional device_polling
 kern/kern_priv.c		standard
 kern/kern_proc.c		standard
 kern/kern_procctl.c		standard
 kern/kern_prot.c		standard
 kern/kern_racct.c		optional racct
 kern/kern_rangelock.c		standard
 kern/kern_rctl.c		standard
 kern/kern_resource.c		standard
 kern/kern_rmlock.c		standard
 kern/kern_rwlock.c		standard
 kern/kern_sdt.c			optional kdtrace_hooks
 kern/kern_sema.c		standard
 kern/kern_sendfile.c		standard
 kern/kern_sharedpage.c		standard
 kern/kern_shutdown.c		standard
 kern/kern_sig.c			standard
 kern/kern_switch.c		standard
 kern/kern_sx.c			standard
 kern/kern_synch.c		standard
 kern/kern_syscalls.c		standard
 kern/kern_sysctl.c		standard
 kern/kern_tc.c			standard
 kern/kern_thr.c			standard
 kern/kern_thread.c		standard
 kern/kern_time.c		standard
 kern/kern_timeout.c		standard
 kern/kern_tslog.c		optional tslog
 kern/kern_ubsan.c		optional kubsan
 kern/kern_umtx.c		standard
 kern/kern_uuid.c		standard
 kern/kern_vnodedumper.c		standard
 kern/kern_xxx.c			standard
 kern/link_elf.c			standard
 kern/linker_if.m		standard
 kern/md4c.c			optional netsmb
 kern/md5c.c			standard
 kern/p1003_1b.c			standard
 kern/posix4_mib.c		standard
 kern/sched_4bsd.c		optional sched_4bsd
 kern/sched_ule.c		optional sched_ule
 kern/serdev_if.m		standard
 kern/stack_protector.c		standard \
 	compile-with "${NORMAL_C:N-fstack-protector*}"
 kern/subr_acl_nfs4.c		optional ufs_acl | zfs
 kern/subr_acl_posix1e.c		optional ufs_acl
 kern/subr_asan.c		optional kasan \
 	compile-with "${NORMAL_C:N-fsanitize*:N-fstack-protector*}"
 kern/subr_autoconf.c		standard
 kern/subr_blist.c		standard
 kern/subr_boot.c		standard
 kern/subr_bus.c			standard
 kern/subr_bus_dma.c		standard
 kern/subr_bufring.c		standard
 kern/subr_capability.c		standard
 kern/subr_clock.c		standard
 kern/subr_compressor.c		standard \
 	compile-with "${NORMAL_C} -I$S/contrib/zstd/lib/freebsd"
 kern/subr_coverage.c		optional coverage \
 	compile-with "${NORMAL_C:N-fsanitize*}"
 kern/subr_counter.c		standard
 kern/subr_csan.c		optional kcsan \
 	compile-with "${NORMAL_C:N-fsanitize*:N-fstack-protector*}"
 kern/subr_devstat.c		standard
 kern/subr_disk.c		standard
 kern/subr_early.c		standard
 kern/subr_epoch.c		standard
 kern/subr_eventhandler.c	standard
 kern/subr_fattime.c		standard
 kern/subr_firmware.c		optional firmware
 kern/subr_filter.c		standard
 kern/subr_gtaskqueue.c		standard
 kern/subr_hash.c		standard
 kern/subr_hints.c		standard
 kern/subr_kdb.c			standard
 kern/subr_kobj.c		standard
 kern/subr_lock.c		standard
 kern/subr_log.c			standard
 kern/subr_mchain.c		optional libmchain
 kern/subr_memdesc.c		standard
 kern/subr_module.c		standard
 kern/subr_msan.c		optional kmsan \
 	compile-with "${NORMAL_C:N-fsanitize*:N-fno-sanitize*:N-fstack-protector*}"
 kern/subr_msgbuf.c		standard
 kern/subr_param.c		standard
 kern/subr_pcpu.c		standard
 kern/subr_pctrie.c		standard
 kern/subr_pidctrl.c		standard
 kern/subr_power.c		standard
 kern/subr_prf.c			standard
 kern/subr_prng.c		standard
 kern/subr_prof.c		standard
 kern/subr_rangeset.c		standard
 kern/subr_rman.c		standard
 kern/subr_rtc.c			standard
 kern/subr_sbuf.c		standard
 kern/subr_scanf.c		standard
 kern/subr_sglist.c		standard
 kern/subr_sleepqueue.c		standard
 kern/subr_smp.c			standard
 kern/subr_smr.c			standard
 kern/subr_stack.c		optional ddb | stack | ktr
 kern/subr_stats.c		optional stats
 kern/subr_taskqueue.c		standard
 kern/subr_terminal.c		optional vt
 kern/subr_trap.c		standard
 kern/subr_turnstile.c		standard
 kern/subr_uio.c			standard
 kern/subr_unit.c		standard
 kern/subr_vmem.c		standard
 kern/subr_witness.c		optional witness
 kern/sys_capability.c		standard
 kern/sys_eventfd.c		standard
 kern/sys_generic.c		standard
 kern/sys_getrandom.c		standard
 kern/sys_pipe.c			standard
 kern/sys_procdesc.c		standard
 kern/sys_process.c		standard
 kern/sys_socket.c		standard
 kern/sys_timerfd.c		standard
 kern/syscalls.c			standard
 kern/sysv_ipc.c			standard
 kern/sysv_msg.c			optional sysvmsg
 kern/sysv_sem.c			optional sysvsem
 kern/sysv_shm.c			optional sysvshm
 kern/tty.c			standard
 kern/tty_compat.c		optional compat_43tty
 kern/tty_info.c			standard
 kern/tty_inq.c			standard
 kern/tty_outq.c			standard
 kern/tty_pts.c			standard
 kern/tty_tty.c			standard
 kern/tty_ttydisc.c		standard
 kern/uipc_accf.c		standard
 kern/uipc_debug.c		optional ddb
 kern/uipc_domain.c		standard
 kern/uipc_ktls.c		optional kern_tls
 kern/uipc_mbuf.c		standard
 kern/uipc_mbuf2.c		standard
 kern/uipc_mbufhash.c		standard
 kern/uipc_mqueue.c		optional p1003_1b_mqueue
 kern/uipc_sem.c			optional p1003_1b_semaphores
 kern/uipc_shm.c			standard
 kern/uipc_sockbuf.c		standard
 kern/uipc_socket.c		standard
 kern/uipc_syscalls.c		standard
 kern/uipc_usrreq.c		standard
 kern/vfs_acl.c			standard
 kern/vfs_aio.c			standard
 kern/vfs_bio.c			standard
 kern/vfs_cache.c		standard
 kern/vfs_cluster.c		standard
 kern/vfs_default.c		standard
 kern/vfs_export.c		standard
 kern/vfs_extattr.c		standard
 kern/vfs_hash.c			standard
 kern/vfs_init.c			standard
 kern/vfs_lookup.c		standard
 kern/vfs_mount.c		standard
 kern/vfs_mountroot.c		standard
 kern/vfs_subr.c			standard
 kern/vfs_syscalls.c		standard
 kern/vfs_vnops.c		standard
 #
 # Kernel GSS-API
 #
 gssd.h				optional kgssapi			\
 	dependency		"$S/kgssapi/gssd.x"			\
 	compile-with		"RPCGEN_CPP='${CPP}' rpcgen -hM $S/kgssapi/gssd.x | grep -v pthread.h > gssd.h" \
 	no-obj no-implicit-rule before-depend local			\
 	clean			"gssd.h"
 gssd_xdr.c			optional kgssapi			\
 	dependency		"$S/kgssapi/gssd.x gssd.h"		\
 	compile-with		"RPCGEN_CPP='${CPP}' rpcgen -c $S/kgssapi/gssd.x -o gssd_xdr.c" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean			"gssd_xdr.c"
 gssd_clnt.c			optional kgssapi			\
 	dependency		"$S/kgssapi/gssd.x gssd.h"		\
 	compile-with		"RPCGEN_CPP='${CPP}' rpcgen -lM $S/kgssapi/gssd.x | grep -v string.h > gssd_clnt.c" \
 	no-ctfconvert no-implicit-rule before-depend local		\
 	clean			"gssd_clnt.c"
 kgssapi/gss_accept_sec_context.c optional kgssapi
 kgssapi/gss_add_oid_set_member.c optional kgssapi
 kgssapi/gss_acquire_cred.c	optional kgssapi
 kgssapi/gss_canonicalize_name.c	optional kgssapi
 kgssapi/gss_create_empty_oid_set.c optional kgssapi
 kgssapi/gss_delete_sec_context.c optional kgssapi
 kgssapi/gss_display_status.c	optional kgssapi
 kgssapi/gss_export_name.c	optional kgssapi
 kgssapi/gss_get_mic.c		optional kgssapi
 kgssapi/gss_init_sec_context.c	optional kgssapi
 kgssapi/gss_impl.c		optional kgssapi
 kgssapi/gss_import_name.c	optional kgssapi
 kgssapi/gss_ip_to_dns.c		optional kgssapi
 kgssapi/gss_names.c		optional kgssapi
 kgssapi/gss_pname_to_uid.c	optional kgssapi
 kgssapi/gss_release_buffer.c	optional kgssapi
 kgssapi/gss_release_cred.c	optional kgssapi
 kgssapi/gss_release_name.c	optional kgssapi
 kgssapi/gss_release_oid_set.c	optional kgssapi
 kgssapi/gss_set_cred_option.c	optional kgssapi
 kgssapi/gss_test_oid_set_member.c optional kgssapi
 kgssapi/gss_unwrap.c		optional kgssapi
 kgssapi/gss_verify_mic.c	optional kgssapi
 kgssapi/gss_wrap.c		optional kgssapi
 kgssapi/gss_wrap_size_limit.c	optional kgssapi
 kgssapi/gssd_prot.c		optional kgssapi
 kgssapi/krb5/krb5_mech.c	optional kgssapi
 kgssapi/krb5/kcrypto.c		optional kgssapi
 kgssapi/krb5/kcrypto_aes.c	optional kgssapi
 kgssapi/kgss_if.m		optional kgssapi
 kgssapi/gsstest.c		optional kgssapi_debug
 # These files in libkern/ are those needed by all architectures.  Some
 # of the files in libkern/ are only needed on some architectures, e.g.,
 # libkern/divdi3.c is needed by i386 but not alpha.  Also, some of these
 # routines may be optimized for a particular platform.  In either case,
 # the file should be moved to conf/files.<arch> from here.
 #
 libkern/arc4random.c		standard
 libkern/arc4random_uniform.c	standard
 libkern/asprintf.c		standard
 libkern/bcd.c			standard
 libkern/bsearch.c		standard
 libkern/crc16.c			standard
 libkern/explicit_bzero.c	standard
 libkern/fnmatch.c		standard
 libkern/gsb_crc32.c		standard
 libkern/iconv.c			optional libiconv
 libkern/iconv_converter_if.m	optional libiconv
 libkern/iconv_ucs.c		optional libiconv
 libkern/iconv_xlat.c		optional libiconv
 libkern/iconv_xlat16.c		optional libiconv
 libkern/inet_aton.c		standard
 libkern/inet_ntoa.c		standard
 libkern/inet_ntop.c		standard
 libkern/inet_pton.c		standard
 libkern/jenkins_hash.c		standard
 libkern/murmur3_32.c		standard
 libkern/memcchr.c		standard
 libkern/memchr.c		standard
 libkern/memmem.c		optional gdb
 libkern/qsort.c			standard
 libkern/qsort_r.c		standard
 libkern/random.c		standard
 libkern/scanc.c			standard
 libkern/strcasecmp.c		standard
 libkern/strcasestr.c		standard
 libkern/strcat.c		standard
 libkern/strchr.c		standard
 libkern/strchrnul.c		standard
 libkern/strcpy.c		standard
 libkern/strcspn.c		standard
 libkern/strdup.c		standard
 libkern/strndup.c		standard
 libkern/strlcat.c		standard
 libkern/strlcpy.c		standard
 libkern/strncat.c		standard
 libkern/strncpy.c		standard
 libkern/strnlen.c		standard
 libkern/strnstr.c		standard
 libkern/strrchr.c		standard
 libkern/strsep.c		standard
 libkern/strspn.c		standard
 libkern/strstr.c		standard
 libkern/strtol.c		standard
 libkern/strtoq.c		standard
 libkern/strtoul.c		standard
 libkern/strtouq.c		standard
 libkern/strvalid.c		standard
 libkern/timingsafe_bcmp.c	standard
 contrib/zlib/adler32.c		optional crypto | geom_uzip | \
 	mxge | ddb_ctf | gzio | zfs | zlib \
 	compile-with "${ZLIB_C}"
 contrib/zlib/compress.c		optional crypto | geom_uzip | \
 	mxge | ddb_ctf | gzio | zfs | zlib \
 	compile-with "${ZLIB_C}"
 contrib/zlib/crc32.c		optional crypto | geom_uzip | \
 	mxge | ddb_ctf | gzio | zfs | zlib \
 	compile-with "${ZLIB_C}"
 contrib/zlib/deflate.c		optional crypto | geom_uzip | \
 	mxge | ddb_ctf | gzio | zfs | zlib \
 	compile-with "${ZLIB_C}"
 contrib/zlib/inffast.c		optional crypto | geom_uzip | \
 	mxge | ddb_ctf | gzio | zfs | zlib \
 	compile-with "${ZLIB_C}"
 contrib/zlib/inflate.c		optional crypto | geom_uzip | \
 	mxge | ddb_ctf | gzio | zfs | zlib \
 	compile-with "${ZLIB_C}"
 contrib/zlib/inftrees.c		optional crypto | geom_uzip | \
 	mxge | ddb_ctf | gzio | zfs | zlib \
 	compile-with "${ZLIB_C}"
 contrib/zlib/trees.c		optional crypto | geom_uzip | \
 	mxge | ddb_ctf | gzio | zfs | zlib \
 	compile-with "${ZLIB_C}"
 contrib/zlib/uncompr.c		optional crypto | geom_uzip | \
 	mxge | ddb_ctf | gzio | zfs | zlib \
 	compile-with "${ZLIB_C}"
 contrib/zlib/zutil.c		optional crypto | geom_uzip | \
 	mxge | ddb_ctf | gzio | zfs | zlib \
 	compile-with "${ZLIB_C}"
 dev/zlib/zlib_mod.c		optional crypto | geom_uzip | \
 	mxge | ddb_ctf | gzio | zfs | zlib
 dev/zlib/zcalloc.c		optional crypto | geom_uzip | \
 	mxge | ddb_ctf | gzio | zfs | zlib
 net/altq/altq_cbq.c		optional altq
 net/altq/altq_codel.c		optional altq
 net/altq/altq_hfsc.c		optional altq
 net/altq/altq_fairq.c		optional altq
 net/altq/altq_priq.c		optional altq
 net/altq/altq_red.c		optional altq
 net/altq/altq_rio.c		optional altq
 net/altq/altq_rmclass.c		optional altq
 net/altq/altq_subr.c		optional altq
 net/bpf.c			standard
 net/bpf_buffer.c		optional bpf
 net/bpf_jitter.c		optional bpf_jitter
 net/bpf_filter.c		optional bpf | netgraph_bpf
 net/bpf_zerocopy.c		optional bpf
 net/bridgestp.c			optional bridge | if_bridge
 net/ieee8023ad_lacp.c		optional lagg
 net/if.c			standard
 net/ifq.c			standard
 net/if_bridge.c			optional bridge inet | if_bridge inet
 net/if_clone.c			standard
 net/if_dead.c			standard
 net/if_disc.c			optional disc
 net/if_edsc.c			optional edsc
 net/if_enc.c			optional enc inet | enc inet6
 net/if_epair.c			optional epair
 net/if_ethersubr.c		optional ether
 net/if_fwsubr.c			optional fwip
 net/if_gif.c			optional gif inet | gif inet6 | \
 					 netgraph_gif inet | netgraph_gif inet6
 net/if_gre.c			optional gre inet | gre inet6
 net/if_ipsec.c			optional inet ipsec | inet6 ipsec
 net/if_lagg.c			optional lagg
 net/if_loop.c			optional loop
 net/if_llatbl.c			standard
 net/if_me.c			optional me inet
 net/if_media.c			standard
 net/if_mib.c			standard
 net/if_ovpn.c			optional ovpn inet | ovpn inet6
 net/if_stf.c			optional stf inet inet6
 net/if_tuntap.c			optional tuntap
 net/if_vlan.c			optional vlan
 net/if_vxlan.c			optional vxlan inet | vxlan inet6
 net/ifdi_if.m			optional ether pci iflib
 net/iflib.c			optional ether pci iflib
 net/mp_ring.c			optional ether iflib
 net/mppcc.c			optional netgraph_mppc_compression
 net/mppcd.c			optional netgraph_mppc_compression
 net/netisr.c			standard
 net/debugnet.c			optional inet debugnet
 net/debugnet_inet.c		optional inet debugnet
 net/pfil.c			optional ether | inet
 net/radix.c			standard
 net/route.c			standard
 net/route/nhgrp.c		optional route_mpath
 net/route/nhgrp_ctl.c		optional route_mpath
 net/route/nhop.c		standard
 net/route/nhop_ctl.c		standard
 net/route/nhop_utils.c		standard
 net/route/fib_algo.c		optional fib_algo
 net/route/route_ctl.c		standard
 net/route/route_ddb.c		optional ddb
 net/route/route_helpers.c	standard
 net/route/route_ifaddrs.c	standard
 net/route/route_rtentry.c	standard
 net/route/route_subscription.c	standard
 net/route/route_tables.c	standard
 net/route/route_temporal.c	standard
 net/rss_config.c		optional inet rss | inet6 rss
 net/rtsock.c			standard
 net/slcompress.c		optional netgraph_vjc
 net/toeplitz.c			optional inet rss | inet6 rss | route_mpath
 net/vnet.c			optional vimage
 net80211/ieee80211.c		optional wlan
 net80211/ieee80211_acl.c	optional wlan wlan_acl
 net80211/ieee80211_action.c	optional wlan
 net80211/ieee80211_adhoc.c	optional wlan \
 	compile-with "${NORMAL_C} -Wno-unused-function"
 net80211/ieee80211_ageq.c	optional wlan
 net80211/ieee80211_amrr.c	optional wlan | wlan_amrr
 net80211/ieee80211_crypto.c	optional wlan \
 	compile-with "${NORMAL_C} -Wno-unused-function"
 net80211/ieee80211_crypto_ccmp.c optional wlan wlan_ccmp
 net80211/ieee80211_crypto_none.c optional wlan
 net80211/ieee80211_crypto_tkip.c optional wlan wlan_tkip
 net80211/ieee80211_crypto_wep.c	optional wlan wlan_wep
 net80211/ieee80211_ddb.c	optional wlan ddb
 net80211/ieee80211_dfs.c	optional wlan
 net80211/ieee80211_freebsd.c	optional wlan
 net80211/ieee80211_hostap.c	optional wlan \
 	compile-with "${NORMAL_C} -Wno-unused-function"
 net80211/ieee80211_ht.c		optional wlan
 net80211/ieee80211_hwmp.c	optional wlan ieee80211_support_mesh
 net80211/ieee80211_input.c	optional wlan
 net80211/ieee80211_ioctl.c	optional wlan
 net80211/ieee80211_mesh.c	optional wlan ieee80211_support_mesh \
 	compile-with "${NORMAL_C} -Wno-unused-function"
 net80211/ieee80211_monitor.c	optional wlan
 net80211/ieee80211_node.c	optional wlan
 net80211/ieee80211_output.c	optional wlan
 net80211/ieee80211_phy.c	optional wlan
 net80211/ieee80211_power.c	optional wlan
 net80211/ieee80211_proto.c	optional wlan
 net80211/ieee80211_radiotap.c	optional wlan
 net80211/ieee80211_ratectl.c	optional wlan
 net80211/ieee80211_ratectl_none.c optional wlan
 net80211/ieee80211_regdomain.c	optional wlan
 net80211/ieee80211_rssadapt.c	optional wlan wlan_rssadapt
 net80211/ieee80211_scan.c	optional wlan
 net80211/ieee80211_scan_sta.c	optional wlan
 net80211/ieee80211_sta.c	optional wlan \
 	compile-with "${NORMAL_C} -Wno-unused-function"
 net80211/ieee80211_superg.c	optional wlan ieee80211_support_superg
 net80211/ieee80211_scan_sw.c	optional wlan
 net80211/ieee80211_tdma.c	optional wlan ieee80211_support_tdma
 net80211/ieee80211_vht.c	optional wlan
 net80211/ieee80211_wds.c	optional wlan
 net80211/ieee80211_xauth.c	optional wlan wlan_xauth
 net80211/ieee80211_alq.c	optional wlan ieee80211_alq
 netgraph/bluetooth/common/ng_bluetooth.c optional netgraph_bluetooth
 netgraph/bluetooth/drivers/ubt/ng_ubt.c optional netgraph_bluetooth_ubt usb
 netgraph/bluetooth/drivers/ubt/ng_ubt_intel.c optional netgraph_bluetooth_ubt usb
 netgraph/bluetooth/drivers/ubtbcmfw/ubtbcmfw.c optional netgraph_bluetooth_ubtbcmfw usb
 netgraph/bluetooth/hci/ng_hci_cmds.c optional netgraph_bluetooth_hci
 netgraph/bluetooth/hci/ng_hci_evnt.c optional netgraph_bluetooth_hci
 netgraph/bluetooth/hci/ng_hci_main.c optional netgraph_bluetooth_hci
 netgraph/bluetooth/hci/ng_hci_misc.c optional netgraph_bluetooth_hci
 netgraph/bluetooth/hci/ng_hci_ulpi.c optional netgraph_bluetooth_hci
 netgraph/bluetooth/l2cap/ng_l2cap_cmds.c optional netgraph_bluetooth_l2cap
 netgraph/bluetooth/l2cap/ng_l2cap_evnt.c optional netgraph_bluetooth_l2cap
 netgraph/bluetooth/l2cap/ng_l2cap_llpi.c optional netgraph_bluetooth_l2cap
 netgraph/bluetooth/l2cap/ng_l2cap_main.c optional netgraph_bluetooth_l2cap
 netgraph/bluetooth/l2cap/ng_l2cap_misc.c optional netgraph_bluetooth_l2cap
 netgraph/bluetooth/l2cap/ng_l2cap_ulpi.c optional netgraph_bluetooth_l2cap
 netgraph/bluetooth/socket/ng_btsocket.c optional netgraph_bluetooth_socket
 netgraph/bluetooth/socket/ng_btsocket_hci_raw.c	optional netgraph_bluetooth_socket
 netgraph/bluetooth/socket/ng_btsocket_l2cap.c optional netgraph_bluetooth_socket
 netgraph/bluetooth/socket/ng_btsocket_l2cap_raw.c optional netgraph_bluetooth_socket
 netgraph/bluetooth/socket/ng_btsocket_rfcomm.c optional netgraph_bluetooth_socket
 netgraph/bluetooth/socket/ng_btsocket_sco.c optional netgraph_bluetooth_socket
 netgraph/netflow/netflow.c	optional netgraph_netflow
 netgraph/netflow/netflow_v9.c	optional netgraph_netflow
 netgraph/netflow/ng_netflow.c	optional netgraph_netflow
 netgraph/ng_UI.c		optional netgraph_UI
 netgraph/ng_async.c		optional netgraph_async
 netgraph/ng_base.c		optional netgraph
 netgraph/ng_bpf.c		optional netgraph_bpf
 netgraph/ng_bridge.c		optional netgraph_bridge
 netgraph/ng_car.c		optional netgraph_car
 netgraph/ng_checksum.c		optional netgraph_checksum
 netgraph/ng_cisco.c		optional netgraph_cisco
 netgraph/ng_deflate.c		optional netgraph_deflate
 netgraph/ng_device.c		optional netgraph_device
 netgraph/ng_echo.c		optional netgraph_echo
 netgraph/ng_eiface.c		optional netgraph_eiface
 netgraph/ng_ether.c		optional netgraph_ether
 netgraph/ng_ether_echo.c	optional netgraph_ether_echo
 netgraph/ng_frame_relay.c	optional netgraph_frame_relay
 netgraph/ng_gif.c		optional netgraph_gif inet6 | netgraph_gif inet
 netgraph/ng_gif_demux.c		optional netgraph_gif_demux
 netgraph/ng_hole.c		optional netgraph_hole
 netgraph/ng_iface.c		optional netgraph_iface
 netgraph/ng_ip_input.c		optional netgraph_ip_input
 netgraph/ng_ipfw.c		optional netgraph_ipfw inet ipfirewall
 netgraph/ng_ksocket.c		optional netgraph_ksocket
 netgraph/ng_l2tp.c		optional netgraph_l2tp
 netgraph/ng_lmi.c		optional netgraph_lmi
 netgraph/ng_macfilter.c		optional netgraph_macfilter
 netgraph/ng_mppc.c		optional netgraph_mppc_compression | \
 					 netgraph_mppc_encryption
 netgraph/ng_nat.c		optional netgraph_nat inet libalias
 netgraph/ng_one2many.c		optional netgraph_one2many
 netgraph/ng_parse.c		optional netgraph
 netgraph/ng_patch.c		optional netgraph_patch
 netgraph/ng_pipe.c		optional netgraph_pipe
 netgraph/ng_ppp.c		optional netgraph_ppp
 netgraph/ng_pppoe.c		optional netgraph_pppoe
 netgraph/ng_pptpgre.c		optional netgraph_pptpgre
 netgraph/ng_pred1.c		optional netgraph_pred1
 netgraph/ng_rfc1490.c		optional netgraph_rfc1490
 netgraph/ng_socket.c		optional netgraph_socket
 netgraph/ng_split.c		optional netgraph_split
 netgraph/ng_tag.c		optional netgraph_tag
 netgraph/ng_tcpmss.c		optional netgraph_tcpmss
 netgraph/ng_tee.c		optional netgraph_tee
 netgraph/ng_tty.c		optional netgraph_tty
 netgraph/ng_vjc.c		optional netgraph_vjc
 netgraph/ng_vlan.c		optional netgraph_vlan
 netgraph/ng_vlan_rotate.c	optional netgraph_vlan_rotate
 netinet/accf_data.c		optional accept_filter_data inet
 netinet/accf_dns.c		optional accept_filter_dns inet
 netinet/accf_http.c		optional accept_filter_http inet
 netinet/if_ether.c		optional inet ether
 netinet/igmp.c			optional inet
 netinet/in.c			optional inet
 netinet/in_cksum.c		optional inet | inet6
 netinet/in_debug.c		optional inet ddb
 netinet/in_kdtrace.c		optional inet | inet6
 netinet/ip_carp.c		optional inet carp | inet6 carp
 netinet/in_fib.c		optional inet
 netinet/in_fib_algo.c		optional inet fib_algo
 netinet/in_gif.c		optional gif inet | netgraph_gif inet
 netinet/ip_gre.c		optional gre inet
 netinet/ip_id.c			optional inet
 netinet/in_jail.c		optional inet
 netinet/in_mcast.c		optional inet
 netinet/in_pcb.c		optional inet | inet6
 netinet/in_prot.c		optional inet | inet6
 netinet/in_proto.c		optional inet | inet6
 netinet/in_rmx.c		optional inet
 netinet/in_rss.c		optional inet rss
 netinet/ip_divert.c		optional ipdivert inet | ipdivert inet6
 netinet/ip_ecn.c		optional inet | inet6
 netinet/ip_encap.c		optional inet | inet6
 netinet/ip_fastfwd.c		optional inet
 netinet/ip_icmp.c		optional inet | inet6
 netinet/ip_input.c		optional inet
 netinet/ip_mroute.c		optional mrouting inet
 netinet/ip_options.c		optional inet
 netinet/ip_output.c		optional inet
 netinet/ip_reass.c		optional inet
 netinet/raw_ip.c		optional inet | inet6
 netinet/cc/cc.c			optional cc_newreno inet | cc_vegas inet | \
 	cc_htcp inet | cc_hd inet | cc_dctcp inet | cc_cubic inet | \
 	cc_chd inet | cc_cdg inet | cc_newreno inet6 | cc_vegas inet6 | \
 	cc_htcp inet6 | cc_hd inet6 |cc_dctcp inet6 | cc_cubic inet6 | \
 	cc_chd inet6 | cc_cdg inet6
 netinet/cc/cc_cdg.c		optional inet cc_cdg tcp_hhook
 netinet/cc/cc_chd.c		optional inet cc_chd tcp_hhook
 netinet/cc/cc_cubic.c		optional inet cc_cubic | inet6 cc_cubic
 netinet/cc/cc_dctcp.c		optional inet cc_dctcp | inet6 cc_dctcp
 netinet/cc/cc_hd.c		optional inet cc_hd tcp_hhook
 netinet/cc/cc_htcp.c		optional inet cc_htcp | inet6 cc_htcp
 netinet/cc/cc_newreno.c		optional inet cc_newreno | inet6 cc_newreno
 netinet/cc/cc_vegas.c		optional inet cc_vegas tcp_hhook
 netinet/khelp/h_ertt.c		optional inet tcp_hhook
 netinet/sctp_asconf.c		optional inet sctp | inet6 sctp
 netinet/sctp_auth.c		optional inet sctp | inet6 sctp
 netinet/sctp_bsd_addr.c		optional inet sctp | inet6 sctp
 netinet/sctp_cc_functions.c	optional inet sctp | inet6 sctp
 netinet/sctp_crc32.c		optional inet | inet6
 netinet/sctp_indata.c		optional inet sctp | inet6 sctp
 netinet/sctp_input.c		optional inet sctp | inet6 sctp
 netinet/sctp_kdtrace.c		optional inet sctp | inet6 sctp
 netinet/sctp_module.c		optional inet sctp | inet6 sctp
 netinet/sctp_output.c		optional inet sctp | inet6 sctp
 netinet/sctp_pcb.c		optional inet sctp | inet6 sctp
 netinet/sctp_peeloff.c		optional inet sctp | inet6 sctp
 netinet/sctp_ss_functions.c	optional inet sctp | inet6 sctp
 netinet/sctp_syscalls.c		optional inet sctp | inet6 sctp
 netinet/sctp_sysctl.c		optional inet sctp | inet6 sctp
 netinet/sctp_timer.c		optional inet sctp | inet6 sctp
 netinet/sctp_usrreq.c		optional inet sctp | inet6 sctp
 netinet/sctputil.c		optional inet sctp | inet6 sctp
 netinet/siftr.c			optional inet siftr alq | inet6 siftr alq
 netinet/tcp_ecn.c		optional inet | inet6
 netinet/tcp_fastopen.c		optional inet tcp_rfc7413 | inet6 tcp_rfc7413
 netinet/tcp_hostcache.c		optional inet | inet6
 netinet/tcp_input.c		optional inet | inet6
 netinet/tcp_log_buf.c		optional tcp_blackbox inet | tcp_blackbox inet6
 netinet/tcp_lro.c		optional inet | inet6
 netinet/tcp_lro_hpts.c		optional tcphpts inet | tcphpts inet6
 netinet/tcp_output.c		optional inet | inet6
 netinet/tcp_offload.c		optional tcp_offload inet | tcp_offload inet6
 netinet/tcp_hpts.c		optional tcphpts inet | tcphpts inet6
 netinet/tcp_ratelimit.c		optional ratelimit inet | ratelimit inet6
 netinet/tcp_pcap.c		optional inet tcppcap | inet6 tcppcap \
 	compile-with "${NORMAL_C} ${NO_WNONNULL}"
 netinet/tcp_reass.c		optional inet | inet6
 netinet/tcp_sack.c		optional inet | inet6
 netinet/tcp_stacks/bbr.c	optional inet tcphpts tcp_bbr | inet6 tcphpts tcp_bbr \
 	compile-with "${NORMAL_C} -DMODNAME=tcp_bbr -DSTACKNAME=bbr"
 netinet/tcp_stacks/rack.c	optional inet tcphpts tcp_rack | inet6 tcphpts tcp_rack \
 	compile-with "${NORMAL_C} -DMODNAME=tcp_rack -DSTACKNAME=rack"
 netinet/tcp_stacks/rack_bbr_common.c	optional inet tcphpts tcp_bbr | inet tcphpts tcp_rack | inet6 tcphpts tcp_bbr | inet6 tcphpts tcp_rack
 netinet/tcp_stacks/sack_filter.c	optional inet tcphpts tcp_bbr | inet tcphpts tcp_rack | inet6 tcphpts tcp_bbr | inet6 tcphpts tcp_rack
 netinet/tcp_stacks/tailq_hash.c	optional inet tcphpts tcp_bbr | inet tcphpts tcp_rack | inet6 tcphpts tcp_bbr | inet6 tcphpts tcp_rack
 netinet/tcp_stats.c		optional stats inet | stats inet6
 netinet/tcp_subr.c		optional inet | inet6
 netinet/tcp_syncache.c		optional inet | inet6
 netinet/tcp_timer.c		optional inet | inet6
 netinet/tcp_timewait.c		optional inet | inet6
 netinet/tcp_usrreq.c		optional inet | inet6
 netinet/udp_usrreq.c		optional inet | inet6
 netinet/libalias/alias.c	optional libalias inet | netgraph_nat inet
 netinet/libalias/alias_db.c	optional libalias inet | netgraph_nat inet
 netinet/libalias/alias_mod.c	optional libalias | netgraph_nat
 netinet/libalias/alias_proxy.c	optional libalias inet | netgraph_nat inet
 netinet/libalias/alias_util.c	optional libalias inet | netgraph_nat inet
 netinet/libalias/alias_sctp.c	optional libalias inet | netgraph_nat inet
 netinet/netdump/netdump_client.c optional inet debugnet netdump
 netinet6/dest6.c		optional inet6
 netinet6/frag6.c		optional inet6
 netinet6/icmp6.c		optional inet6
 netinet6/in6.c			optional inet6
 netinet6/in6_cksum.c		optional inet6
 netinet6/in6_fib.c		optional inet6
 netinet6/in6_fib_algo.c		optional inet6 fib_algo
 netinet6/in6_gif.c		optional gif inet6 | netgraph_gif inet6
 netinet6/in6_ifattach.c		optional inet6
 netinet6/in6_jail.c		optional inet6
 netinet6/in6_mcast.c		optional inet6
 netinet6/in6_pcb.c		optional inet6
 netinet6/in6_proto.c		optional inet6
 netinet6/in6_rmx.c		optional inet6
 netinet6/in6_rss.c		optional inet6 rss
 netinet6/in6_src.c		optional inet6
 netinet6/ip6_fastfwd.c		optional inet6
 netinet6/ip6_forward.c		optional inet6
 netinet6/ip6_gre.c		optional gre inet6
 netinet6/ip6_id.c		optional inet6
 netinet6/ip6_input.c		optional inet6
 netinet6/ip6_mroute.c		optional mrouting inet6
 netinet6/ip6_output.c		optional inet6
 netinet6/mld6.c			optional inet6
 netinet6/nd6.c			optional inet6
 netinet6/nd6_nbr.c		optional inet6
 netinet6/nd6_rtr.c		optional inet6
 netinet6/raw_ip6.c		optional inet6
 netinet6/route6.c		optional inet6
 netinet6/scope6.c		optional inet6
 netinet6/sctp6_usrreq.c		optional inet6 sctp
 netinet6/udp6_usrreq.c		optional inet6
 netipsec/ipsec.c		optional ipsec inet | ipsec inet6
 netipsec/ipsec_input.c		optional ipsec inet | ipsec inet6
 netipsec/ipsec_mbuf.c		optional ipsec inet | ipsec inet6
 netipsec/ipsec_mod.c		optional ipsec inet | ipsec inet6
 netipsec/ipsec_output.c		optional ipsec inet | ipsec inet6
 netipsec/ipsec_pcb.c		optional ipsec inet | ipsec inet6 | \
 	ipsec_support inet | ipsec_support inet6
 netipsec/key.c			optional ipsec inet | ipsec inet6 | \
 	ipsec_support inet | ipsec_support inet6
 netipsec/key_debug.c		optional ipsec inet | ipsec inet6 | \
 	ipsec_support inet | ipsec_support inet6
 netipsec/keysock.c		optional ipsec inet | ipsec inet6 | \
 	ipsec_support inet | ipsec_support inet6
 netipsec/subr_ipsec.c		optional ipsec inet | ipsec inet6 | \
 	ipsec_support inet | ipsec_support inet6
-netipsec/udpencap.c		optional ipsec inet
+netipsec/udpencap.c		optional ipsec inet | ipsec inet6
 netipsec/xform_ah.c		optional ipsec inet | ipsec inet6
 netipsec/xform_esp.c		optional ipsec inet | ipsec inet6
 netipsec/xform_ipcomp.c		optional ipsec inet | ipsec inet6
 netipsec/xform_tcp.c		optional ipsec inet tcp_signature | \
 	 ipsec inet6 tcp_signature | ipsec_support inet tcp_signature | \
 	 ipsec_support inet6 tcp_signature
 netlink/netlink_generic_kpi.c	standard
 netlink/netlink_glue.c		standard
 netlink/netlink_message_parser.c	standard
 netlink/netlink_domain.c	optional netlink
 netlink/netlink_generic.c	optional netlink
 netlink/netlink_io.c		optional netlink
 netlink/netlink_message_writer.c	optional netlink
 netlink/netlink_module.c	optional netlink
 netlink/netlink_route.c		optional netlink
 netlink/route/iface_drivers.c	optional netlink
 netlink/route/iface.c		optional netlink
 netlink/route/neigh.c		optional netlink
 netlink/route/nexthop.c		optional netlink
 netlink/route/rt.c		optional netlink
 netpfil/ipfw/dn_aqm_codel.c	optional inet dummynet
 netpfil/ipfw/dn_aqm_pie.c	optional inet dummynet
 netpfil/ipfw/dn_heap.c		optional inet dummynet
 netpfil/ipfw/dn_sched_fifo.c	optional inet dummynet
 netpfil/ipfw/dn_sched_fq_codel.c	optional inet dummynet
 netpfil/ipfw/dn_sched_fq_pie.c	optional inet dummynet
 netpfil/ipfw/dn_sched_prio.c	optional inet dummynet
 netpfil/ipfw/dn_sched_qfq.c	optional inet dummynet
 netpfil/ipfw/dn_sched_rr.c	optional inet dummynet
 netpfil/ipfw/dn_sched_wf2q.c	optional inet dummynet
 netpfil/ipfw/ip_dummynet.c	optional inet dummynet
 netpfil/ipfw/ip_dn_io.c		optional inet dummynet
 netpfil/ipfw/ip_dn_glue.c	optional inet dummynet
 netpfil/ipfw/ip_fw2.c		optional inet ipfirewall
 netpfil/ipfw/ip_fw_bpf.c	optional inet ipfirewall
 netpfil/ipfw/ip_fw_dynamic.c	optional inet ipfirewall \
 	compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 netpfil/ipfw/ip_fw_eaction.c	optional inet ipfirewall
 netpfil/ipfw/ip_fw_log.c	optional inet ipfirewall
 netpfil/ipfw/ip_fw_pfil.c	optional inet ipfirewall
 netpfil/ipfw/ip_fw_sockopt.c	optional inet ipfirewall
 netpfil/ipfw/ip_fw_table.c	optional inet ipfirewall
 netpfil/ipfw/ip_fw_table_algo.c	optional inet ipfirewall
 netpfil/ipfw/ip_fw_table_value.c	optional inet ipfirewall
 netpfil/ipfw/ip_fw_iface.c	optional inet ipfirewall
 netpfil/ipfw/ip_fw_nat.c	optional inet ipfirewall_nat
 netpfil/ipfw/nat64/ip_fw_nat64.c	optional inet inet6 ipfirewall \
 	ipfirewall_nat64
 netpfil/ipfw/nat64/nat64clat.c	optional inet inet6 ipfirewall \
 	ipfirewall_nat64
 netpfil/ipfw/nat64/nat64clat_control.c	optional inet inet6 ipfirewall \
 	ipfirewall_nat64
 netpfil/ipfw/nat64/nat64lsn.c	optional inet inet6 ipfirewall \
 	ipfirewall_nat64 compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 netpfil/ipfw/nat64/nat64lsn_control.c	optional inet inet6 ipfirewall \
 	ipfirewall_nat64 compile-with "${NORMAL_C} -I$S/contrib/ck/include"
 netpfil/ipfw/nat64/nat64stl.c	optional inet inet6 ipfirewall \
 	ipfirewall_nat64
 netpfil/ipfw/nat64/nat64stl_control.c	optional inet inet6 ipfirewall \
 	ipfirewall_nat64
 netpfil/ipfw/nat64/nat64_translate.c	optional inet inet6 ipfirewall \
 	ipfirewall_nat64
 netpfil/ipfw/nptv6/ip_fw_nptv6.c	optional inet inet6 ipfirewall \
 	ipfirewall_nptv6
 netpfil/ipfw/nptv6/nptv6.c	optional inet inet6 ipfirewall \
 	ipfirewall_nptv6
 netpfil/ipfw/pmod/ip_fw_pmod.c	optional inet ipfirewall_pmod
 netpfil/ipfw/pmod/tcpmod.c	optional inet ipfirewall_pmod
 netpfil/pf/if_pflog.c		optional pflog pf inet
 netpfil/pf/if_pfsync.c		optional pfsync pf inet
 netpfil/pf/pf.c			optional pf inet
 netpfil/pf/pf_if.c		optional pf inet
 netpfil/pf/pf_ioctl.c		optional pf inet
 netpfil/pf/pf_lb.c		optional pf inet
 netpfil/pf/pf_norm.c		optional pf inet
 netpfil/pf/pf_nl.c		optional pf inet
 netpfil/pf/pf_nv.c		optional pf inet
 netpfil/pf/pf_osfp.c		optional pf inet
 netpfil/pf/pf_ruleset.c		optional pf inet
 netpfil/pf/pf_syncookies.c	optional pf inet
 netpfil/pf/pf_table.c		optional pf inet
 netpfil/pf/pflow.c		optional pflow pf inet
 netpfil/pf/pfsync_nv.c		optional pfsync pf inet
 netpfil/pf/in4_cksum.c		optional pf inet
 netsmb/smb_conn.c		optional netsmb
 netsmb/smb_crypt.c		optional netsmb
 netsmb/smb_dev.c		optional netsmb
 netsmb/smb_iod.c		optional netsmb
 netsmb/smb_rq.c			optional netsmb
 netsmb/smb_smb.c		optional netsmb
 netsmb/smb_subr.c		optional netsmb
 netsmb/smb_trantcp.c		optional netsmb
 netsmb/smb_usr.c		optional netsmb
 nfs/bootp_subr.c		optional bootp nfscl
 nfs/krpc_subr.c			optional bootp nfscl
 nfs/nfs_diskless.c		optional nfscl nfs_root
 nfs/nfs_nfssvc.c		optional nfscl | nfslockd | nfsd
 nlm/nlm_advlock.c		optional nfslockd | nfsd
 nlm/nlm_prot_clnt.c		optional nfslockd | nfsd
 nlm/nlm_prot_impl.c		optional nfslockd | nfsd
 nlm/nlm_prot_server.c		optional nfslockd | nfsd
 nlm/nlm_prot_svc.c		optional nfslockd | nfsd
 nlm/nlm_prot_xdr.c		optional nfslockd | nfsd
 nlm/sm_inter_xdr.c		optional nfslockd | nfsd
 
 # Linux Kernel Programming Interface
 compat/linuxkpi/common/src/linux_80211.c	optional compat_linuxkpi wlan \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_80211_macops.c	optional compat_linuxkpi wlan \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_kmod.c		optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_acpi.c		optional compat_linuxkpi acpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_compat.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_current.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_devres.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_dmi.c		optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_domain.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_firmware.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_fpu.c		optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_hrtimer.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_i2c.c		optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_i2cbb.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_interrupt.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_kobject.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_kthread.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_lock.c		optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_mhi.c		optional compat_linuxkpi wlan \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_netdev.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_page.c		optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_pci.c		optional compat_linuxkpi pci \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_tasklet.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_idr.c		optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_radix.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_rcu.c		optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C} -I$S/contrib/ck/include"
 compat/linuxkpi/common/src/linux_schedule.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_shmemfs.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_shrinker.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_skbuff.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_slab.c		optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_usb.c		optional compat_linuxkpi usb \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_work.c		optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_xarray.c	optional compat_linuxkpi \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/lkpi_iic_if.m	optional compat_linuxkpi
 
 compat/linuxkpi/common/src/linux_seq_file.c	optional compat_linuxkpi | lindebugfs \
 	compile-with "${LINUXKPI_C}"
 compat/linuxkpi/common/src/linux_simple_attr.c	optional compat_linuxkpi | lindebugfs \
 	compile-with "${LINUXKPI_C}"
 compat/lindebugfs/lindebugfs.c			optional lindebugfs \
 	compile-with "${LINUXKPI_C}"
 
 # OpenFabrics Enterprise Distribution (Infiniband)
 net/if_infiniband.c					optional ofed | lagg
 ofed/drivers/infiniband/core/ib_addr.c			optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_agent.c			optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_cache.c			optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_cm.c			optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_cma.c			optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_core_uverbs.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_cq.c			optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_device.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_fmr_pool.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_iwcm.c			optional ofed	\
 	compile-with "${OFED_C} ${NO_WUNUSED_BUT_SET_VARIABLE}"
 ofed/drivers/infiniband/core/ib_iwpm_msg.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_iwpm_util.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_mad.c			optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_mad_rmpp.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_multicast.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_packer.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_rdma_core.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_roce_gid_mgmt.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_sa_query.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_smi.c			optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_sysfs.c			optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_ucm.c			optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_ucma.c			optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_ud_header.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_umem.c			optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_user_mad.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_cmd.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_ioctl.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_main.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_marshall.c	optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_std_types.c	optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_std_types_async_fd.c	optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_std_types_counters.c	optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_std_types_cq.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_std_types_device.c	optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_std_types_dm.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_std_types_flow_action.c	optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_std_types_mr.c	optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_uverbs_uapi.c		optional ofed	\
 	compile-with "${OFED_C}"
 ofed/drivers/infiniband/core/ib_verbs.c			optional ofed	\
 	compile-with "${OFED_C}"
 
 ofed/drivers/infiniband/ulp/ipoib/ipoib_cm.c	optional ipoib		\
 	compile-with "${OFED_C} -I$S/ofed/drivers/infiniband/ulp/ipoib/"
 #ofed/drivers/infiniband/ulp/ipoib/ipoib_fs.c	optional ipoib		\
 #	compile-with "${OFED_C} -I$S/ofed/drivers/infiniband/ulp/ipoib/"
 ofed/drivers/infiniband/ulp/ipoib/ipoib_ib.c	optional ipoib		\
 	compile-with "${OFED_C} -I$S/ofed/drivers/infiniband/ulp/ipoib/"
 ofed/drivers/infiniband/ulp/ipoib/ipoib_main.c	optional ipoib		\
 	compile-with "${OFED_C} -I$S/ofed/drivers/infiniband/ulp/ipoib/"
 ofed/drivers/infiniband/ulp/ipoib/ipoib_multicast.c	optional ipoib	\
 	compile-with "${OFED_C} -I$S/ofed/drivers/infiniband/ulp/ipoib/"
 ofed/drivers/infiniband/ulp/ipoib/ipoib_verbs.c	optional ipoib		\
 	compile-with "${OFED_C} -I$S/ofed/drivers/infiniband/ulp/ipoib/"
 #ofed/drivers/infiniband/ulp/ipoib/ipoib_vlan.c	optional ipoib		\
 #	compile-with "${OFED_C} -I$S/ofed/drivers/infiniband/ulp/ipoib/"
 
 ofed/drivers/infiniband/ulp/sdp/sdp_bcopy.c	optional sdp inet	\
 	compile-with "${OFED_C} -I$S/ofed/drivers/infiniband/ulp/sdp/"
 ofed/drivers/infiniband/ulp/sdp/sdp_main.c	optional sdp inet 	\
 	compile-with "${OFED_C} -I$S/ofed/drivers/infiniband/ulp/sdp/"
 ofed/drivers/infiniband/ulp/sdp/sdp_rx.c	optional sdp inet 	\
 	compile-with "${OFED_C} -I$S/ofed/drivers/infiniband/ulp/sdp/ ${NO_WUNUSED_BUT_SET_VARIABLE}"
 ofed/drivers/infiniband/ulp/sdp/sdp_cma.c	optional sdp inet 	\
 	compile-with "${OFED_C} -I$S/ofed/drivers/infiniband/ulp/sdp/"
 ofed/drivers/infiniband/ulp/sdp/sdp_tx.c	optional sdp inet 	\
 	compile-with "${OFED_C} -I$S/ofed/drivers/infiniband/ulp/sdp/ ${NO_WUNUSED_BUT_SET_VARIABLE}"
 
 dev/irdma/icrdma.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/irdma_cm.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/irdma_ctrl.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/irdma_hmc.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/irdma_hw.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/icrdma_hw.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/fbsd_kcompat.c	optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/irdma_kcompat.c	optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/irdma_pble.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/irdma_puda.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/irdma_uda.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/irdma_uk.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/irdma_utils.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/irdma_verbs.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 dev/irdma/irdma_ws.c		optional irdma ice inet inet6 pci ofed \
 	compile-with "${OFED_C} -I$S/dev/ice/"
 
 dev/mthca/mthca_allocator.c		optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_av.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_catas.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_cmd.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_cq.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_eq.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_mad.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_main.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_mcg.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_memfree.c		optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_mr.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_pd.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_profile.c		optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_provider.c		optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_qp.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_reset.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_srq.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 dev/mthca/mthca_uar.c			optional mthca pci ofed \
 	compile-with "${OFED_C}"
 
 dev/mlx4/mlx4_ib/mlx4_ib_alias_GUID.c		optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_ib/mlx4_ib_mcg.c			optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_ib/mlx4_ib_sysfs.c		optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_ib/mlx4_ib_cm.c			optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_ib/mlx4_ib_ah.c			optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_ib/mlx4_ib_cq.c			optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_ib/mlx4_ib_doorbell.c		optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_ib/mlx4_ib_mad.c			optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_ib/mlx4_ib_main.c			optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_ib/mlx4_ib_mr.c			optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_ib/mlx4_ib_qp.c			optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_ib/mlx4_ib_srq.c			optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_ib/mlx4_ib_wc.c			optional mlx4ib pci ofed \
 	compile-with "${OFED_C}"
 
 dev/mlx4/mlx4_core/mlx4_alloc.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_catas.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_cmd.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_cq.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_eq.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_fw.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_fw_qos.c		optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_icm.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_intf.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_main.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_mcg.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_mr.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_pd.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_port.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_profile.c		optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_qp.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_reset.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_sense.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_srq.c			optional mlx4 pci \
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_core/mlx4_resource_tracker.c	optional mlx4 pci \
 	compile-with "${OFED_C}"
 
 dev/mlx4/mlx4_en/mlx4_en_cq.c			optional mlx4en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_en/mlx4_en_main.c			optional mlx4en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_en/mlx4_en_netdev.c		optional mlx4en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_en/mlx4_en_port.c			optional mlx4en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_en/mlx4_en_resources.c		optional mlx4en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_en/mlx4_en_rx.c			optional mlx4en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx4/mlx4_en/mlx4_en_tx.c			optional mlx4en pci inet inet6	\
 	compile-with "${OFED_C}"
 
 dev/mlx5/mlx5_ib/mlx5_ib_ah.c			optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_ib/mlx5_ib_cong.c			optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_ib/mlx5_ib_cq.c			optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_ib/mlx5_ib_devx.c			optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_ib/mlx5_ib_doorbell.c		optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_ib/mlx5_ib_gsi.c			optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_ib/mlx5_ib_mad.c			optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_ib/mlx5_ib_main.c			optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_ib/mlx5_ib_mem.c			optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_ib/mlx5_ib_mr.c			optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_ib/mlx5_ib_qp.c			optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_ib/mlx5_ib_srq.c			optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_ib/mlx5_ib_virt.c			optional mlx5ib pci ofed \
 	compile-with "${OFED_C}"
 
 dev/mlx5/mlx5_core/mlx5_alloc.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_cmd.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_cq.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_diag_cnt.c		optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_diagnostics.c		optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_eq.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_eswitch.c		optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_fc_cmd.c		optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_fs_cmd.c		optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_fs_counters.c		optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_fs_tcp.c		optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_fs_tree.c		optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_fw.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_fwdump.c		optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_health.c		optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_mad.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_main.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_mcg.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_mpfs.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_mr.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_pagealloc.c		optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_pd.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_port.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_qp.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_rl.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_srq.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_tls.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_transobj.c		optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_uar.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_vport.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_vsc.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_core/mlx5_wq.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_lib/mlx5_gid.c			optional mlx5 pci	\
 	compile-with "${OFED_C}"
 
 dev/mlx5/mlx5_en/mlx5_en_dim.c			optional mlx5en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_en/mlx5_en_ethtool.c		optional mlx5en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_en/mlx5_en_main.c			optional mlx5en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_en/mlx5_en_tx.c			optional mlx5en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_en/mlx5_en_flow_table.c		optional mlx5en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_en/mlx5_en_hw_tls.c		optional mlx5en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_en/mlx5_en_hw_tls_rx.c		optional mlx5en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_en/mlx5_en_iq.c			optional mlx5en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_en/mlx5_en_rx.c			optional mlx5en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_en/mlx5_en_rl.c			optional mlx5en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_en/mlx5_en_txrx.c			optional mlx5en pci inet inet6	\
 	compile-with "${OFED_C}"
 dev/mlx5/mlx5_en/mlx5_en_port_buffer.c		optional mlx5en pci inet inet6	\
 	compile-with "${OFED_C}"
 
 # crypto support
 opencrypto/cbc_mac.c		optional crypto
 opencrypto/criov.c		optional crypto
 opencrypto/crypto.c		optional crypto
 opencrypto/cryptodev.c		optional cryptodev
 opencrypto/cryptodev_if.m	optional crypto
 opencrypto/cryptosoft.c		optional crypto
 opencrypto/cryptodeflate.c	optional crypto
 opencrypto/gmac.c		optional crypto
 opencrypto/gfmult.c		optional crypto
 opencrypto/ktls_ocf.c		optional kern_tls
 opencrypto/rmd160.c		optional crypto
 opencrypto/xform_aes_cbc.c	optional crypto
 opencrypto/xform_aes_icm.c	optional crypto
 opencrypto/xform_aes_xts.c	optional crypto
 opencrypto/xform_cbc_mac.c	optional crypto
 opencrypto/xform_chacha20_poly1305.c	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include -I$S/crypto/libsodium"
 opencrypto/xform_cml.c		optional crypto
 opencrypto/xform_deflate.c	optional crypto
 opencrypto/xform_gmac.c		optional crypto
 opencrypto/xform_null.c		optional crypto
 opencrypto/xform_poly1305.c	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include -I$S/crypto/libsodium"
 opencrypto/xform_rmd160.c	optional crypto
 opencrypto/xform_sha1.c		optional crypto
 opencrypto/xform_sha2.c		optional crypto
 contrib/libsodium/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c \
 	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium -Wno-unused-function"
 contrib/libsodium/src/libsodium/crypto_core/hchacha20/core_hchacha20.c \
 	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium"
 contrib/libsodium/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305.c \
 	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium"
 contrib/libsodium/src/libsodium/crypto_onetimeauth/poly1305/donna/poly1305_donna.c \
 	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium"
 contrib/libsodium/src/libsodium/crypto_scalarmult/curve25519/scalarmult_curve25519.c \
 	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium"
 contrib/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c \
 	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium -Wno-unused-function"
 contrib/libsodium/src/libsodium/crypto_stream/chacha20/stream_chacha20.c \
 	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium"
 contrib/libsodium/src/libsodium/crypto_stream/chacha20/ref/chacha20_ref.c \
 	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium"
 contrib/libsodium/src/libsodium/crypto_verify/sodium/verify.c \
 	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium"
 crypto/libsodium/randombytes.c	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include -I$S/crypto/libsodium"
 crypto/libsodium/utils.c	optional crypto \
 	compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include -I$S/crypto/libsodium"
 
 rpc/auth_none.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/auth_unix.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/authunix_prot.c		optional krpc | nfslockd | nfscl | nfsd
 rpc/clnt_bck.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/clnt_dg.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/clnt_rc.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/clnt_vc.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/getnetconfig.c		optional krpc | nfslockd | nfscl | nfsd
 rpc/replay.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/rpc_callmsg.c		optional krpc | nfslockd | nfscl | nfsd
 rpc/rpc_generic.c		optional krpc | nfslockd | nfscl | nfsd
 rpc/rpc_prot.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/rpcb_clnt.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/rpcb_prot.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/svc.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/svc_auth.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/svc_auth_unix.c		optional krpc | nfslockd | nfscl | nfsd
 rpc/svc_dg.c			optional krpc | nfslockd | nfscl | nfsd
 rpc/svc_generic.c		optional krpc | nfslockd | nfscl | nfsd
 rpc/svc_vc.c			optional krpc | nfslockd | nfscl | nfsd
 #
 # Kernel RPC-over-TLS
 #
 rpctlscd.h			optional krpc | nfslockd | nfscl | nfsd	\
 	dependency		"$S/rpc/rpcsec_tls/rpctlscd.x"			\
 	compile-with		"RPCGEN_CPP='${CPP}' rpcgen -hM $S/rpc/rpcsec_tls/rpctlscd.x | grep -v pthread.h > rpctlscd.h" \
 	no-obj no-implicit-rule before-depend local			\
 	clean			"rpctlscd.h"
 rpctlscd_xdr.c			optional krpc | nfslockd | nfscl | nfsd	\
 	dependency		"$S/rpc/rpcsec_tls/rpctlscd.x rpctlscd.h"		\
 	compile-with		"RPCGEN_CPP='${CPP}' rpcgen -c $S/rpc/rpcsec_tls/rpctlscd.x -o rpctlscd_xdr.c" no-ctfconvert \
 	no-implicit-rule before-depend local				\
 	clean			"rpctlscd_xdr.c"
 rpctlscd_clnt.c			optional krpc | nfslockd | nfscl | nfsd	\
 	dependency		"$S/rpc/rpcsec_tls/rpctlscd.x rpctlscd.h"		\
 	compile-with		"RPCGEN_CPP='${CPP}' rpcgen -lM $S/rpc/rpcsec_tls/rpctlscd.x | grep -v string.h > rpctlscd_clnt.c" no-ctfconvert \
 	no-implicit-rule before-depend local				\
 	clean			"rpctlscd_clnt.c"
 rpctlssd.h			optional krpc | nfslockd | nfscl | nfsd	\
 	dependency		"$S/rpc/rpcsec_tls/rpctlssd.x"			\
 	compile-with		"RPCGEN_CPP='${CPP}' rpcgen -hM $S/rpc/rpcsec_tls/rpctlssd.x | grep -v pthread.h > rpctlssd.h" \
 	no-obj no-implicit-rule before-depend local			\
 	clean			"rpctlssd.h"
 rpctlssd_xdr.c			optional krpc | nfslockd | nfscl | nfsd	\
 	dependency		"$S/rpc/rpcsec_tls/rpctlssd.x rpctlssd.h"		\
 	compile-with		"RPCGEN_CPP='${CPP}' rpcgen -c $S/rpc/rpcsec_tls/rpctlssd.x -o rpctlssd_xdr.c" no-ctfconvert \
 	no-implicit-rule before-depend local				\
 	clean			"rpctlssd_xdr.c"
 rpctlssd_clnt.c			optional krpc | nfslockd | nfscl | nfsd	\
 	dependency		"$S/rpc/rpcsec_tls/rpctlssd.x rpctlssd.h"		\
 	compile-with		"RPCGEN_CPP='${CPP}' rpcgen -lM $S/rpc/rpcsec_tls/rpctlssd.x | grep -v string.h > rpctlssd_clnt.c" no-ctfconvert \
 	no-implicit-rule before-depend local				\
 	clean			"rpctlssd_clnt.c"
 rpc/rpcsec_tls/rpctls_impl.c	optional krpc | nfslockd | nfscl | nfsd
 rpc/rpcsec_tls/auth_tls.c	optional krpc | nfslockd | nfscl | nfsd
 rpc/rpcsec_gss/rpcsec_gss.c	optional krpc kgssapi | nfslockd kgssapi | nfscl kgssapi | nfsd kgssapi
 rpc/rpcsec_gss/rpcsec_gss_conf.c optional krpc kgssapi | nfslockd kgssapi | nfscl kgssapi | nfsd kgssapi
 rpc/rpcsec_gss/rpcsec_gss_misc.c optional krpc kgssapi | nfslockd kgssapi | nfscl kgssapi | nfsd kgssapi
 rpc/rpcsec_gss/rpcsec_gss_prot.c optional krpc kgssapi | nfslockd kgssapi | nfscl kgssapi | nfsd kgssapi
 rpc/rpcsec_gss/svc_rpcsec_gss.c	optional krpc kgssapi | nfslockd kgssapi | nfscl kgssapi | nfsd kgssapi
 security/audit/audit.c		optional audit
 security/audit/audit_arg.c	optional audit
 security/audit/audit_bsm.c	optional audit
 security/audit/audit_bsm_db.c	optional audit
 security/audit/audit_bsm_klib.c	optional audit
 security/audit/audit_dtrace.c	optional dtaudit audit | dtraceall audit compile-with "${CDDL_C}"
 security/audit/audit_pipe.c	optional audit
 security/audit/audit_syscalls.c	standard
 security/audit/audit_trigger.c	optional audit
 security/audit/audit_worker.c	optional audit
 security/audit/bsm_domain.c	optional audit
 security/audit/bsm_errno.c	optional audit
 security/audit/bsm_fcntl.c	optional audit
 security/audit/bsm_socket_type.c	optional audit
 security/audit/bsm_token.c	optional audit
 security/mac/mac_audit.c	optional mac audit
 security/mac/mac_cred.c		optional mac
 security/mac/mac_kdb.c		optional mac
 security/mac/mac_framework.c	optional mac
 security/mac/mac_inet.c		optional mac inet | mac inet6
 security/mac/mac_inet6.c	optional mac inet6
 security/mac/mac_label.c	optional mac
 security/mac/mac_net.c		optional mac
 security/mac/mac_pipe.c		optional mac
 security/mac/mac_posix_sem.c	optional mac
 security/mac/mac_posix_shm.c	optional mac
 security/mac/mac_priv.c		optional mac
 security/mac/mac_process.c	optional mac
 security/mac/mac_socket.c	optional mac
 security/mac/mac_syscalls.c	standard
 security/mac/mac_system.c	optional mac
 security/mac/mac_sysv_msg.c	optional mac
 security/mac/mac_sysv_sem.c	optional mac
 security/mac/mac_sysv_shm.c	optional mac
 security/mac/mac_vfs.c		optional mac
 security/mac_biba/mac_biba.c	optional mac_biba
 security/mac_ddb/mac_ddb.c	optional mac_ddb
 security/mac_bsdextended/mac_bsdextended.c	optional mac_bsdextended
 security/mac_bsdextended/ugidfw_system.c	optional mac_bsdextended
 security/mac_bsdextended/ugidfw_vnode.c		optional mac_bsdextended
 security/mac_ifoff/mac_ifoff.c	optional mac_ifoff
 security/mac_ipacl/mac_ipacl.c	optional mac_ipacl
 security/mac_lomac/mac_lomac.c	optional mac_lomac
 security/mac_mls/mac_mls.c	optional mac_mls
 security/mac_none/mac_none.c	optional mac_none
 security/mac_ntpd/mac_ntpd.c	optional mac_ntpd
 security/mac_partition/mac_partition.c optional mac_partition
 security/mac_portacl/mac_portacl.c optional mac_portacl
 security/mac_priority/mac_priority.c	optional mac_priority
 security/mac_seeotheruids/mac_seeotheruids.c optional mac_seeotheruids
 security/mac_stub/mac_stub.c	optional mac_stub
 security/mac_test/mac_test.c	optional mac_test
 security/mac_grantbylabel/mac_grantbylabel.c		optional mac_grantbylabel
 security/mac_veriexec/mac_veriexec.c			optional mac_veriexec
 security/mac_veriexec/veriexec_fingerprint.c		optional mac_veriexec
 security/mac_veriexec/veriexec_metadata.c		optional mac_veriexec
 security/mac_veriexec_parser/mac_veriexec_parser.c	optional mac_veriexec mac_veriexec_parser
 security/mac_veriexec/mac_veriexec_rmd160.c		optional mac_veriexec_rmd160
 security/mac_veriexec/mac_veriexec_sha1.c		optional mac_veriexec_sha1
 security/mac_veriexec/mac_veriexec_sha256.c		optional mac_veriexec_sha256
 security/mac_veriexec/mac_veriexec_sha384.c		optional mac_veriexec_sha384
 security/mac_veriexec/mac_veriexec_sha512.c		optional mac_veriexec_sha512
 teken/teken.c			optional sc !SC_NO_TERM_TEKEN | vt
 ufs/ffs/ffs_alloc.c		optional ffs
 ufs/ffs/ffs_balloc.c		optional ffs
 ufs/ffs/ffs_inode.c		optional ffs
 ufs/ffs/ffs_snapshot.c		optional ffs
 ufs/ffs/ffs_softdep.c		optional ffs
 ufs/ffs/ffs_subr.c		optional ffs | geom_label
 ufs/ffs/ffs_tables.c		optional ffs | geom_label
 ufs/ffs/ffs_vfsops.c		optional ffs
 ufs/ffs/ffs_vnops.c		optional ffs
 ufs/ffs/ffs_rawread.c		optional ffs directio
 ufs/ffs/ffs_suspend.c		optional ffs
 ufs/ufs/ufs_acl.c		optional ffs
 ufs/ufs/ufs_bmap.c		optional ffs
 ufs/ufs/ufs_dirhash.c		optional ffs
 ufs/ufs/ufs_extattr.c		optional ffs
 ufs/ufs/ufs_gjournal.c		optional ffs UFS_GJOURNAL
 ufs/ufs/ufs_inode.c		optional ffs
 ufs/ufs/ufs_lookup.c		optional ffs
 ufs/ufs/ufs_quota.c		optional ffs
 ufs/ufs/ufs_vfsops.c		optional ffs
 ufs/ufs/ufs_vnops.c		optional ffs
 vm/device_pager.c		standard
 vm/phys_pager.c			standard
 vm/redzone.c			optional DEBUG_REDZONE
 vm/sg_pager.c			standard
 vm/swap_pager.c			standard
 vm/uma_core.c			standard
 vm/uma_dbg.c			standard
 vm/memguard.c			optional DEBUG_MEMGUARD
 vm/vm_domainset.c		standard
 vm/vm_fault.c			standard
 vm/vm_glue.c			standard
 vm/vm_init.c			standard
 vm/vm_kern.c			standard
 vm/vm_map.c			standard
 vm/vm_meter.c			standard
 vm/vm_mmap.c			standard
 vm/vm_object.c			standard
 vm/vm_page.c			standard
 vm/vm_pageout.c			standard
 vm/vm_pager.c			standard
 vm/vm_phys.c			standard
 vm/vm_radix.c			standard
 vm/vm_reserv.c			standard
 vm/vm_swapout.c			optional !NO_SWAPPING
 vm/vm_swapout_dummy.c		optional NO_SWAPPING
 vm/vm_unix.c			standard
 vm/vnode_pager.c		standard
 xen/features.c			optional xenhvm
 xen/xen_common.c		optional xenhvm
 xen/xenbus/xenbus_if.m		optional xenhvm
 xen/xenbus/xenbus.c		optional xenhvm
 xen/xenbus/xenbusb_if.m		optional xenhvm
 xen/xenbus/xenbusb.c		optional xenhvm
 xen/xenbus/xenbusb_front.c	optional xenhvm
 xen/xenbus/xenbusb_back.c	optional xenhvm
 xen/xenmem/xenmem_if.m		optional xenhvm
 xdr/xdr.c			optional xdr | krpc | nfslockd | nfscl | nfsd
 xdr/xdr_array.c			optional xdr | krpc | nfslockd | nfscl | nfsd
 xdr/xdr_mbuf.c			optional xdr | krpc | nfslockd | nfscl | nfsd
 xdr/xdr_mem.c			optional xdr | krpc | nfslockd | nfscl | nfsd
 xdr/xdr_reference.c		optional xdr | krpc | nfslockd | nfscl | nfsd
 xdr/xdr_sizeof.c		optional xdr | krpc | nfslockd | nfscl | nfsd
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index b68ec95a923a..24bc3403b0f7 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1,1752 +1,1778 @@
 /*-
  * SPDX-License-Identifier: BSD-3-Clause
  *
  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
  *	The Regents of the University of California.
  * Copyright (c) 2008 Robert N. M. Watson
  * Copyright (c) 2010-2011 Juniper Networks, Inc.
  * Copyright (c) 2014 Kevin Lo
  * All rights reserved.
  *
  * Portions of this software were developed by Robert N. M. Watson under
  * contract to Juniper Networks, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 
 #include <sys/cdefs.h>
 #include "opt_inet.h"
 #include "opt_inet6.h"
 #include "opt_ipsec.h"
 #include "opt_route.h"
 #include "opt_rss.h"
 
 #include <sys/param.h>
 #include <sys/domain.h>
 #include <sys/eventhandler.h>
 #include <sys/jail.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/priv.h>
 #include <sys/proc.h>
 #include <sys/protosw.h>
 #include <sys/sdt.h>
 #include <sys/signalvar.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
 #include <sys/sx.h>
 #include <sys/sysctl.h>
 #include <sys/syslog.h>
 #include <sys/systm.h>
 
 #include <vm/uma.h>
 
 #include <net/if.h>
 #include <net/if_var.h>
 #include <net/route.h>
 #include <net/route/nhop.h>
 #include <net/rss_config.h>
 
 #include <netinet/in.h>
 #include <netinet/in_kdtrace.h>
 #include <netinet/in_fib.h>
 #include <netinet/in_pcb.h>
 #include <netinet/in_systm.h>
 #include <netinet/in_var.h>
 #include <netinet/ip.h>
 #ifdef INET6
 #include <netinet/ip6.h>
 #endif
 #include <netinet/ip_icmp.h>
 #include <netinet/icmp_var.h>
 #include <netinet/ip_var.h>
 #include <netinet/ip_options.h>
 #ifdef INET6
 #include <netinet6/ip6_var.h>
 #endif
 #include <netinet/udp.h>
 #include <netinet/udp_var.h>
 #include <netinet/udplite.h>
 #include <netinet/in_rss.h>
 
 #include <netipsec/ipsec_support.h>
 
 #include <machine/in_cksum.h>
 
 #include <security/mac/mac_framework.h>
 
 /*
  * UDP and UDP-Lite protocols implementation.
  * Per RFC 768, August, 1980.
  * Per RFC 3828, July, 2004.
  */
 
 /*
  * BSD 4.2 defaulted the udp checksum to be off.  Turning off udp checksums
  * removes the only data integrity mechanism for packets and malformed
  * packets that would otherwise be discarded due to bad checksums, and may
  * cause problems (especially for NFS data blocks).
  */
 VNET_DEFINE(int, udp_cksum) = 1;
 SYSCTL_INT(_net_inet_udp, UDPCTL_CHECKSUM, checksum, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(udp_cksum), 0, "compute udp checksum");
 
 VNET_DEFINE(int, udp_log_in_vain) = 0;
 SYSCTL_INT(_net_inet_udp, OID_AUTO, log_in_vain, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(udp_log_in_vain), 0, "Log all incoming UDP packets");
 
 VNET_DEFINE(int, udp_blackhole) = 0;
 SYSCTL_INT(_net_inet_udp, OID_AUTO, blackhole, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(udp_blackhole), 0,
     "Do not send port unreachables for refused connects");
 VNET_DEFINE(bool, udp_blackhole_local) = false;
 SYSCTL_BOOL(_net_inet_udp, OID_AUTO, blackhole_local, CTLFLAG_VNET |
     CTLFLAG_RW, &VNET_NAME(udp_blackhole_local), false,
     "Enforce net.inet.udp.blackhole for locally originated packets");
 
 u_long	udp_sendspace = 9216;		/* really max datagram size */
 SYSCTL_ULONG(_net_inet_udp, UDPCTL_MAXDGRAM, maxdgram, CTLFLAG_RW,
     &udp_sendspace, 0, "Maximum outgoing UDP datagram size");
 
 u_long	udp_recvspace = 40 * (1024 +
 #ifdef INET6
 				      sizeof(struct sockaddr_in6)
 #else
 				      sizeof(struct sockaddr_in)
 #endif
 				      );	/* 40 1K datagrams */
 
 SYSCTL_ULONG(_net_inet_udp, UDPCTL_RECVSPACE, recvspace, CTLFLAG_RW,
     &udp_recvspace, 0, "Maximum space for incoming UDP datagrams");
 
 VNET_DEFINE(struct inpcbinfo, udbinfo);
 VNET_DEFINE(struct inpcbinfo, ulitecbinfo);
 
 #ifndef UDBHASHSIZE
 #define	UDBHASHSIZE	128
 #endif
 
 VNET_PCPUSTAT_DEFINE(struct udpstat, udpstat);		/* from udp_var.h */
 VNET_PCPUSTAT_SYSINIT(udpstat);
 SYSCTL_VNET_PCPUSTAT(_net_inet_udp, UDPCTL_STATS, stats, struct udpstat,
     udpstat, "UDP statistics (struct udpstat, netinet/udp_var.h)");
 
 #ifdef VIMAGE
 VNET_PCPUSTAT_SYSUNINIT(udpstat);
 #endif /* VIMAGE */
 #ifdef INET
 static void	udp_detach(struct socket *so);
 #endif
 
 INPCBSTORAGE_DEFINE(udpcbstor, udpcb, "udpinp", "udp_inpcb", "udp", "udphash");
 INPCBSTORAGE_DEFINE(udplitecbstor, udpcb, "udpliteinp", "udplite_inpcb",
     "udplite", "udplitehash");
 
 static void
 udp_vnet_init(void *arg __unused)
 {
 
 	/*
 	 * For now default to 2-tuple UDP hashing - until the fragment
 	 * reassembly code can also update the flowid.
 	 *
 	 * Once we can calculate the flowid that way and re-establish
 	 * a 4-tuple, flip this to 4-tuple.
 	 */
 	in_pcbinfo_init(&V_udbinfo, &udpcbstor, UDBHASHSIZE, UDBHASHSIZE);
 	/* Additional pcbinfo for UDP-Lite */
 	in_pcbinfo_init(&V_ulitecbinfo, &udplitecbstor, UDBHASHSIZE,
 	    UDBHASHSIZE);
 }
 VNET_SYSINIT(udp_vnet_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
     udp_vnet_init, NULL);
 
 /*
  * Kernel module interface for updating udpstat.  The argument is an index
  * into udpstat treated as an array of u_long.  While this encodes the
  * general layout of udpstat into the caller, it doesn't encode its location,
  * so that future changes to add, for example, per-CPU stats support won't
  * cause binary compatibility problems for kernel modules.
  */
 void
 kmod_udpstat_inc(int statnum)
 {
 
 	counter_u64_add(VNET(udpstat)[statnum], 1);
 }
 
 #ifdef VIMAGE
 static void
 udp_destroy(void *unused __unused)
 {
 
 	in_pcbinfo_destroy(&V_udbinfo);
 	in_pcbinfo_destroy(&V_ulitecbinfo);
 }
 VNET_SYSUNINIT(udp, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH, udp_destroy, NULL);
 #endif
 
 #ifdef INET
 /*
  * Subroutine of udp_input(), which appends the provided mbuf chain to the
  * passed pcb/socket.  The caller must provide a sockaddr_in via udp_in that
  * contains the source address.  If the socket ends up being an IPv6 socket,
  * udp_append() will convert to a sockaddr_in6 before passing the address
  * into the socket code.
  *
  * In the normal case udp_append() will return 0, indicating that you
  * must unlock the inp. However if a tunneling protocol is in place we increment
  * the inpcb refcnt and unlock the inp, on return from the tunneling protocol we
  * then decrement the reference count. If the inp_rele returns 1, indicating the
  * inp is gone, we return that to the caller to tell them *not* to unlock
  * the inp. In the case of multi-cast this will cause the distribution
  * to stop (though most tunneling protocols known currently do *not* use
  * multicast).
  */
 static int
 udp_append(struct inpcb *inp, struct ip *ip, struct mbuf *n, int off,
     struct sockaddr_in *udp_in)
 {
 	struct sockaddr *append_sa;
 	struct socket *so;
 	struct mbuf *tmpopts, *opts = NULL;
 #ifdef INET6
 	struct sockaddr_in6 udp_in6;
 #endif
 	struct udpcb *up;
 	bool filtered;
 
 	INP_LOCK_ASSERT(inp);
 
 	/*
 	 * Engage the tunneling protocol.
 	 */
 	up = intoudpcb(inp);
 	if (up->u_tun_func != NULL) {
 		in_pcbref(inp);
 		INP_RUNLOCK(inp);
 		filtered = (*up->u_tun_func)(n, off, inp, (struct sockaddr *)&udp_in[0],
 		    up->u_tun_ctx);
 		INP_RLOCK(inp);
 		if (filtered)
 			return (in_pcbrele_rlocked(inp));
 	}
 
 	off += sizeof(struct udphdr);
 
 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
 	/* Check AH/ESP integrity. */
 	if (IPSEC_ENABLED(ipv4) &&
 	    IPSEC_CHECK_POLICY(ipv4, n, inp) != 0) {
 		m_freem(n);
 		return (0);
 	}
 	if (up->u_flags & UF_ESPINUDP) {/* IPSec UDP encaps. */
 		if (IPSEC_ENABLED(ipv4) &&
-		    UDPENCAP_INPUT(n, off, AF_INET) != 0)
+		    UDPENCAP_INPUT(ipv4, n, off, AF_INET) != 0)
 			return (0);	/* Consumed. */
 	}
 #endif /* IPSEC */
 #ifdef MAC
 	if (mac_inpcb_check_deliver(inp, n) != 0) {
 		m_freem(n);
 		return (0);
 	}
 #endif /* MAC */
 	if (inp->inp_flags & INP_CONTROLOPTS ||
 	    inp->inp_socket->so_options & (SO_TIMESTAMP | SO_BINTIME)) {
 #ifdef INET6
 		if (inp->inp_vflag & INP_IPV6)
 			(void)ip6_savecontrol_v4(inp, n, &opts, NULL);
 		else
 #endif /* INET6 */
 			ip_savecontrol(inp, &opts, ip, n);
 	}
 	if ((inp->inp_vflag & INP_IPV4) && (inp->inp_flags2 & INP_ORIGDSTADDR)) {
 		tmpopts = sbcreatecontrol(&udp_in[1],
 		    sizeof(struct sockaddr_in), IP_ORIGDSTADDR, IPPROTO_IP,
 		    M_NOWAIT);
 		if (tmpopts) {
 			if (opts) {
 				tmpopts->m_next = opts;
 				opts = tmpopts;
 			} else
 				opts = tmpopts;
 		}
 	}
 #ifdef INET6
 	if (inp->inp_vflag & INP_IPV6) {
 		bzero(&udp_in6, sizeof(udp_in6));
 		udp_in6.sin6_len = sizeof(udp_in6);
 		udp_in6.sin6_family = AF_INET6;
 		in6_sin_2_v4mapsin6(&udp_in[0], &udp_in6);
 		append_sa = (struct sockaddr *)&udp_in6;
 	} else
 #endif /* INET6 */
 		append_sa = (struct sockaddr *)&udp_in[0];
 	m_adj(n, off);
 
 	so = inp->inp_socket;
 	SOCKBUF_LOCK(&so->so_rcv);
 	if (sbappendaddr_locked(&so->so_rcv, append_sa, n, opts) == 0) {
 		soroverflow_locked(so);
 		m_freem(n);
 		if (opts)
 			m_freem(opts);
 		UDPSTAT_INC(udps_fullsock);
 	} else
 		sorwakeup_locked(so);
 	return (0);
 }
 
 static bool
 udp_multi_match(const struct inpcb *inp, void *v)
 {
 	struct ip *ip = v;
 	struct udphdr *uh = (struct udphdr *)(ip + 1);
 
 	if (inp->inp_lport != uh->uh_dport)
 		return (false);
 #ifdef INET6
 	if ((inp->inp_vflag & INP_IPV4) == 0)
 		return (false);
 #endif
 	if (inp->inp_laddr.s_addr != INADDR_ANY &&
 	    inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
 		return (false);
 	if (inp->inp_faddr.s_addr != INADDR_ANY &&
 	    inp->inp_faddr.s_addr != ip->ip_src.s_addr)
 		return (false);
 	if (inp->inp_fport != 0 &&
 	    inp->inp_fport != uh->uh_sport)
 		return (false);
 
 	return (true);
 }
 
 static int
 udp_multi_input(struct mbuf *m, int proto, struct sockaddr_in *udp_in)
 {
 	struct ip *ip = mtod(m, struct ip *);
 	struct inpcb_iterator inpi = INP_ITERATOR(udp_get_inpcbinfo(proto),
 	    INPLOOKUP_RLOCKPCB, udp_multi_match, ip);
 #ifdef KDTRACE_HOOKS
 	struct udphdr *uh = (struct udphdr *)(ip + 1);
 #endif
 	struct inpcb *inp;
 	struct mbuf *n;
 	int appends = 0;
 
 	MPASS(ip->ip_hl == sizeof(struct ip) >> 2);
 
 	while ((inp = inp_next(&inpi)) != NULL) {
 		/*
 		 * XXXRW: Because we weren't holding either the inpcb
 		 * or the hash lock when we checked for a match
 		 * before, we should probably recheck now that the
 		 * inpcb lock is held.
 		 */
 		/*
 		 * Handle socket delivery policy for any-source
 		 * and source-specific multicast. [RFC3678]
 		 */
 		if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
 			struct ip_moptions	*imo;
 			struct sockaddr_in	 group;
 			int			 blocked;
 
 			imo = inp->inp_moptions;
 			if (imo == NULL)
 				continue;
 			bzero(&group, sizeof(struct sockaddr_in));
 			group.sin_len = sizeof(struct sockaddr_in);
 			group.sin_family = AF_INET;
 			group.sin_addr = ip->ip_dst;
 
 			blocked = imo_multi_filter(imo, m->m_pkthdr.rcvif,
 				(struct sockaddr *)&group,
 				(struct sockaddr *)&udp_in[0]);
 			if (blocked != MCAST_PASS) {
 				if (blocked == MCAST_NOTGMEMBER)
 					IPSTAT_INC(ips_notmember);
 				if (blocked == MCAST_NOTSMEMBER ||
 				    blocked == MCAST_MUTED)
 					UDPSTAT_INC(udps_filtermcast);
 				continue;
 			}
 		}
 		if ((n = m_copym(m, 0, M_COPYALL, M_NOWAIT)) != NULL) {
 			if (proto == IPPROTO_UDPLITE)
 				UDPLITE_PROBE(receive, NULL, inp, ip, inp, uh);
 			else
 				UDP_PROBE(receive, NULL, inp, ip, inp, uh);
 			if (udp_append(inp, ip, n, sizeof(struct ip), udp_in)) {
 				break;
 			} else
 				appends++;
 		}
 		/*
 		 * Don't look for additional matches if this one does
 		 * not have either the SO_REUSEPORT or SO_REUSEADDR
 		 * socket options set.  This heuristic avoids
 		 * searching through all pcbs in the common case of a
 		 * non-shared port.  It assumes that an application
 		 * will never clear these options after setting them.
 		 */
 		if ((inp->inp_socket->so_options &
 		    (SO_REUSEPORT|SO_REUSEPORT_LB|SO_REUSEADDR)) == 0) {
 			INP_RUNLOCK(inp);
 			break;
 		}
 	}
 
 	if (appends == 0) {
 		/*
 		 * No matching pcb found; discard datagram.  (No need
 		 * to send an ICMP Port Unreachable for a broadcast
 		 * or multicast datgram.)
 		 */
 		UDPSTAT_INC(udps_noport);
 		if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)))
 			UDPSTAT_INC(udps_noportmcast);
 		else
 			UDPSTAT_INC(udps_noportbcast);
 	}
 	m_freem(m);
 
 	return (IPPROTO_DONE);
 }
 
 static int
 udp_input(struct mbuf **mp, int *offp, int proto)
 {
 	struct ip *ip;
 	struct udphdr *uh;
 	struct ifnet *ifp;
 	struct inpcb *inp;
 	uint16_t len, ip_len;
 	struct inpcbinfo *pcbinfo;
 	struct sockaddr_in udp_in[2];
 	struct mbuf *m;
 	struct m_tag *fwd_tag;
 	int cscov_partial, iphlen;
 
 	m = *mp;
 	iphlen = *offp;
 	ifp = m->m_pkthdr.rcvif;
 	*mp = NULL;
 	UDPSTAT_INC(udps_ipackets);
 
 	/*
 	 * Strip IP options, if any; should skip this, make available to
 	 * user, and use on returned packets, but we don't yet have a way to
 	 * check the checksum with options still present.
 	 */
 	if (iphlen > sizeof (struct ip)) {
 		ip_stripoptions(m);
 		iphlen = sizeof(struct ip);
 	}
 
 	/*
 	 * Get IP and UDP header together in first mbuf.
 	 */
 	if (m->m_len < iphlen + sizeof(struct udphdr)) {
 		if ((m = m_pullup(m, iphlen + sizeof(struct udphdr))) == NULL) {
 			UDPSTAT_INC(udps_hdrops);
 			return (IPPROTO_DONE);
 		}
 	}
 	ip = mtod(m, struct ip *);
 	uh = (struct udphdr *)((caddr_t)ip + iphlen);
 	cscov_partial = (proto == IPPROTO_UDPLITE) ? 1 : 0;
 
 	/*
 	 * Destination port of 0 is illegal, based on RFC768.
 	 */
 	if (uh->uh_dport == 0)
 		goto badunlocked;
 
 	/*
 	 * Construct sockaddr format source address.  Stuff source address
 	 * and datagram in user buffer.
 	 */
 	bzero(&udp_in[0], sizeof(struct sockaddr_in) * 2);
 	udp_in[0].sin_len = sizeof(struct sockaddr_in);
 	udp_in[0].sin_family = AF_INET;
 	udp_in[0].sin_port = uh->uh_sport;
 	udp_in[0].sin_addr = ip->ip_src;
 	udp_in[1].sin_len = sizeof(struct sockaddr_in);
 	udp_in[1].sin_family = AF_INET;
 	udp_in[1].sin_port = uh->uh_dport;
 	udp_in[1].sin_addr = ip->ip_dst;
 
 	/*
 	 * Make mbuf data length reflect UDP length.  If not enough data to
 	 * reflect UDP length, drop.
 	 */
 	len = ntohs((u_short)uh->uh_ulen);
 	ip_len = ntohs(ip->ip_len) - iphlen;
 	if (proto == IPPROTO_UDPLITE && (len == 0 || len == ip_len)) {
 		/* Zero means checksum over the complete packet. */
 		if (len == 0)
 			len = ip_len;
 		cscov_partial = 0;
 	}
 	if (ip_len != len) {
 		if (len > ip_len || len < sizeof(struct udphdr)) {
 			UDPSTAT_INC(udps_badlen);
 			goto badunlocked;
 		}
 		if (proto == IPPROTO_UDP)
 			m_adj(m, len - ip_len);
 	}
 
 	/*
 	 * Checksum extended UDP header and data.
 	 */
 	if (uh->uh_sum) {
 		u_short uh_sum;
 
 		if ((m->m_pkthdr.csum_flags & CSUM_DATA_VALID) &&
 		    !cscov_partial) {
 			if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
 				uh_sum = m->m_pkthdr.csum_data;
 			else
 				uh_sum = in_pseudo(ip->ip_src.s_addr,
 				    ip->ip_dst.s_addr, htonl((u_short)len +
 				    m->m_pkthdr.csum_data + proto));
 			uh_sum ^= 0xffff;
 		} else {
 			char b[offsetof(struct ipovly, ih_src)];
 			struct ipovly *ipov = (struct ipovly *)ip;
 
 			bcopy(ipov, b, sizeof(b));
 			bzero(ipov, sizeof(ipov->ih_x1));
 			ipov->ih_len = (proto == IPPROTO_UDP) ?
 			    uh->uh_ulen : htons(ip_len);
 			uh_sum = in_cksum(m, len + sizeof (struct ip));
 			bcopy(b, ipov, sizeof(b));
 		}
 		if (uh_sum) {
 			UDPSTAT_INC(udps_badsum);
 			m_freem(m);
 			return (IPPROTO_DONE);
 		}
 	} else {
 		if (proto == IPPROTO_UDP) {
 			UDPSTAT_INC(udps_nosum);
 		} else {
 			/* UDPLite requires a checksum */
 			/* XXX: What is the right UDPLite MIB counter here? */
 			m_freem(m);
 			return (IPPROTO_DONE);
 		}
 	}
 
 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
 	    in_broadcast(ip->ip_dst, ifp))
 		return (udp_multi_input(m, proto, udp_in));
 
 	pcbinfo = udp_get_inpcbinfo(proto);
 
 	/*
 	 * Locate pcb for datagram.
 	 *
 	 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
 	 */
 	if ((m->m_flags & M_IP_NEXTHOP) &&
 	    (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
 		struct sockaddr_in *next_hop;
 
 		next_hop = (struct sockaddr_in *)(fwd_tag + 1);
 
 		/*
 		 * Transparently forwarded. Pretend to be the destination.
 		 * Already got one like this?
 		 */
 		inp = in_pcblookup_mbuf(pcbinfo, ip->ip_src, uh->uh_sport,
 		    ip->ip_dst, uh->uh_dport, INPLOOKUP_RLOCKPCB, ifp, m);
 		if (!inp) {
 			/*
 			 * It's new.  Try to find the ambushing socket.
 			 * Because we've rewritten the destination address,
 			 * any hardware-generated hash is ignored.
 			 */
 			inp = in_pcblookup(pcbinfo, ip->ip_src,
 			    uh->uh_sport, next_hop->sin_addr,
 			    next_hop->sin_port ? htons(next_hop->sin_port) :
 			    uh->uh_dport, INPLOOKUP_WILDCARD |
 			    INPLOOKUP_RLOCKPCB, ifp);
 		}
 		/* Remove the tag from the packet. We don't need it anymore. */
 		m_tag_delete(m, fwd_tag);
 		m->m_flags &= ~M_IP_NEXTHOP;
 	} else
 		inp = in_pcblookup_mbuf(pcbinfo, ip->ip_src, uh->uh_sport,
 		    ip->ip_dst, uh->uh_dport, INPLOOKUP_WILDCARD |
 		    INPLOOKUP_RLOCKPCB, ifp, m);
 	if (inp == NULL) {
 		if (V_udp_log_in_vain) {
 			char src[INET_ADDRSTRLEN];
 			char dst[INET_ADDRSTRLEN];
 
 			log(LOG_INFO,
 			    "Connection attempt to UDP %s:%d from %s:%d\n",
 			    inet_ntoa_r(ip->ip_dst, dst), ntohs(uh->uh_dport),
 			    inet_ntoa_r(ip->ip_src, src), ntohs(uh->uh_sport));
 		}
 		if (proto == IPPROTO_UDPLITE)
 			UDPLITE_PROBE(receive, NULL, NULL, ip, NULL, uh);
 		else
 			UDP_PROBE(receive, NULL, NULL, ip, NULL, uh);
 		UDPSTAT_INC(udps_noport);
 		if (m->m_flags & (M_BCAST | M_MCAST)) {
 			UDPSTAT_INC(udps_noportbcast);
 			goto badunlocked;
 		}
 		if (V_udp_blackhole && (V_udp_blackhole_local ||
 		    !in_localip(ip->ip_src)))
 			goto badunlocked;
 		if (badport_bandlim(BANDLIM_ICMP_UNREACH) < 0)
 			goto badunlocked;
 		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
 		return (IPPROTO_DONE);
 	}
 
 	/*
 	 * Check the minimum TTL for socket.
 	 */
 	INP_RLOCK_ASSERT(inp);
 	if (inp->inp_ip_minttl && inp->inp_ip_minttl > ip->ip_ttl) {
 		if (proto == IPPROTO_UDPLITE)
 			UDPLITE_PROBE(receive, NULL, inp, ip, inp, uh);
 		else
 			UDP_PROBE(receive, NULL, inp, ip, inp, uh);
 		INP_RUNLOCK(inp);
 		m_freem(m);
 		return (IPPROTO_DONE);
 	}
 	if (cscov_partial) {
 		struct udpcb *up;
 
 		up = intoudpcb(inp);
 		if (up->u_rxcslen == 0 || up->u_rxcslen > len) {
 			INP_RUNLOCK(inp);
 			m_freem(m);
 			return (IPPROTO_DONE);
 		}
 	}
 
 	if (proto == IPPROTO_UDPLITE)
 		UDPLITE_PROBE(receive, NULL, inp, ip, inp, uh);
 	else
 		UDP_PROBE(receive, NULL, inp, ip, inp, uh);
 	if (udp_append(inp, ip, m, iphlen, udp_in) == 0)
 		INP_RUNLOCK(inp);
 	return (IPPROTO_DONE);
 
 badunlocked:
 	m_freem(m);
 	return (IPPROTO_DONE);
 }
 #endif /* INET */
 
 /*
  * Notify a udp user of an asynchronous error; just wake up so that they can
  * collect error status.
  */
 struct inpcb *
 udp_notify(struct inpcb *inp, int errno)
 {
 
 	INP_WLOCK_ASSERT(inp);
 	if ((errno == EHOSTUNREACH || errno == ENETUNREACH ||
 	     errno == EHOSTDOWN) && inp->inp_route.ro_nh) {
 		NH_FREE(inp->inp_route.ro_nh);
 		inp->inp_route.ro_nh = (struct nhop_object *)NULL;
 	}
 
 	inp->inp_socket->so_error = errno;
 	sorwakeup(inp->inp_socket);
 	sowwakeup(inp->inp_socket);
 	return (inp);
 }
 
 #ifdef INET
 static void
 udp_common_ctlinput(struct icmp *icmp, struct inpcbinfo *pcbinfo)
 {
 	struct ip *ip = &icmp->icmp_ip;
 	struct udphdr *uh;
 	struct inpcb *inp;
 
 	if (icmp_errmap(icmp) == 0)
 		return;
 
 	uh = (struct udphdr *)((caddr_t)ip + (ip->ip_hl << 2));
 	inp = in_pcblookup(pcbinfo, ip->ip_dst, uh->uh_dport, ip->ip_src,
 	    uh->uh_sport, INPLOOKUP_WLOCKPCB, NULL);
 	if (inp != NULL) {
 		INP_WLOCK_ASSERT(inp);
 		if (inp->inp_socket != NULL)
 			udp_notify(inp, icmp_errmap(icmp));
 		INP_WUNLOCK(inp);
 	} else {
 		inp = in_pcblookup(pcbinfo, ip->ip_dst, uh->uh_dport,
 		    ip->ip_src, uh->uh_sport,
 		    INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB, NULL);
 		if (inp != NULL) {
 			struct udpcb *up;
 			udp_tun_icmp_t *func;
 
 			up = intoudpcb(inp);
 			func = up->u_icmp_func;
 			INP_RUNLOCK(inp);
 			if (func != NULL)
 				func(icmp);
 		}
 	}
 }
 
 static void
 udp_ctlinput(struct icmp *icmp)
 {
 
 	return (udp_common_ctlinput(icmp, &V_udbinfo));
 }
 
 static void
 udplite_ctlinput(struct icmp *icmp)
 {
 
 	return (udp_common_ctlinput(icmp, &V_ulitecbinfo));
 }
 #endif /* INET */
 
 static int
 udp_pcblist(SYSCTL_HANDLER_ARGS)
 {
 	struct inpcb_iterator inpi = INP_ALL_ITERATOR(&V_udbinfo,
 	    INPLOOKUP_RLOCKPCB);
 	struct xinpgen xig;
 	struct inpcb *inp;
 	int error;
 
 	if (req->newptr != 0)
 		return (EPERM);
 
 	if (req->oldptr == 0) {
 		int n;
 
 		n = V_udbinfo.ipi_count;
 		n += imax(n / 8, 10);
 		req->oldidx = 2 * (sizeof xig) + n * sizeof(struct xinpcb);
 		return (0);
 	}
 
 	if ((error = sysctl_wire_old_buffer(req, 0)) != 0)
 		return (error);
 
 	bzero(&xig, sizeof(xig));
 	xig.xig_len = sizeof xig;
 	xig.xig_count = V_udbinfo.ipi_count;
 	xig.xig_gen = V_udbinfo.ipi_gencnt;
 	xig.xig_sogen = so_gencnt;
 	error = SYSCTL_OUT(req, &xig, sizeof xig);
 	if (error)
 		return (error);
 
 	while ((inp = inp_next(&inpi)) != NULL) {
 		if (inp->inp_gencnt <= xig.xig_gen &&
 		    cr_canseeinpcb(req->td->td_ucred, inp) == 0) {
 			struct xinpcb xi;
 
 			in_pcbtoxinpcb(inp, &xi);
 			error = SYSCTL_OUT(req, &xi, sizeof xi);
 			if (error) {
 				INP_RUNLOCK(inp);
 				break;
 			}
 		}
 	}
 
 	if (!error) {
 		/*
 		 * Give the user an updated idea of our state.  If the
 		 * generation differs from what we told her before, she knows
 		 * that something happened while we were processing this
 		 * request, and it might be necessary to retry.
 		 */
 		xig.xig_gen = V_udbinfo.ipi_gencnt;
 		xig.xig_sogen = so_gencnt;
 		xig.xig_count = V_udbinfo.ipi_count;
 		error = SYSCTL_OUT(req, &xig, sizeof xig);
 	}
 
 	return (error);
 }
 
 SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist,
     CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
     udp_pcblist, "S,xinpcb",
     "List of active UDP sockets");
 
 #ifdef INET
 static int
 udp_getcred(SYSCTL_HANDLER_ARGS)
 {
 	struct xucred xuc;
 	struct sockaddr_in addrs[2];
 	struct epoch_tracker et;
 	struct inpcb *inp;
 	int error;
 
 	error = priv_check(req->td, PRIV_NETINET_GETCRED);
 	if (error)
 		return (error);
 	error = SYSCTL_IN(req, addrs, sizeof(addrs));
 	if (error)
 		return (error);
 	NET_EPOCH_ENTER(et);
 	inp = in_pcblookup(&V_udbinfo, addrs[1].sin_addr, addrs[1].sin_port,
 	    addrs[0].sin_addr, addrs[0].sin_port,
 	    INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB, NULL);
 	NET_EPOCH_EXIT(et);
 	if (inp != NULL) {
 		INP_RLOCK_ASSERT(inp);
 		if (inp->inp_socket == NULL)
 			error = ENOENT;
 		if (error == 0)
 			error = cr_canseeinpcb(req->td->td_ucred, inp);
 		if (error == 0)
 			cru2x(inp->inp_cred, &xuc);
 		INP_RUNLOCK(inp);
 	} else
 		error = ENOENT;
 	if (error == 0)
 		error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
 	return (error);
 }
 
 SYSCTL_PROC(_net_inet_udp, OID_AUTO, getcred,
     CTLTYPE_OPAQUE | CTLFLAG_RW | CTLFLAG_PRISON | CTLFLAG_MPSAFE,
     0, 0, udp_getcred, "S,xucred",
     "Get the xucred of a UDP connection");
 #endif /* INET */
 
 int
 udp_ctloutput(struct socket *so, struct sockopt *sopt)
 {
 	struct inpcb *inp;
 	struct udpcb *up;
 	int isudplite, error, optval;
 
 	error = 0;
 	isudplite = (so->so_proto->pr_protocol == IPPROTO_UDPLITE) ? 1 : 0;
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
 	INP_WLOCK(inp);
 	if (sopt->sopt_level != so->so_proto->pr_protocol) {
 #ifdef INET6
 		if (INP_CHECK_SOCKAF(so, AF_INET6)) {
 			INP_WUNLOCK(inp);
 			error = ip6_ctloutput(so, sopt);
 		}
 #endif
 #if defined(INET) && defined(INET6)
 		else
 #endif
 #ifdef INET
 		{
 			INP_WUNLOCK(inp);
 			error = ip_ctloutput(so, sopt);
 		}
 #endif
 		return (error);
 	}
 
 	switch (sopt->sopt_dir) {
 	case SOPT_SET:
 		switch (sopt->sopt_name) {
 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
-#ifdef INET
+#if defined(INET) || defined(INET6)
 		case UDP_ENCAP:
-			if (!INP_CHECK_SOCKAF(so, AF_INET)) {
-				INP_WUNLOCK(inp);
-				return (EINVAL);
-			}
-			if (!IPSEC_ENABLED(ipv4)) {
-				INP_WUNLOCK(inp);
-				return (ENOPROTOOPT);
+#ifdef INET
+			if (INP_SOCKAF(so) == AF_INET) {
+				if (!IPSEC_ENABLED(ipv4)) {
+					INP_WUNLOCK(inp);
+					return (ENOPROTOOPT);
+				}
+				error = UDPENCAP_PCBCTL(ipv4, inp, sopt);
+				break;
 			}
-			error = UDPENCAP_PCBCTL(inp, sopt);
-			break;
 #endif /* INET */
+#ifdef INET6
+			if (INP_SOCKAF(so) == AF_INET6) {
+				if (!IPSEC_ENABLED(ipv6)) {
+					INP_WUNLOCK(inp);
+					return (ENOPROTOOPT);
+				}
+				error = UDPENCAP_PCBCTL(ipv6, inp, sopt);
+				break;
+			}
+#endif /* INET6 */
+			INP_WUNLOCK(inp);
+			return (EINVAL);
+#endif /* INET || INET6 */
+
 #endif /* IPSEC */
 		case UDPLITE_SEND_CSCOV:
 		case UDPLITE_RECV_CSCOV:
 			if (!isudplite) {
 				INP_WUNLOCK(inp);
 				error = ENOPROTOOPT;
 				break;
 			}
 			INP_WUNLOCK(inp);
 			error = sooptcopyin(sopt, &optval, sizeof(optval),
 			    sizeof(optval));
 			if (error != 0)
 				break;
 			inp = sotoinpcb(so);
 			KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
 			INP_WLOCK(inp);
 			up = intoudpcb(inp);
 			KASSERT(up != NULL, ("%s: up == NULL", __func__));
 			if ((optval != 0 && optval < 8) || (optval > 65535)) {
 				INP_WUNLOCK(inp);
 				error = EINVAL;
 				break;
 			}
 			if (sopt->sopt_name == UDPLITE_SEND_CSCOV)
 				up->u_txcslen = optval;
 			else
 				up->u_rxcslen = optval;
 			INP_WUNLOCK(inp);
 			break;
 		default:
 			INP_WUNLOCK(inp);
 			error = ENOPROTOOPT;
 			break;
 		}
 		break;
 	case SOPT_GET:
 		switch (sopt->sopt_name) {
 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
-#ifdef INET
+#if defined(INET) || defined(INET6)
 		case UDP_ENCAP:
-			if (!INP_CHECK_SOCKAF(so, AF_INET)) {
-				INP_WUNLOCK(inp);
-				return (EINVAL);
-			}
-			if (!IPSEC_ENABLED(ipv4)) {
-				INP_WUNLOCK(inp);
-				return (ENOPROTOOPT);
+#ifdef INET
+			if (INP_SOCKAF(so) == AF_INET) {
+				if (!IPSEC_ENABLED(ipv4)) {
+					INP_WUNLOCK(inp);
+					return (ENOPROTOOPT);
+				}
+				error = UDPENCAP_PCBCTL(ipv4, inp, sopt);
+				break;
 			}
-			error = UDPENCAP_PCBCTL(inp, sopt);
-			break;
 #endif /* INET */
+#ifdef INET6
+			if (INP_SOCKAF(so) == AF_INET6) {
+				if (!IPSEC_ENABLED(ipv6)) {
+					INP_WUNLOCK(inp);
+					return (ENOPROTOOPT);
+				}
+				error = UDPENCAP_PCBCTL(ipv6, inp, sopt);
+				break;
+			}
+#endif /* INET6 */
+			INP_WUNLOCK(inp);
+			return (EINVAL);
+#endif /* INET || INET6 */
+
 #endif /* IPSEC */
 		case UDPLITE_SEND_CSCOV:
 		case UDPLITE_RECV_CSCOV:
 			if (!isudplite) {
 				INP_WUNLOCK(inp);
 				error = ENOPROTOOPT;
 				break;
 			}
 			up = intoudpcb(inp);
 			KASSERT(up != NULL, ("%s: up == NULL", __func__));
 			if (sopt->sopt_name == UDPLITE_SEND_CSCOV)
 				optval = up->u_txcslen;
 			else
 				optval = up->u_rxcslen;
 			INP_WUNLOCK(inp);
 			error = sooptcopyout(sopt, &optval, sizeof(optval));
 			break;
 		default:
 			INP_WUNLOCK(inp);
 			error = ENOPROTOOPT;
 			break;
 		}
 		break;
 	}
 	return (error);
 }
 
 #ifdef INET
 #ifdef INET6
 /* The logic here is derived from ip6_setpktopt(). See comments there. */
 static int
 udp_v4mapped_pktinfo(struct cmsghdr *cm, struct sockaddr_in * src,
     struct inpcb *inp, int flags)
 {
 	struct ifnet *ifp;
 	struct in6_pktinfo *pktinfo;
 	struct in_addr ia;
 
 	if ((flags & PRUS_IPV6) == 0)
 		return (0);
 
 	if (cm->cmsg_level != IPPROTO_IPV6)
 		return (0);
 
 	if  (cm->cmsg_type != IPV6_2292PKTINFO &&
 	    cm->cmsg_type != IPV6_PKTINFO)
 		return (0);
 
 	if (cm->cmsg_len !=
 	    CMSG_LEN(sizeof(struct in6_pktinfo)))
 		return (EINVAL);
 
 	pktinfo = (struct in6_pktinfo *)CMSG_DATA(cm);
 	if (!IN6_IS_ADDR_V4MAPPED(&pktinfo->ipi6_addr) &&
 	    !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr))
 		return (EINVAL);
 
 	/* Validate the interface index if specified. */
 	if (pktinfo->ipi6_ifindex) {
 		struct epoch_tracker et;
 
 		NET_EPOCH_ENTER(et);
 		ifp = ifnet_byindex(pktinfo->ipi6_ifindex);
 		NET_EPOCH_EXIT(et);	/* XXXGL: unsafe ifp */
 		if (ifp == NULL)
 			return (ENXIO);
 	} else
 		ifp = NULL;
 	if (ifp != NULL && !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
 		ia.s_addr = pktinfo->ipi6_addr.s6_addr32[3];
 		if (in_ifhasaddr(ifp, ia) == 0)
 			return (EADDRNOTAVAIL);
 	}
 
 	bzero(src, sizeof(*src));
 	src->sin_family = AF_INET;
 	src->sin_len = sizeof(*src);
 	src->sin_port = inp->inp_lport;
 	src->sin_addr.s_addr = pktinfo->ipi6_addr.s6_addr32[3];
 
 	return (0);
 }
 #endif	/* INET6 */
 
 int
 udp_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
     struct mbuf *control, struct thread *td)
 {
 	struct inpcb *inp;
 	struct udpiphdr *ui;
 	int len, error = 0;
 	struct in_addr faddr, laddr;
 	struct cmsghdr *cm;
 	struct inpcbinfo *pcbinfo;
 	struct sockaddr_in *sin, src;
 	struct epoch_tracker et;
 	int cscov_partial = 0;
 	int ipflags = 0;
 	u_short fport, lport;
 	u_char tos, vflagsav;
 	uint8_t pr;
 	uint16_t cscov = 0;
 	uint32_t flowid = 0;
 	uint8_t flowtype = M_HASHTYPE_NONE;
 	bool use_cached_route;
 
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp_send: inp == NULL"));
 
 	if (addr != NULL) {
 		if (addr->sa_family != AF_INET)
 			error = EAFNOSUPPORT;
 		else if (addr->sa_len != sizeof(struct sockaddr_in))
 			error = EINVAL;
 		if (__predict_false(error != 0)) {
 			m_freem(control);
 			m_freem(m);
 			return (error);
 		}
 	}
 
 	len = m->m_pkthdr.len;
 	if (len + sizeof(struct udpiphdr) > IP_MAXPACKET) {
 		if (control)
 			m_freem(control);
 		m_freem(m);
 		return (EMSGSIZE);
 	}
 
 	src.sin_family = 0;
 	sin = (struct sockaddr_in *)addr;
 
 	/*
 	 * udp_send() may need to temporarily bind or connect the current
 	 * inpcb.  As such, we don't know up front whether we will need the
 	 * pcbinfo lock or not.  Do any work to decide what is needed up
 	 * front before acquiring any locks.
 	 *
 	 * We will need network epoch in either case, to safely lookup into
 	 * pcb hash.
 	 */
 	use_cached_route = sin == NULL || (inp->inp_laddr.s_addr == INADDR_ANY && inp->inp_lport == 0);
 	if (use_cached_route || (flags & PRUS_IPV6) != 0)
 		INP_WLOCK(inp);
 	else
 		INP_RLOCK(inp);
 	NET_EPOCH_ENTER(et);
 	tos = inp->inp_ip_tos;
 	if (control != NULL) {
 		/*
 		 * XXX: Currently, we assume all the optional information is
 		 * stored in a single mbuf.
 		 */
 		if (control->m_next) {
 			m_freem(control);
 			error = EINVAL;
 			goto release;
 		}
 		for (; control->m_len > 0;
 		    control->m_data += CMSG_ALIGN(cm->cmsg_len),
 		    control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
 			cm = mtod(control, struct cmsghdr *);
 			if (control->m_len < sizeof(*cm) || cm->cmsg_len == 0
 			    || cm->cmsg_len > control->m_len) {
 				error = EINVAL;
 				break;
 			}
 #ifdef INET6
 			error = udp_v4mapped_pktinfo(cm, &src, inp, flags);
 			if (error != 0)
 				break;
 #endif
 			if (cm->cmsg_level != IPPROTO_IP)
 				continue;
 
 			switch (cm->cmsg_type) {
 			case IP_SENDSRCADDR:
 				if (cm->cmsg_len !=
 				    CMSG_LEN(sizeof(struct in_addr))) {
 					error = EINVAL;
 					break;
 				}
 				bzero(&src, sizeof(src));
 				src.sin_family = AF_INET;
 				src.sin_len = sizeof(src);
 				src.sin_port = inp->inp_lport;
 				src.sin_addr =
 				    *(struct in_addr *)CMSG_DATA(cm);
 				break;
 
 			case IP_TOS:
 				if (cm->cmsg_len != CMSG_LEN(sizeof(u_char))) {
 					error = EINVAL;
 					break;
 				}
 				tos = *(u_char *)CMSG_DATA(cm);
 				break;
 
 			case IP_FLOWID:
 				if (cm->cmsg_len != CMSG_LEN(sizeof(uint32_t))) {
 					error = EINVAL;
 					break;
 				}
 				flowid = *(uint32_t *) CMSG_DATA(cm);
 				break;
 
 			case IP_FLOWTYPE:
 				if (cm->cmsg_len != CMSG_LEN(sizeof(uint32_t))) {
 					error = EINVAL;
 					break;
 				}
 				flowtype = *(uint32_t *) CMSG_DATA(cm);
 				break;
 
 #ifdef	RSS
 			case IP_RSSBUCKETID:
 				if (cm->cmsg_len != CMSG_LEN(sizeof(uint32_t))) {
 					error = EINVAL;
 					break;
 				}
 				/* This is just a placeholder for now */
 				break;
 #endif	/* RSS */
 			default:
 				error = ENOPROTOOPT;
 				break;
 			}
 			if (error)
 				break;
 		}
 		m_freem(control);
 		control = NULL;
 	}
 	if (error)
 		goto release;
 
 	pr = inp->inp_socket->so_proto->pr_protocol;
 	pcbinfo = udp_get_inpcbinfo(pr);
 
 	/*
 	 * If the IP_SENDSRCADDR control message was specified, override the
 	 * source address for this datagram.  Its use is invalidated if the
 	 * address thus specified is incomplete or clobbers other inpcbs.
 	 */
 	laddr = inp->inp_laddr;
 	lport = inp->inp_lport;
 	if (src.sin_family == AF_INET) {
 		if ((lport == 0) ||
 		    (laddr.s_addr == INADDR_ANY &&
 		     src.sin_addr.s_addr == INADDR_ANY)) {
 			error = EINVAL;
 			goto release;
 		}
 		if ((flags & PRUS_IPV6) != 0) {
 			vflagsav = inp->inp_vflag;
 			inp->inp_vflag |= INP_IPV4;
 			inp->inp_vflag &= ~INP_IPV6;
 		}
 		INP_HASH_WLOCK(pcbinfo);
 		error = in_pcbbind_setup(inp, &src, &laddr.s_addr, &lport,
 		    td->td_ucred);
 		INP_HASH_WUNLOCK(pcbinfo);
 		if ((flags & PRUS_IPV6) != 0)
 			inp->inp_vflag = vflagsav;
 		if (error)
 			goto release;
 	}
 
 	/*
 	 * If a UDP socket has been connected, then a local address/port will
 	 * have been selected and bound.
 	 *
 	 * If a UDP socket has not been connected to, then an explicit
 	 * destination address must be used, in which case a local
 	 * address/port may not have been selected and bound.
 	 */
 	if (sin != NULL) {
 		INP_LOCK_ASSERT(inp);
 		if (inp->inp_faddr.s_addr != INADDR_ANY) {
 			error = EISCONN;
 			goto release;
 		}
 
 		/*
 		 * Jail may rewrite the destination address, so let it do
 		 * that before we use it.
 		 */
 		error = prison_remote_ip4(td->td_ucred, &sin->sin_addr);
 		if (error)
 			goto release;
 
 		/*
 		 * If a local address or port hasn't yet been selected, or if
 		 * the destination address needs to be rewritten due to using
 		 * a special INADDR_ constant, invoke in_pcbconnect_setup()
 		 * to do the heavy lifting.  Once a port is selected, we
 		 * commit the binding back to the socket; we also commit the
 		 * binding of the address if in jail.
 		 *
 		 * If we already have a valid binding and we're not
 		 * requesting a destination address rewrite, use a fast path.
 		 */
 		if (inp->inp_laddr.s_addr == INADDR_ANY ||
 		    inp->inp_lport == 0 ||
 		    sin->sin_addr.s_addr == INADDR_ANY ||
 		    sin->sin_addr.s_addr == INADDR_BROADCAST) {
 			if ((flags & PRUS_IPV6) != 0) {
 				vflagsav = inp->inp_vflag;
 				inp->inp_vflag |= INP_IPV4;
 				inp->inp_vflag &= ~INP_IPV6;
 			}
 			INP_HASH_WLOCK(pcbinfo);
 			error = in_pcbconnect_setup(inp, sin, &laddr.s_addr,
 			    &lport, &faddr.s_addr, &fport, td->td_ucred);
 			if ((flags & PRUS_IPV6) != 0)
 				inp->inp_vflag = vflagsav;
 			if (error) {
 				INP_HASH_WUNLOCK(pcbinfo);
 				goto release;
 			}
 
 			/*
 			 * XXXRW: Why not commit the port if the address is
 			 * !INADDR_ANY?
 			 */
 			/* Commit the local port if newly assigned. */
 			if (inp->inp_laddr.s_addr == INADDR_ANY &&
 			    inp->inp_lport == 0) {
 				INP_WLOCK_ASSERT(inp);
 				/*
 				 * Remember addr if jailed, to prevent
 				 * rebinding.
 				 */
 				if (prison_flag(td->td_ucred, PR_IP4))
 					inp->inp_laddr = laddr;
 				inp->inp_lport = lport;
 				error = in_pcbinshash(inp);
 				INP_HASH_WUNLOCK(pcbinfo);
 				if (error != 0) {
 					inp->inp_lport = 0;
 					error = EAGAIN;
 					goto release;
 				}
 				inp->inp_flags |= INP_ANONPORT;
 			} else
 				INP_HASH_WUNLOCK(pcbinfo);
 		} else {
 			faddr = sin->sin_addr;
 			fport = sin->sin_port;
 		}
 	} else {
 		INP_LOCK_ASSERT(inp);
 		faddr = inp->inp_faddr;
 		fport = inp->inp_fport;
 		if (faddr.s_addr == INADDR_ANY) {
 			error = ENOTCONN;
 			goto release;
 		}
 	}
 
 	/*
 	 * Calculate data length and get a mbuf for UDP, IP, and possible
 	 * link-layer headers.  Immediate slide the data pointer back forward
 	 * since we won't use that space at this layer.
 	 */
 	M_PREPEND(m, sizeof(struct udpiphdr) + max_linkhdr, M_NOWAIT);
 	if (m == NULL) {
 		error = ENOBUFS;
 		goto release;
 	}
 	m->m_data += max_linkhdr;
 	m->m_len -= max_linkhdr;
 	m->m_pkthdr.len -= max_linkhdr;
 
 	/*
 	 * Fill in mbuf with extended UDP header and addresses and length put
 	 * into network format.
 	 */
 	ui = mtod(m, struct udpiphdr *);
 	/*
 	 * Filling only those fields of udpiphdr that participate in the
 	 * checksum calculation. The rest must be zeroed and will be filled
 	 * later.
 	 */
 	bzero(ui->ui_x1, sizeof(ui->ui_x1));
 	ui->ui_pr = pr;
 	ui->ui_src = laddr;
 	ui->ui_dst = faddr;
 	ui->ui_sport = lport;
 	ui->ui_dport = fport;
 	ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
 	if (pr == IPPROTO_UDPLITE) {
 		struct udpcb *up;
 		uint16_t plen;
 
 		up = intoudpcb(inp);
 		cscov = up->u_txcslen;
 		plen = (u_short)len + sizeof(struct udphdr);
 		if (cscov >= plen)
 			cscov = 0;
 		ui->ui_len = htons(plen);
 		ui->ui_ulen = htons(cscov);
 		/*
 		 * For UDP-Lite, checksum coverage length of zero means
 		 * the entire UDPLite packet is covered by the checksum.
 		 */
 		cscov_partial = (cscov == 0) ? 0 : 1;
 	}
 
 	if (inp->inp_socket->so_options & SO_DONTROUTE)
 		ipflags |= IP_ROUTETOIF;
 	if (inp->inp_socket->so_options & SO_BROADCAST)
 		ipflags |= IP_ALLOWBROADCAST;
 	if (inp->inp_flags & INP_ONESBCAST)
 		ipflags |= IP_SENDONES;
 
 #ifdef MAC
 	mac_inpcb_create_mbuf(inp, m);
 #endif
 
 	/*
 	 * Set up checksum and output datagram.
 	 */
 	ui->ui_sum = 0;
 	if (pr == IPPROTO_UDPLITE) {
 		if (inp->inp_flags & INP_ONESBCAST)
 			faddr.s_addr = INADDR_BROADCAST;
 		if (cscov_partial) {
 			if ((ui->ui_sum = in_cksum(m, sizeof(struct ip) + cscov)) == 0)
 				ui->ui_sum = 0xffff;
 		} else {
 			if ((ui->ui_sum = in_cksum(m, sizeof(struct udpiphdr) + len)) == 0)
 				ui->ui_sum = 0xffff;
 		}
 	} else if (V_udp_cksum) {
 		if (inp->inp_flags & INP_ONESBCAST)
 			faddr.s_addr = INADDR_BROADCAST;
 		ui->ui_sum = in_pseudo(ui->ui_src.s_addr, faddr.s_addr,
 		    htons((u_short)len + sizeof(struct udphdr) + pr));
 		m->m_pkthdr.csum_flags = CSUM_UDP;
 		m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
 	}
 	/*
 	 * After finishing the checksum computation, fill the remaining fields
 	 * of udpiphdr.
 	 */
 	((struct ip *)ui)->ip_v = IPVERSION;
 	((struct ip *)ui)->ip_tos = tos;
 	((struct ip *)ui)->ip_len = htons(sizeof(struct udpiphdr) + len);
 	if (inp->inp_flags & INP_DONTFRAG)
 		((struct ip *)ui)->ip_off |= htons(IP_DF);
 	((struct ip *)ui)->ip_ttl = inp->inp_ip_ttl;
 	UDPSTAT_INC(udps_opackets);
 
 	/*
 	 * Setup flowid / RSS information for outbound socket.
 	 *
 	 * Once the UDP code decides to set a flowid some other way,
 	 * this allows the flowid to be overridden by userland.
 	 */
 	if (flowtype != M_HASHTYPE_NONE) {
 		m->m_pkthdr.flowid = flowid;
 		M_HASHTYPE_SET(m, flowtype);
 	}
 #if defined(ROUTE_MPATH) || defined(RSS)
 	else if (CALC_FLOWID_OUTBOUND_SENDTO) {
 		uint32_t hash_val, hash_type;
 
 		hash_val = fib4_calc_packet_hash(laddr, faddr,
 		    lport, fport, pr, &hash_type);
 		m->m_pkthdr.flowid = hash_val;
 		M_HASHTYPE_SET(m, hash_type);
 	}
 
 	/*
 	 * Don't override with the inp cached flowid value.
 	 *
 	 * Depending upon the kind of send being done, the inp
 	 * flowid/flowtype values may actually not be appropriate
 	 * for this particular socket send.
 	 *
 	 * We should either leave the flowid at zero (which is what is
 	 * currently done) or set it to some software generated
 	 * hash value based on the packet contents.
 	 */
 	ipflags |= IP_NODEFAULTFLOWID;
 #endif	/* RSS */
 
 	if (pr == IPPROTO_UDPLITE)
 		UDPLITE_PROBE(send, NULL, inp, &ui->ui_i, inp, &ui->ui_u);
 	else
 		UDP_PROBE(send, NULL, inp, &ui->ui_i, inp, &ui->ui_u);
 	error = ip_output(m, inp->inp_options,
 	    use_cached_route ? &inp->inp_route : NULL, ipflags,
 	    inp->inp_moptions, inp);
 	INP_UNLOCK(inp);
 	NET_EPOCH_EXIT(et);
 	return (error);
 
 release:
 	INP_UNLOCK(inp);
 	NET_EPOCH_EXIT(et);
 	m_freem(m);
 	return (error);
 }
 
 void
 udp_abort(struct socket *so)
 {
 	struct inpcb *inp;
 	struct inpcbinfo *pcbinfo;
 
 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp_abort: inp == NULL"));
 	INP_WLOCK(inp);
 	if (inp->inp_faddr.s_addr != INADDR_ANY) {
 		INP_HASH_WLOCK(pcbinfo);
 		in_pcbdisconnect(inp);
 		INP_HASH_WUNLOCK(pcbinfo);
 		soisdisconnected(so);
 	}
 	INP_WUNLOCK(inp);
 }
 
 static int
 udp_attach(struct socket *so, int proto, struct thread *td)
 {
 	static uint32_t udp_flowid;
 	struct inpcbinfo *pcbinfo;
 	struct inpcb *inp;
 	struct udpcb *up;
 	int error;
 
 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 	inp = sotoinpcb(so);
 	KASSERT(inp == NULL, ("udp_attach: inp != NULL"));
 	error = soreserve(so, udp_sendspace, udp_recvspace);
 	if (error)
 		return (error);
 	error = in_pcballoc(so, pcbinfo);
 	if (error)
 		return (error);
 
 	inp = sotoinpcb(so);
 	inp->inp_ip_ttl = V_ip_defttl;
 	inp->inp_flowid = atomic_fetchadd_int(&udp_flowid, 1);
 	inp->inp_flowtype = M_HASHTYPE_OPAQUE;
 	up = intoudpcb(inp);
 	bzero(&up->u_start_zero, u_zero_size);
 	INP_WUNLOCK(inp);
 
 	return (0);
 }
 #endif /* INET */
 
 int
 udp_set_kernel_tunneling(struct socket *so, udp_tun_func_t f, udp_tun_icmp_t i, void *ctx)
 {
 	struct inpcb *inp;
 	struct udpcb *up;
 
 	KASSERT(so->so_type == SOCK_DGRAM,
 	    ("udp_set_kernel_tunneling: !dgram"));
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp_set_kernel_tunneling: inp == NULL"));
 	INP_WLOCK(inp);
 	up = intoudpcb(inp);
 	if ((f != NULL || i != NULL) && ((up->u_tun_func != NULL) ||
 	    (up->u_icmp_func != NULL))) {
 		INP_WUNLOCK(inp);
 		return (EBUSY);
 	}
 	up->u_tun_func = f;
 	up->u_icmp_func = i;
 	up->u_tun_ctx = ctx;
 	INP_WUNLOCK(inp);
 	return (0);
 }
 
 #ifdef INET
 static int
 udp_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
 {
 	struct inpcb *inp;
 	struct inpcbinfo *pcbinfo;
 	struct sockaddr_in *sinp;
 	int error;
 
 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp_bind: inp == NULL"));
 
 	sinp = (struct sockaddr_in *)nam;
 	if (nam->sa_family != AF_INET) {
 		/*
 		 * Preserve compatibility with old programs.
 		 */
 		if (nam->sa_family != AF_UNSPEC ||
 		    nam->sa_len < offsetof(struct sockaddr_in, sin_zero) ||
 		    sinp->sin_addr.s_addr != INADDR_ANY)
 			return (EAFNOSUPPORT);
 		nam->sa_family = AF_INET;
 	}
 	if (nam->sa_len != sizeof(struct sockaddr_in))
 		return (EINVAL);
 
 	INP_WLOCK(inp);
 	INP_HASH_WLOCK(pcbinfo);
 	error = in_pcbbind(inp, sinp, td->td_ucred);
 	INP_HASH_WUNLOCK(pcbinfo);
 	INP_WUNLOCK(inp);
 	return (error);
 }
 
 static void
 udp_close(struct socket *so)
 {
 	struct inpcb *inp;
 	struct inpcbinfo *pcbinfo;
 
 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp_close: inp == NULL"));
 	INP_WLOCK(inp);
 	if (inp->inp_faddr.s_addr != INADDR_ANY) {
 		INP_HASH_WLOCK(pcbinfo);
 		in_pcbdisconnect(inp);
 		INP_HASH_WUNLOCK(pcbinfo);
 		soisdisconnected(so);
 	}
 	INP_WUNLOCK(inp);
 }
 
 static int
 udp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
 {
 	struct epoch_tracker et;
 	struct inpcb *inp;
 	struct inpcbinfo *pcbinfo;
 	struct sockaddr_in *sin;
 	int error;
 
 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp_connect: inp == NULL"));
 
 	sin = (struct sockaddr_in *)nam;
 	if (sin->sin_family != AF_INET)
 		return (EAFNOSUPPORT);
 	if (sin->sin_len != sizeof(*sin))
 		return (EINVAL);
 
 	INP_WLOCK(inp);
 	if (inp->inp_faddr.s_addr != INADDR_ANY) {
 		INP_WUNLOCK(inp);
 		return (EISCONN);
 	}
 	error = prison_remote_ip4(td->td_ucred, &sin->sin_addr);
 	if (error != 0) {
 		INP_WUNLOCK(inp);
 		return (error);
 	}
 	NET_EPOCH_ENTER(et);
 	INP_HASH_WLOCK(pcbinfo);
 	error = in_pcbconnect(inp, sin, td->td_ucred, true);
 	INP_HASH_WUNLOCK(pcbinfo);
 	NET_EPOCH_EXIT(et);
 	if (error == 0)
 		soisconnected(so);
 	INP_WUNLOCK(inp);
 	return (error);
 }
 
 static void
 udp_detach(struct socket *so)
 {
 	struct inpcb *inp;
 
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp_detach: inp == NULL"));
 	KASSERT(inp->inp_faddr.s_addr == INADDR_ANY,
 	    ("udp_detach: not disconnected"));
 	INP_WLOCK(inp);
 	in_pcbfree(inp);
 }
 
 int
 udp_disconnect(struct socket *so)
 {
 	struct inpcb *inp;
 	struct inpcbinfo *pcbinfo;
 
 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp_disconnect: inp == NULL"));
 	INP_WLOCK(inp);
 	if (inp->inp_faddr.s_addr == INADDR_ANY) {
 		INP_WUNLOCK(inp);
 		return (ENOTCONN);
 	}
 	INP_HASH_WLOCK(pcbinfo);
 	in_pcbdisconnect(inp);
 	INP_HASH_WUNLOCK(pcbinfo);
 	SOCK_LOCK(so);
 	so->so_state &= ~SS_ISCONNECTED;		/* XXX */
 	SOCK_UNLOCK(so);
 	INP_WUNLOCK(inp);
 	return (0);
 }
 #endif /* INET */
 
 int
 udp_shutdown(struct socket *so, enum shutdown_how how)
 {
 	int error;
 
 	SOCK_LOCK(so);
 	if (!(so->so_state & SS_ISCONNECTED))
 		/*
 		 * POSIX mandates us to just return ENOTCONN when shutdown(2) is
 		 * invoked on a datagram sockets, however historically we would
 		 * actually tear socket down.  This is known to be leveraged by
 		 * some applications to unblock process waiting in recv(2) by
 		 * other process that it shares that socket with.  Try to meet
 		 * both backward-compatibility and POSIX requirements by forcing
 		 * ENOTCONN but still flushing buffers and performing wakeup(9).
 		 *
 		 * XXXGL: it remains unknown what applications expect this
 		 * behavior and is this isolated to unix/dgram or inet/dgram or
 		 * both.  See: D10351, D3039.
 		 */
 		error = ENOTCONN;
 	else
 		error = 0;
 	SOCK_UNLOCK(so);
 
 	switch (how) {
 	case SHUT_RD:
 		socantrcvmore(so);
 		sbrelease(so, SO_RCV);
 		break;
 	case SHUT_RDWR:
 		socantrcvmore(so);
 		sbrelease(so, SO_RCV);
 		/* FALLTHROUGH */
 	case SHUT_WR:
 		socantsendmore(so);
 	}
 
 	return (error);
 }
 
 #ifdef INET
 #define	UDP_PROTOSW							\
 	.pr_type =		SOCK_DGRAM,				\
 	.pr_flags =		PR_ATOMIC | PR_ADDR | PR_CAPATTACH,	\
 	.pr_ctloutput =		udp_ctloutput,				\
 	.pr_abort =		udp_abort,				\
 	.pr_attach =		udp_attach,				\
 	.pr_bind =		udp_bind,				\
 	.pr_connect =		udp_connect,				\
 	.pr_control =		in_control,				\
 	.pr_detach =		udp_detach,				\
 	.pr_disconnect =	udp_disconnect,				\
 	.pr_peeraddr =		in_getpeeraddr,				\
 	.pr_send =		udp_send,				\
 	.pr_soreceive =		soreceive_dgram,			\
 	.pr_sosend =		sosend_dgram,				\
 	.pr_shutdown =		udp_shutdown,				\
 	.pr_sockaddr =		in_getsockaddr,				\
 	.pr_sosetlabel =	in_pcbsosetlabel,			\
 	.pr_close =		udp_close
 
 struct protosw udp_protosw = {
 	.pr_protocol =		IPPROTO_UDP,
 	UDP_PROTOSW
 };
 
 struct protosw udplite_protosw = {
 	.pr_protocol =		IPPROTO_UDPLITE,
 	UDP_PROTOSW
 };
 
 static void
 udp_init(void *arg __unused)
 {
 
 	IPPROTO_REGISTER(IPPROTO_UDP, udp_input, udp_ctlinput);
 	IPPROTO_REGISTER(IPPROTO_UDPLITE, udp_input, udplite_ctlinput);
 }
 SYSINIT(udp_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD, udp_init, NULL);
 #endif /* INET */
diff --git a/sys/netinet6/udp6_usrreq.c b/sys/netinet6/udp6_usrreq.c
index bbd7ba9477d6..414be35b5bef 100644
--- a/sys/netinet6/udp6_usrreq.c
+++ b/sys/netinet6/udp6_usrreq.c
@@ -1,1278 +1,1288 @@
 /*-
  * SPDX-License-Identifier: BSD-3-Clause
  *
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * Copyright (c) 2010-2011 Juniper Networks, Inc.
  * Copyright (c) 2014 Kevin Lo
  * All rights reserved.
  *
  * Portions of this software were developed by Robert N. M. Watson under
  * contract to Juniper Networks, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
  *	$KAME: udp6_usrreq.c,v 1.27 2001/05/21 05:45:10 jinmei Exp $
  *	$KAME: udp6_output.c,v 1.31 2001/05/21 16:39:15 jinmei Exp $
  */
 
 /*-
  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
  *	The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 
 #include <sys/cdefs.h>
 #include "opt_inet.h"
 #include "opt_inet6.h"
 #include "opt_ipsec.h"
 #include "opt_route.h"
 #include "opt_rss.h"
 
 #include <sys/param.h>
+#include <sys/domain.h>
 #include <sys/jail.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
 #include <sys/mbuf.h>
 #include <sys/priv.h>
 #include <sys/proc.h>
 #include <sys/protosw.h>
 #include <sys/sdt.h>
 #include <sys/signalvar.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
 #include <sys/sx.h>
 #include <sys/sysctl.h>
 #include <sys/syslog.h>
 #include <sys/systm.h>
 
 #include <net/if.h>
 #include <net/if_var.h>
 #include <net/if_types.h>
 #include <net/route.h>
 #include <net/rss_config.h>
 
 #include <netinet/in.h>
 #include <netinet/in_kdtrace.h>
 #include <netinet/in_pcb.h>
 #include <netinet/in_systm.h>
 #include <netinet/in_var.h>
 #include <netinet/ip.h>
 #include <netinet/ip6.h>
 #include <netinet/icmp6.h>
 #include <netinet/ip_var.h>
 #include <netinet/udp.h>
 #include <netinet/udp_var.h>
 #include <netinet/udplite.h>
 
 #include <netinet6/ip6_var.h>
 #include <netinet6/in6_fib.h>
 #include <netinet6/in6_pcb.h>
 #include <netinet6/in6_rss.h>
 #include <netinet6/udp6_var.h>
 #include <netinet6/scope6_var.h>
 
 #include <netipsec/ipsec_support.h>
 
 #include <security/mac/mac_framework.h>
 
 VNET_DEFINE(int, zero_checksum_port) = 0;
 #define	V_zero_checksum_port	VNET(zero_checksum_port)
 SYSCTL_INT(_net_inet6_udp6, OID_AUTO, rfc6935_port, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(zero_checksum_port), 0,
     "Zero UDP checksum allowed for traffic to/from this port.");
 
 /*
  * UDP protocol implementation.
  * Per RFC 768, August, 1980.
  */
 
 static void		udp6_detach(struct socket *so);
 
 static int
 udp6_append(struct inpcb *inp, struct mbuf *n, int off,
     struct sockaddr_in6 *fromsa)
 {
 	struct socket *so;
 	struct mbuf *opts = NULL, *tmp_opts;
 	struct udpcb *up;
 	bool filtered;
 
 	INP_LOCK_ASSERT(inp);
 
 	/*
 	 * Engage the tunneling protocol.
 	 */
 	up = intoudpcb(inp);
 	if (up->u_tun_func != NULL) {
 		in_pcbref(inp);
 		INP_RUNLOCK(inp);
 		filtered = (*up->u_tun_func)(n, off, inp,
 		    (struct sockaddr *)&fromsa[0], up->u_tun_ctx);
 		INP_RLOCK(inp);
 		if (filtered)
 			return (in_pcbrele_rlocked(inp));
 	}
+
+	off += sizeof(struct udphdr);
+
 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
 	/* Check AH/ESP integrity. */
 	if (IPSEC_ENABLED(ipv6)) {
 		if (IPSEC_CHECK_POLICY(ipv6, n, inp) != 0) {
 			m_freem(n);
 			return (0);
 		}
+
+		/* IPSec UDP encaps. */
+		if ((up->u_flags & UF_ESPINUDP) != 0 &&
+		    UDPENCAP_INPUT(ipv6, n, off, AF_INET6) != 0) {
+			return (0); /* Consumed. */
+		}
 	}
 #endif /* IPSEC */
 #ifdef MAC
 	if (mac_inpcb_check_deliver(inp, n) != 0) {
 		m_freem(n);
 		return (0);
 	}
 #endif
 	opts = NULL;
 	if (inp->inp_flags & INP_CONTROLOPTS ||
 	    inp->inp_socket->so_options & SO_TIMESTAMP)
 		ip6_savecontrol(inp, n, &opts);
 	if ((inp->inp_vflag & INP_IPV6) && (inp->inp_flags2 & INP_ORIGDSTADDR)) {
 		tmp_opts = sbcreatecontrol(&fromsa[1],
 		    sizeof(struct sockaddr_in6), IPV6_ORIGDSTADDR,
 		    IPPROTO_IPV6, M_NOWAIT);
                 if (tmp_opts) {
                         if (opts) {
                                 tmp_opts->m_next = opts;
                                 opts = tmp_opts;
                         } else
                                 opts = tmp_opts;
                 }
 	}
-	m_adj(n, off + sizeof(struct udphdr));
+	m_adj(n, off);
 
 	so = inp->inp_socket;
 	SOCKBUF_LOCK(&so->so_rcv);
 	if (sbappendaddr_locked(&so->so_rcv, (struct sockaddr *)&fromsa[0], n,
 	    opts) == 0) {
 		soroverflow_locked(so);
 		m_freem(n);
 		if (opts)
 			m_freem(opts);
 		UDPSTAT_INC(udps_fullsock);
 	} else
 		sorwakeup_locked(so);
 	return (0);
 }
 
 struct udp6_multi_match_ctx {
 	struct ip6_hdr *ip6;
 	struct udphdr *uh;
 };
 
 static bool
 udp6_multi_match(const struct inpcb *inp, void *v)
 {
 	struct udp6_multi_match_ctx *ctx = v;
 
 	if ((inp->inp_vflag & INP_IPV6) == 0)
 		return(false);
 	if (inp->inp_lport != ctx->uh->uh_dport)
 		return(false);
 	if (inp->inp_fport != 0 && inp->inp_fport != ctx->uh->uh_sport)
 		return(false);
 	if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) &&
 	    !IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, &ctx->ip6->ip6_dst))
 		return (false);
 	if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
 	    (!IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, &ctx->ip6->ip6_src) ||
 	    inp->inp_fport != ctx->uh->uh_sport))
 		return (false);
 
 	return (true);
 }
 
 static int
 udp6_multi_input(struct mbuf *m, int off, int proto,
     struct sockaddr_in6 *fromsa)
 {
 	struct udp6_multi_match_ctx ctx;
 	struct inpcb_iterator inpi = INP_ITERATOR(udp_get_inpcbinfo(proto),
 	    INPLOOKUP_RLOCKPCB, udp6_multi_match, &ctx);
 	struct inpcb *inp;
 	struct ip6_moptions *imo;
 	struct mbuf *n;
 	int appends = 0;
 
 	/*
 	 * In the event that laddr should be set to the link-local
 	 * address (this happens in RIPng), the multicast address
 	 * specified in the received packet will not match laddr.  To
 	 * handle this situation, matching is relaxed if the
 	 * receiving interface is the same as one specified in the
 	 * socket and if the destination multicast address matches
 	 * one of the multicast groups specified in the socket.
 	 */
 
 	/*
 	 * KAME note: traditionally we dropped udpiphdr from mbuf
 	 * here.  We need udphdr for IPsec processing so we do that
 	 * later.
 	 */
 	ctx.ip6 = mtod(m, struct ip6_hdr *);
 	ctx.uh = (struct udphdr *)((char *)ctx.ip6 + off);
 	while ((inp = inp_next(&inpi)) != NULL) {
 		INP_RLOCK_ASSERT(inp);
 		/*
 		 * XXXRW: Because we weren't holding either the inpcb
 		 * or the hash lock when we checked for a match
 		 * before, we should probably recheck now that the
 		 * inpcb lock is (supposed to be) held.
 		 */
 		/*
 		 * Handle socket delivery policy for any-source
 		 * and source-specific multicast. [RFC3678]
 		 */
 		if ((imo = inp->in6p_moptions) != NULL) {
 			struct sockaddr_in6	 mcaddr;
 			int			 blocked;
 
 			bzero(&mcaddr, sizeof(struct sockaddr_in6));
 			mcaddr.sin6_len = sizeof(struct sockaddr_in6);
 			mcaddr.sin6_family = AF_INET6;
 			mcaddr.sin6_addr = ctx.ip6->ip6_dst;
 
 			blocked = im6o_mc_filter(imo, m->m_pkthdr.rcvif,
 				(struct sockaddr *)&mcaddr,
 				(struct sockaddr *)&fromsa[0]);
 			if (blocked != MCAST_PASS) {
 				if (blocked == MCAST_NOTGMEMBER)
 					IP6STAT_INC(ip6s_notmember);
 				if (blocked == MCAST_NOTSMEMBER ||
 				    blocked == MCAST_MUTED)
 					UDPSTAT_INC(udps_filtermcast);
 				continue;
 			}
 		}
 		if ((n = m_copym(m, 0, M_COPYALL, M_NOWAIT)) != NULL) {
 			if (proto == IPPROTO_UDPLITE)
 				UDPLITE_PROBE(receive, NULL, inp, ctx.ip6,
 				    inp, ctx.uh);
 			else
 				UDP_PROBE(receive, NULL, inp, ctx.ip6, inp,
 				    ctx.uh);
 			if (udp6_append(inp, n, off, fromsa)) {
 				break;
 			} else
 				appends++;
 		}
 		/*
 		 * Don't look for additional matches if this one does
 		 * not have either the SO_REUSEPORT or SO_REUSEADDR
 		 * socket options set.  This heuristic avoids
 		 * searching through all pcbs in the common case of a
 		 * non-shared port.  It assumes that an application
 		 * will never clear these options after setting them.
 		 */
 		if ((inp->inp_socket->so_options &
 		     (SO_REUSEPORT|SO_REUSEPORT_LB|SO_REUSEADDR)) == 0) {
 			INP_RUNLOCK(inp);
 			break;
 		}
 	}
 	m_freem(m);
 
 	if (appends == 0) {
 		/*
 		 * No matching pcb found; discard datagram.  (No need
 		 * to send an ICMP Port Unreachable for a broadcast
 		 * or multicast datgram.)
 		 */
 		UDPSTAT_INC(udps_noport);
 		UDPSTAT_INC(udps_noportmcast);
 	}
 
 	return (IPPROTO_DONE);
 }
 
 int
 udp6_input(struct mbuf **mp, int *offp, int proto)
 {
 	struct mbuf *m = *mp;
 	struct ip6_hdr *ip6;
 	struct udphdr *uh;
 	struct inpcb *inp;
 	struct inpcbinfo *pcbinfo;
 	struct udpcb *up;
 	int off = *offp;
 	int cscov_partial;
 	int plen, ulen;
 	struct sockaddr_in6 fromsa[2];
 	struct m_tag *fwd_tag;
 	uint16_t uh_sum;
 	uint8_t nxt;
 
 	NET_EPOCH_ASSERT();
 
 	if (m->m_len < off + sizeof(struct udphdr)) {
 		m = m_pullup(m, off + sizeof(struct udphdr));
 		if (m == NULL) {
 			IP6STAT_INC(ip6s_exthdrtoolong);
 			*mp = NULL;
 			return (IPPROTO_DONE);
 		}
 	}
 	ip6 = mtod(m, struct ip6_hdr *);
 	uh = (struct udphdr *)((caddr_t)ip6 + off);
 
 	UDPSTAT_INC(udps_ipackets);
 
 	/*
 	 * Destination port of 0 is illegal, based on RFC768.
 	 */
 	if (uh->uh_dport == 0)
 		goto badunlocked;
 
 	plen = ntohs(ip6->ip6_plen) - off + sizeof(*ip6);
 	ulen = ntohs((u_short)uh->uh_ulen);
 
 	nxt = proto;
 	cscov_partial = (nxt == IPPROTO_UDPLITE) ? 1 : 0;
 	if (nxt == IPPROTO_UDPLITE) {
 		/* Zero means checksum over the complete packet. */
 		if (ulen == 0)
 			ulen = plen;
 		if (ulen == plen)
 			cscov_partial = 0;
 		if ((ulen < sizeof(struct udphdr)) || (ulen > plen)) {
 			/* XXX: What is the right UDPLite MIB counter? */
 			goto badunlocked;
 		}
 		if (uh->uh_sum == 0) {
 			/* XXX: What is the right UDPLite MIB counter? */
 			goto badunlocked;
 		}
 	} else {
 		if ((ulen < sizeof(struct udphdr)) || (plen != ulen)) {
 			UDPSTAT_INC(udps_badlen);
 			goto badunlocked;
 		}
 		if (uh->uh_sum == 0) {
 			UDPSTAT_INC(udps_nosum);
 			/*
 			 * dport 0 was rejected earlier so this is OK even if
 			 * zero_checksum_port is 0 (which is its default value).
 			 */
 			if (ntohs(uh->uh_dport) == V_zero_checksum_port)
 				goto skip_checksum;
 			else
 				goto badunlocked;
 		}
 	}
 
 	if ((m->m_pkthdr.csum_flags & CSUM_DATA_VALID_IPV6) &&
 	    !cscov_partial) {
 		if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
 			uh_sum = m->m_pkthdr.csum_data;
 		else
 			uh_sum = in6_cksum_pseudo(ip6, ulen, nxt,
 			    m->m_pkthdr.csum_data);
 		uh_sum ^= 0xffff;
 	} else
 		uh_sum = in6_cksum_partial(m, nxt, off, plen, ulen);
 
 	if (uh_sum != 0) {
 		UDPSTAT_INC(udps_badsum);
 		goto badunlocked;
 	}
 
 skip_checksum:
 	/*
 	 * Construct sockaddr format source address.
 	 */
 	init_sin6(&fromsa[0], m, 0);
 	fromsa[0].sin6_port = uh->uh_sport;
 	init_sin6(&fromsa[1], m, 1);
 	fromsa[1].sin6_port = uh->uh_dport;
 
 	pcbinfo = udp_get_inpcbinfo(nxt);
 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))  {
 		*mp = NULL;
 		return (udp6_multi_input(m, off, proto, fromsa));
 	}
 
 	/*
 	 * Locate pcb for datagram.
 	 */
 
 	/*
 	 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
 	 */
 	if ((m->m_flags & M_IP6_NEXTHOP) &&
 	    (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
 		struct sockaddr_in6 *next_hop6;
 
 		next_hop6 = (struct sockaddr_in6 *)(fwd_tag + 1);
 
 		/*
 		 * Transparently forwarded. Pretend to be the destination.
 		 * Already got one like this?
 		 */
 		inp = in6_pcblookup_mbuf(pcbinfo, &ip6->ip6_src,
 		    uh->uh_sport, &ip6->ip6_dst, uh->uh_dport,
 		    INPLOOKUP_RLOCKPCB, m->m_pkthdr.rcvif, m);
 		if (!inp) {
 			/*
 			 * It's new.  Try to find the ambushing socket.
 			 * Because we've rewritten the destination address,
 			 * any hardware-generated hash is ignored.
 			 */
 			inp = in6_pcblookup(pcbinfo, &ip6->ip6_src,
 			    uh->uh_sport, &next_hop6->sin6_addr,
 			    next_hop6->sin6_port ? htons(next_hop6->sin6_port) :
 			    uh->uh_dport, INPLOOKUP_WILDCARD |
 			    INPLOOKUP_RLOCKPCB, m->m_pkthdr.rcvif);
 		}
 		/* Remove the tag from the packet. We don't need it anymore. */
 		m_tag_delete(m, fwd_tag);
 		m->m_flags &= ~M_IP6_NEXTHOP;
 	} else
 		inp = in6_pcblookup_mbuf(pcbinfo, &ip6->ip6_src,
 		    uh->uh_sport, &ip6->ip6_dst, uh->uh_dport,
 		    INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB,
 		    m->m_pkthdr.rcvif, m);
 	if (inp == NULL) {
 		if (V_udp_log_in_vain) {
 			char ip6bufs[INET6_ADDRSTRLEN];
 			char ip6bufd[INET6_ADDRSTRLEN];
 
 			log(LOG_INFO,
 			    "Connection attempt to UDP [%s]:%d from [%s]:%d\n",
 			    ip6_sprintf(ip6bufd, &ip6->ip6_dst),
 			    ntohs(uh->uh_dport),
 			    ip6_sprintf(ip6bufs, &ip6->ip6_src),
 			    ntohs(uh->uh_sport));
 		}
 		if (nxt == IPPROTO_UDPLITE)
 			UDPLITE_PROBE(receive, NULL, NULL, ip6, NULL, uh);
 		else
 			UDP_PROBE(receive, NULL, NULL, ip6, NULL, uh);
 		UDPSTAT_INC(udps_noport);
 		if (m->m_flags & M_MCAST) {
 			printf("UDP6: M_MCAST is set in a unicast packet.\n");
 			UDPSTAT_INC(udps_noportmcast);
 			goto badunlocked;
 		}
 		if (V_udp_blackhole && (V_udp_blackhole_local ||
 		    !in6_localaddr(&ip6->ip6_src)))
 			goto badunlocked;
 		icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT, 0);
 		*mp = NULL;
 		return (IPPROTO_DONE);
 	}
 	INP_RLOCK_ASSERT(inp);
 	up = intoudpcb(inp);
 	if (cscov_partial) {
 		if (up->u_rxcslen == 0 || up->u_rxcslen > ulen) {
 			INP_RUNLOCK(inp);
 			m_freem(m);
 			*mp = NULL;
 			return (IPPROTO_DONE);
 		}
 	}
 	if (nxt == IPPROTO_UDPLITE)
 		UDPLITE_PROBE(receive, NULL, inp, ip6, inp, uh);
 	else
 		UDP_PROBE(receive, NULL, inp, ip6, inp, uh);
 	if (udp6_append(inp, m, off, fromsa) == 0)
 		INP_RUNLOCK(inp);
 	*mp = NULL;
 	return (IPPROTO_DONE);
 
 badunlocked:
 	m_freem(m);
 	*mp = NULL;
 	return (IPPROTO_DONE);
 }
 
 static void
 udp6_common_ctlinput(struct ip6ctlparam *ip6cp, struct inpcbinfo *pcbinfo)
 {
 	struct udphdr uh;
 	struct ip6_hdr *ip6;
 	struct mbuf *m;
 	struct inpcb *inp;
 	int errno, off = 0;
 	struct udp_portonly {
 		u_int16_t uh_sport;
 		u_int16_t uh_dport;
 	} *uhp;
 
 	if ((errno = icmp6_errmap(ip6cp->ip6c_icmp6)) == 0)
 		return;
 
 	m = ip6cp->ip6c_m;
 	ip6 = ip6cp->ip6c_ip6;
 	off = ip6cp->ip6c_off;
 
 	/* Check if we can safely examine src and dst ports. */
 	if (m->m_pkthdr.len < off + sizeof(*uhp))
 		return;
 
 	bzero(&uh, sizeof(uh));
 	m_copydata(m, off, sizeof(*uhp), (caddr_t)&uh);
 
 	/* Check to see if its tunneled */
 	inp = in6_pcblookup_mbuf(pcbinfo, &ip6->ip6_dst, uh.uh_dport,
 	    &ip6->ip6_src, uh.uh_sport, INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB,
 	    m->m_pkthdr.rcvif, m);
 	if (inp != NULL) {
 		struct udpcb *up;
 		udp_tun_icmp_t *func;
 
 		up = intoudpcb(inp);
 		func = up->u_icmp_func;
 		INP_RUNLOCK(inp);
 		if (func != NULL)
 			func(ip6cp);
 	}
 	in6_pcbnotify(pcbinfo, ip6cp->ip6c_finaldst, uh.uh_dport,
 	    ip6cp->ip6c_src, uh.uh_sport, errno, ip6cp->ip6c_cmdarg,
 	    udp_notify);
 }
 
 static void
 udp6_ctlinput(struct ip6ctlparam *ctl)
 {
 
 	return (udp6_common_ctlinput(ctl, &V_udbinfo));
 }
 
 static void
 udplite6_ctlinput(struct ip6ctlparam *ctl)
 {
 
 	return (udp6_common_ctlinput(ctl, &V_ulitecbinfo));
 }
 
 static int
 udp6_getcred(SYSCTL_HANDLER_ARGS)
 {
 	struct xucred xuc;
 	struct sockaddr_in6 addrs[2];
 	struct epoch_tracker et;
 	struct inpcb *inp;
 	int error;
 
 	error = priv_check(req->td, PRIV_NETINET_GETCRED);
 	if (error)
 		return (error);
 
 	if (req->newlen != sizeof(addrs))
 		return (EINVAL);
 	if (req->oldlen != sizeof(struct xucred))
 		return (EINVAL);
 	error = SYSCTL_IN(req, addrs, sizeof(addrs));
 	if (error)
 		return (error);
 	if ((error = sa6_embedscope(&addrs[0], V_ip6_use_defzone)) != 0 ||
 	    (error = sa6_embedscope(&addrs[1], V_ip6_use_defzone)) != 0) {
 		return (error);
 	}
 	NET_EPOCH_ENTER(et);
 	inp = in6_pcblookup(&V_udbinfo, &addrs[1].sin6_addr,
 	    addrs[1].sin6_port, &addrs[0].sin6_addr, addrs[0].sin6_port,
 	    INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB, NULL);
 	NET_EPOCH_EXIT(et);
 	if (inp != NULL) {
 		INP_RLOCK_ASSERT(inp);
 		if (inp->inp_socket == NULL)
 			error = ENOENT;
 		if (error == 0)
 			error = cr_canseesocket(req->td->td_ucred,
 			    inp->inp_socket);
 		if (error == 0)
 			cru2x(inp->inp_cred, &xuc);
 		INP_RUNLOCK(inp);
 	} else
 		error = ENOENT;
 	if (error == 0)
 		error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
 	return (error);
 }
 
 SYSCTL_PROC(_net_inet6_udp6, OID_AUTO, getcred,
     CTLTYPE_OPAQUE | CTLFLAG_RW | CTLFLAG_MPSAFE,
     0, 0, udp6_getcred, "S,xucred",
     "Get the xucred of a UDP6 connection");
 
 static int
 udp6_send(struct socket *so, int flags_arg, struct mbuf *m,
     struct sockaddr *addr6, struct mbuf *control, struct thread *td)
 {
 	struct inpcb *inp;
 	struct ip6_hdr *ip6;
 	struct udphdr *udp6;
 	struct in6_addr *laddr, *faddr, in6a;
 	struct ip6_pktopts *optp, opt;
 	struct sockaddr_in6 *sin6, tmp;
 	struct epoch_tracker et;
 	int cscov_partial, error, flags, hlen, scope_ambiguous;
 	u_int32_t ulen, plen;
 	uint16_t cscov;
 	u_short fport;
 	uint8_t nxt;
 
 	if (addr6) {
 		error = 0;
 		if (addr6->sa_family != AF_INET6)
 			error = EAFNOSUPPORT;
 		else if (addr6->sa_len != sizeof(struct sockaddr_in6))
 			error = EINVAL;
 		if (__predict_false(error != 0)) {
 			m_freem(control);
 			m_freem(m);
 			return (error);
 		}
 	}
 
 	sin6 = (struct sockaddr_in6 *)addr6;
 
 	/*
 	 * In contrast to IPv4 we do not validate the max. packet length
 	 * here due to IPv6 Jumbograms (RFC2675).
 	 */
 
 	scope_ambiguous = 0;
 	if (sin6) {
 		/* Protect *addr6 from overwrites. */
 		tmp = *sin6;
 		sin6 = &tmp;
 
 		/*
 		 * Application should provide a proper zone ID or the use of
 		 * default zone IDs should be enabled.  Unfortunately, some
 		 * applications do not behave as it should, so we need a
 		 * workaround.  Even if an appropriate ID is not determined,
 		 * we'll see if we can determine the outgoing interface.  If we
 		 * can, determine the zone ID based on the interface below.
 		 */
 		if (sin6->sin6_scope_id == 0 && !V_ip6_use_defzone)
 			scope_ambiguous = 1;
 		if ((error = sa6_embedscope(sin6, V_ip6_use_defzone)) != 0) {
 			if (control)
 				m_freem(control);
 			m_freem(m);
 			return (error);
 		}
 	}
 
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
 	/*
 	 * In the following cases we want a write lock on the inp for either
 	 * local operations or for possible route cache updates in the IPv6
 	 * output path:
 	 * - on connected sockets (sin6 is NULL) for route cache updates,
 	 * - when we are not bound to an address and source port (it is
 	 *   in6_pcbsetport() which will require the write lock).
 	 *
 	 * We check the inp fields before actually locking the inp, so
 	 * here exists a race, and we may WLOCK the inp and end with already
 	 * bound one by other thread. This is fine.
 	 */
 	if (sin6 == NULL || (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) &&
 	    inp->inp_lport == 0))
 		INP_WLOCK(inp);
 	else
 		INP_RLOCK(inp);
 
 	nxt = (inp->inp_socket->so_proto->pr_protocol == IPPROTO_UDP) ?
 	    IPPROTO_UDP : IPPROTO_UDPLITE;
 
 #ifdef INET
 	if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
 		int hasv4addr;
 
 		if (sin6 == NULL)
 			hasv4addr = (inp->inp_vflag & INP_IPV4);
 		else
 			hasv4addr = IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)
 			    ? 1 : 0;
 		if (hasv4addr) {
 			/*
 			 * XXXRW: We release UDP-layer locks before calling
 			 * udp_send() in order to avoid recursion.  However,
 			 * this does mean there is a short window where inp's
 			 * fields are unstable.  Could this lead to a
 			 * potential race in which the factors causing us to
 			 * select the UDPv4 output routine are invalidated?
 			 */
 			INP_UNLOCK(inp);
 			if (sin6)
 				in6_sin6_2_sin_in_sock((struct sockaddr *)sin6);
 			/* addr will just be freed in sendit(). */
 			return (udp_send(so, flags_arg | PRUS_IPV6, m,
 			    (struct sockaddr *)sin6, control, td));
 		}
 	} else
 #endif
 	if (sin6 && IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
 		/*
 		 * Given this is either an IPv6-only socket or no INET is
 		 * supported we will fail the send if the given destination
 		 * address is a v4mapped address.
 		 */
 		INP_UNLOCK(inp);
 		m_freem(m);
 		m_freem(control);
 		return (EINVAL);
 	}
 
 	NET_EPOCH_ENTER(et);
 	if (control) {
 		if ((error = ip6_setpktopts(control, &opt,
 		    inp->in6p_outputopts, td->td_ucred, nxt)) != 0) {
 			goto release;
 		}
 		optp = &opt;
 	} else
 		optp = inp->in6p_outputopts;
 
 	if (sin6) {
 		/*
 		 * Since we saw no essential reason for calling in_pcbconnect,
 		 * we get rid of such kind of logic, and call in6_selectsrc
 		 * and in6_pcbsetport in order to fill in the local address
 		 * and the local port.
 		 */
 		if (sin6->sin6_port == 0) {
 			error = EADDRNOTAVAIL;
 			goto release;
 		}
 
 		if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
 			/* how about ::ffff:0.0.0.0 case? */
 			error = EISCONN;
 			goto release;
 		}
 
 		/*
 		 * Given we handle the v4mapped case in the INET block above
 		 * assert here that it must not happen anymore.
 		 */
 		KASSERT(!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr),
 		    ("%s: sin6(%p)->sin6_addr is v4mapped which we "
 		    "should have handled.", __func__, sin6));
 
 		/* This only requires read-locking. */
 		error = in6_selectsrc_socket(sin6, optp, inp,
 		    td->td_ucred, scope_ambiguous, &in6a, NULL);
 		if (error)
 			goto release;
 		laddr = &in6a;
 
 		if (inp->inp_lport == 0) {
 			struct inpcbinfo *pcbinfo;
 
 			INP_WLOCK_ASSERT(inp);
 
 			pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 			INP_HASH_WLOCK(pcbinfo);
 			error = in6_pcbsetport(laddr, inp, td->td_ucred);
 			INP_HASH_WUNLOCK(pcbinfo);
 			if (error != 0) {
 				/* Undo an address bind that may have occurred. */
 				inp->in6p_laddr = in6addr_any;
 				goto release;
 			}
 		}
 		faddr = &sin6->sin6_addr;
 		fport = sin6->sin6_port; /* allow 0 port */
 
 	} else {
 		if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
 			error = ENOTCONN;
 			goto release;
 		}
 		laddr = &inp->in6p_laddr;
 		faddr = &inp->in6p_faddr;
 		fport = inp->inp_fport;
 	}
 
 	ulen = m->m_pkthdr.len;
 	plen = sizeof(struct udphdr) + ulen;
 	hlen = sizeof(struct ip6_hdr);
 
 	/*
 	 * Calculate data length and get a mbuf
 	 * for UDP and IP6 headers.
 	 */
 	M_PREPEND(m, hlen + sizeof(struct udphdr), M_NOWAIT);
 	if (m == NULL) {
 		error = ENOBUFS;
 		goto release;
 	}
 
 	/*
 	 * Stuff checksum and output datagram.
 	 */
 	cscov = cscov_partial = 0;
 	udp6 = (struct udphdr *)(mtod(m, caddr_t) + hlen);
 	udp6->uh_sport = inp->inp_lport; /* lport is always set in the PCB */
 	udp6->uh_dport = fport;
 	if (nxt == IPPROTO_UDPLITE) {
 		struct udpcb *up;
 
 		up = intoudpcb(inp);
 		cscov = up->u_txcslen;
 		if (cscov >= plen)
 			cscov = 0;
 		udp6->uh_ulen = htons(cscov);
 		/*
 		 * For UDP-Lite, checksum coverage length of zero means
 		 * the entire UDPLite packet is covered by the checksum.
 		 */
 		cscov_partial = (cscov == 0) ? 0 : 1;
 	} else if (plen <= 0xffff)
 		udp6->uh_ulen = htons((u_short)plen);
 	else
 		udp6->uh_ulen = 0;
 	udp6->uh_sum = 0;
 
 	ip6 = mtod(m, struct ip6_hdr *);
 	ip6->ip6_flow	= inp->inp_flow & IPV6_FLOWINFO_MASK;
 	ip6->ip6_vfc	&= ~IPV6_VERSION_MASK;
 	ip6->ip6_vfc	|= IPV6_VERSION;
 	ip6->ip6_plen	= htons((u_short)plen);
 	ip6->ip6_nxt	= nxt;
 	ip6->ip6_hlim	= in6_selecthlim(inp, NULL);
 	ip6->ip6_src	= *laddr;
 	ip6->ip6_dst	= *faddr;
 
 #ifdef MAC
 	mac_inpcb_create_mbuf(inp, m);
 #endif
 
 	if (cscov_partial) {
 		if ((udp6->uh_sum = in6_cksum_partial(m, nxt,
 		    sizeof(struct ip6_hdr), plen, cscov)) == 0)
 			udp6->uh_sum = 0xffff;
 	} else {
 		udp6->uh_sum = in6_cksum_pseudo(ip6, plen, nxt, 0);
 		m->m_pkthdr.csum_flags = CSUM_UDP_IPV6;
 		m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
 	}
 
 	flags = 0;
 #if defined(ROUTE_MPATH) || defined(RSS)
 	if (CALC_FLOWID_OUTBOUND_SENDTO) {
 		uint32_t hash_type, hash_val;
 		uint8_t pr;
 
 		pr = inp->inp_socket->so_proto->pr_protocol;
 
 		hash_val = fib6_calc_packet_hash(laddr, faddr,
 		    inp->inp_lport, fport, pr, &hash_type);
 		m->m_pkthdr.flowid = hash_val;
 		M_HASHTYPE_SET(m, hash_type);
 	}
 	/* do not use inp flowid */
 	flags |= IP_NODEFAULTFLOWID;
 #endif
 
 	UDPSTAT_INC(udps_opackets);
 	if (nxt == IPPROTO_UDPLITE)
 		UDPLITE_PROBE(send, NULL, inp, ip6, inp, udp6);
 	else
 		UDP_PROBE(send, NULL, inp, ip6, inp, udp6);
 	error = ip6_output(m, optp,
 	    INP_WLOCKED(inp) ? &inp->inp_route6 : NULL, flags,
 	    inp->in6p_moptions, NULL, inp);
 	INP_UNLOCK(inp);
 	NET_EPOCH_EXIT(et);
 
 	if (control) {
 		ip6_clearpktopts(&opt, -1);
 		m_freem(control);
 	}
 	return (error);
 
 release:
 	INP_UNLOCK(inp);
 	NET_EPOCH_EXIT(et);
 	if (control) {
 		ip6_clearpktopts(&opt, -1);
 		m_freem(control);
 	}
 	m_freem(m);
 
 	return (error);
 }
 
 static void
 udp6_abort(struct socket *so)
 {
 	struct inpcb *inp;
 	struct inpcbinfo *pcbinfo;
 
 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp6_abort: inp == NULL"));
 
 	INP_WLOCK(inp);
 #ifdef INET
 	if (inp->inp_vflag & INP_IPV4) {
 		INP_WUNLOCK(inp);
 		udp_abort(so);
 		return;
 	}
 #endif
 
 	if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
 		INP_HASH_WLOCK(pcbinfo);
 		in6_pcbdisconnect(inp);
 		INP_HASH_WUNLOCK(pcbinfo);
 		soisdisconnected(so);
 	}
 	INP_WUNLOCK(inp);
 }
 
 static int
 udp6_attach(struct socket *so, int proto, struct thread *td)
 {
 	struct inpcbinfo *pcbinfo;
 	struct inpcb *inp;
 	struct udpcb *up;
 	int error;
 
 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 	inp = sotoinpcb(so);
 	KASSERT(inp == NULL, ("udp6_attach: inp != NULL"));
 
 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
 		error = soreserve(so, udp_sendspace, udp_recvspace);
 		if (error)
 			return (error);
 	}
 	error = in_pcballoc(so, pcbinfo);
 	if (error)
 		return (error);
 	inp = (struct inpcb *)so->so_pcb;
 	inp->in6p_cksum = -1;	/* just to be sure */
 	/*
 	 * XXX: ugly!!
 	 * IPv4 TTL initialization is necessary for an IPv6 socket as well,
 	 * because the socket may be bound to an IPv6 wildcard address,
 	 * which may match an IPv4-mapped IPv6 address.
 	 */
 	inp->inp_ip_ttl = V_ip_defttl;
 	up = intoudpcb(inp);
 	bzero(&up->u_start_zero, u_zero_size);
 	INP_WUNLOCK(inp);
 	return (0);
 }
 
 static int
 udp6_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
 {
 	struct sockaddr_in6 *sin6_p;
 	struct inpcb *inp;
 	struct inpcbinfo *pcbinfo;
 	int error;
 	u_char vflagsav;
 
 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp6_bind: inp == NULL"));
 
 	if (nam->sa_family != AF_INET6)
 		return (EAFNOSUPPORT);
 	if (nam->sa_len != sizeof(struct sockaddr_in6))
 		return (EINVAL);
 
 	sin6_p = (struct sockaddr_in6 *)nam;
 
 	INP_WLOCK(inp);
 	INP_HASH_WLOCK(pcbinfo);
 	vflagsav = inp->inp_vflag;
 	inp->inp_vflag &= ~INP_IPV4;
 	inp->inp_vflag |= INP_IPV6;
 	if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6_p->sin6_addr))
 			inp->inp_vflag |= INP_IPV4;
 #ifdef INET
 		else if (IN6_IS_ADDR_V4MAPPED(&sin6_p->sin6_addr)) {
 			struct sockaddr_in sin;
 
 			in6_sin6_2_sin(&sin, sin6_p);
 			inp->inp_vflag |= INP_IPV4;
 			inp->inp_vflag &= ~INP_IPV6;
 			error = in_pcbbind(inp, &sin, td->td_ucred);
 			goto out;
 		}
 #endif
 	}
 
 	error = in6_pcbbind(inp, sin6_p, td->td_ucred);
 #ifdef INET
 out:
 #endif
 	if (error != 0)
 		inp->inp_vflag = vflagsav;
 	INP_HASH_WUNLOCK(pcbinfo);
 	INP_WUNLOCK(inp);
 	return (error);
 }
 
 static void
 udp6_close(struct socket *so)
 {
 	struct inpcb *inp;
 	struct inpcbinfo *pcbinfo;
 
 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp6_close: inp == NULL"));
 
 	INP_WLOCK(inp);
 #ifdef INET
 	if (inp->inp_vflag & INP_IPV4) {
 		INP_WUNLOCK(inp);
 		(void)udp_disconnect(so);
 		return;
 	}
 #endif
 	if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
 		INP_HASH_WLOCK(pcbinfo);
 		in6_pcbdisconnect(inp);
 		INP_HASH_WUNLOCK(pcbinfo);
 		soisdisconnected(so);
 	}
 	INP_WUNLOCK(inp);
 }
 
 static int
 udp6_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
 {
 	struct epoch_tracker et;
 	struct inpcb *inp;
 	struct inpcbinfo *pcbinfo;
 	struct sockaddr_in6 *sin6;
 	int error;
 	u_char vflagsav;
 
 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp6_connect: inp == NULL"));
 
 	sin6 = (struct sockaddr_in6 *)nam;
 	if (sin6->sin6_family != AF_INET6)
 		return (EAFNOSUPPORT);
 	if (sin6->sin6_len != sizeof(*sin6))
 		return (EINVAL);
 
 	/*
 	 * XXXRW: Need to clarify locking of v4/v6 flags.
 	 */
 	INP_WLOCK(inp);
 #ifdef INET
 	if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
 		struct sockaddr_in sin;
 
 		if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
 			error = EINVAL;
 			goto out;
 		}
 		if ((inp->inp_vflag & INP_IPV4) == 0) {
 			error = EAFNOSUPPORT;
 			goto out;
 		}
 		if (inp->inp_faddr.s_addr != INADDR_ANY) {
 			error = EISCONN;
 			goto out;
 		}
 		in6_sin6_2_sin(&sin, sin6);
 		error = prison_remote_ip4(td->td_ucred, &sin.sin_addr);
 		if (error != 0)
 			goto out;
 		vflagsav = inp->inp_vflag;
 		inp->inp_vflag |= INP_IPV4;
 		inp->inp_vflag &= ~INP_IPV6;
 		NET_EPOCH_ENTER(et);
 		INP_HASH_WLOCK(pcbinfo);
 		error = in_pcbconnect(inp, &sin, td->td_ucred, true);
 		INP_HASH_WUNLOCK(pcbinfo);
 		NET_EPOCH_EXIT(et);
 		/*
 		 * If connect succeeds, mark socket as connected. If
 		 * connect fails and socket is unbound, reset inp_vflag
 		 * field.
 		 */
 		if (error == 0)
 			soisconnected(so);
 		else if (inp->inp_laddr.s_addr == INADDR_ANY &&
 		    inp->inp_lport == 0)
 			inp->inp_vflag = vflagsav;
 		goto out;
 	} else {
 		if ((inp->inp_vflag & INP_IPV6) == 0) {
 			error = EAFNOSUPPORT;
 			goto out;
 		}
 	}
 #endif
 	if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
 		error = EISCONN;
 		goto out;
 	}
 	error = prison_remote_ip6(td->td_ucred, &sin6->sin6_addr);
 	if (error != 0)
 		goto out;
 	vflagsav = inp->inp_vflag;
 	inp->inp_vflag &= ~INP_IPV4;
 	inp->inp_vflag |= INP_IPV6;
 	NET_EPOCH_ENTER(et);
 	INP_HASH_WLOCK(pcbinfo);
 	error = in6_pcbconnect(inp, sin6, td->td_ucred, true);
 	INP_HASH_WUNLOCK(pcbinfo);
 	NET_EPOCH_EXIT(et);
 	/*
 	 * If connect succeeds, mark socket as connected. If
 	 * connect fails and socket is unbound, reset inp_vflag
 	 * field.
 	 */
 	if (error == 0)
 		soisconnected(so);
 	else if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) &&
 	    inp->inp_lport == 0)
 		inp->inp_vflag = vflagsav;
 out:
 	INP_WUNLOCK(inp);
 	return (error);
 }
 
 static void
 udp6_detach(struct socket *so)
 {
 	struct inpcb *inp;
 
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp6_detach: inp == NULL"));
 
 	INP_WLOCK(inp);
 	in_pcbfree(inp);
 }
 
 static int
 udp6_disconnect(struct socket *so)
 {
 	struct inpcb *inp;
 	struct inpcbinfo *pcbinfo;
 
 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 	inp = sotoinpcb(so);
 	KASSERT(inp != NULL, ("udp6_disconnect: inp == NULL"));
 
 	INP_WLOCK(inp);
 #ifdef INET
 	if (inp->inp_vflag & INP_IPV4) {
 		INP_WUNLOCK(inp);
 		(void)udp_disconnect(so);
 		return (0);
 	}
 #endif
 
 	if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
 		INP_WUNLOCK(inp);
 		return (ENOTCONN);
 	}
 
 	INP_HASH_WLOCK(pcbinfo);
 	in6_pcbdisconnect(inp);
 	INP_HASH_WUNLOCK(pcbinfo);
 	SOCK_LOCK(so);
 	so->so_state &= ~SS_ISCONNECTED;		/* XXX */
 	SOCK_UNLOCK(so);
 	INP_WUNLOCK(inp);
 	return (0);
 }
 
 #define	UDP6_PROTOSW							\
 	.pr_type =		SOCK_DGRAM,				\
 	.pr_flags =		PR_ATOMIC|PR_ADDR|PR_CAPATTACH,		\
 	.pr_ctloutput =		udp_ctloutput,				\
 	.pr_abort =		udp6_abort,				\
 	.pr_attach =		udp6_attach,				\
 	.pr_bind =		udp6_bind,				\
 	.pr_connect =		udp6_connect,				\
 	.pr_control =		in6_control,				\
 	.pr_detach =		udp6_detach,				\
 	.pr_disconnect =	udp6_disconnect,			\
 	.pr_peeraddr =		in6_mapped_peeraddr,			\
 	.pr_send =		udp6_send,				\
 	.pr_shutdown =		udp_shutdown,				\
 	.pr_sockaddr =		in6_mapped_sockaddr,			\
 	.pr_soreceive =		soreceive_dgram,			\
 	.pr_sosend =		sosend_dgram,				\
 	.pr_sosetlabel =	in_pcbsosetlabel,			\
 	.pr_close =		udp6_close
 
 struct protosw udp6_protosw = {
 	.pr_protocol =		IPPROTO_UDP,
 	UDP6_PROTOSW
 };
 
 struct protosw udplite6_protosw = {
 	.pr_protocol =		IPPROTO_UDPLITE,
 	UDP6_PROTOSW
 };
 
 static void
 udp6_init(void *arg __unused)
 {
 
 	IP6PROTO_REGISTER(IPPROTO_UDP, udp6_input, udp6_ctlinput);
 	IP6PROTO_REGISTER(IPPROTO_UDPLITE, udp6_input, udplite6_ctlinput);
 }
 SYSINIT(udp6_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD, udp6_init, NULL);
diff --git a/sys/netipsec/ipsec_input.c b/sys/netipsec/ipsec_input.c
index 472216392949..1150f3f470d3 100644
--- a/sys/netipsec/ipsec_input.c
+++ b/sys/netipsec/ipsec_input.c
@@ -1,775 +1,784 @@
 /*	$OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $	*/
 /*-
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
  * Niels Provos (provos@physnet.uni-hamburg.de).
  *
  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
  * in November 1995.
  *
  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  * by Angelos D. Keromytis.
  *
  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
  * and Niels Provos.
  *
  * Additional features in 1999 by Angelos D. Keromytis.
  *
  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
  * Angelos D. Keromytis and Niels Provos.
  * Copyright (c) 2001, Angelos D. Keromytis.
  * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
  *
  * Permission to use, copy, and modify this software with or without fee
  * is hereby granted, provided that this entire notice is included in
  * all copies of any software which is or includes a copy or
  * modification of this software.
  * You may use this code under the GNU public license if you so wish. Please
  * contribute changes back to the authors under this freer than GPL license
  * so that we may further the use of strong encryption without limitations to
  * all.
  *
  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  * PURPOSE.
  */
 
 /*
  * IPsec input processing.
  */
 
 #include <sys/cdefs.h>
 #include "opt_inet.h"
 #include "opt_inet6.h"
 #include "opt_ipsec.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/domain.h>
 #include <sys/protosw.h>
 #include <sys/socket.h>
 #include <sys/errno.h>
 #include <sys/hhook.h>
 #include <sys/syslog.h>
 
 #include <net/if.h>
 #include <net/if_var.h>
 #include <net/if_enc.h>
 #include <net/if_private.h>
 #include <net/netisr.h>
 #include <net/vnet.h>
 
 #include <netinet/in.h>
 #include <netinet/in_pcb.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
 #include <netinet/ip_var.h>
 #include <netinet/ip_icmp.h>
 #include <netinet/in_var.h>
 #include <netinet/tcp_var.h>
 
 #include <netinet/ip6.h>
 #ifdef INET6
 #include <netinet6/ip6_var.h>
 #endif
 #include <netinet/in_pcb.h>
 #ifdef INET6
 #include <netinet/icmp6.h>
 #endif
 
 #include <netipsec/ipsec.h>
 #ifdef INET6
 #include <netipsec/ipsec6.h>
 #endif
 #include <netipsec/ipsec_support.h>
 #include <netipsec/ah_var.h>
 #include <netipsec/esp.h>
 #include <netipsec/esp_var.h>
 #include <netipsec/ipcomp_var.h>
 
 #include <netipsec/key.h>
 #include <netipsec/keydb.h>
 #include <netipsec/key_debug.h>
 
 #include <netipsec/xform.h>
 
 #include <machine/in_cksum.h>
 #include <machine/stdarg.h>
 
 #define	IPSEC_ISTAT(proto, name)	do {	\
 	if ((proto) == IPPROTO_ESP)		\
 		ESPSTAT_INC(esps_##name);	\
 	else if ((proto) == IPPROTO_AH)		\
 		AHSTAT_INC(ahs_##name);		\
 	else					\
 		IPCOMPSTAT_INC(ipcomps_##name);	\
 } while (0)
 
 /*
  * ipsec_common_input gets called when an IPsec-protected packet
  * is received by IPv4 or IPv6.  Its job is to find the right SA
  * and call the appropriate transform.  The transform callback
  * takes care of further processing (like ingress filtering).
  */
 static int
 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
 {
 	IPSEC_DEBUG_DECLARE(char buf[IPSEC_ADDRSTRLEN]);
 	union sockaddr_union dst_address;
 	struct secasvar *sav;
 	uint32_t spi;
 	int error;
 
 	IPSEC_ISTAT(sproto, input);
 
 	IPSEC_ASSERT(m != NULL, ("null packet"));
 
 	IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
 		sproto == IPPROTO_IPCOMP,
 		("unexpected security protocol %u", sproto));
 
 	if ((sproto == IPPROTO_ESP && !V_esp_enable) ||
 	    (sproto == IPPROTO_AH && !V_ah_enable) ||
 	    (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) {
 		m_freem(m);
 		IPSEC_ISTAT(sproto, pdrops);
 		return EOPNOTSUPP;
 	}
 
 	if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) {
 		m_freem(m);
 		IPSEC_ISTAT(sproto, hdrops);
 		DPRINTF(("%s: packet too small\n", __func__));
 		return EINVAL;
 	}
 
 	/* Retrieve the SPI from the relevant IPsec header */
 	if (sproto == IPPROTO_ESP)
 		m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
 	else if (sproto == IPPROTO_AH)
 		m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
 		    (caddr_t) &spi);
 	else if (sproto == IPPROTO_IPCOMP) {
 		u_int16_t cpi;
 		m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
 		    (caddr_t) &cpi);
 		spi = ntohl(htons(cpi));
 	}
 
 	/*
 	 * Find the SA and (indirectly) call the appropriate
 	 * kernel crypto routine. The resulting mbuf chain is a valid
 	 * IP packet ready to go through input processing.
 	 */
 	bzero(&dst_address, sizeof (dst_address));
 	dst_address.sa.sa_family = af;
 	switch (af) {
 #ifdef INET
 	case AF_INET:
 		dst_address.sin.sin_len = sizeof(struct sockaddr_in);
 		m_copydata(m, offsetof(struct ip, ip_dst),
 		    sizeof(struct in_addr),
 		    (caddr_t) &dst_address.sin.sin_addr);
 		break;
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:
 		dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
 		m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
 		    sizeof(struct in6_addr),
 		    (caddr_t) &dst_address.sin6.sin6_addr);
 		/* We keep addresses in SADB without embedded scope id */
 		if (IN6_IS_SCOPE_LINKLOCAL(&dst_address.sin6.sin6_addr)) {
 			/* XXX: sa6_recoverscope() */
 			dst_address.sin6.sin6_scope_id =
 			    ntohs(dst_address.sin6.sin6_addr.s6_addr16[1]);
 			dst_address.sin6.sin6_addr.s6_addr16[1] = 0;
 		}
 		break;
 #endif /* INET6 */
 	default:
 		DPRINTF(("%s: unsupported protocol family %u\n", __func__, af));
 		m_freem(m);
 		IPSEC_ISTAT(sproto, nopf);
 		return EPFNOSUPPORT;
 	}
 
 	/* NB: only pass dst since key_allocsa follows RFC2401 */
 	sav = key_allocsa(&dst_address, sproto, spi);
 	if (sav == NULL) {
 		DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n",
 		    __func__, ipsec_address(&dst_address, buf, sizeof(buf)),
 		    (u_long) ntohl(spi), sproto));
 		IPSEC_ISTAT(sproto, notdb);
 		m_freem(m);
 		return ENOENT;
 	}
 
 	if (sav->tdb_xform == NULL) {
 		DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n",
 		    __func__, ipsec_address(&dst_address, buf, sizeof(buf)),
 		    (u_long) ntohl(spi), sproto));
 		IPSEC_ISTAT(sproto, noxform);
 		key_freesav(&sav);
 		m_freem(m);
 		return ENXIO;
 	}
 
 	/*
 	 * Call appropriate transform and return -- callback takes care of
 	 * everything else.
 	 */
 	error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff);
 	return (error);
 }
 
 #ifdef INET
 /*
  * IPSEC_INPUT() method implementation for IPv4.
  *  0 - Permitted by inbound security policy for further processing.
  *  EACCES - Forbidden by inbound security policy.
  *  EINPROGRESS - consumed by IPsec.
  */
 int
 ipsec4_input(struct mbuf *m, int offset, int proto)
 {
 
 	switch (proto) {
 	case IPPROTO_AH:
 	case IPPROTO_ESP:
 	case IPPROTO_IPCOMP:
 		/* Do inbound IPsec processing for AH/ESP/IPCOMP */
 		ipsec_common_input(m, offset,
 		    offsetof(struct ip, ip_p), AF_INET, proto);
 		return (EINPROGRESS); /* mbuf consumed by IPsec */
 	default:
 		/*
 		 * Protocols with further headers get their IPsec treatment
 		 * within the protocol specific processing.
 		 */
 		switch (proto) {
 		case IPPROTO_ICMP:
 		case IPPROTO_IGMP:
 		case IPPROTO_IPV4:
 		case IPPROTO_IPV6:
 		case IPPROTO_RSVP:
 		case IPPROTO_GRE:
 		case IPPROTO_MOBILE:
 		case IPPROTO_ETHERIP:
 		case IPPROTO_PIM:
 		case IPPROTO_SCTP:
 			break;
 		default:
 			return (0);
 		}
 	};
 	/*
 	 * Enforce IPsec policy checking if we are seeing last header.
 	 */
 	if (ipsec4_in_reject(m, NULL) != 0) {
 		/* Forbidden by inbound security policy */
 		m_freem(m);
 		return (EACCES);
 	}
 	return (0);
 }
 
 int
 ipsec4_ctlinput(ipsec_ctlinput_param_t param)
 {
 	struct icmp *icp = param.icmp;
 	struct ip *ip = &icp->icmp_ip;
 	struct sockaddr_in icmpsrc = {
 		.sin_len = sizeof(struct sockaddr_in),
 		.sin_family = AF_INET,
 		.sin_addr = ip->ip_dst,
 	};
 	struct in_conninfo inc;
 	struct secasvar *sav;
 	uint32_t pmtu, spi;
 	uint32_t max_pmtu;
 	uint8_t proto;
 
 	pmtu = ntohs(icp->icmp_nextmtu);
 
 	if (pmtu < V_ip4_ipsec_min_pmtu)
 		return (EINVAL);
 
 	proto = ip->ip_p;
 	if (proto != IPPROTO_ESP && proto != IPPROTO_AH &&
 	    proto != IPPROTO_IPCOMP)
 		return (EINVAL);
 
 	memcpy(&spi, (caddr_t)ip + (ip->ip_hl << 2), sizeof(spi));
 	sav = key_allocsa((union sockaddr_union *)&icmpsrc, proto, spi);
 	if (sav == NULL)
 		return (ENOENT);
 
 	key_freesav(&sav);
 
 	memset(&inc, 0, sizeof(inc));
 	inc.inc_faddr = ip->ip_dst;
 
 	/* Update pmtu only if its smaller than the current one. */
 	max_pmtu = tcp_hc_getmtu(&inc);
 	if (max_pmtu == 0)
 		max_pmtu = tcp_maxmtu(&inc, NULL);
 
 	if (pmtu < max_pmtu)
 		tcp_hc_updatemtu(&inc, pmtu);
 
 	return (0);
 }
 
 /*
  * IPsec input callback for INET protocols.
  * This routine is called as the transform callback.
  * Takes care of filtering and other sanity checks on
  * the processed packet.
  */
 int
 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip,
     int protoff)
 {
 	IPSEC_DEBUG_DECLARE(char buf[IPSEC_ADDRSTRLEN]);
 	struct epoch_tracker et;
 	struct ipsec_ctx_data ctx;
 	struct xform_history *xh;
 	struct secasindex *saidx;
 	struct m_tag *mtag;
 	struct ip *ip;
 	int error, prot, af, sproto, isr_prot;
 
 	IPSEC_ASSERT(sav != NULL, ("null SA"));
 	IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
 	saidx = &sav->sah->saidx;
 	af = saidx->dst.sa.sa_family;
 	IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af));
 	sproto = saidx->proto;
 	IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
 		sproto == IPPROTO_IPCOMP,
 		("unexpected security protocol %u", sproto));
 
 	if (skip != 0) {
 		/*
 		 * Fix IPv4 header
 		 */
 		if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
 			DPRINTF(("%s: processing failed for SA %s/%08lx\n",
 			    __func__, ipsec_address(&sav->sah->saidx.dst,
 			    buf, sizeof(buf)), (u_long) ntohl(sav->spi)));
 			IPSEC_ISTAT(sproto, hdrops);
 			error = ENOBUFS;
 			goto bad_noepoch;
 		}
 
 		ip = mtod(m, struct ip *);
 		ip->ip_len = htons(m->m_pkthdr.len);
 		ip->ip_sum = 0;
 		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
 	} else {
 		ip = mtod(m, struct ip *);
 	}
 	prot = ip->ip_p;
 	/*
 	 * Check that we have NAT-T enabled and apply transport mode
 	 * decapsulation NAT procedure (RFC3948).
 	 * Do this before invoking into the PFIL.
 	 */
 	if (sav->natt != NULL &&
 	    (prot == IPPROTO_UDP || prot == IPPROTO_TCP))
 		udp_ipsec_adjust_cksum(m, sav, prot, skip);
 
 	/*
 	 * Needed for ipsec_run_hooks and netisr_queue_src
 	 */
 	NET_EPOCH_ENTER(et);
 
 	IPSEC_INIT_CTX(&ctx, &m, NULL, sav, AF_INET, IPSEC_ENC_BEFORE);
 	if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0)
 		goto bad;
 	ip = mtod(m, struct ip *);	/* update pointer */
 
 	/* IP-in-IP encapsulation */
 	if (prot == IPPROTO_IPIP &&
 	    saidx->mode != IPSEC_MODE_TRANSPORT) {
 		if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
 			IPSEC_ISTAT(sproto, hdrops);
 			error = EINVAL;
 			goto bad;
 		}
 		/* enc0: strip outer IPv4 header */
 		m_striphdr(m, 0, ip->ip_hl << 2);
 	}
 #ifdef INET6
 	/* IPv6-in-IP encapsulation. */
 	else if (prot == IPPROTO_IPV6 &&
 	    saidx->mode != IPSEC_MODE_TRANSPORT) {
 		if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
 			IPSEC_ISTAT(sproto, hdrops);
 			error = EINVAL;
 			goto bad;
 		}
 		/* enc0: strip IPv4 header, keep IPv6 header only */
 		m_striphdr(m, 0, ip->ip_hl << 2);
 	}
 #endif /* INET6 */
 	else if (prot != IPPROTO_IPV6 && saidx->mode == IPSEC_MODE_ANY) {
 		/*
 		 * When mode is wildcard, inner protocol is IPv6 and
 		 * we have no INET6 support - drop this packet a bit later.
 		 * In other cases we assume transport mode. Set prot to
 		 * correctly choose netisr.
 		 */
 		prot = IPPROTO_IPIP;
 	}
 
 	/*
 	 * Record what we've done to the packet (under what SA it was
 	 * processed).
 	 */
 	if (sproto != IPPROTO_IPCOMP) {
 		mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
 		    sizeof(struct xform_history), M_NOWAIT);
 		if (mtag == NULL) {
 			DPRINTF(("%s: failed to get tag\n", __func__));
 			IPSEC_ISTAT(sproto, hdrops);
 			error = ENOMEM;
 			goto bad;
 		}
 
 		xh = (struct xform_history *)(mtag + 1);
 		bcopy(&saidx->dst, &xh->dst, saidx->dst.sa.sa_len);
 		xh->spi = sav->spi;
 		xh->proto = sproto;
 		xh->mode = saidx->mode;
 		m_tag_prepend(m, mtag);
 	}
 
 	key_sa_recordxfer(sav, m);		/* record data transfer */
 
 	/*
 	 * In transport mode requeue decrypted mbuf back to IPv4 protocol
 	 * handler. This is necessary to correctly expose rcvif.
 	 */
 	if (saidx->mode == IPSEC_MODE_TRANSPORT)
 		prot = IPPROTO_IPIP;
 	/*
 	 * Re-dispatch via software interrupt.
 	 */
 	switch (prot) {
 	case IPPROTO_IPIP:
 		isr_prot = NETISR_IP;
 		af = AF_INET;
 		break;
 #ifdef INET6
 	case IPPROTO_IPV6:
 		isr_prot = NETISR_IPV6;
 		af = AF_INET6;
 		break;
 #endif
 	default:
 		DPRINTF(("%s: cannot handle inner ip proto %d\n",
 			    __func__, prot));
 		IPSEC_ISTAT(sproto, nopf);
 		error = EPFNOSUPPORT;
 		goto bad;
 	}
 
 	IPSEC_INIT_CTX(&ctx, &m, NULL, sav, af, IPSEC_ENC_AFTER);
 	if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0)
 		goto bad;
 
 	/* Handle virtual tunneling interfaces */
 	if (saidx->mode == IPSEC_MODE_TUNNEL)
 		error = ipsec_if_input(m, sav, af);
 	if (error == 0) {
 		error = netisr_queue_src(isr_prot, (uintptr_t)sav->spi, m);
 		if (error) {
 			IPSEC_ISTAT(sproto, qfull);
 			DPRINTF(("%s: queue full; proto %u packet dropped\n",
 			    __func__, sproto));
 		}
 	}
 	NET_EPOCH_EXIT(et);
 	key_freesav(&sav);
 	return (error);
 bad:
 	NET_EPOCH_EXIT(et);
 bad_noepoch:
 	key_freesav(&sav);
 	if (m != NULL)
 		m_freem(m);
 	return (error);
 }
 #endif /* INET */
 
 #ifdef INET6
 static bool
 ipsec6_lasthdr(int proto)
 {
 
 	switch (proto) {
 	case IPPROTO_IPV4:
 	case IPPROTO_IPV6:
 	case IPPROTO_GRE:
 	case IPPROTO_ICMPV6:
 	case IPPROTO_ETHERIP:
 	case IPPROTO_PIM:
 	case IPPROTO_SCTP:
 		return (true);
 	default:
 		return (false);
 	};
 }
 
 /*
  * IPSEC_INPUT() method implementation for IPv6.
  *  0 - Permitted by inbound security policy for further processing.
  *  EACCES - Forbidden by inbound security policy.
  *  EINPROGRESS - consumed by IPsec.
  */
 int
 ipsec6_input(struct mbuf *m, int offset, int proto)
 {
 
 	switch (proto) {
 	case IPPROTO_AH:
 	case IPPROTO_ESP:
 	case IPPROTO_IPCOMP:
 		/* Do inbound IPsec processing for AH/ESP/IPCOMP */
 		ipsec_common_input(m, offset,
 		    offsetof(struct ip6_hdr, ip6_nxt), AF_INET6, proto);
 		return (EINPROGRESS); /* mbuf consumed by IPsec */
 	default:
 		/*
 		 * Protocols with further headers get their IPsec treatment
 		 * within the protocol specific processing.
 		 */
 		if (!ipsec6_lasthdr(proto))
 			return (0);
 		/* FALLTHROUGH */
 	};
 	/*
 	 * Enforce IPsec policy checking if we are seeing last header.
 	 */
 	if (ipsec6_in_reject(m, NULL) != 0) {
 		/* Forbidden by inbound security policy */
 		m_freem(m);
 		return (EACCES);
 	}
 	return (0);
 }
 
 int
 ipsec6_ctlinput(ipsec_ctlinput_param_t param)
 {
 	return (0);
 }
 
 extern ipproto_input_t	*ip6_protox[];
 
 /*
  * IPsec input callback, called by the transform callback. Takes care of
  * filtering and other sanity checks on the processed packet.
  */
 int
 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip,
     int protoff)
 {
 	IPSEC_DEBUG_DECLARE(char buf[IPSEC_ADDRSTRLEN]);
 	struct epoch_tracker et;
 	struct ipsec_ctx_data ctx;
 	struct xform_history *xh;
 	struct secasindex *saidx;
 	struct ip6_hdr *ip6;
 	struct m_tag *mtag;
 	int prot, af, sproto;
 	int nxt, isr_prot;
 	int error, nest;
 	uint8_t nxt8;
 
 	IPSEC_ASSERT(sav != NULL, ("null SA"));
 	IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
 	saidx = &sav->sah->saidx;
 	af = saidx->dst.sa.sa_family;
 	IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af));
 	sproto = saidx->proto;
 	IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
 		sproto == IPPROTO_IPCOMP,
 		("unexpected security protocol %u", sproto));
 
 	NET_EPOCH_ENTER(et);
 
 	/* Fix IPv6 header */
 	if (m->m_len < sizeof(struct ip6_hdr) &&
 	    (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
 		DPRINTF(("%s: processing failed for SA %s/%08lx\n",
 		    __func__, ipsec_address(&sav->sah->saidx.dst, buf,
 		    sizeof(buf)), (u_long) ntohl(sav->spi)));
 
 		IPSEC_ISTAT(sproto, hdrops);
 		error = EACCES;
 		goto bad;
 	}
 
 	IPSEC_INIT_CTX(&ctx, &m, NULL, sav, af, IPSEC_ENC_BEFORE);
 	if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0)
 		goto bad;
 
 	ip6 = mtod(m, struct ip6_hdr *);
 	ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
 
 	/* Save protocol */
 	m_copydata(m, protoff, 1, &nxt8);
 	prot = nxt8;
 
+	/*
+	 * Check that we have NAT-T enabled and apply transport mode
+	 * decapsulation NAT procedure (RFC3948).
+	 * Do this before invoking into the PFIL.
+	 */
+	if (sav->natt != NULL &&
+	    (prot == IPPROTO_UDP || prot == IPPROTO_TCP))
+		udp_ipsec_adjust_cksum(m, sav, prot, skip);
+
 	/* IPv6-in-IP encapsulation */
 	if (prot == IPPROTO_IPV6 &&
 	    saidx->mode != IPSEC_MODE_TRANSPORT) {
 		if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
 			IPSEC_ISTAT(sproto, hdrops);
 			error = EINVAL;
 			goto bad;
 		}
 		/* ip6n will now contain the inner IPv6 header. */
 		m_striphdr(m, 0, skip);
 		skip = 0;
 	}
 #ifdef INET
 	/* IP-in-IP encapsulation */
 	else if (prot == IPPROTO_IPIP &&
 	    saidx->mode != IPSEC_MODE_TRANSPORT) {
 		if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
 			IPSEC_ISTAT(sproto, hdrops);
 			error = EINVAL;
 			goto bad;
 		}
 		/* ipn will now contain the inner IPv4 header */
 		m_striphdr(m, 0, skip);
 		skip = 0;
 	}
 #endif /* INET */
 	else {
 		prot = IPPROTO_IPV6; /* for correct BPF processing */
 	}
 
 	/*
 	 * Record what we've done to the packet (under what SA it was
 	 * processed).
 	 */
 	if (sproto != IPPROTO_IPCOMP) {
 		mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
 		    sizeof(struct xform_history), M_NOWAIT);
 		if (mtag == NULL) {
 			DPRINTF(("%s: failed to get tag\n", __func__));
 			IPSEC_ISTAT(sproto, hdrops);
 			error = ENOMEM;
 			goto bad;
 		}
 
 		xh = (struct xform_history *)(mtag + 1);
 		bcopy(&saidx->dst, &xh->dst, saidx->dst.sa.sa_len);
 		xh->spi = sav->spi;
 		xh->proto = sproto;
 		xh->mode = saidx->mode;
 		m_tag_prepend(m, mtag);
 	}
 
 	key_sa_recordxfer(sav, m);
 
 #ifdef INET
 	if (prot == IPPROTO_IPIP)
 		af = AF_INET;
 	else
 #endif
 		af = AF_INET6;
 	IPSEC_INIT_CTX(&ctx, &m, NULL, sav, af, IPSEC_ENC_AFTER);
 	if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0)
 		goto bad;
 	if (skip == 0) {
 		/*
 		 * We stripped outer IPv6 header.
 		 * Now we should requeue decrypted packet via netisr.
 		 */
 		switch (prot) {
 #ifdef INET
 		case IPPROTO_IPIP:
 			isr_prot = NETISR_IP;
 			break;
 #endif
 		case IPPROTO_IPV6:
 			isr_prot = NETISR_IPV6;
 			break;
 		default:
 			DPRINTF(("%s: cannot handle inner ip proto %d\n",
 			    __func__, prot));
 			IPSEC_ISTAT(sproto, nopf);
 			error = EPFNOSUPPORT;
 			goto bad;
 		}
 		/* Handle virtual tunneling interfaces */
 		if (saidx->mode == IPSEC_MODE_TUNNEL)
 			error = ipsec_if_input(m, sav, af);
 		if (error == 0) {
 			error = netisr_queue_src(isr_prot,
 			    (uintptr_t)sav->spi, m);
 			if (error) {
 				IPSEC_ISTAT(sproto, qfull);
 				DPRINTF(("%s: queue full; proto %u packet"
 				    " dropped\n", __func__, sproto));
 			}
 		}
 		NET_EPOCH_EXIT(et);
 		key_freesav(&sav);
 		return (error);
 	}
 	/*
 	 * See the end of ip6_input for this logic.
 	 * IPPROTO_IPV[46] case will be processed just like other ones
 	 */
 	nest = 0;
 	nxt = nxt8;
 	while (nxt != IPPROTO_DONE) {
 		if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) {
 			IP6STAT_INC(ip6s_toomanyhdr);
 			error = EINVAL;
 			goto bad;
 		}
 
 		/*
 		 * Protection against faulty packet - there should be
 		 * more sanity checks in header chain processing.
 		 */
 		if (m->m_pkthdr.len < skip) {
 			IP6STAT_INC(ip6s_tooshort);
 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
 			error = EINVAL;
 			goto bad;
 		}
 		/*
 		 * Enforce IPsec policy checking if we are seeing last header.
 		 * note that we do not visit this with protocols with pcb layer
 		 * code - like udp/tcp/raw ip.
 		 */
 		if (ipsec6_lasthdr(nxt) && ipsec6_in_reject(m, NULL)) {
 			error = EINVAL;
 			goto bad;
 		}
 		nxt = ip6_protox[nxt](&m, &skip, nxt);
 	}
 	NET_EPOCH_EXIT(et);
 	key_freesav(&sav);
 	return (0);
 bad:
 	NET_EPOCH_EXIT(et);
 	key_freesav(&sav);
 	if (m)
 		m_freem(m);
 	return (error);
 }
 #endif /* INET6 */
diff --git a/sys/netipsec/ipsec_mod.c b/sys/netipsec/ipsec_mod.c
index c5976723b4d5..eea2898b5359 100644
--- a/sys/netipsec/ipsec_mod.c
+++ b/sys/netipsec/ipsec_mod.c
@@ -1,147 +1,149 @@
 /*-
  * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "opt_inet.h"
 #include "opt_inet6.h"
 #include "opt_ipsec.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/module.h>
 #include <sys/priv.h>
 #include <sys/rmlock.h>
 #include <sys/socket.h>
 #include <sys/sockopt.h>
 #include <sys/syslog.h>
 #include <sys/proc.h>
 
 #include <netinet/in.h>
 #include <netinet/in_pcb.h>
 
 #include <netipsec/ipsec.h>
 #include <netipsec/ipsec6.h>
 #include <netipsec/key.h>
 #include <netipsec/key_debug.h>
 
 #include <netipsec/ipsec_support.h>
 
 #ifdef INET
 static const struct ipsec_methods ipv4_methods = {
 	.input = ipsec4_input,
 	.forward = ipsec4_forward,
 	.output = ipsec4_output,
 	.pcbctl = ipsec4_pcbctl,
 	.capability = ipsec4_capability,
 	.check_policy = ipsec4_in_reject,
 	.ctlinput = ipsec4_ctlinput,
 	.hdrsize = ipsec_hdrsiz_inpcb,
 	.udp_input = udp_ipsec_input,
 	.udp_pcbctl = udp_ipsec_pcbctl,
 };
 #ifndef KLD_MODULE
 static const struct ipsec_support ipv4_ipsec = {
 	.enabled = IPSEC_MODULE_ENABLED,
 	.methods = &ipv4_methods
 };
 const struct ipsec_support * const ipv4_ipsec_support = &ipv4_ipsec;
 #endif /* !KLD_MODULE */
 #endif /* INET */
 
 #ifdef INET6
 static const struct ipsec_methods ipv6_methods = {
 	.input = ipsec6_input,
 	.forward = ipsec6_forward,
 	.output = ipsec6_output,
 	.pcbctl = ipsec6_pcbctl,
 	.capability = ipsec6_capability,
 	.check_policy = ipsec6_in_reject,
 	.ctlinput = ipsec6_ctlinput,
 	.hdrsize = ipsec_hdrsiz_inpcb,
+	.udp_input = udp_ipsec_input,
+	.udp_pcbctl = udp_ipsec_pcbctl,
 };
 #ifndef KLD_MODULE
 static const struct ipsec_support ipv6_ipsec = {
 	.enabled = IPSEC_MODULE_ENABLED,
 	.methods = &ipv6_methods
 };
 const struct ipsec_support * const ipv6_ipsec_support = &ipv6_ipsec;
 #endif /* !KLD_MODULE */
 #endif /* INET6 */
 
 /*
  * Always register ipsec module.
  * Even when IPsec is build in the kernel, we need to have
  * module registered. This will prevent to load ipsec.ko.
  */
 static int
 ipsec_modevent(module_t mod, int type, void *data)
 {
 
 	switch (type) {
 	case MOD_LOAD:
 		/* All xforms are registered via SYSINIT */
 		if (!ipsec_initialized())
 			return (ENOMEM);
 #ifdef KLD_MODULE
 #ifdef INET
 		ipsec_support_enable(ipv4_ipsec_support, &ipv4_methods);
 #endif
 #ifdef INET6
 		ipsec_support_enable(ipv6_ipsec_support, &ipv6_methods);
 #endif
 #endif /* KLD_MODULE */
 		break;
 	case MOD_UNLOAD:
 		/* All xforms are unregistered via SYSUNINIT */
 #ifdef KLD_MODULE
 #ifdef INET
 		ipsec_support_disable(ipv4_ipsec_support);
 #endif
 #ifdef INET6
 		ipsec_support_disable(ipv6_ipsec_support);
 #endif
 #endif /* KLD_MODULE */
 		break;
 	default:
 		return (EOPNOTSUPP);
 	}
 	return (0);
 }
 
 static moduledata_t ipsec_mod = {
 	"ipsec",
 	ipsec_modevent,
 	0
 };
 
 DECLARE_MODULE(ipsec, ipsec_mod, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY);
 MODULE_VERSION(ipsec, 1);
 #ifdef KLD_MODULE
 MODULE_DEPEND(ipsec, ipsec_support, 1, 1, 1);
 #endif
diff --git a/sys/netipsec/ipsec_output.c b/sys/netipsec/ipsec_output.c
index caf3c3f74433..707fe3421c97 100644
--- a/sys/netipsec/ipsec_output.c
+++ b/sys/netipsec/ipsec_output.c
@@ -1,1180 +1,1180 @@
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
  * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 
 /*
  * IPsec output processing.
  */
 #include "opt_inet.h"
 #include "opt_inet6.h"
 #include "opt_ipsec.h"
 #include "opt_sctp.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 #include <sys/domain.h>
 #include <sys/protosw.h>
 #include <sys/socket.h>
 #include <sys/errno.h>
 #include <sys/hhook.h>
 #include <sys/syslog.h>
 
 #include <net/if.h>
 #include <net/if_enc.h>
 #include <net/if_var.h>
 #include <net/vnet.h>
 
 #include <netinet/in.h>
 #include <netinet/in_pcb.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
 #include <netinet/ip_var.h>
 #include <netinet/in_var.h>
 #include <netinet/ip_ecn.h>
 #ifdef INET6
 #include <netinet6/ip6_ecn.h>
 #endif
 #include <netinet/ip_icmp.h>
 #include <netinet/tcp_var.h>
 
 #include <netinet/ip6.h>
 #ifdef INET6
 #include <netinet6/ip6_var.h>
 #include <netinet6/scope6_var.h>
 #endif
 #include <netinet/in_pcb.h>
 #ifdef INET6
 #include <netinet/icmp6.h>
 #endif
 #if defined(SCTP) || defined(SCTP_SUPPORT)
 #include <netinet/sctp_crc32.h>
 #endif
 
 #include <netinet/udp.h>
 #include <netipsec/ah.h>
 #include <netipsec/esp.h>
 #include <netipsec/ipsec.h>
 #ifdef INET6
 #include <netipsec/ipsec6.h>
 #endif
 #include <netipsec/ipsec_support.h>
 #include <netipsec/ah_var.h>
 #include <netipsec/esp_var.h>
 #include <netipsec/ipcomp_var.h>
 
 #include <netipsec/xform.h>
 
 #include <netipsec/key.h>
 #include <netipsec/keydb.h>
 #include <netipsec/key_debug.h>
 
 #include <machine/in_cksum.h>
 
 #define	IPSEC_OSTAT_INC(proto, name)	do {		\
 	if ((proto) == IPPROTO_ESP)	\
 		ESPSTAT_INC(esps_##name);	\
 	else if ((proto) == IPPROTO_AH)\
 		AHSTAT_INC(ahs_##name);		\
 	else					\
 		IPCOMPSTAT_INC(ipcomps_##name);	\
 } while (0)
 
 static int ipsec_encap(struct mbuf **mp, struct secasindex *saidx);
 static size_t ipsec_get_pmtu(struct secasvar *sav);
 
 #ifdef INET
 static struct secasvar *
 ipsec4_allocsa(struct mbuf *m, struct secpolicy *sp, u_int *pidx, int *error)
 {
 	struct secasindex *saidx, tmpsaidx;
 	struct ipsecrequest *isr;
 	struct sockaddr_in *sin;
 	struct secasvar *sav;
 	struct ip *ip;
 
 	/*
 	 * Check system global policy controls.
 	 */
 next:
 	isr = sp->req[*pidx];
 	if ((isr->saidx.proto == IPPROTO_ESP && !V_esp_enable) ||
 	    (isr->saidx.proto == IPPROTO_AH && !V_ah_enable) ||
 	    (isr->saidx.proto == IPPROTO_IPCOMP && !V_ipcomp_enable)) {
 		DPRINTF(("%s: IPsec outbound packet dropped due"
 			" to policy (check your sysctls)\n", __func__));
 		IPSEC_OSTAT_INC(isr->saidx.proto, pdrops);
 		*error = EHOSTUNREACH;
 		return (NULL);
 	}
 	/*
 	 * Craft SA index to search for proper SA.  Note that
 	 * we only initialize unspecified SA peers for transport
 	 * mode; for tunnel mode they must already be filled in.
 	 */
 	if (isr->saidx.mode == IPSEC_MODE_TRANSPORT) {
 		saidx = &tmpsaidx;
 		*saidx = isr->saidx;
 		ip = mtod(m, struct ip *);
 		if (saidx->src.sa.sa_len == 0) {
 			sin = &saidx->src.sin;
 			sin->sin_len = sizeof(*sin);
 			sin->sin_family = AF_INET;
 			sin->sin_port = IPSEC_PORT_ANY;
 			sin->sin_addr = ip->ip_src;
 		}
 		if (saidx->dst.sa.sa_len == 0) {
 			sin = &saidx->dst.sin;
 			sin->sin_len = sizeof(*sin);
 			sin->sin_family = AF_INET;
 			sin->sin_port = IPSEC_PORT_ANY;
 			sin->sin_addr = ip->ip_dst;
 		}
 	} else
 		saidx = &sp->req[*pidx]->saidx;
 	/*
 	 * Lookup SA and validate it.
 	 */
 	sav = key_allocsa_policy(sp, saidx, error);
 	if (sav == NULL) {
 		IPSECSTAT_INC(ips_out_nosa);
 		if (*error != 0)
 			return (NULL);
 		if (ipsec_get_reqlevel(sp, *pidx) != IPSEC_LEVEL_REQUIRE) {
 			/*
 			 * We have no SA and policy that doesn't require
 			 * this IPsec transform, thus we can continue w/o
 			 * IPsec processing, i.e. return EJUSTRETURN.
 			 * But first check if there is some bundled transform.
 			 */
 			if (sp->tcount > ++(*pidx))
 				goto next;
 			*error = EJUSTRETURN;
 		}
 		return (NULL);
 	}
 	IPSEC_ASSERT(sav->tdb_xform != NULL, ("SA with NULL tdb_xform"));
 	return (sav);
 }
 
 /*
  * IPsec output logic for IPv4.
  */
 static int
 ipsec4_perform_request(struct mbuf *m, struct secpolicy *sp,
     struct inpcb *inp, u_int idx)
 {
 	struct ipsec_ctx_data ctx;
 	union sockaddr_union *dst;
 	struct secasvar *sav;
 	struct ip *ip;
 	int error, i, off;
 
 	IPSEC_ASSERT(idx < sp->tcount, ("Wrong IPsec request index %d", idx));
 
 	/*
 	 * We hold the reference to SP. Content of SP couldn't be changed.
 	 * Craft secasindex and do lookup for suitable SA.
 	 * Then do encapsulation if needed and call xform's output.
 	 * We need to store SP in the xform callback parameters.
 	 * In xform callback we will extract SP and it can be used to
 	 * determine next transform. At the end of transform we can
 	 * release reference to SP.
 	 */
 	sav = ipsec4_allocsa(m, sp, &idx, &error);
 	if (sav == NULL) {
 		if (error == EJUSTRETURN) { /* No IPsec required */
 			key_freesp(&sp);
 			return (error);
 		}
 		goto bad;
 	}
 	/*
 	 * XXXAE: most likely ip_sum at this point is wrong.
 	 */
 	IPSEC_INIT_CTX(&ctx, &m, inp, sav, AF_INET, IPSEC_ENC_BEFORE);
 	if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0)
 		goto bad;
 
 	ip = mtod(m, struct ip *);
 	dst = &sav->sah->saidx.dst;
 	/* Do the appropriate encapsulation, if necessary */
 	if (sp->req[idx]->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
 	    dst->sa.sa_family != AF_INET ||	    /* PF mismatch */
 	    (dst->sa.sa_family == AF_INET &&	    /* Proxy */
 	     dst->sin.sin_addr.s_addr != INADDR_ANY &&
 	     dst->sin.sin_addr.s_addr != ip->ip_dst.s_addr)) {
 		/* Fix IPv4 header checksum and length */
 		ip->ip_len = htons(m->m_pkthdr.len);
 		ip->ip_sum = 0;
 		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
 		error = ipsec_encap(&m, &sav->sah->saidx);
 		if (error != 0) {
 			DPRINTF(("%s: encapsulation for SPI 0x%08x failed "
 			    "with error %d\n", __func__, ntohl(sav->spi),
 			    error));
 			/* XXXAE: IPSEC_OSTAT_INC(tunnel); */
 			goto bad;
 		}
 		inp = NULL;
 	}
 
 	IPSEC_INIT_CTX(&ctx, &m, inp, sav, dst->sa.sa_family, IPSEC_ENC_AFTER);
 	if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0)
 		goto bad;
 
 	/*
 	 * Dispatch to the appropriate IPsec transform logic.  The
 	 * packet will be returned for transmission after crypto
 	 * processing, etc. are completed.
 	 *
 	 * NB: m & sav are ``passed to caller'' who's responsible for
 	 *     reclaiming their resources.
 	 */
 	switch(dst->sa.sa_family) {
 	case AF_INET:
 		ip = mtod(m, struct ip *);
 		i = ip->ip_hl << 2;
 		off = offsetof(struct ip, ip_p);
 		break;
 #ifdef INET6
 	case AF_INET6:
 		i = sizeof(struct ip6_hdr);
 		off = offsetof(struct ip6_hdr, ip6_nxt);
 		break;
 #endif /* INET6 */
 	default:
 		DPRINTF(("%s: unsupported protocol family %u\n",
 		    __func__, dst->sa.sa_family));
 		error = EPFNOSUPPORT;
 		IPSEC_OSTAT_INC(sav->sah->saidx.proto, nopf);
 		goto bad;
 	}
 	error = (*sav->tdb_xform->xf_output)(m, sp, sav, idx, i, off);
 	return (error);
 bad:
 	IPSECSTAT_INC(ips_out_inval);
 	if (m != NULL)
 		m_freem(m);
 	if (sav != NULL)
 		key_freesav(&sav);
 	key_freesp(&sp);
 	return (error);
 }
 
 int
 ipsec4_process_packet(struct mbuf *m, struct secpolicy *sp,
     struct inpcb *inp)
 {
 
 	return (ipsec4_perform_request(m, sp, inp, 0));
 }
 
 int
 ipsec4_check_pmtu(struct mbuf *m, struct secpolicy *sp, int forwarding)
 {
 	struct secasvar *sav;
 	struct ip *ip;
 	size_t hlen, pmtu;
 	uint32_t idx;
 	int error;
 
 	/* Don't check PMTU if the frame won't have DF bit set. */
 	if (!V_ip4_ipsec_dfbit)
 		return (0);
 	if (V_ip4_ipsec_dfbit == 1)
 		goto setdf;
 
 	/* V_ip4_ipsec_dfbit > 1 - we will copy it from inner header. */
 	ip = mtod(m, struct ip *);
 	if (!(ip->ip_off & htons(IP_DF)))
 		return (0);
 
 setdf:
 	idx = sp->tcount - 1;
 	sav = ipsec4_allocsa(m, sp, &idx, &error);
 	if (sav == NULL) {
 		key_freesp(&sp);
 		/*
 		 * No matching SA was found and SADB_ACQUIRE message was generated.
 		 * Since we have matched a SP to this packet drop it silently.
 		 */
 		if (error == 0)
 			error = EINPROGRESS;
 		if (error != EJUSTRETURN)
 			m_freem(m);
 
 		return (error);
 	}
 
 	pmtu = ipsec_get_pmtu(sav);
 	if (pmtu == 0) {
 		key_freesav(&sav);
 		return (0);
 	}
 
 	hlen = ipsec_hdrsiz_internal(sp);
 	key_freesav(&sav);
 
 	if (m_length(m, NULL) + hlen > pmtu) {
 		/*
 		 * If we're forwarding generate ICMP message here,
 		 * so that it contains pmtu subtracted by header size.
 		 * Set error to EINPROGRESS, in order for the frame
 		 * to be dropped silently.
 		 */
 		if (forwarding) {
 			if (pmtu > hlen)
 				icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG,
 				    0, pmtu - hlen);
 			else
 				m_freem(m);
 
 			key_freesp(&sp);
 			return (EINPROGRESS); /* Pretend that we consumed it. */
 		} else {
 			m_freem(m);
 			key_freesp(&sp);
 			return (EMSGSIZE);
 		}
 	}
 
 	return (0);
 }
 
 static int
 ipsec4_common_output(struct mbuf *m, struct inpcb *inp, int forwarding)
 {
 	struct secpolicy *sp;
 	int error;
 
 	/* Lookup for the corresponding outbound security policy */
 	sp = ipsec4_checkpolicy(m, inp, &error, !forwarding);
 	if (sp == NULL) {
 		if (error == -EINVAL) {
 			/* Discarded by policy. */
 			m_freem(m);
 			return (EACCES);
 		}
 		return (0); /* No IPsec required. */
 	}
 
 	/*
 	 * Usually we have to have tunnel mode IPsec security policy
 	 * when we are forwarding a packet. Otherwise we could not handle
 	 * encrypted replies, because they are not destined for us. But
 	 * some users are doing source address translation for forwarded
 	 * packets, and thus, even if they are forwarded, the replies will
 	 * return back to us.
 	 */
 	if (!forwarding) {
 		/*
 		 * Do delayed checksums now because we send before
 		 * this is done in the normal processing path.
 		 */
 		if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
 			in_delayed_cksum(m);
 			m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
 		}
 #if defined(SCTP) || defined(SCTP_SUPPORT)
 		if (m->m_pkthdr.csum_flags & CSUM_SCTP) {
 			struct ip *ip;
 
 			ip = mtod(m, struct ip *);
 			sctp_delayed_cksum(m, (uint32_t)(ip->ip_hl << 2));
 			m->m_pkthdr.csum_flags &= ~CSUM_SCTP;
 		}
 #endif
 	}
 	/* NB: callee frees mbuf and releases reference to SP */
 	error = ipsec4_check_pmtu(m, sp, forwarding);
 	if (error != 0) {
 		if (error == EJUSTRETURN)
 			return (0);
 
 		return (error);
 	}
 
 	error = ipsec4_process_packet(m, sp, inp);
 	if (error == EJUSTRETURN) {
 		/*
 		 * We had a SP with a level of 'use' and no SA. We
 		 * will just continue to process the packet without
 		 * IPsec processing and return without error.
 		 */
 		return (0);
 	}
 	if (error == 0)
 		return (EINPROGRESS); /* consumed by IPsec */
 	return (error);
 }
 
 /*
  * IPSEC_OUTPUT() method implementation for IPv4.
  * 0 - no IPsec handling needed
  * other values - mbuf consumed by IPsec.
  */
 int
 ipsec4_output(struct mbuf *m, struct inpcb *inp)
 {
 
 	/*
 	 * If the packet is resubmitted to ip_output (e.g. after
 	 * AH, ESP, etc. processing), there will be a tag to bypass
 	 * the lookup and related policy checking.
 	 */
 	if (m_tag_find(m, PACKET_TAG_IPSEC_OUT_DONE, NULL) != NULL)
 		return (0);
 
 	return (ipsec4_common_output(m, inp, 0));
 }
 
 /*
  * IPSEC_FORWARD() method implementation for IPv4.
  * 0 - no IPsec handling needed
  * other values - mbuf consumed by IPsec.
  */
 int
 ipsec4_forward(struct mbuf *m)
 {
 
 	/*
 	 * Check if this packet has an active inbound SP and needs to be
 	 * dropped instead of forwarded.
 	 */
 	if (ipsec4_in_reject(m, NULL) != 0) {
 		m_freem(m);
 		return (EACCES);
 	}
 	return (ipsec4_common_output(m, NULL, 1));
 }
 #endif
 
 #ifdef INET6
 static int
 in6_sa_equal_addrwithscope(const struct sockaddr_in6 *sa,
     const struct in6_addr *ia)
 {
 	struct in6_addr ia2;
 
 	if (IN6_IS_SCOPE_LINKLOCAL(&sa->sin6_addr)) {
 		memcpy(&ia2, &sa->sin6_addr, sizeof(ia2));
 		ia2.s6_addr16[1] = htons(sa->sin6_scope_id);
 		return (IN6_ARE_ADDR_EQUAL(ia, &ia2));
 	}
 	return (IN6_ARE_ADDR_EQUAL(&sa->sin6_addr, ia));
 }
 
 static struct secasvar *
 ipsec6_allocsa(struct mbuf *m, struct secpolicy *sp, u_int *pidx, int *error)
 {
 	struct secasindex *saidx, tmpsaidx;
 	struct ipsecrequest *isr;
 	struct sockaddr_in6 *sin6;
 	struct secasvar *sav;
 	struct ip6_hdr *ip6;
 
 	/*
 	 * Check system global policy controls.
 	 */
 next:
 	isr = sp->req[*pidx];
 	if ((isr->saidx.proto == IPPROTO_ESP && !V_esp_enable) ||
 	    (isr->saidx.proto == IPPROTO_AH && !V_ah_enable) ||
 	    (isr->saidx.proto == IPPROTO_IPCOMP && !V_ipcomp_enable)) {
 		DPRINTF(("%s: IPsec outbound packet dropped due"
 			" to policy (check your sysctls)\n", __func__));
 		IPSEC_OSTAT_INC(isr->saidx.proto, pdrops);
 		*error = EHOSTUNREACH;
 		return (NULL);
 	}
 	/*
 	 * Craft SA index to search for proper SA.  Note that
 	 * we only fillin unspecified SA peers for transport
 	 * mode; for tunnel mode they must already be filled in.
 	 */
 	if (isr->saidx.mode == IPSEC_MODE_TRANSPORT) {
 		saidx = &tmpsaidx;
 		*saidx = isr->saidx;
 		ip6 = mtod(m, struct ip6_hdr *);
 		if (saidx->src.sin6.sin6_len == 0) {
 			sin6 = (struct sockaddr_in6 *)&saidx->src;
 			sin6->sin6_len = sizeof(*sin6);
 			sin6->sin6_family = AF_INET6;
 			sin6->sin6_port = IPSEC_PORT_ANY;
 			sin6->sin6_addr = ip6->ip6_src;
 			if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
 				/* fix scope id for comparing SPD */
 				sin6->sin6_addr.s6_addr16[1] = 0;
 				sin6->sin6_scope_id =
 				    ntohs(ip6->ip6_src.s6_addr16[1]);
 			}
 		}
 		if (saidx->dst.sin6.sin6_len == 0) {
 			sin6 = (struct sockaddr_in6 *)&saidx->dst;
 			sin6->sin6_len = sizeof(*sin6);
 			sin6->sin6_family = AF_INET6;
 			sin6->sin6_port = IPSEC_PORT_ANY;
 			sin6->sin6_addr = ip6->ip6_dst;
 			if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
 				/* fix scope id for comparing SPD */
 				sin6->sin6_addr.s6_addr16[1] = 0;
 				sin6->sin6_scope_id =
 				    ntohs(ip6->ip6_dst.s6_addr16[1]);
 			}
 		}
 	} else
 		saidx = &sp->req[*pidx]->saidx;
 	/*
 	 * Lookup SA and validate it.
 	 */
 	sav = key_allocsa_policy(sp, saidx, error);
 	if (sav == NULL) {
 		IPSEC6STAT_INC(ips_out_nosa);
 		if (*error != 0)
 			return (NULL);
 		if (ipsec_get_reqlevel(sp, *pidx) != IPSEC_LEVEL_REQUIRE) {
 			/*
 			 * We have no SA and policy that doesn't require
 			 * this IPsec transform, thus we can continue w/o
 			 * IPsec processing, i.e. return EJUSTRETURN.
 			 * But first check if there is some bundled transform.
 			 */
 			if (sp->tcount > ++(*pidx))
 				goto next;
 			*error = EJUSTRETURN;
 		}
 		return (NULL);
 	}
 	IPSEC_ASSERT(sav->tdb_xform != NULL, ("SA with NULL tdb_xform"));
 	return (sav);
 }
 
 /*
  * IPsec output logic for IPv6.
  */
 static int
 ipsec6_perform_request(struct mbuf *m, struct secpolicy *sp,
     struct inpcb *inp, u_int idx)
 {
 	struct ipsec_ctx_data ctx;
 	union sockaddr_union *dst;
 	struct secasvar *sav;
 	struct ip6_hdr *ip6;
 	int error, i, off;
 
 	IPSEC_ASSERT(idx < sp->tcount, ("Wrong IPsec request index %d", idx));
 
 	sav = ipsec6_allocsa(m, sp, &idx, &error);
 	if (sav == NULL) {
 		if (error == EJUSTRETURN) { /* No IPsec required */
 			key_freesp(&sp);
 			return (error);
 		}
 		goto bad;
 	}
 
 	/* Fix IP length in case if it is not set yet. */
 	ip6 = mtod(m, struct ip6_hdr *);
 	ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6));
 
 	IPSEC_INIT_CTX(&ctx, &m, inp, sav, AF_INET6, IPSEC_ENC_BEFORE);
 	if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0)
 		goto bad;
 
 	ip6 = mtod(m, struct ip6_hdr *); /* pfil can change mbuf */
 	dst = &sav->sah->saidx.dst;
 
 	/* Do the appropriate encapsulation, if necessary */
 	if (sp->req[idx]->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
 	    dst->sa.sa_family != AF_INET6 ||        /* PF mismatch */
 	    ((dst->sa.sa_family == AF_INET6) &&
 	     (!IN6_IS_ADDR_UNSPECIFIED(&dst->sin6.sin6_addr)) &&
 	     (!in6_sa_equal_addrwithscope(&dst->sin6, &ip6->ip6_dst)))) {
 		if (m->m_pkthdr.len - sizeof(*ip6) > IPV6_MAXPACKET) {
 			/* No jumbogram support. */
 			error = ENXIO;   /*XXX*/
 			goto bad;
 		}
 		error = ipsec_encap(&m, &sav->sah->saidx);
 		if (error != 0) {
 			DPRINTF(("%s: encapsulation for SPI 0x%08x failed "
 			    "with error %d\n", __func__, ntohl(sav->spi),
 			    error));
 			/* XXXAE: IPSEC_OSTAT_INC(tunnel); */
 			goto bad;
 		}
 		inp = NULL;
 	}
 
 	IPSEC_INIT_CTX(&ctx, &m, inp, sav, dst->sa.sa_family, IPSEC_ENC_AFTER);
 	if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0)
 		goto bad;
 
 	switch(dst->sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		{
 		struct ip *ip;
 		ip = mtod(m, struct ip *);
 		i = ip->ip_hl << 2;
 		off = offsetof(struct ip, ip_p);
 		}
 		break;
 #endif /* AF_INET */
 	case AF_INET6:
 		i = sizeof(struct ip6_hdr);
 		off = offsetof(struct ip6_hdr, ip6_nxt);
 		break;
 	default:
 		DPRINTF(("%s: unsupported protocol family %u\n",
 				 __func__, dst->sa.sa_family));
 		error = EPFNOSUPPORT;
 		IPSEC_OSTAT_INC(sav->sah->saidx.proto, nopf);
 		goto bad;
 	}
 	error = (*sav->tdb_xform->xf_output)(m, sp, sav, idx, i, off);
 	return (error);
 bad:
 	IPSEC6STAT_INC(ips_out_inval);
 	if (m != NULL)
 		m_freem(m);
 	if (sav != NULL)
 		key_freesav(&sav);
 	key_freesp(&sp);
 	return (error);
 }
 
 int
 ipsec6_process_packet(struct mbuf *m, struct secpolicy *sp,
     struct inpcb *inp)
 {
 
 	return (ipsec6_perform_request(m, sp, inp, 0));
 }
 
 /*
  * IPv6 implementation is based on IPv4 implementation.
  */
 int
 ipsec6_check_pmtu(struct mbuf *m, struct secpolicy *sp, int forwarding)
 {
 	struct secasvar *sav;
 	size_t hlen, pmtu;
 	uint32_t idx;
 	int error;
 
 	/*
 	 * According to RFC8200 L3 fragmentation is supposed to be done only on
 	 * locally generated packets. During L3 forwarding packets that are too
 	 * big are always supposed to be dropped, with an ICMPv6 packet being
 	 * sent back.
 	 */
 	if (!forwarding)
 		return (0);
 
 	idx = sp->tcount - 1;
 	sav = ipsec6_allocsa(m, sp, &idx, &error);
 	if (sav == NULL) {
 		key_freesp(&sp);
 		/*
 		 * No matching SA was found and SADB_ACQUIRE message was generated.
 		 * Since we have matched a SP to this packet drop it silently.
 		 */
 		if (error == 0)
 			error = EINPROGRESS;
 		if (error != EJUSTRETURN)
 			m_freem(m);
 
 		return (error);
 	}
 
 	pmtu = ipsec_get_pmtu(sav);
 	if (pmtu == 0) {
 		key_freesav(&sav);
 		return (0);
 	}
 
 	hlen = ipsec_hdrsiz_internal(sp);
 	key_freesav(&sav);
 
 	if (m_length(m, NULL) + hlen > pmtu) {
 		/*
 		 * If we're forwarding generate ICMPv6 message here,
 		 * so that it contains pmtu subtracted by header size.
 		 * Set error to EINPROGRESS, in order for the frame
 		 * to be dropped silently.
 		 */
 		if (forwarding) {
 			if (pmtu > hlen)
 				icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, pmtu - hlen);
 			else
 				m_freem(m);
 
 			key_freesp(&sp);
 			return (EINPROGRESS); /* Pretend that we consumed it. */
 		}
 	}
 
 	return (0);
 }
 
 static int
 ipsec6_common_output(struct mbuf *m, struct inpcb *inp, int forwarding)
 {
 	struct secpolicy *sp;
 	int error;
 
 	/* Lookup for the corresponding outbound security policy */
 	sp = ipsec6_checkpolicy(m, inp, &error, !forwarding);
 	if (sp == NULL) {
 		if (error == -EINVAL) {
 			/* Discarded by policy. */
 			m_freem(m);
 			return (EACCES);
 		}
 		return (0); /* No IPsec required. */
 	}
 
 	if (!forwarding) {
 		/*
 		 * Do delayed checksums now because we send before
 		 * this is done in the normal processing path.
 		 */
 		if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6) {
 			in6_delayed_cksum(m, m->m_pkthdr.len -
 			    sizeof(struct ip6_hdr), sizeof(struct ip6_hdr));
 			m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
 		}
 #if defined(SCTP) || defined(SCTP_SUPPORT)
 		if (m->m_pkthdr.csum_flags & CSUM_SCTP_IPV6) {
 			sctp_delayed_cksum(m, sizeof(struct ip6_hdr));
 			m->m_pkthdr.csum_flags &= ~CSUM_SCTP_IPV6;
 		}
 #endif
 	}
 
 	error = ipsec6_check_pmtu(m, sp, forwarding);
 	if (error != 0) {
 		if (error == EJUSTRETURN)
 			return (0);
 
 		return (error);
 	}
 
 	/* NB: callee frees mbuf and releases reference to SP */
 	error = ipsec6_process_packet(m, sp, inp);
 	if (error == EJUSTRETURN) {
 		/*
 		 * We had a SP with a level of 'use' and no SA. We
 		 * will just continue to process the packet without
 		 * IPsec processing and return without error.
 		 */
 		return (0);
 	}
 	if (error == 0)
 		return (EINPROGRESS); /* consumed by IPsec */
 	return (error);
 }
 
 /*
  * IPSEC_OUTPUT() method implementation for IPv6.
  * 0 - no IPsec handling needed
  * other values - mbuf consumed by IPsec.
  */
 int
 ipsec6_output(struct mbuf *m, struct inpcb *inp)
 {
 
 	/*
 	 * If the packet is resubmitted to ip_output (e.g. after
 	 * AH, ESP, etc. processing), there will be a tag to bypass
 	 * the lookup and related policy checking.
 	 */
 	if (m_tag_find(m, PACKET_TAG_IPSEC_OUT_DONE, NULL) != NULL)
 		return (0);
 
 	return (ipsec6_common_output(m, inp, 0));
 }
 
 /*
  * IPSEC_FORWARD() method implementation for IPv6.
  * 0 - no IPsec handling needed
  * other values - mbuf consumed by IPsec.
  */
 int
 ipsec6_forward(struct mbuf *m)
 {
 
 	/*
 	 * Check if this packet has an active inbound SP and needs to be
 	 * dropped instead of forwarded.
 	 */
 	if (ipsec6_in_reject(m, NULL) != 0) {
 		m_freem(m);
 		return (EACCES);
 	}
 	return (ipsec6_common_output(m, NULL, 1));
 }
 #endif /* INET6 */
 
 int
 ipsec_process_done(struct mbuf *m, struct secpolicy *sp, struct secasvar *sav,
     u_int idx)
 {
 	struct epoch_tracker et;
 	struct xform_history *xh;
 	struct secasindex *saidx;
 	struct m_tag *mtag;
 	int error;
 
 	saidx = &sav->sah->saidx;
 	switch (saidx->dst.sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		/* Fix the header length, for AH processing. */
 		mtod(m, struct ip *)->ip_len = htons(m->m_pkthdr.len);
 		break;
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:
 		/* Fix the header length, for AH processing. */
 		if (m->m_pkthdr.len < sizeof (struct ip6_hdr)) {
 			error = ENXIO;
 			goto bad;
 		}
 		if (m->m_pkthdr.len - sizeof (struct ip6_hdr) > IPV6_MAXPACKET) {
 			/* No jumbogram support. */
 			error = ENXIO;	/*?*/
 			goto bad;
 		}
 		mtod(m, struct ip6_hdr *)->ip6_plen =
 			htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
 		break;
 #endif /* INET6 */
 	default:
 		DPRINTF(("%s: unknown protocol family %u\n", __func__,
 		    saidx->dst.sa.sa_family));
 		error = ENXIO;
 		goto bad;
 	}
 
 	/*
 	 * Add a record of what we've done to the packet.
 	 */
 	mtag = m_tag_get(PACKET_TAG_IPSEC_OUT_DONE, sizeof(*xh), M_NOWAIT);
 	if (mtag == NULL) {
 		DPRINTF(("%s: could not get packet tag\n", __func__));
 		error = ENOMEM;
 		goto bad;
 	}
 
 	xh = (struct xform_history *)(mtag + 1);
 	xh->dst = saidx->dst;
 	xh->proto = saidx->proto;
 	xh->mode = saidx->mode;
 	xh->spi = sav->spi;
 	m_tag_prepend(m, mtag);
 
 	key_sa_recordxfer(sav, m);		/* record data transfer */
 
 	/*
 	 * If there's another (bundled) SA to apply, do so.
 	 * Note that this puts a burden on the kernel stack size.
 	 * If this is a problem we'll need to introduce a queue
 	 * to set the packet on so we can unwind the stack before
 	 * doing further processing.
 	 */
 	if (++idx < sp->tcount) {
 		switch (saidx->dst.sa.sa_family) {
 #ifdef INET
 		case AF_INET:
 			key_freesav(&sav);
 			IPSECSTAT_INC(ips_out_bundlesa);
 			return (ipsec4_perform_request(m, sp, NULL, idx));
 			/* NOTREACHED */
 #endif
 #ifdef INET6
 		case AF_INET6:
 			key_freesav(&sav);
 			IPSEC6STAT_INC(ips_out_bundlesa);
 			return (ipsec6_perform_request(m, sp, NULL, idx));
 			/* NOTREACHED */
 #endif /* INET6 */
 		default:
 			DPRINTF(("%s: unknown protocol family %u\n", __func__,
 			    saidx->dst.sa.sa_family));
 			error = EPFNOSUPPORT;
 			goto bad;
 		}
 	}
 
 	key_freesp(&sp), sp = NULL;	/* Release reference to SP */
-#ifdef INET
+#if defined(INET) || defined(INET6)
 	/*
 	 * Do UDP encapsulation if SA requires it.
 	 */
 	if (sav->natt != NULL) {
 		error = udp_ipsec_output(m, sav);
 		if (error != 0)
 			goto bad;
 	}
-#endif /* INET */
+#endif /* INET || INET6 */
 	/*
 	 * We're done with IPsec processing, transmit the packet using the
 	 * appropriate network protocol (IP or IPv6).
 	 */
 	NET_EPOCH_ENTER(et);
 	switch (saidx->dst.sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		key_freesav(&sav);
 		error = ip_output(m, NULL, NULL, IP_RAWOUTPUT, NULL, NULL);
 		break;
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:
 		key_freesav(&sav);
 		error = ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
 		break;
 #endif /* INET6 */
 	default:
 		panic("ipsec_process_done");
 	}
 	NET_EPOCH_EXIT(et);
 	return (error);
 bad:
 	m_freem(m);
 	key_freesav(&sav);
 	if (sp != NULL)
 		key_freesp(&sp);
 	return (error);
 }
 
 /*
  * ipsec_prepend() is optimized version of M_PREPEND().
  * ipsec_encap() is called by IPsec output routine for tunnel mode SA.
  * It is expected that after IP encapsulation some IPsec transform will
  * be performed. Each IPsec transform inserts its variable length header
  * just after outer IP header using m_makespace(). If given mbuf has not
  * enough free space at the beginning, we allocate new mbuf and reserve
  * some space at the beginning and at the end.
  * This helps avoid allocating of new mbuf and data copying in m_makespace(),
  * we place outer header in the middle of mbuf's data with reserved leading
  * and trailing space:
  *	[ LEADINGSPACE ][ Outer IP header ][ TRAILINGSPACE ]
  * LEADINGSPACE will be used to add ethernet header, TRAILINGSPACE will
  * be used to inject AH/ESP/IPCOMP header.
  */
 #define	IPSEC_TRAILINGSPACE	(sizeof(struct udphdr) +/* NAT-T */	\
     max(sizeof(struct newesp) + EALG_MAX_BLOCK_LEN,	/* ESP + IV */	\
 	sizeof(struct newah) + HASH_MAX_LEN		/* AH + ICV */))
 static struct mbuf *
 ipsec_prepend(struct mbuf *m, int len, int how)
 {
 	struct mbuf *n;
 
 	M_ASSERTPKTHDR(m);
 	IPSEC_ASSERT(len < MHLEN, ("wrong length"));
 	if (M_LEADINGSPACE(m) >= len) {
 		/* No need to allocate new mbuf. */
 		m->m_data -= len;
 		m->m_len += len;
 		m->m_pkthdr.len += len;
 		return (m);
 	}
 	n = m_gethdr(how, m->m_type);
 	if (n == NULL) {
 		m_freem(m);
 		return (NULL);
 	}
 	m_move_pkthdr(n, m);
 	n->m_next = m;
 	if (len + IPSEC_TRAILINGSPACE < M_SIZE(n))
 		m_align(n, len + IPSEC_TRAILINGSPACE);
 	n->m_len = len;
 	n->m_pkthdr.len += len;
 	return (n);
 }
 
 static size_t
 ipsec_get_pmtu(struct secasvar *sav)
 {
 	union sockaddr_union *dst;
 	struct in_conninfo inc;
 	size_t pmtu;
 
 	dst = &sav->sah->saidx.dst;
 	memset(&inc, 0, sizeof(inc));
 
 	switch (dst->sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		inc.inc_faddr = satosin(&dst->sa)->sin_addr;
 		break;
 #endif
 #ifdef INET6
 	case AF_INET6:
 		inc.inc6_faddr = satosin6(&dst->sa)->sin6_addr;
 		inc.inc_flags |= INC_ISIPV6;
 		break;
 #endif
 	default:
 		return (0);
 	}
 
 	pmtu = tcp_hc_getmtu(&inc);
 	if (pmtu != 0)
 		return (pmtu);
 
 	/* No entry in hostcache. Assume that PMTU is equal to link's MTU */
 	switch (dst->sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		pmtu = tcp_maxmtu(&inc, NULL);
 		break;
 #endif
 #ifdef INET6
 	case AF_INET6:
 		pmtu = tcp_maxmtu6(&inc, NULL);
 		break;
 #endif
 	default:
 		return (0);
 	}
 	if (pmtu == 0)
 		return (0);
 
 	tcp_hc_updatemtu(&inc, pmtu);
 
 	return (pmtu);
 }
 
 static int
 ipsec_encap(struct mbuf **mp, struct secasindex *saidx)
 {
 #ifdef INET6
 	struct ip6_hdr *ip6;
 #endif
 	struct ip *ip;
 #ifdef INET
 	int setdf;
 #endif
 	uint8_t itos, proto;
 
 	ip = mtod(*mp, struct ip *);
 	switch (ip->ip_v) {
 #ifdef INET
 	case IPVERSION:
 		proto = IPPROTO_IPIP;
 		/*
 		 * Collect IP_DF state from the inner header
 		 * and honor system-wide control of how to handle it.
 		 */
 		switch (V_ip4_ipsec_dfbit) {
 		case 0:	/* clear in outer header */
 		case 1:	/* set in outer header */
 			setdf = V_ip4_ipsec_dfbit;
 			break;
 		default:/* propagate to outer header */
 			setdf = (ip->ip_off & htons(IP_DF)) != 0;
 		}
 		itos = ip->ip_tos;
 		break;
 #endif
 #ifdef INET6
 	case (IPV6_VERSION >> 4):
 		proto = IPPROTO_IPV6;
 		ip6 = mtod(*mp, struct ip6_hdr *);
 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
 		/* scoped address handling */
 		in6_clearscope(&ip6->ip6_src);
 		in6_clearscope(&ip6->ip6_dst);
 		break;
 #endif
 	default:
 		return (EAFNOSUPPORT);
 	}
 	switch (saidx->dst.sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		if (saidx->src.sa.sa_family != AF_INET ||
 		    saidx->src.sin.sin_addr.s_addr == INADDR_ANY ||
 		    saidx->dst.sin.sin_addr.s_addr == INADDR_ANY)
 			return (EINVAL);
 		*mp = ipsec_prepend(*mp, sizeof(struct ip), M_NOWAIT);
 		if (*mp == NULL)
 			return (ENOBUFS);
 		ip = mtod(*mp, struct ip *);
 		ip->ip_v = IPVERSION;
 		ip->ip_hl = sizeof(struct ip) >> 2;
 		ip->ip_p = proto;
 		ip->ip_len = htons((*mp)->m_pkthdr.len);
 		ip->ip_ttl = V_ip_defttl;
 		ip->ip_sum = 0;
 		ip->ip_off = setdf ? htons(IP_DF): 0;
 		ip->ip_src = saidx->src.sin.sin_addr;
 		ip->ip_dst = saidx->dst.sin.sin_addr;
 		ip_ecn_ingress(V_ip4_ipsec_ecn, &ip->ip_tos, &itos);
 		ip_fillid(ip);
 		break;
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:
 		if (saidx->src.sa.sa_family != AF_INET6 ||
 		    IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr) ||
 		    IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr))
 			return (EINVAL);
 		*mp = ipsec_prepend(*mp, sizeof(struct ip6_hdr), M_NOWAIT);
 		if (*mp == NULL)
 			return (ENOBUFS);
 		ip6 = mtod(*mp, struct ip6_hdr *);
 		ip6->ip6_flow = 0;
 		ip6->ip6_vfc = IPV6_VERSION;
 		ip6->ip6_hlim = V_ip6_defhlim;
 		ip6->ip6_nxt = proto;
 		ip6->ip6_dst = saidx->dst.sin6.sin6_addr;
 		/* For link-local address embed scope zone id */
 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
 			ip6->ip6_dst.s6_addr16[1] =
 			    htons(saidx->dst.sin6.sin6_scope_id & 0xffff);
 		ip6->ip6_src = saidx->src.sin6.sin6_addr;
 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
 			ip6->ip6_src.s6_addr16[1] =
 			    htons(saidx->src.sin6.sin6_scope_id & 0xffff);
 		ip6->ip6_plen = htons((*mp)->m_pkthdr.len - sizeof(*ip6));
 		ip_ecn_ingress(V_ip6_ipsec_ecn, &proto, &itos);
 		ip6->ip6_flow |= htonl((uint32_t)proto << 20);
 		break;
 #endif /* INET6 */
 	default:
 		return (EAFNOSUPPORT);
 	}
 	(*mp)->m_flags &= ~(M_BCAST | M_MCAST);
 	return (0);
 }
diff --git a/sys/netipsec/ipsec_support.h b/sys/netipsec/ipsec_support.h
index c437879e3a2c..905b2b6cd764 100644
--- a/sys/netipsec/ipsec_support.h
+++ b/sys/netipsec/ipsec_support.h
@@ -1,222 +1,222 @@
 /*-
  * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef _NETIPSEC_IPSEC_SUPPORT_H_
 #define	_NETIPSEC_IPSEC_SUPPORT_H_
 
 #ifdef _KERNEL
 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
 struct mbuf;
 struct inpcb;
 struct tcphdr;
 struct sockopt;
 struct sockaddr;
 struct ipsec_support;
 struct tcpmd5_support;
 struct icmp;
 struct ip6ctlparam;
 
 typedef union {
 	struct icmp *icmp;
 	struct ip6ctlparam *ip6cp;
 } ipsec_ctlinput_param_t __attribute__((__transparent_union__));
 
 size_t ipsec_hdrsiz_inpcb(struct inpcb *);
 int ipsec_init_pcbpolicy(struct inpcb *);
 int ipsec_delete_pcbpolicy(struct inpcb *);
 int ipsec_copy_pcbpolicy(struct inpcb *, struct inpcb *);
 
 #ifdef INET
 int udp_ipsec_input(struct mbuf *, int, int);
 int udp_ipsec_pcbctl(struct inpcb *, struct sockopt *);
 int ipsec4_in_reject(const struct mbuf *, struct inpcb *);
 int ipsec4_input(struct mbuf *, int, int);
 int ipsec4_forward(struct mbuf *);
 int ipsec4_pcbctl(struct inpcb *, struct sockopt *);
 int ipsec4_output(struct mbuf *, struct inpcb *);
 int ipsec4_capability(struct mbuf *, u_int);
 int ipsec4_ctlinput(ipsec_ctlinput_param_t);
 #endif /* INET */
 
 #ifdef INET6
 int ipsec6_input(struct mbuf *, int, int);
 int ipsec6_in_reject(const struct mbuf *, struct inpcb *);
 int ipsec6_forward(struct mbuf *);
 int ipsec6_pcbctl(struct inpcb *, struct sockopt *);
 int ipsec6_output(struct mbuf *, struct inpcb *);
 int ipsec6_capability(struct mbuf *, u_int);
 int ipsec6_ctlinput(ipsec_ctlinput_param_t);
 #endif /* INET6 */
 
 struct ipsec_methods {
 	int	(*input)(struct mbuf *, int, int);
 	int	(*check_policy)(const struct mbuf *, struct inpcb *);
 	int	(*forward)(struct mbuf *);
 	int	(*output)(struct mbuf *, struct inpcb *);
 	int	(*pcbctl)(struct inpcb *, struct sockopt *);
 	size_t	(*hdrsize)(struct inpcb *);
 	int	(*capability)(struct mbuf *, u_int);
 	int	(*ctlinput)(ipsec_ctlinput_param_t);
 
 	int	(*udp_input)(struct mbuf *, int, int);
 	int	(*udp_pcbctl)(struct inpcb *, struct sockopt *);
 };
 #define	IPSEC_CAP_OPERABLE		1
 #define	IPSEC_CAP_BYPASS_FILTER		2
 
 struct tcpmd5_methods {
 	int	(*input)(struct mbuf *, struct tcphdr *, u_char *);
 	int	(*output)(struct mbuf *, struct tcphdr *, u_char *);
 	int	(*pcbctl)(struct inpcb *, struct sockopt *);
 };
 
 #define	IPSEC_MODULE_ENABLED	0x0001
 #define	IPSEC_ENABLED(proto)	\
     ((proto ## _ipsec_support)->enabled & IPSEC_MODULE_ENABLED)
 #define	TCPMD5_ENABLED()	IPSEC_ENABLED(tcp)
 
 #ifdef TCP_SIGNATURE
 /* TCP-MD5 build in the kernel */
 struct tcpmd5_support {
 	const u_int enabled;
 	const struct tcpmd5_methods * const methods;
 };
 extern const struct tcpmd5_support * const tcp_ipsec_support;
 
 #define	TCPMD5_INPUT(m, ...)		\
     (*tcp_ipsec_support->methods->input)(m, __VA_ARGS__)
 #define	TCPMD5_OUTPUT(m, ...)		\
     (*tcp_ipsec_support->methods->output)(m, __VA_ARGS__)
 #define	TCPMD5_PCBCTL(inp, sopt)	\
     (*tcp_ipsec_support->methods->pcbctl)(inp, sopt)
 #elif defined(IPSEC_SUPPORT)
 /* TCP-MD5 build as module */
 struct tcpmd5_support {
 	volatile u_int enabled;
 	const struct tcpmd5_methods * volatile methods;
 };
 extern struct tcpmd5_support * const tcp_ipsec_support;
 
 void tcpmd5_support_enable(const struct tcpmd5_methods * const);
 void tcpmd5_support_disable(void);
 
 int tcpmd5_kmod_pcbctl(struct tcpmd5_support * const, struct inpcb *,
     struct sockopt *);
 int tcpmd5_kmod_input(struct tcpmd5_support * const, struct mbuf *,
     struct tcphdr *, u_char *);
 int tcpmd5_kmod_output(struct tcpmd5_support * const, struct mbuf *,
     struct tcphdr *, u_char *);
 #define	TCPMD5_INPUT(m, ...)		\
     tcpmd5_kmod_input(tcp_ipsec_support, m, __VA_ARGS__)
 #define	TCPMD5_OUTPUT(m, ...)		\
     tcpmd5_kmod_output(tcp_ipsec_support, m, __VA_ARGS__)
 #define	TCPMD5_PCBCTL(inp, sopt)	\
     tcpmd5_kmod_pcbctl(tcp_ipsec_support, inp, sopt)
 #endif
 
 #endif /* IPSEC || IPSEC_SUPPORT */
 
 #if defined(IPSEC)
 struct ipsec_support {
 	const u_int enabled;
 	const struct ipsec_methods * const methods;
 };
 extern const struct ipsec_support * const ipv4_ipsec_support;
 extern const struct ipsec_support * const ipv6_ipsec_support;
 
 #define	IPSEC_INPUT(proto, m, ...)		\
     (*(proto ## _ipsec_support)->methods->input)(m, __VA_ARGS__)
 #define	IPSEC_CHECK_POLICY(proto, m, ...)	\
     (*(proto ## _ipsec_support)->methods->check_policy)(m, __VA_ARGS__)
 #define	IPSEC_FORWARD(proto, m)		\
     (*(proto ## _ipsec_support)->methods->forward)(m)
 #define	IPSEC_OUTPUT(proto, m, ...)		\
     (*(proto ## _ipsec_support)->methods->output)(m, __VA_ARGS__)
 #define	IPSEC_PCBCTL(proto, inp, sopt)		\
     (*(proto ## _ipsec_support)->methods->pcbctl)(inp, sopt)
 #define	IPSEC_CAPS(proto, m, ...)		\
     (*(proto ## _ipsec_support)->methods->capability)(m, __VA_ARGS__)
 #define	IPSEC_HDRSIZE(proto, inp)		\
     (*(proto ## _ipsec_support)->methods->hdrsize)(inp)
 #define	IPSEC_CTLINPUT(proto, param)		\
     (*(proto ## _ipsec_support)->methods->ctlinput)(param)
 
-#define	UDPENCAP_INPUT(m, ...)			\
-    (*ipv4_ipsec_support->methods->udp_input)(m, __VA_ARGS__)
-#define	UDPENCAP_PCBCTL(inp, sopt)		\
-    (*ipv4_ipsec_support->methods->udp_pcbctl)(inp, sopt)
+#define	UDPENCAP_INPUT(proto, m, ...)			\
+    (*(proto ## _ipsec_support)->methods->udp_input)(m, __VA_ARGS__)
+#define	UDPENCAP_PCBCTL(proto, inp, sopt)		\
+    (*(proto ## _ipsec_support)->methods->udp_pcbctl)(inp, sopt)
 
 #elif defined(IPSEC_SUPPORT)
 struct ipsec_support {
 	volatile u_int enabled;
 	const struct ipsec_methods * volatile methods;
 };
 extern struct ipsec_support * const ipv4_ipsec_support;
 extern struct ipsec_support * const ipv6_ipsec_support;
 
 void ipsec_support_enable(struct ipsec_support * const,
     const struct ipsec_methods * const);
 void ipsec_support_disable(struct ipsec_support * const);
 
 int ipsec_kmod_input(struct ipsec_support * const, struct mbuf *, int, int);
 int ipsec_kmod_check_policy(struct ipsec_support * const, struct mbuf *,
     struct inpcb *);
 int ipsec_kmod_forward(struct ipsec_support * const, struct mbuf *);
 int ipsec_kmod_output(struct ipsec_support * const, struct mbuf *,
     struct inpcb *);
 int ipsec_kmod_pcbctl(struct ipsec_support * const, struct inpcb *,
     struct sockopt *);
 int ipsec_kmod_capability(struct ipsec_support * const, struct mbuf *, u_int);
 size_t ipsec_kmod_hdrsize(struct ipsec_support * const, struct inpcb *);
 int ipsec_kmod_ctlinput(struct ipsec_support *, ipsec_ctlinput_param_t);
 int ipsec_kmod_udp_input(struct ipsec_support * const, struct mbuf *, int, int);
 int ipsec_kmod_udp_pcbctl(struct ipsec_support * const, struct inpcb *,
     struct sockopt *);
 
-#define	UDPENCAP_INPUT(m, ...)		\
-    ipsec_kmod_udp_input(ipv4_ipsec_support, m, __VA_ARGS__)
-#define	UDPENCAP_PCBCTL(inp, sopt)	\
-    ipsec_kmod_udp_pcbctl(ipv4_ipsec_support, inp, sopt)
+#define	UDPENCAP_INPUT(proto, m, ...)		\
+    ipsec_kmod_udp_input(proto ## _ipsec_support, m, __VA_ARGS__)
+#define	UDPENCAP_PCBCTL(proto, inp, sopt)	\
+    ipsec_kmod_udp_pcbctl(proto ## _ipsec_support, inp, sopt)
 
 #define	IPSEC_INPUT(proto, ...)		\
     ipsec_kmod_input(proto ## _ipsec_support, __VA_ARGS__)
 #define	IPSEC_CHECK_POLICY(proto, ...)	\
     ipsec_kmod_check_policy(proto ## _ipsec_support, __VA_ARGS__)
 #define	IPSEC_FORWARD(proto, ...)	\
     ipsec_kmod_forward(proto ## _ipsec_support, __VA_ARGS__)
 #define	IPSEC_OUTPUT(proto, ...)	\
     ipsec_kmod_output(proto ## _ipsec_support, __VA_ARGS__)
 #define	IPSEC_PCBCTL(proto, ...)	\
     ipsec_kmod_pcbctl(proto ## _ipsec_support, __VA_ARGS__)
 #define	IPSEC_CAPS(proto, ...)		\
     ipsec_kmod_capability(proto ## _ipsec_support, __VA_ARGS__)
 #define	IPSEC_HDRSIZE(proto, ...)	\
     ipsec_kmod_hdrsize(proto ## _ipsec_support, __VA_ARGS__)
 #define	IPSEC_CTLINPUT(proto, ...)	\
     ipsec_kmod_ctlinput(proto ## _ipsec_support, __VA_ARGS__)
 #endif /* IPSEC_SUPPORT */
 #endif /* _KERNEL */
 #endif /* _NETIPSEC_IPSEC_SUPPORT_H_ */
diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c
index 772602eeea90..a077f8007e47 100644
--- a/sys/netipsec/key.c
+++ b/sys/netipsec/key.c
@@ -1,8645 +1,8711 @@
 /*	$KAME: key.c,v 1.191 2001/06/27 10:46:49 sakane Exp $	*/
 
 /*-
  * SPDX-License-Identifier: BSD-3-Clause
  *
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 
 /*
  * This code is referd to RFC 2367
  */
 
 #include "opt_inet.h"
 #include "opt_inet6.h"
 #include "opt_ipsec.h"
 
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/fnv_hash.h>
 #include <sys/lock.h>
 #include <sys/mutex.h>
 #include <sys/mbuf.h>
 #include <sys/domain.h>
 #include <sys/protosw.h>
 #include <sys/malloc.h>
 #include <sys/rmlock.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
 #include <sys/sysctl.h>
 #include <sys/errno.h>
 #include <sys/proc.h>
 #include <sys/queue.h>
 #include <sys/refcount.h>
 #include <sys/syslog.h>
 
 #include <vm/uma.h>
 
 #include <net/if.h>
 #include <net/if_var.h>
 #include <net/vnet.h>
 
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
 #include <netinet/in_var.h>
 #include <netinet/udp.h>
 
 #ifdef INET6
 #include <netinet/ip6.h>
 #include <netinet6/in6_var.h>
 #include <netinet6/ip6_var.h>
 #endif /* INET6 */
 
 #include <net/pfkeyv2.h>
 #include <netipsec/keydb.h>
 #include <netipsec/key.h>
 #include <netipsec/keysock.h>
 #include <netipsec/key_debug.h>
 
 #include <netipsec/ipsec.h>
 #ifdef INET6
 #include <netipsec/ipsec6.h>
 #endif
 
 #include <netipsec/xform.h>
 #include <machine/in_cksum.h>
 #include <machine/stdarg.h>
 
 /* randomness */
 #include <sys/random.h>
 
 #define FULLMASK	0xff
 #define	_BITS(bytes)	((bytes) << 3)
 
 #define	UINT32_80PCT	0xcccccccc
 /*
  * Note on SA reference counting:
  * - SAs that are not in DEAD state will have (total external reference + 1)
  *   following value in reference count field.  they cannot be freed and are
  *   referenced from SA header.
  * - SAs that are in DEAD state will have (total external reference)
  *   in reference count field.  they are ready to be freed.  reference from
  *   SA header will be removed in key_delsav(), when the reference count
  *   field hits 0 (= no external reference other than from SA header.
  */
 
 VNET_DEFINE(u_int32_t, key_debug_level) = 0;
 VNET_DEFINE_STATIC(u_int, key_spi_trycnt) = 1000;
 VNET_DEFINE_STATIC(u_int32_t, key_spi_minval) = 0x100;
 VNET_DEFINE_STATIC(u_int32_t, key_spi_maxval) = 0x0fffffff;	/* XXX */
 VNET_DEFINE_STATIC(u_int32_t, policy_id) = 0;
 /*interval to initialize randseed,1(m)*/
 VNET_DEFINE_STATIC(u_int, key_int_random) = 60;
 /* interval to expire acquiring, 30(s)*/
 VNET_DEFINE_STATIC(u_int, key_larval_lifetime) = 30;
 /* counter for blocking SADB_ACQUIRE.*/
 VNET_DEFINE_STATIC(int, key_blockacq_count) = 10;
 /* lifetime for blocking SADB_ACQUIRE.*/
 VNET_DEFINE_STATIC(int, key_blockacq_lifetime) = 20;
 /* preferred old sa rather than new sa.*/
 VNET_DEFINE_STATIC(int, key_preferred_oldsa) = 1;
 #define	V_key_spi_trycnt	VNET(key_spi_trycnt)
 #define	V_key_spi_minval	VNET(key_spi_minval)
 #define	V_key_spi_maxval	VNET(key_spi_maxval)
 #define	V_policy_id		VNET(policy_id)
 #define	V_key_int_random	VNET(key_int_random)
 #define	V_key_larval_lifetime	VNET(key_larval_lifetime)
 #define	V_key_blockacq_count	VNET(key_blockacq_count)
 #define	V_key_blockacq_lifetime	VNET(key_blockacq_lifetime)
 #define	V_key_preferred_oldsa	VNET(key_preferred_oldsa)
 
 VNET_DEFINE_STATIC(u_int32_t, acq_seq) = 0;
 #define	V_acq_seq		VNET(acq_seq)
 
 VNET_DEFINE_STATIC(uint32_t, sp_genid) = 0;
 #define	V_sp_genid		VNET(sp_genid)
 
 /* SPD */
 TAILQ_HEAD(secpolicy_queue, secpolicy);
 LIST_HEAD(secpolicy_list, secpolicy);
 VNET_DEFINE_STATIC(struct secpolicy_queue, sptree[IPSEC_DIR_MAX]);
 VNET_DEFINE_STATIC(struct secpolicy_queue, sptree_ifnet[IPSEC_DIR_MAX]);
 static struct rmlock sptree_lock;
 #define	V_sptree		VNET(sptree)
 #define	V_sptree_ifnet		VNET(sptree_ifnet)
 #define	SPTREE_LOCK_INIT()      rm_init(&sptree_lock, "sptree")
 #define	SPTREE_LOCK_DESTROY()   rm_destroy(&sptree_lock)
 #define	SPTREE_RLOCK_TRACKER    struct rm_priotracker sptree_tracker
 #define	SPTREE_RLOCK()          rm_rlock(&sptree_lock, &sptree_tracker)
 #define	SPTREE_RUNLOCK()        rm_runlock(&sptree_lock, &sptree_tracker)
 #define	SPTREE_RLOCK_ASSERT()   rm_assert(&sptree_lock, RA_RLOCKED)
 #define	SPTREE_WLOCK()          rm_wlock(&sptree_lock)
 #define	SPTREE_WUNLOCK()        rm_wunlock(&sptree_lock)
 #define	SPTREE_WLOCK_ASSERT()   rm_assert(&sptree_lock, RA_WLOCKED)
 #define	SPTREE_UNLOCK_ASSERT()  rm_assert(&sptree_lock, RA_UNLOCKED)
 
 /* Hash table for lookup SP using unique id */
 VNET_DEFINE_STATIC(struct secpolicy_list *, sphashtbl);
 VNET_DEFINE_STATIC(u_long, sphash_mask);
 #define	V_sphashtbl		VNET(sphashtbl)
 #define	V_sphash_mask		VNET(sphash_mask)
 
 #define	SPHASH_NHASH_LOG2	7
 #define	SPHASH_NHASH		(1 << SPHASH_NHASH_LOG2)
 #define	SPHASH_HASHVAL(id)	(key_u32hash(id) & V_sphash_mask)
 #define	SPHASH_HASH(id)		&V_sphashtbl[SPHASH_HASHVAL(id)]
 
 /* SPD cache */
 struct spdcache_entry {
    struct secpolicyindex spidx;	/* secpolicyindex */
    struct secpolicy *sp;	/* cached policy to be used */
 
    LIST_ENTRY(spdcache_entry) chain;
 };
 LIST_HEAD(spdcache_entry_list, spdcache_entry);
 
 #define	SPDCACHE_MAX_ENTRIES_PER_HASH	8
 
 VNET_DEFINE_STATIC(u_int, key_spdcache_maxentries) = 0;
 #define	V_key_spdcache_maxentries	VNET(key_spdcache_maxentries)
 VNET_DEFINE_STATIC(u_int, key_spdcache_threshold) = 32;
 #define	V_key_spdcache_threshold	VNET(key_spdcache_threshold)
 VNET_DEFINE_STATIC(unsigned long, spd_size) = 0;
 #define	V_spd_size		VNET(spd_size)
 
 #define SPDCACHE_ENABLED()	(V_key_spdcache_maxentries != 0)
 #define SPDCACHE_ACTIVE() \
 	(SPDCACHE_ENABLED() && V_spd_size >= V_key_spdcache_threshold)
 
 VNET_DEFINE_STATIC(struct spdcache_entry_list *, spdcachehashtbl);
 VNET_DEFINE_STATIC(u_long, spdcachehash_mask);
 #define	V_spdcachehashtbl	VNET(spdcachehashtbl)
 #define	V_spdcachehash_mask	VNET(spdcachehash_mask)
 
 #define	SPDCACHE_HASHVAL(idx) \
 	(key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->ul_proto) &  \
 	    V_spdcachehash_mask)
 
 /* Each cache line is protected by a mutex */
 VNET_DEFINE_STATIC(struct mtx *, spdcache_lock);
 #define	V_spdcache_lock		VNET(spdcache_lock)
 
 #define	SPDCACHE_LOCK_INIT(a) \
 	mtx_init(&V_spdcache_lock[a], "spdcache", \
 	    "fast ipsec SPD cache", MTX_DEF|MTX_DUPOK)
 #define	SPDCACHE_LOCK_DESTROY(a)	mtx_destroy(&V_spdcache_lock[a])
 #define	SPDCACHE_LOCK(a)		mtx_lock(&V_spdcache_lock[a]);
 #define	SPDCACHE_UNLOCK(a)		mtx_unlock(&V_spdcache_lock[a]);
 
 static struct sx spi_alloc_lock;
 #define	SPI_ALLOC_LOCK_INIT()		sx_init(&spi_alloc_lock, "spialloc")
 #define	SPI_ALLOC_LOCK_DESTROY()	sx_destroy(&spi_alloc_lock)
 #define	SPI_ALLOC_LOCK()          	sx_xlock(&spi_alloc_lock)
 #define	SPI_ALLOC_UNLOCK()        	sx_unlock(&spi_alloc_lock)
 #define	SPI_ALLOC_LOCK_ASSERT()   	sx_assert(&spi_alloc_lock, SA_XLOCKED)
 
 /* SAD */
 TAILQ_HEAD(secashead_queue, secashead);
 LIST_HEAD(secashead_list, secashead);
 VNET_DEFINE_STATIC(struct secashead_queue, sahtree);
 static struct rmlock sahtree_lock;
 #define	V_sahtree		VNET(sahtree)
 #define	SAHTREE_LOCK_INIT()	rm_init(&sahtree_lock, "sahtree")
 #define	SAHTREE_LOCK_DESTROY()	rm_destroy(&sahtree_lock)
 #define	SAHTREE_RLOCK_TRACKER	struct rm_priotracker sahtree_tracker
 #define	SAHTREE_RLOCK()		rm_rlock(&sahtree_lock, &sahtree_tracker)
 #define	SAHTREE_RUNLOCK()	rm_runlock(&sahtree_lock, &sahtree_tracker)
 #define	SAHTREE_RLOCK_ASSERT()	rm_assert(&sahtree_lock, RA_RLOCKED)
 #define	SAHTREE_WLOCK()		rm_wlock(&sahtree_lock)
 #define	SAHTREE_WUNLOCK()	rm_wunlock(&sahtree_lock)
 #define	SAHTREE_WLOCK_ASSERT()	rm_assert(&sahtree_lock, RA_WLOCKED)
 #define	SAHTREE_UNLOCK_ASSERT()	rm_assert(&sahtree_lock, RA_UNLOCKED)
 
 /* Hash table for lookup in SAD using SA addresses */
 VNET_DEFINE_STATIC(struct secashead_list *, sahaddrhashtbl);
 VNET_DEFINE_STATIC(u_long, sahaddrhash_mask);
 #define	V_sahaddrhashtbl	VNET(sahaddrhashtbl)
 #define	V_sahaddrhash_mask	VNET(sahaddrhash_mask)
 
 #define	SAHHASH_NHASH_LOG2	7
 #define	SAHHASH_NHASH		(1 << SAHHASH_NHASH_LOG2)
 #define	SAHADDRHASH_HASHVAL(idx)	\
 	(key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->proto) & \
 	    V_sahaddrhash_mask)
 #define	SAHADDRHASH_HASH(saidx)		\
     &V_sahaddrhashtbl[SAHADDRHASH_HASHVAL(saidx)]
 
 /* Hash table for lookup in SAD using SPI */
 LIST_HEAD(secasvar_list, secasvar);
 VNET_DEFINE_STATIC(struct secasvar_list *, savhashtbl);
 VNET_DEFINE_STATIC(u_long, savhash_mask);
 #define	V_savhashtbl		VNET(savhashtbl)
 #define	V_savhash_mask		VNET(savhash_mask)
 #define	SAVHASH_NHASH_LOG2	7
 #define	SAVHASH_NHASH		(1 << SAVHASH_NHASH_LOG2)
 #define	SAVHASH_HASHVAL(spi)	(key_u32hash(spi) & V_savhash_mask)
 #define	SAVHASH_HASH(spi)	&V_savhashtbl[SAVHASH_HASHVAL(spi)]
 
 static uint32_t
 key_addrprotohash(const union sockaddr_union *src,
     const union sockaddr_union *dst, const uint8_t *proto)
 {
 	uint32_t hval;
 
 	hval = fnv_32_buf(proto, sizeof(*proto),
 	    FNV1_32_INIT);
 	switch (dst->sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		hval = fnv_32_buf(&src->sin.sin_addr,
 		    sizeof(in_addr_t), hval);
 		hval = fnv_32_buf(&dst->sin.sin_addr,
 		    sizeof(in_addr_t), hval);
 		break;
 #endif
 #ifdef INET6
 	case AF_INET6:
 		hval = fnv_32_buf(&src->sin6.sin6_addr,
 		    sizeof(struct in6_addr), hval);
 		hval = fnv_32_buf(&dst->sin6.sin6_addr,
 		    sizeof(struct in6_addr), hval);
 		break;
 #endif
 	default:
 		hval = 0;
 		ipseclog((LOG_DEBUG, "%s: unknown address family %d\n",
 		    __func__, dst->sa.sa_family));
 	}
 	return (hval);
 }
 
 static uint32_t
 key_u32hash(uint32_t val)
 {
 
 	return (fnv_32_buf(&val, sizeof(val), FNV1_32_INIT));
 }
 
 							/* registed list */
 VNET_DEFINE_STATIC(LIST_HEAD(_regtree, secreg), regtree[SADB_SATYPE_MAX + 1]);
 #define	V_regtree		VNET(regtree)
 static struct mtx regtree_lock;
 #define	REGTREE_LOCK_INIT() \
 	mtx_init(&regtree_lock, "regtree", "fast ipsec regtree", MTX_DEF)
 #define	REGTREE_LOCK_DESTROY()	mtx_destroy(&regtree_lock)
 #define	REGTREE_LOCK()		mtx_lock(&regtree_lock)
 #define	REGTREE_UNLOCK()	mtx_unlock(&regtree_lock)
 #define	REGTREE_LOCK_ASSERT()	mtx_assert(&regtree_lock, MA_OWNED)
 
 /* Acquiring list */
 LIST_HEAD(secacq_list, secacq);
 VNET_DEFINE_STATIC(struct secacq_list, acqtree);
 #define	V_acqtree		VNET(acqtree)
 static struct mtx acq_lock;
 #define	ACQ_LOCK_INIT() \
     mtx_init(&acq_lock, "acqtree", "ipsec SA acquiring list", MTX_DEF)
 #define	ACQ_LOCK_DESTROY()	mtx_destroy(&acq_lock)
 #define	ACQ_LOCK()		mtx_lock(&acq_lock)
 #define	ACQ_UNLOCK()		mtx_unlock(&acq_lock)
 #define	ACQ_LOCK_ASSERT()	mtx_assert(&acq_lock, MA_OWNED)
 
 /* Hash table for lookup in ACQ list using SA addresses */
 VNET_DEFINE_STATIC(struct secacq_list *, acqaddrhashtbl);
 VNET_DEFINE_STATIC(u_long, acqaddrhash_mask);
 #define	V_acqaddrhashtbl	VNET(acqaddrhashtbl)
 #define	V_acqaddrhash_mask	VNET(acqaddrhash_mask)
 
 /* Hash table for lookup in ACQ list using SEQ number */
 VNET_DEFINE_STATIC(struct secacq_list *, acqseqhashtbl);
 VNET_DEFINE_STATIC(u_long, acqseqhash_mask);
 #define	V_acqseqhashtbl		VNET(acqseqhashtbl)
 #define	V_acqseqhash_mask	VNET(acqseqhash_mask)
 
 #define	ACQHASH_NHASH_LOG2	7
 #define	ACQHASH_NHASH		(1 << ACQHASH_NHASH_LOG2)
 #define	ACQADDRHASH_HASHVAL(idx)	\
 	(key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->proto) & \
 	    V_acqaddrhash_mask)
 #define	ACQSEQHASH_HASHVAL(seq)		\
     (key_u32hash(seq) & V_acqseqhash_mask)
 #define	ACQADDRHASH_HASH(saidx)	\
     &V_acqaddrhashtbl[ACQADDRHASH_HASHVAL(saidx)]
 #define	ACQSEQHASH_HASH(seq)	\
     &V_acqseqhashtbl[ACQSEQHASH_HASHVAL(seq)]
 							/* SP acquiring list */
 VNET_DEFINE_STATIC(LIST_HEAD(_spacqtree, secspacq), spacqtree);
 #define	V_spacqtree		VNET(spacqtree)
 static struct mtx spacq_lock;
 #define	SPACQ_LOCK_INIT() \
 	mtx_init(&spacq_lock, "spacqtree", \
 		"fast ipsec security policy acquire list", MTX_DEF)
 #define	SPACQ_LOCK_DESTROY()	mtx_destroy(&spacq_lock)
 #define	SPACQ_LOCK()		mtx_lock(&spacq_lock)
 #define	SPACQ_UNLOCK()		mtx_unlock(&spacq_lock)
 #define	SPACQ_LOCK_ASSERT()	mtx_assert(&spacq_lock, MA_OWNED)
 
 static const int minsize[] = {
 	[SADB_EXT_RESERVED] = sizeof(struct sadb_msg),
 	[SADB_EXT_SA] = sizeof(struct sadb_sa),
 	[SADB_EXT_LIFETIME_CURRENT] = sizeof(struct sadb_lifetime),
 	[SADB_EXT_LIFETIME_HARD] = sizeof(struct sadb_lifetime),
 	[SADB_EXT_LIFETIME_SOFT] = sizeof(struct sadb_lifetime),
 	[SADB_EXT_ADDRESS_SRC] = sizeof(struct sadb_address),
 	[SADB_EXT_ADDRESS_DST] = sizeof(struct sadb_address),
 	[SADB_EXT_ADDRESS_PROXY] = sizeof(struct sadb_address),
 	[SADB_EXT_KEY_AUTH] = sizeof(struct sadb_key),
 	[SADB_EXT_KEY_ENCRYPT] = sizeof(struct sadb_key),
 	[SADB_EXT_IDENTITY_SRC] = sizeof(struct sadb_ident),
 	[SADB_EXT_IDENTITY_DST] = sizeof(struct sadb_ident),
 	[SADB_EXT_SENSITIVITY] = sizeof(struct sadb_sens),
 	[SADB_EXT_PROPOSAL] = sizeof(struct sadb_prop),
 	[SADB_EXT_SUPPORTED_AUTH] = sizeof(struct sadb_supported),
 	[SADB_EXT_SUPPORTED_ENCRYPT] = sizeof(struct sadb_supported),
 	[SADB_EXT_SPIRANGE] = sizeof(struct sadb_spirange),
 	[SADB_X_EXT_KMPRIVATE] = 0,
 	[SADB_X_EXT_POLICY] = sizeof(struct sadb_x_policy),
 	[SADB_X_EXT_SA2] = sizeof(struct sadb_x_sa2),
 	[SADB_X_EXT_NAT_T_TYPE] = sizeof(struct sadb_x_nat_t_type),
 	[SADB_X_EXT_NAT_T_SPORT] = sizeof(struct sadb_x_nat_t_port),
 	[SADB_X_EXT_NAT_T_DPORT] = sizeof(struct sadb_x_nat_t_port),
 	[SADB_X_EXT_NAT_T_OAI] = sizeof(struct sadb_address),
 	[SADB_X_EXT_NAT_T_OAR] = sizeof(struct sadb_address),
 	[SADB_X_EXT_NAT_T_FRAG] = sizeof(struct sadb_x_nat_t_frag),
 	[SADB_X_EXT_SA_REPLAY] = sizeof(struct sadb_x_sa_replay),
 	[SADB_X_EXT_NEW_ADDRESS_SRC] = sizeof(struct sadb_address),
 	[SADB_X_EXT_NEW_ADDRESS_DST] = sizeof(struct sadb_address),
 };
 _Static_assert(nitems(minsize) == SADB_EXT_MAX + 1, "minsize size mismatch");
 
 static const int maxsize[] = {
 	[SADB_EXT_RESERVED] = sizeof(struct sadb_msg),
 	[SADB_EXT_SA] = sizeof(struct sadb_sa),
 	[SADB_EXT_LIFETIME_CURRENT] = sizeof(struct sadb_lifetime),
 	[SADB_EXT_LIFETIME_HARD] = sizeof(struct sadb_lifetime),
 	[SADB_EXT_LIFETIME_SOFT] = sizeof(struct sadb_lifetime),
 	[SADB_EXT_ADDRESS_SRC] = 0,
 	[SADB_EXT_ADDRESS_DST] = 0,
 	[SADB_EXT_ADDRESS_PROXY] = 0,
 	[SADB_EXT_KEY_AUTH] = 0,
 	[SADB_EXT_KEY_ENCRYPT] = 0,
 	[SADB_EXT_IDENTITY_SRC] = 0,
 	[SADB_EXT_IDENTITY_DST] = 0,
 	[SADB_EXT_SENSITIVITY] = 0,
 	[SADB_EXT_PROPOSAL] = 0,
 	[SADB_EXT_SUPPORTED_AUTH] = 0,
 	[SADB_EXT_SUPPORTED_ENCRYPT] = 0,
 	[SADB_EXT_SPIRANGE] = sizeof(struct sadb_spirange),
 	[SADB_X_EXT_KMPRIVATE] = 0,
 	[SADB_X_EXT_POLICY] = 0,
 	[SADB_X_EXT_SA2] = sizeof(struct sadb_x_sa2),
 	[SADB_X_EXT_NAT_T_TYPE] = sizeof(struct sadb_x_nat_t_type),
 	[SADB_X_EXT_NAT_T_SPORT] = sizeof(struct sadb_x_nat_t_port),
 	[SADB_X_EXT_NAT_T_DPORT] = sizeof(struct sadb_x_nat_t_port),
 	[SADB_X_EXT_NAT_T_OAI] = 0,
 	[SADB_X_EXT_NAT_T_OAR] = 0,
 	[SADB_X_EXT_NAT_T_FRAG] = sizeof(struct sadb_x_nat_t_frag),
 	[SADB_X_EXT_SA_REPLAY] = sizeof(struct sadb_x_sa_replay),
 	[SADB_X_EXT_NEW_ADDRESS_SRC] = 0,
 	[SADB_X_EXT_NEW_ADDRESS_DST] = 0,
 };
 _Static_assert(nitems(maxsize) == SADB_EXT_MAX + 1, "maxsize size mismatch");
 
 /*
  * Internal values for SA flags:
  * SADB_X_EXT_F_CLONED means that SA was cloned by key_updateaddresses,
  *	thus we will not free the most of SA content in key_delsav().
  */
 #define	SADB_X_EXT_F_CLONED	0x80000000
 
 #define	SADB_CHECKLEN(_mhp, _ext)			\
     ((_mhp)->extlen[(_ext)] < minsize[(_ext)] || (maxsize[(_ext)] != 0 && \
 	((_mhp)->extlen[(_ext)] > maxsize[(_ext)])))
 #define	SADB_CHECKHDR(_mhp, _ext)	((_mhp)->ext[(_ext)] == NULL)
 
 VNET_DEFINE_STATIC(int, ipsec_esp_keymin) = 256;
 VNET_DEFINE_STATIC(int, ipsec_esp_auth) = 0;
 VNET_DEFINE_STATIC(int, ipsec_ah_keymin) = 128;
 
 #define	V_ipsec_esp_keymin	VNET(ipsec_esp_keymin)
 #define	V_ipsec_esp_auth	VNET(ipsec_esp_auth)
 #define	V_ipsec_ah_keymin	VNET(ipsec_ah_keymin)
 
 #ifdef IPSEC_DEBUG
 VNET_DEFINE(int, ipsec_debug) = 1;
 #else
 VNET_DEFINE(int, ipsec_debug) = 0;
 #endif
 
 #ifdef INET
 SYSCTL_DECL(_net_inet_ipsec);
 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG, debug,
     CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_debug), 0,
     "Enable IPsec debugging output when set.");
 #endif
 #ifdef INET6
 SYSCTL_DECL(_net_inet6_ipsec6);
 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG, debug,
     CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_debug), 0,
     "Enable IPsec debugging output when set.");
 #endif
 
 SYSCTL_INT(_net_key, KEYCTL_DEBUG_LEVEL,	debug,
 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_debug_level), 0, "");
 
 /* max count of trial for the decision of spi value */
 SYSCTL_INT(_net_key, KEYCTL_SPI_TRY, spi_trycnt,
 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_trycnt), 0, "");
 
 /* minimum spi value to allocate automatically. */
 SYSCTL_INT(_net_key, KEYCTL_SPI_MIN_VALUE, spi_minval,
 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_minval), 0, "");
 
 /* maximun spi value to allocate automatically. */
 SYSCTL_INT(_net_key, KEYCTL_SPI_MAX_VALUE, spi_maxval,
 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_maxval), 0, "");
 
 /* interval to initialize randseed */
 SYSCTL_INT(_net_key, KEYCTL_RANDOM_INT, int_random,
 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_int_random), 0, "");
 
 /* lifetime for larval SA */
 SYSCTL_INT(_net_key, KEYCTL_LARVAL_LIFETIME, larval_lifetime,
 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_larval_lifetime), 0, "");
 
 /* counter for blocking to send SADB_ACQUIRE to IKEd */
 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_COUNT, blockacq_count,
 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_blockacq_count), 0, "");
 
 /* lifetime for blocking to send SADB_ACQUIRE to IKEd */
 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_LIFETIME, blockacq_lifetime,
 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_blockacq_lifetime), 0, "");
 
 /* ESP auth */
 SYSCTL_INT(_net_key, KEYCTL_ESP_AUTH, esp_auth,
 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_esp_auth), 0, "");
 
 /* minimum ESP key length */
 SYSCTL_INT(_net_key, KEYCTL_ESP_KEYMIN, esp_keymin,
 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_esp_keymin), 0, "");
 
 /* minimum AH key length */
 SYSCTL_INT(_net_key, KEYCTL_AH_KEYMIN, ah_keymin,
 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_ah_keymin), 0, "");
 
 /* perfered old SA rather than new SA */
 SYSCTL_INT(_net_key, KEYCTL_PREFERED_OLDSA, preferred_oldsa,
 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_preferred_oldsa), 0, "");
 
 SYSCTL_NODE(_net_key, OID_AUTO, spdcache, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
     "SPD cache");
 
 SYSCTL_UINT(_net_key_spdcache, OID_AUTO, maxentries,
 	CTLFLAG_VNET | CTLFLAG_RDTUN, &VNET_NAME(key_spdcache_maxentries), 0,
 	"Maximum number of entries in the SPD cache"
 	" (power of 2, 0 to disable)");
 
 SYSCTL_UINT(_net_key_spdcache, OID_AUTO, threshold,
 	CTLFLAG_VNET | CTLFLAG_RDTUN, &VNET_NAME(key_spdcache_threshold), 0,
 	"Number of SPs that make the SPD cache active");
 
 #define __LIST_CHAINED(elm) \
 	(!((elm)->chain.le_next == NULL && (elm)->chain.le_prev == NULL))
 
 MALLOC_DEFINE(M_IPSEC_SA, "secasvar", "ipsec security association");
 MALLOC_DEFINE(M_IPSEC_SAH, "sahead", "ipsec sa head");
 MALLOC_DEFINE(M_IPSEC_SP, "ipsecpolicy", "ipsec security policy");
 MALLOC_DEFINE(M_IPSEC_SR, "ipsecrequest", "ipsec security request");
 MALLOC_DEFINE(M_IPSEC_MISC, "ipsec-misc", "ipsec miscellaneous");
 MALLOC_DEFINE(M_IPSEC_SAQ, "ipsec-saq", "ipsec sa acquire");
 MALLOC_DEFINE(M_IPSEC_SAR, "ipsec-reg", "ipsec sa acquire");
 MALLOC_DEFINE(M_IPSEC_SPDCACHE, "ipsec-spdcache", "ipsec SPD cache");
 
 static uma_zone_t __read_mostly ipsec_key_lft_zone;
 
 /*
  * set parameters into secpolicyindex buffer.
  * Must allocate secpolicyindex buffer passed to this function.
  */
 #define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, idx) \
 do { \
 	bzero((idx), sizeof(struct secpolicyindex));                         \
 	(idx)->dir = (_dir);                                                 \
 	(idx)->prefs = (ps);                                                 \
 	(idx)->prefd = (pd);                                                 \
 	(idx)->ul_proto = (ulp);                                             \
 	bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len);     \
 	bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len);     \
 } while (0)
 
 /*
  * set parameters into secasindex buffer.
  * Must allocate secasindex buffer before calling this function.
  */
 #define KEY_SETSECASIDX(p, m, r, s, d, idx) \
 do { \
 	bzero((idx), sizeof(struct secasindex));                             \
 	(idx)->proto = (p);                                                  \
 	(idx)->mode = (m);                                                   \
 	(idx)->reqid = (r);                                                  \
 	bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len);     \
 	bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len);     \
 	key_porttosaddr(&(idx)->src.sa, 0);				     \
 	key_porttosaddr(&(idx)->dst.sa, 0);				     \
 } while (0)
 
 /* key statistics */
 struct _keystat {
 	u_long getspi_count; /* the avarage of count to try to get new SPI */
 } keystat;
 
 struct sadb_msghdr {
 	struct sadb_msg *msg;
 	struct sadb_ext *ext[SADB_EXT_MAX + 1];
 	int extoff[SADB_EXT_MAX + 1];
 	int extlen[SADB_EXT_MAX + 1];
 };
 
 static const struct supported_ealgs {
 	int sadb_alg;
 	const struct enc_xform *xform;
 } supported_ealgs[] = {
 	{ SADB_X_EALG_AES,		&enc_xform_aes_cbc },
 	{ SADB_EALG_NULL,		&enc_xform_null },
 	{ SADB_X_EALG_AESCTR,		&enc_xform_aes_icm },
 	{ SADB_X_EALG_AESGCM16,		&enc_xform_aes_nist_gcm },
 	{ SADB_X_EALG_AESGMAC,		&enc_xform_aes_nist_gmac },
 	{ SADB_X_EALG_CHACHA20POLY1305,	&enc_xform_chacha20_poly1305 },
 };
 
 static const struct supported_aalgs {
 	int sadb_alg;
 	const struct auth_hash *xform;
 } supported_aalgs[] = {
 	{ SADB_X_AALG_NULL,		&auth_hash_null },
 	{ SADB_AALG_SHA1HMAC,		&auth_hash_hmac_sha1 },
 	{ SADB_X_AALG_SHA2_256,		&auth_hash_hmac_sha2_256 },
 	{ SADB_X_AALG_SHA2_384,		&auth_hash_hmac_sha2_384 },
 	{ SADB_X_AALG_SHA2_512,		&auth_hash_hmac_sha2_512 },
 	{ SADB_X_AALG_AES128GMAC,	&auth_hash_nist_gmac_aes_128 },
 	{ SADB_X_AALG_AES192GMAC,	&auth_hash_nist_gmac_aes_192 },
 	{ SADB_X_AALG_AES256GMAC,	&auth_hash_nist_gmac_aes_256 },
 	{ SADB_X_AALG_CHACHA20POLY1305,	&auth_hash_poly1305 },
 };
 
 static const struct supported_calgs {
 	int sadb_alg;
 	const struct comp_algo *xform;
 } supported_calgs[] = {
 	{ SADB_X_CALG_DEFLATE,		&comp_algo_deflate },
 };
 
 #ifndef IPSEC_DEBUG2
 static struct callout key_timer;
 #endif
 
 static void key_unlink(struct secpolicy *);
 static void key_detach(struct secpolicy *);
 static struct secpolicy *key_do_allocsp(struct secpolicyindex *spidx, u_int dir);
 static struct secpolicy *key_getsp(struct secpolicyindex *);
 static struct secpolicy *key_getspbyid(u_int32_t);
 static struct mbuf *key_gather_mbuf(struct mbuf *,
 	const struct sadb_msghdr *, int, int, ...);
 static int key_spdadd(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static uint32_t key_getnewspid(void);
 static int key_spddelete(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_spddelete2(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_spdget(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_spdflush(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_spddump(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static struct mbuf *key_setdumpsp(struct secpolicy *,
 	u_int8_t, u_int32_t, u_int32_t);
 static struct mbuf *key_sp2mbuf(struct secpolicy *);
 static size_t key_getspreqmsglen(struct secpolicy *);
 static int key_spdexpire(struct secpolicy *);
 static struct secashead *key_newsah(struct secasindex *);
 static void key_freesah(struct secashead **);
 static void key_delsah(struct secashead *);
 static struct secasvar *key_newsav(const struct sadb_msghdr *,
     struct secasindex *, uint32_t, int *);
 static void key_delsav(struct secasvar *);
 static void key_unlinksav(struct secasvar *);
 static struct secashead *key_getsah(struct secasindex *);
 static int key_checkspidup(uint32_t);
 static struct secasvar *key_getsavbyspi(uint32_t);
 static int key_setnatt(struct secasvar *, const struct sadb_msghdr *);
 static int key_setsaval(struct secasvar *, const struct sadb_msghdr *);
 static int key_updatelifetimes(struct secasvar *, const struct sadb_msghdr *);
 static int key_updateaddresses(struct socket *, struct mbuf *,
     const struct sadb_msghdr *, struct secasvar *, struct secasindex *);
 
 static struct mbuf *key_setdumpsa(struct secasvar *, u_int8_t,
 	u_int8_t, u_int32_t, u_int32_t);
 static struct mbuf *key_setsadbmsg(u_int8_t, u_int16_t, u_int8_t,
 	u_int32_t, pid_t, u_int16_t);
 static struct mbuf *key_setsadbsa(struct secasvar *);
 static struct mbuf *key_setsadbaddr(u_int16_t,
 	const struct sockaddr *, u_int8_t, u_int16_t);
 static struct mbuf *key_setsadbxport(u_int16_t, u_int16_t);
 static struct mbuf *key_setsadbxtype(u_int16_t);
 static struct mbuf *key_setsadbxsa2(u_int8_t, u_int32_t, u_int32_t);
 static struct mbuf *key_setsadbxsareplay(u_int32_t);
 static struct mbuf *key_setsadbxpolicy(u_int16_t, u_int8_t,
 	u_int32_t, u_int32_t);
 static struct seckey *key_dup_keymsg(const struct sadb_key *, size_t,
     struct malloc_type *);
 static struct seclifetime *key_dup_lifemsg(const struct sadb_lifetime *src,
     struct malloc_type *);
 
 /* flags for key_cmpsaidx() */
 #define CMP_HEAD	1	/* protocol, addresses. */
 #define CMP_MODE_REQID	2	/* additionally HEAD, reqid, mode. */
 #define CMP_REQID	3	/* additionally HEAD, reaid. */
 #define CMP_EXACTLY	4	/* all elements. */
 static int key_cmpsaidx(const struct secasindex *,
     const struct secasindex *, int);
 static int key_cmpspidx_exactly(struct secpolicyindex *,
     struct secpolicyindex *);
 static int key_cmpspidx_withmask(struct secpolicyindex *,
     struct secpolicyindex *);
 static int key_bbcmp(const void *, const void *, u_int);
 static uint8_t key_satype2proto(uint8_t);
 static uint8_t key_proto2satype(uint8_t);
 
 static int key_getspi(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static uint32_t key_do_getnewspi(struct sadb_spirange *, struct secasindex *);
 static int key_update(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_add(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_setident(struct secashead *, const struct sadb_msghdr *);
 static struct mbuf *key_getmsgbuf_x1(struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_delete(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_delete_all(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *, struct secasindex *);
 static int key_get(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 
 static void key_getcomb_setlifetime(struct sadb_comb *);
 static struct mbuf *key_getcomb_ealg(void);
 static struct mbuf *key_getcomb_ah(void);
 static struct mbuf *key_getcomb_ipcomp(void);
 static struct mbuf *key_getprop(const struct secasindex *);
 
 static int key_acquire(const struct secasindex *, struct secpolicy *);
 static uint32_t key_newacq(const struct secasindex *, int *);
 static uint32_t key_getacq(const struct secasindex *, int *);
 static int key_acqdone(const struct secasindex *, uint32_t);
 static int key_acqreset(uint32_t);
 static struct secspacq *key_newspacq(struct secpolicyindex *);
 static struct secspacq *key_getspacq(struct secpolicyindex *);
 static int key_acquire2(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_register(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_expire(struct secasvar *, int);
 static int key_flush(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_dump(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_promisc(struct socket *, struct mbuf *,
 	const struct sadb_msghdr *);
 static int key_senderror(struct socket *, struct mbuf *, int);
 static int key_validate_ext(const struct sadb_ext *, int);
 static int key_align(struct mbuf *, struct sadb_msghdr *);
 static struct mbuf *key_setlifetime(struct seclifetime *, uint16_t);
 static struct mbuf *key_setkey(struct seckey *, uint16_t);
 
 static void spdcache_init(void);
 static void spdcache_clear(void);
 static struct spdcache_entry *spdcache_entry_alloc(
 	const struct secpolicyindex *spidx,
 	struct secpolicy *policy);
 static void spdcache_entry_free(struct spdcache_entry *entry);
 #ifdef VIMAGE
 static void spdcache_destroy(void);
 #endif
 
 #define	DBG_IPSEC_INITREF(t, p)	do {				\
 	refcount_init(&(p)->refcnt, 1);				\
 	KEYDBG(KEY_STAMP,					\
 	    printf("%s: Initialize refcnt %s(%p) = %u\n",	\
 	    __func__, #t, (p), (p)->refcnt));			\
 } while (0)
 #define	DBG_IPSEC_ADDREF(t, p)	do {				\
 	refcount_acquire(&(p)->refcnt);				\
 	KEYDBG(KEY_STAMP,					\
 	    printf("%s: Acquire refcnt %s(%p) -> %u\n",		\
 	    __func__, #t, (p), (p)->refcnt));			\
 } while (0)
 #define	DBG_IPSEC_DELREF(t, p)	do {				\
 	KEYDBG(KEY_STAMP,					\
 	    printf("%s: Release refcnt %s(%p) -> %u\n",		\
 	    __func__, #t, (p), (p)->refcnt - 1));		\
 	refcount_release(&(p)->refcnt);				\
 } while (0)
 
 #define	IPSEC_INITREF(t, p)	refcount_init(&(p)->refcnt, 1)
 #define	IPSEC_ADDREF(t, p)	refcount_acquire(&(p)->refcnt)
 #define	IPSEC_DELREF(t, p)	refcount_release(&(p)->refcnt)
 
 #define	SP_INITREF(p)	IPSEC_INITREF(SP, p)
 #define	SP_ADDREF(p)	IPSEC_ADDREF(SP, p)
 #define	SP_DELREF(p)	IPSEC_DELREF(SP, p)
 
 #define	SAH_INITREF(p)	IPSEC_INITREF(SAH, p)
 #define	SAH_ADDREF(p)	IPSEC_ADDREF(SAH, p)
 #define	SAH_DELREF(p)	IPSEC_DELREF(SAH, p)
 
 #define	SAV_INITREF(p)	IPSEC_INITREF(SAV, p)
 #define	SAV_ADDREF(p)	IPSEC_ADDREF(SAV, p)
 #define	SAV_DELREF(p)	IPSEC_DELREF(SAV, p)
 
 /*
  * Update the refcnt while holding the SPTREE lock.
  */
 void
 key_addref(struct secpolicy *sp)
 {
 
 	SP_ADDREF(sp);
 }
 
 /*
  * Return 0 when there are known to be no SP's for the specified
  * direction.  Otherwise return 1.  This is used by IPsec code
  * to optimize performance.
  */
 int
 key_havesp(u_int dir)
 {
 
 	IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND,
 		("invalid direction %u", dir));
 	return (TAILQ_FIRST(&V_sptree[dir]) != NULL);
 }
 
 int
 key_havesp_any(void)
 {
 
 	return (V_spd_size != 0);
 }
 
 /*
  * Allocate a single mbuf with a buffer of the desired length.  The buffer is
  * pre-zeroed to help ensure that uninitialized pad bytes are not leaked.
  */
 static struct mbuf *
 key_mget(u_int len)
 {
 	struct mbuf *m;
 
 	KASSERT(len <= MCLBYTES,
 	    ("%s: invalid buffer length %u", __func__, len));
 
 	m = m_get2(len, M_NOWAIT, MT_DATA, M_PKTHDR);
 	if (m == NULL)
 		return (NULL);
 	memset(mtod(m, void *), 0, len);
 	return (m);
 }
 
 /* %%% IPsec policy management */
 /*
  * Return current SPDB generation.
  */
 uint32_t
 key_getspgen(void)
 {
 
 	return (V_sp_genid);
 }
 
 void
 key_bumpspgen(void)
 {
 
 	V_sp_genid++;
 }
 
 static int
 key_checksockaddrs(struct sockaddr *src, struct sockaddr *dst)
 {
 
 	/* family match */
 	if (src->sa_family != dst->sa_family)
 		return (EINVAL);
 	/* sa_len match */
 	if (src->sa_len != dst->sa_len)
 		return (EINVAL);
 	switch (src->sa_family) {
 #ifdef INET
 	case AF_INET:
 		if (src->sa_len != sizeof(struct sockaddr_in))
 			return (EINVAL);
 		break;
 #endif
 #ifdef INET6
 	case AF_INET6:
 		if (src->sa_len != sizeof(struct sockaddr_in6))
 			return (EINVAL);
 		break;
 #endif
 	default:
 		return (EAFNOSUPPORT);
 	}
 	return (0);
 }
 
 struct secpolicy *
 key_do_allocsp(struct secpolicyindex *spidx, u_int dir)
 {
 	SPTREE_RLOCK_TRACKER;
 	struct secpolicy *sp;
 
 	IPSEC_ASSERT(spidx != NULL, ("null spidx"));
 	IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND,
 		("invalid direction %u", dir));
 
 	SPTREE_RLOCK();
 	TAILQ_FOREACH(sp, &V_sptree[dir], chain) {
 		if (key_cmpspidx_withmask(&sp->spidx, spidx)) {
 			SP_ADDREF(sp);
 			break;
 		}
 	}
 	SPTREE_RUNLOCK();
 	return (sp);
 }
 
 /*
  * allocating a SP for OUTBOUND or INBOUND packet.
  * Must call key_freesp() later.
  * OUT:	NULL:	not found
  *	others:	found and return the pointer.
  */
 struct secpolicy *
 key_allocsp(struct secpolicyindex *spidx, u_int dir)
 {
 	struct spdcache_entry *entry, *lastentry, *tmpentry;
 	struct secpolicy *sp;
 	uint32_t hashv;
 	time_t ts;
 	int nb_entries;
 
 	if (!SPDCACHE_ACTIVE()) {
 		sp = key_do_allocsp(spidx, dir);
 		goto out;
 	}
 
 	hashv = SPDCACHE_HASHVAL(spidx);
 	SPDCACHE_LOCK(hashv);
 	nb_entries = 0;
 	LIST_FOREACH_SAFE(entry, &V_spdcachehashtbl[hashv], chain, tmpentry) {
 		/* Removed outdated entries */
 		if (entry->sp != NULL &&
 		    entry->sp->state == IPSEC_SPSTATE_DEAD) {
 			LIST_REMOVE(entry, chain);
 			spdcache_entry_free(entry);
 			continue;
 		}
 
 		nb_entries++;
 		if (!key_cmpspidx_exactly(&entry->spidx, spidx)) {
 			lastentry = entry;
 			continue;
 		}
 
 		sp = entry->sp;
 		if (entry->sp != NULL)
 			SP_ADDREF(sp);
 
 		/* IPSECSTAT_INC(ips_spdcache_hits); */
 
 		SPDCACHE_UNLOCK(hashv);
 		goto out;
 	}
 
 	/* IPSECSTAT_INC(ips_spdcache_misses); */
 
 	sp = key_do_allocsp(spidx, dir);
 	entry = spdcache_entry_alloc(spidx, sp);
 	if (entry != NULL) {
 		if (nb_entries >= SPDCACHE_MAX_ENTRIES_PER_HASH) {
 			LIST_REMOVE(lastentry, chain);
 			spdcache_entry_free(lastentry);
 		}
 
 		LIST_INSERT_HEAD(&V_spdcachehashtbl[hashv], entry, chain);
 	}
 
 	SPDCACHE_UNLOCK(hashv);
 
 out:
 	if (sp != NULL) {	/* found a SPD entry */
 		ts = time_second;
 		if (__predict_false(sp->lastused != ts))
 			sp->lastused = ts;
 		KEYDBG(IPSEC_STAMP,
 		    printf("%s: return SP(%p)\n", __func__, sp));
 		KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
 	} else {
 		KEYDBG(IPSEC_DATA,
 		    printf("%s: lookup failed for ", __func__);
 		    kdebug_secpolicyindex(spidx, NULL));
 	}
 	return (sp);
 }
 
 /*
  * Allocating an SA entry for an *INBOUND* or *OUTBOUND* TCP packet, signed
  * or should be signed by MD5 signature.
  * We don't use key_allocsa() for such lookups, because we don't know SPI.
  * Unlike ESP and AH protocols, SPI isn't transmitted in the TCP header with
  * signed packet. We use SADB only as storage for password.
  * OUT:	positive:	corresponding SA for given saidx found.
  *	NULL:		SA not found
  */
 struct secasvar *
 key_allocsa_tcpmd5(struct secasindex *saidx)
 {
 	SAHTREE_RLOCK_TRACKER;
 	struct secashead *sah;
 	struct secasvar *sav;
 
 	IPSEC_ASSERT(saidx->proto == IPPROTO_TCP,
 	    ("unexpected security protocol %u", saidx->proto));
 	IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TCPMD5,
 	    ("unexpected mode %u", saidx->mode));
 
 	SAHTREE_RLOCK();
 	LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) {
 		KEYDBG(IPSEC_DUMP,
 		    printf("%s: checking SAH\n", __func__);
 		    kdebug_secash(sah, "  "));
 		if (sah->saidx.proto != IPPROTO_TCP)
 			continue;
 		if (!key_sockaddrcmp(&saidx->dst.sa, &sah->saidx.dst.sa, 0) &&
 		    !key_sockaddrcmp(&saidx->src.sa, &sah->saidx.src.sa, 0))
 			break;
 	}
 	if (sah != NULL) {
 		if (V_key_preferred_oldsa)
 			sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue);
 		else
 			sav = TAILQ_FIRST(&sah->savtree_alive);
 		if (sav != NULL)
 			SAV_ADDREF(sav);
 	} else
 		sav = NULL;
 	SAHTREE_RUNLOCK();
 
 	if (sav != NULL) {
 		KEYDBG(IPSEC_STAMP,
 		    printf("%s: return SA(%p)\n", __func__, sav));
 		KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
 	} else {
 		KEYDBG(IPSEC_STAMP,
 		    printf("%s: SA not found\n", __func__));
 		KEYDBG(IPSEC_DATA, kdebug_secasindex(saidx, NULL));
 	}
 	return (sav);
 }
 
 /*
  * Allocating an SA entry for an *OUTBOUND* packet.
  * OUT:	positive:	corresponding SA for given saidx found.
  *	NULL:		SA not found, but will be acquired, check *error
  *			for acquiring status.
  */
 struct secasvar *
 key_allocsa_policy(struct secpolicy *sp, const struct secasindex *saidx,
     int *error)
 {
 	SAHTREE_RLOCK_TRACKER;
 	struct secashead *sah;
 	struct secasvar *sav;
 
 	IPSEC_ASSERT(saidx != NULL, ("null saidx"));
 	IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TRANSPORT ||
 		saidx->mode == IPSEC_MODE_TUNNEL,
 		("unexpected policy %u", saidx->mode));
 
 	/*
 	 * We check new SA in the IPsec request because a different
 	 * SA may be involved each time this request is checked, either
 	 * because new SAs are being configured, or this request is
 	 * associated with an unconnected datagram socket, or this request
 	 * is associated with a system default policy.
 	 */
 	SAHTREE_RLOCK();
 	LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) {
 		KEYDBG(IPSEC_DUMP,
 		    printf("%s: checking SAH\n", __func__);
 		    kdebug_secash(sah, "  "));
 		if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID))
 			break;
 	}
 	if (sah != NULL) {
 		/*
 		 * Allocate the oldest SA available according to
 		 * draft-jenkins-ipsec-rekeying-03.
 		 */
 		if (V_key_preferred_oldsa)
 			sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue);
 		else
 			sav = TAILQ_FIRST(&sah->savtree_alive);
 		if (sav != NULL)
 			SAV_ADDREF(sav);
 	} else
 		sav = NULL;
 	SAHTREE_RUNLOCK();
 
 	if (sav != NULL) {
 		*error = 0;
 		KEYDBG(IPSEC_STAMP,
 		    printf("%s: chosen SA(%p) for SP(%p)\n", __func__,
 			sav, sp));
 		KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
 		return (sav); /* return referenced SA */
 	}
 
 	/* there is no SA */
 	*error = key_acquire(saidx, sp);
 	if ((*error) != 0)
 		ipseclog((LOG_DEBUG,
 		    "%s: error %d returned from key_acquire()\n",
 			__func__, *error));
 	KEYDBG(IPSEC_STAMP,
 	    printf("%s: acquire SA for SP(%p), error %d\n",
 		__func__, sp, *error));
 	KEYDBG(IPSEC_DATA, kdebug_secasindex(saidx, NULL));
 	return (NULL);
 }
 
 /*
  * allocating a usable SA entry for a *INBOUND* packet.
  * Must call key_freesav() later.
  * OUT: positive:	pointer to a usable sav (i.e. MATURE or DYING state).
  *	NULL:		not found, or error occurred.
  *
  * According to RFC 2401 SA is uniquely identified by a triple SPI,
  * destination address, and security protocol. But according to RFC 4301,
  * SPI by itself suffices to specify an SA.
  *
  * Note that, however, we do need to keep source address in IPsec SA.
  * IKE specification and PF_KEY specification do assume that we
  * keep source address in IPsec SA.  We see a tricky situation here.
  */
 struct secasvar *
 key_allocsa(union sockaddr_union *dst, uint8_t proto, uint32_t spi)
 {
 	SAHTREE_RLOCK_TRACKER;
 	struct secasvar *sav;
 
 	IPSEC_ASSERT(proto == IPPROTO_ESP || proto == IPPROTO_AH ||
 	    proto == IPPROTO_IPCOMP, ("unexpected security protocol %u",
 	    proto));
 
 	SAHTREE_RLOCK();
 	LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) {
 		if (sav->spi == spi)
 			break;
 	}
 	/*
 	 * We use single SPI namespace for all protocols, so it is
 	 * impossible to have SPI duplicates in the SAVHASH.
 	 */
 	if (sav != NULL) {
 		if (sav->state != SADB_SASTATE_LARVAL &&
 		    sav->sah->saidx.proto == proto &&
 		    key_sockaddrcmp(&dst->sa,
 			&sav->sah->saidx.dst.sa, 0) == 0)
 			SAV_ADDREF(sav);
 		else
 			sav = NULL;
 	}
 	SAHTREE_RUNLOCK();
 
 	if (sav == NULL) {
 		KEYDBG(IPSEC_STAMP,
 		    char buf[IPSEC_ADDRSTRLEN];
 		    printf("%s: SA not found for spi %u proto %u dst %s\n",
 			__func__, ntohl(spi), proto, ipsec_address(dst, buf,
 			sizeof(buf))));
 	} else {
 		KEYDBG(IPSEC_STAMP,
 		    printf("%s: return SA(%p)\n", __func__, sav));
 		KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
 	}
 	return (sav);
 }
 
 struct secasvar *
 key_allocsa_tunnel(union sockaddr_union *src, union sockaddr_union *dst,
     uint8_t proto)
 {
 	SAHTREE_RLOCK_TRACKER;
 	struct secasindex saidx;
 	struct secashead *sah;
 	struct secasvar *sav;
 
 	IPSEC_ASSERT(src != NULL, ("null src address"));
 	IPSEC_ASSERT(dst != NULL, ("null dst address"));
 
 	KEY_SETSECASIDX(proto, IPSEC_MODE_TUNNEL, 0, &src->sa,
 	    &dst->sa, &saidx);
 
 	sav = NULL;
 	SAHTREE_RLOCK();
 	LIST_FOREACH(sah, SAHADDRHASH_HASH(&saidx), addrhash) {
 		if (IPSEC_MODE_TUNNEL != sah->saidx.mode)
 			continue;
 		if (proto != sah->saidx.proto)
 			continue;
 		if (key_sockaddrcmp(&src->sa, &sah->saidx.src.sa, 0) != 0)
 			continue;
 		if (key_sockaddrcmp(&dst->sa, &sah->saidx.dst.sa, 0) != 0)
 			continue;
 		/* XXXAE: is key_preferred_oldsa reasonably?*/
 		if (V_key_preferred_oldsa)
 			sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue);
 		else
 			sav = TAILQ_FIRST(&sah->savtree_alive);
 		if (sav != NULL) {
 			SAV_ADDREF(sav);
 			break;
 		}
 	}
 	SAHTREE_RUNLOCK();
 	KEYDBG(IPSEC_STAMP,
 	    printf("%s: return SA(%p)\n", __func__, sav));
 	if (sav != NULL)
 		KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
 	return (sav);
 }
 
 /*
  * Must be called after calling key_allocsp().
  */
 void
 key_freesp(struct secpolicy **spp)
 {
 	struct secpolicy *sp = *spp;
 
 	IPSEC_ASSERT(sp != NULL, ("null sp"));
 	if (SP_DELREF(sp) == 0)
 		return;
 
 	KEYDBG(IPSEC_STAMP,
 	    printf("%s: last reference to SP(%p)\n", __func__, sp));
 	KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
 
 	*spp = NULL;
 	while (sp->tcount > 0)
 		ipsec_delisr(sp->req[--sp->tcount]);
 	free(sp, M_IPSEC_SP);
 }
 
 static void
 key_unlink(struct secpolicy *sp)
 {
 	SPTREE_WLOCK();
 	key_detach(sp);
 	SPTREE_WUNLOCK();
 	if (SPDCACHE_ENABLED())
 		spdcache_clear();
 	key_freesp(&sp);
 }
 
 static void
 key_detach(struct secpolicy *sp)
 {
 	IPSEC_ASSERT(sp->spidx.dir == IPSEC_DIR_INBOUND ||
 	    sp->spidx.dir == IPSEC_DIR_OUTBOUND,
 	    ("invalid direction %u", sp->spidx.dir));
 	SPTREE_WLOCK_ASSERT();
 
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SP(%p)\n", __func__, sp));
 	if (sp->state != IPSEC_SPSTATE_ALIVE) {
 		/* SP is already unlinked */
 		return;
 	}
 	sp->state = IPSEC_SPSTATE_DEAD;
 	TAILQ_REMOVE(&V_sptree[sp->spidx.dir], sp, chain);
 	V_spd_size--;
 	LIST_REMOVE(sp, idhash);
 	V_sp_genid++;
 }
 
 /*
  * insert a secpolicy into the SP database. Lower priorities first
  */
 static void
 key_insertsp(struct secpolicy *newsp)
 {
 	struct secpolicy *sp;
 
 	SPTREE_WLOCK_ASSERT();
 	TAILQ_FOREACH(sp, &V_sptree[newsp->spidx.dir], chain) {
 		if (newsp->priority < sp->priority) {
 			TAILQ_INSERT_BEFORE(sp, newsp, chain);
 			goto done;
 		}
 	}
 	TAILQ_INSERT_TAIL(&V_sptree[newsp->spidx.dir], newsp, chain);
 done:
 	LIST_INSERT_HEAD(SPHASH_HASH(newsp->id), newsp, idhash);
 	newsp->state = IPSEC_SPSTATE_ALIVE;
 	V_spd_size++;
 	V_sp_genid++;
 }
 
 /*
  * Insert a bunch of VTI secpolicies into the SPDB.
  * We keep VTI policies in the separate list due to following reasons:
  * 1) they should be immutable to user's or some deamon's attempts to
  *    delete. The only way delete such policies - destroy or unconfigure
  *    corresponding virtual inteface.
  * 2) such policies have traffic selector that matches all traffic per
  *    address family.
  * Since all VTI policies have the same priority, we don't care about
  * policies order.
  */
 int
 key_register_ifnet(struct secpolicy **spp, u_int count)
 {
 	struct mbuf *m;
 	u_int i;
 
 	SPTREE_WLOCK();
 	/*
 	 * First of try to acquire id for each SP.
 	 */
 	for (i = 0; i < count; i++) {
 		IPSEC_ASSERT(spp[i]->spidx.dir == IPSEC_DIR_INBOUND ||
 		    spp[i]->spidx.dir == IPSEC_DIR_OUTBOUND,
 		    ("invalid direction %u", spp[i]->spidx.dir));
 
 		if ((spp[i]->id = key_getnewspid()) == 0) {
 			SPTREE_WUNLOCK();
 			return (EAGAIN);
 		}
 	}
 	for (i = 0; i < count; i++) {
 		TAILQ_INSERT_TAIL(&V_sptree_ifnet[spp[i]->spidx.dir],
 		    spp[i], chain);
 		/*
 		 * NOTE: despite the fact that we keep VTI SP in the
 		 * separate list, SPHASH contains policies from both
 		 * sources. Thus SADB_X_SPDGET will correctly return
 		 * SP by id, because it uses SPHASH for lookups.
 		 */
 		LIST_INSERT_HEAD(SPHASH_HASH(spp[i]->id), spp[i], idhash);
 		spp[i]->state = IPSEC_SPSTATE_IFNET;
 	}
 	SPTREE_WUNLOCK();
 	/*
 	 * Notify user processes about new SP.
 	 */
 	for (i = 0; i < count; i++) {
 		m = key_setdumpsp(spp[i], SADB_X_SPDADD, 0, 0);
 		if (m != NULL)
 			key_sendup_mbuf(NULL, m, KEY_SENDUP_ALL);
 	}
 	return (0);
 }
 
 void
 key_unregister_ifnet(struct secpolicy **spp, u_int count)
 {
 	struct mbuf *m;
 	u_int i;
 
 	SPTREE_WLOCK();
 	for (i = 0; i < count; i++) {
 		IPSEC_ASSERT(spp[i]->spidx.dir == IPSEC_DIR_INBOUND ||
 		    spp[i]->spidx.dir == IPSEC_DIR_OUTBOUND,
 		    ("invalid direction %u", spp[i]->spidx.dir));
 
 		if (spp[i]->state != IPSEC_SPSTATE_IFNET)
 			continue;
 		spp[i]->state = IPSEC_SPSTATE_DEAD;
 		TAILQ_REMOVE(&V_sptree_ifnet[spp[i]->spidx.dir],
 		    spp[i], chain);
 		V_spd_size--;
 		LIST_REMOVE(spp[i], idhash);
 	}
 	SPTREE_WUNLOCK();
 	if (SPDCACHE_ENABLED())
 		spdcache_clear();
 
 	for (i = 0; i < count; i++) {
 		m = key_setdumpsp(spp[i], SADB_X_SPDDELETE, 0, 0);
 		if (m != NULL)
 			key_sendup_mbuf(NULL, m, KEY_SENDUP_ALL);
 	}
 }
 
 /*
  * Must be called after calling key_allocsa().
  * This function is called by key_freesp() to free some SA allocated
  * for a policy.
  */
 void
 key_freesav(struct secasvar **psav)
 {
 	struct secasvar *sav = *psav;
 
 	IPSEC_ASSERT(sav != NULL, ("null sav"));
 	CURVNET_ASSERT_SET();
 	if (SAV_DELREF(sav) == 0)
 		return;
 
 	KEYDBG(IPSEC_STAMP,
 	    printf("%s: last reference to SA(%p)\n", __func__, sav));
 
 	*psav = NULL;
 	key_delsav(sav);
 }
 
 /*
  * Unlink SA from SAH and SPI hash under SAHTREE_WLOCK.
  * Expect that SA has extra reference due to lookup.
  * Release this references, also release SAH reference after unlink.
  */
 static void
 key_unlinksav(struct secasvar *sav)
 {
 	struct secashead *sah;
 
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SA(%p)\n", __func__, sav));
 
 	CURVNET_ASSERT_SET();
 	SAHTREE_UNLOCK_ASSERT();
 	SAHTREE_WLOCK();
 	if (sav->state == SADB_SASTATE_DEAD) {
 		/* SA is already unlinked */
 		SAHTREE_WUNLOCK();
 		return;
 	}
 	/* Unlink from SAH */
 	if (sav->state == SADB_SASTATE_LARVAL)
 		TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain);
 	else
 		TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain);
 	/* Unlink from SPI hash */
 	LIST_REMOVE(sav, spihash);
 	sav->state = SADB_SASTATE_DEAD;
 	sah = sav->sah;
 	SAHTREE_WUNLOCK();
 	key_freesav(&sav);
 	/* Since we are unlinked, release reference to SAH */
 	key_freesah(&sah);
 }
 
 /* %%% SPD management */
 /*
  * search SPD
  * OUT:	NULL	: not found
  *	others	: found, pointer to a SP.
  */
 static struct secpolicy *
 key_getsp(struct secpolicyindex *spidx)
 {
 	SPTREE_RLOCK_TRACKER;
 	struct secpolicy *sp;
 
 	IPSEC_ASSERT(spidx != NULL, ("null spidx"));
 
 	SPTREE_RLOCK();
 	TAILQ_FOREACH(sp, &V_sptree[spidx->dir], chain) {
 		if (key_cmpspidx_exactly(spidx, &sp->spidx)) {
 			SP_ADDREF(sp);
 			break;
 		}
 	}
 	SPTREE_RUNLOCK();
 
 	return sp;
 }
 
 /*
  * get SP by index.
  * OUT:	NULL	: not found
  *	others	: found, pointer to referenced SP.
  */
 static struct secpolicy *
 key_getspbyid(uint32_t id)
 {
 	SPTREE_RLOCK_TRACKER;
 	struct secpolicy *sp;
 
 	SPTREE_RLOCK();
 	LIST_FOREACH(sp, SPHASH_HASH(id), idhash) {
 		if (sp->id == id) {
 			SP_ADDREF(sp);
 			break;
 		}
 	}
 	SPTREE_RUNLOCK();
 	return (sp);
 }
 
 struct secpolicy *
 key_newsp(void)
 {
 	struct secpolicy *sp;
 
 	sp = malloc(sizeof(*sp), M_IPSEC_SP, M_NOWAIT | M_ZERO);
 	if (sp != NULL)
 		SP_INITREF(sp);
 	return (sp);
 }
 
 struct ipsecrequest *
 ipsec_newisr(void)
 {
 
 	return (malloc(sizeof(struct ipsecrequest), M_IPSEC_SR,
 	    M_NOWAIT | M_ZERO));
 }
 
 void
 ipsec_delisr(struct ipsecrequest *p)
 {
 
 	free(p, M_IPSEC_SR);
 }
 
 /*
  * create secpolicy structure from sadb_x_policy structure.
  * NOTE: `state', `secpolicyindex' and 'id' in secpolicy structure
  * are not set, so must be set properly later.
  */
 struct secpolicy *
 key_msg2sp(struct sadb_x_policy *xpl0, size_t len, int *error)
 {
 	struct secpolicy *newsp;
 
 	IPSEC_ASSERT(xpl0 != NULL, ("null xpl0"));
 	IPSEC_ASSERT(len >= sizeof(*xpl0), ("policy too short: %zu", len));
 
 	if (len != PFKEY_EXTLEN(xpl0)) {
 		ipseclog((LOG_DEBUG, "%s: Invalid msg length.\n", __func__));
 		*error = EINVAL;
 		return NULL;
 	}
 
 	if ((newsp = key_newsp()) == NULL) {
 		*error = ENOBUFS;
 		return NULL;
 	}
 
 	newsp->spidx.dir = xpl0->sadb_x_policy_dir;
 	newsp->policy = xpl0->sadb_x_policy_type;
 	newsp->priority = xpl0->sadb_x_policy_priority;
 	newsp->tcount = 0;
 
 	/* check policy */
 	switch (xpl0->sadb_x_policy_type) {
 	case IPSEC_POLICY_DISCARD:
 	case IPSEC_POLICY_NONE:
 	case IPSEC_POLICY_ENTRUST:
 	case IPSEC_POLICY_BYPASS:
 		break;
 
 	case IPSEC_POLICY_IPSEC:
 	    {
 		struct sadb_x_ipsecrequest *xisr;
 		struct ipsecrequest *isr;
 		int tlen;
 
 		/* validity check */
 		if (PFKEY_EXTLEN(xpl0) < sizeof(*xpl0)) {
 			ipseclog((LOG_DEBUG, "%s: Invalid msg length.\n",
 				__func__));
 			key_freesp(&newsp);
 			*error = EINVAL;
 			return NULL;
 		}
 
 		tlen = PFKEY_EXTLEN(xpl0) - sizeof(*xpl0);
 		xisr = (struct sadb_x_ipsecrequest *)(xpl0 + 1);
 
 		while (tlen > 0) {
 			/* length check */
 			if (xisr->sadb_x_ipsecrequest_len < sizeof(*xisr) ||
 			    xisr->sadb_x_ipsecrequest_len > tlen) {
 				ipseclog((LOG_DEBUG, "%s: invalid ipsecrequest "
 					"length.\n", __func__));
 				key_freesp(&newsp);
 				*error = EINVAL;
 				return NULL;
 			}
 
 			if (newsp->tcount >= IPSEC_MAXREQ) {
 				ipseclog((LOG_DEBUG,
 				    "%s: too many ipsecrequests.\n",
 				    __func__));
 				key_freesp(&newsp);
 				*error = EINVAL;
 				return (NULL);
 			}
 
 			/* allocate request buffer */
 			/* NB: data structure is zero'd */
 			isr = ipsec_newisr();
 			if (isr == NULL) {
 				ipseclog((LOG_DEBUG,
 				    "%s: No more memory.\n", __func__));
 				key_freesp(&newsp);
 				*error = ENOBUFS;
 				return NULL;
 			}
 
 			newsp->req[newsp->tcount++] = isr;
 
 			/* set values */
 			switch (xisr->sadb_x_ipsecrequest_proto) {
 			case IPPROTO_ESP:
 			case IPPROTO_AH:
 			case IPPROTO_IPCOMP:
 				break;
 			default:
 				ipseclog((LOG_DEBUG,
 				    "%s: invalid proto type=%u\n", __func__,
 				    xisr->sadb_x_ipsecrequest_proto));
 				key_freesp(&newsp);
 				*error = EPROTONOSUPPORT;
 				return NULL;
 			}
 			isr->saidx.proto =
 			    (uint8_t)xisr->sadb_x_ipsecrequest_proto;
 
 			switch (xisr->sadb_x_ipsecrequest_mode) {
 			case IPSEC_MODE_TRANSPORT:
 			case IPSEC_MODE_TUNNEL:
 				break;
 			case IPSEC_MODE_ANY:
 			default:
 				ipseclog((LOG_DEBUG,
 				    "%s: invalid mode=%u\n", __func__,
 				    xisr->sadb_x_ipsecrequest_mode));
 				key_freesp(&newsp);
 				*error = EINVAL;
 				return NULL;
 			}
 			isr->saidx.mode = xisr->sadb_x_ipsecrequest_mode;
 
 			switch (xisr->sadb_x_ipsecrequest_level) {
 			case IPSEC_LEVEL_DEFAULT:
 			case IPSEC_LEVEL_USE:
 			case IPSEC_LEVEL_REQUIRE:
 				break;
 			case IPSEC_LEVEL_UNIQUE:
 				/* validity check */
 				/*
 				 * If range violation of reqid, kernel will
 				 * update it, don't refuse it.
 				 */
 				if (xisr->sadb_x_ipsecrequest_reqid
 						> IPSEC_MANUAL_REQID_MAX) {
 					ipseclog((LOG_DEBUG,
 					    "%s: reqid=%d range "
 					    "violation, updated by kernel.\n",
 					    __func__,
 					    xisr->sadb_x_ipsecrequest_reqid));
 					xisr->sadb_x_ipsecrequest_reqid = 0;
 				}
 
 				/* allocate new reqid id if reqid is zero. */
 				if (xisr->sadb_x_ipsecrequest_reqid == 0) {
 					u_int32_t reqid;
 					if ((reqid = key_newreqid()) == 0) {
 						key_freesp(&newsp);
 						*error = ENOBUFS;
 						return NULL;
 					}
 					isr->saidx.reqid = reqid;
 					xisr->sadb_x_ipsecrequest_reqid = reqid;
 				} else {
 				/* set it for manual keying. */
 					isr->saidx.reqid =
 					    xisr->sadb_x_ipsecrequest_reqid;
 				}
 				break;
 
 			default:
 				ipseclog((LOG_DEBUG, "%s: invalid level=%u\n",
 					__func__,
 					xisr->sadb_x_ipsecrequest_level));
 				key_freesp(&newsp);
 				*error = EINVAL;
 				return NULL;
 			}
 			isr->level = xisr->sadb_x_ipsecrequest_level;
 
 			/* set IP addresses if there */
 			if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) {
 				struct sockaddr *paddr;
 
 				len = tlen - sizeof(*xisr);
 				paddr = (struct sockaddr *)(xisr + 1);
 				/* validity check */
 				if (len < sizeof(struct sockaddr) ||
 				    len < 2 * paddr->sa_len ||
 				    paddr->sa_len > sizeof(isr->saidx.src)) {
 					ipseclog((LOG_DEBUG, "%s: invalid "
 						"request address length.\n",
 						__func__));
 					key_freesp(&newsp);
 					*error = EINVAL;
 					return NULL;
 				}
 				/*
 				 * Request length should be enough to keep
 				 * source and destination addresses.
 				 */
 				if (xisr->sadb_x_ipsecrequest_len <
 				    sizeof(*xisr) + 2 * paddr->sa_len) {
 					ipseclog((LOG_DEBUG, "%s: invalid "
 					    "ipsecrequest length.\n",
 					    __func__));
 					key_freesp(&newsp);
 					*error = EINVAL;
 					return (NULL);
 				}
 				bcopy(paddr, &isr->saidx.src, paddr->sa_len);
 				paddr = (struct sockaddr *)((caddr_t)paddr +
 				    paddr->sa_len);
 
 				/* validity check */
 				if (paddr->sa_len !=
 				    isr->saidx.src.sa.sa_len) {
 					ipseclog((LOG_DEBUG, "%s: invalid "
 						"request address length.\n",
 						__func__));
 					key_freesp(&newsp);
 					*error = EINVAL;
 					return NULL;
 				}
 				/* AF family should match */
 				if (paddr->sa_family !=
 				    isr->saidx.src.sa.sa_family) {
 					ipseclog((LOG_DEBUG, "%s: address "
 					    "family doesn't match.\n",
 						__func__));
 					key_freesp(&newsp);
 					*error = EINVAL;
 					return (NULL);
 				}
 				bcopy(paddr, &isr->saidx.dst, paddr->sa_len);
 			} else {
 				/*
 				 * Addresses for TUNNEL mode requests are
 				 * mandatory.
 				 */
 				if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
 					ipseclog((LOG_DEBUG, "%s: missing "
 					    "request addresses.\n", __func__));
 					key_freesp(&newsp);
 					*error = EINVAL;
 					return (NULL);
 				}
 			}
 			tlen -= xisr->sadb_x_ipsecrequest_len;
 
 			/* validity check */
 			if (tlen < 0) {
 				ipseclog((LOG_DEBUG, "%s: becoming tlen < 0.\n",
 					__func__));
 				key_freesp(&newsp);
 				*error = EINVAL;
 				return NULL;
 			}
 
 			xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr
 			                 + xisr->sadb_x_ipsecrequest_len);
 		}
 		/* XXXAE: LARVAL SP */
 		if (newsp->tcount < 1) {
 			ipseclog((LOG_DEBUG, "%s: valid IPSEC transforms "
 			    "not found.\n", __func__));
 			key_freesp(&newsp);
 			*error = EINVAL;
 			return (NULL);
 		}
 	    }
 		break;
 	default:
 		ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__));
 		key_freesp(&newsp);
 		*error = EINVAL;
 		return NULL;
 	}
 
 	*error = 0;
 	return (newsp);
 }
 
 uint32_t
 key_newreqid(void)
 {
 	static uint32_t auto_reqid = IPSEC_MANUAL_REQID_MAX + 1;
 
 	if (auto_reqid == ~0)
 		auto_reqid = IPSEC_MANUAL_REQID_MAX + 1;
 	else
 		auto_reqid++;
 
 	/* XXX should be unique check */
 	return (auto_reqid);
 }
 
 /*
  * copy secpolicy struct to sadb_x_policy structure indicated.
  */
 static struct mbuf *
 key_sp2mbuf(struct secpolicy *sp)
 {
 	struct mbuf *m;
 	size_t tlen;
 
 	tlen = key_getspreqmsglen(sp);
 	m = m_get2(tlen, M_NOWAIT, MT_DATA, 0);
 	if (m == NULL)
 		return (NULL);
 	m_align(m, tlen);
 	m->m_len = tlen;
 	if (key_sp2msg(sp, m->m_data, &tlen) != 0) {
 		m_freem(m);
 		return (NULL);
 	}
 	return (m);
 }
 
 int
 key_sp2msg(struct secpolicy *sp, void *request, size_t *len)
 {
 	struct sadb_x_ipsecrequest *xisr;
 	struct sadb_x_policy *xpl;
 	struct ipsecrequest *isr;
 	size_t xlen, ilen;
 	caddr_t p;
 	int error, i;
 
 	IPSEC_ASSERT(sp != NULL, ("null policy"));
 
 	xlen = sizeof(*xpl);
 	if (*len < xlen)
 		return (EINVAL);
 
 	error = 0;
 	bzero(request, *len);
 	xpl = (struct sadb_x_policy *)request;
 	xpl->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
 	xpl->sadb_x_policy_type = sp->policy;
 	xpl->sadb_x_policy_dir = sp->spidx.dir;
 	xpl->sadb_x_policy_id = sp->id;
 	xpl->sadb_x_policy_priority = sp->priority;
 	switch (sp->state) {
 	case IPSEC_SPSTATE_IFNET:
 		xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_IFNET;
 		break;
 	case IPSEC_SPSTATE_PCB:
 		xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_PCB;
 		break;
 	default:
 		xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_GLOBAL;
 	}
 
 	/* if is the policy for ipsec ? */
 	if (sp->policy == IPSEC_POLICY_IPSEC) {
 		p = (caddr_t)xpl + sizeof(*xpl);
 		for (i = 0; i < sp->tcount; i++) {
 			isr = sp->req[i];
 			ilen = PFKEY_ALIGN8(sizeof(*xisr) +
 			    isr->saidx.src.sa.sa_len +
 			    isr->saidx.dst.sa.sa_len);
 			xlen += ilen;
 			if (xlen > *len) {
 				error = ENOBUFS;
 				/* Calculate needed size */
 				continue;
 			}
 			xisr = (struct sadb_x_ipsecrequest *)p;
 			xisr->sadb_x_ipsecrequest_len = ilen;
 			xisr->sadb_x_ipsecrequest_proto = isr->saidx.proto;
 			xisr->sadb_x_ipsecrequest_mode = isr->saidx.mode;
 			xisr->sadb_x_ipsecrequest_level = isr->level;
 			xisr->sadb_x_ipsecrequest_reqid = isr->saidx.reqid;
 
 			p += sizeof(*xisr);
 			bcopy(&isr->saidx.src, p, isr->saidx.src.sa.sa_len);
 			p += isr->saidx.src.sa.sa_len;
 			bcopy(&isr->saidx.dst, p, isr->saidx.dst.sa.sa_len);
 			p += isr->saidx.dst.sa.sa_len;
 		}
 	}
 	xpl->sadb_x_policy_len = PFKEY_UNIT64(xlen);
 	if (error == 0)
 		*len = xlen;
 	else
 		*len = sizeof(*xpl);
 	return (error);
 }
 
 /* m will not be freed nor modified */
 static struct mbuf *
 key_gather_mbuf(struct mbuf *m, const struct sadb_msghdr *mhp,
     int ndeep, int nitem, ...)
 {
 	va_list ap;
 	int idx;
 	int i;
 	struct mbuf *result = NULL, *n;
 	int len;
 
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 
 	va_start(ap, nitem);
 	for (i = 0; i < nitem; i++) {
 		idx = va_arg(ap, int);
 		if (idx < 0 || idx > SADB_EXT_MAX)
 			goto fail;
 		/* don't attempt to pull empty extension */
 		if (idx == SADB_EXT_RESERVED && mhp->msg == NULL)
 			continue;
 		if (idx != SADB_EXT_RESERVED  &&
 		    (mhp->ext[idx] == NULL || mhp->extlen[idx] == 0))
 			continue;
 
 		if (idx == SADB_EXT_RESERVED) {
 			len = PFKEY_ALIGN8(sizeof(struct sadb_msg));
 
 			IPSEC_ASSERT(len <= MHLEN, ("header too big %u", len));
 
 			MGETHDR(n, M_NOWAIT, MT_DATA);
 			if (!n)
 				goto fail;
 			n->m_len = len;
 			n->m_next = NULL;
 			m_copydata(m, 0, sizeof(struct sadb_msg),
 			    mtod(n, caddr_t));
 		} else if (i < ndeep) {
 			len = mhp->extlen[idx];
 			n = m_get2(len, M_NOWAIT, MT_DATA, 0);
 			if (n == NULL)
 				goto fail;
 			m_align(n, len);
 			n->m_len = len;
 			m_copydata(m, mhp->extoff[idx], mhp->extlen[idx],
 			    mtod(n, caddr_t));
 		} else {
 			n = m_copym(m, mhp->extoff[idx], mhp->extlen[idx],
 			    M_NOWAIT);
 		}
 		if (n == NULL)
 			goto fail;
 
 		if (result)
 			m_cat(result, n);
 		else
 			result = n;
 	}
 	va_end(ap);
 
 	if ((result->m_flags & M_PKTHDR) != 0) {
 		result->m_pkthdr.len = 0;
 		for (n = result; n; n = n->m_next)
 			result->m_pkthdr.len += n->m_len;
 	}
 
 	return result;
 
 fail:
 	m_freem(result);
 	va_end(ap);
 	return NULL;
 }
 
 /*
  * SADB_X_SPDADD, SADB_X_SPDSETIDX or SADB_X_SPDUPDATE processing
  * add an entry to SP database, when received
  *   <base, address(SD), (lifetime(H),) policy>
  * from the user(?).
  * Adding to SP database,
  * and send
  *   <base, address(SD), (lifetime(H),) policy>
  * to the socket which was send.
  *
  * SPDADD set a unique policy entry.
  * SPDSETIDX like SPDADD without a part of policy requests.
  * SPDUPDATE replace a unique policy entry.
  *
  * XXXAE: serialize this in PF_KEY to avoid races.
  * m will always be freed.
  */
 static int
 key_spdadd(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	struct secpolicyindex spidx;
 	struct sadb_address *src0, *dst0;
 	struct sadb_x_policy *xpl0, *xpl;
 	struct sadb_lifetime *lft = NULL;
 	struct secpolicy *newsp, *oldsp;
 	int error;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
 	    SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: missing required header.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) ||
 	    SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: wrong header size.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	if (!SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD)) {
 		if (SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_HARD)) {
 			ipseclog((LOG_DEBUG,
 			    "%s: invalid message: wrong header size.\n",
 			    __func__));
 			return key_senderror(so, m, EINVAL);
 		}
 		lft = (struct sadb_lifetime *)mhp->ext[SADB_EXT_LIFETIME_HARD];
 	}
 
 	src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
 	dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
 	xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY];
 
 	/* check the direciton */
 	switch (xpl0->sadb_x_policy_dir) {
 	case IPSEC_DIR_INBOUND:
 	case IPSEC_DIR_OUTBOUND:
 		break;
 	default:
 		ipseclog((LOG_DEBUG, "%s: invalid SP direction.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	/* key_spdadd() accepts DISCARD, NONE and IPSEC. */
 	if (xpl0->sadb_x_policy_type != IPSEC_POLICY_DISCARD &&
 	    xpl0->sadb_x_policy_type != IPSEC_POLICY_NONE &&
 	    xpl0->sadb_x_policy_type != IPSEC_POLICY_IPSEC) {
 		ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	/* policy requests are mandatory when action is ipsec. */
 	if (xpl0->sadb_x_policy_type == IPSEC_POLICY_IPSEC &&
 	    mhp->extlen[SADB_X_EXT_POLICY] <= sizeof(*xpl0)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: policy requests required.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	error = key_checksockaddrs((struct sockaddr *)(src0 + 1),
 	    (struct sockaddr *)(dst0 + 1));
 	if (error != 0 ||
 	    src0->sadb_address_proto != dst0->sadb_address_proto) {
 		ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
 		return key_senderror(so, m, error);
 	}
 	/* make secindex */
 	KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir,
 	                src0 + 1,
 	                dst0 + 1,
 	                src0->sadb_address_prefixlen,
 	                dst0->sadb_address_prefixlen,
 	                src0->sadb_address_proto,
 	                &spidx);
 	/* Checking there is SP already or not. */
 	oldsp = key_getsp(&spidx);
 	if (oldsp != NULL) {
 		if (mhp->msg->sadb_msg_type == SADB_X_SPDUPDATE) {
 			KEYDBG(KEY_STAMP,
 			    printf("%s: unlink SP(%p) for SPDUPDATE\n",
 				__func__, oldsp));
 			KEYDBG(KEY_DATA, kdebug_secpolicy(oldsp));
 		} else {
 			key_freesp(&oldsp);
 			ipseclog((LOG_DEBUG,
 			    "%s: a SP entry exists already.\n", __func__));
 			return (key_senderror(so, m, EEXIST));
 		}
 	}
 
 	/* allocate new SP entry */
 	if ((newsp = key_msg2sp(xpl0, PFKEY_EXTLEN(xpl0), &error)) == NULL) {
 		if (oldsp != NULL) {
 			key_unlink(oldsp);
 			key_freesp(&oldsp); /* second for our reference */
 		}
 		return key_senderror(so, m, error);
 	}
 
 	newsp->lastused = newsp->created = time_second;
 	newsp->lifetime = lft ? lft->sadb_lifetime_addtime : 0;
 	newsp->validtime = lft ? lft->sadb_lifetime_usetime : 0;
 	bcopy(&spidx, &newsp->spidx, sizeof(spidx));
 
 	SPTREE_WLOCK();
 	if ((newsp->id = key_getnewspid()) == 0) {
 		if (oldsp != NULL)
 			key_detach(oldsp);
 		SPTREE_WUNLOCK();
 		if (oldsp != NULL) {
 			key_freesp(&oldsp); /* first for key_detach */
 			IPSEC_ASSERT(oldsp != NULL, ("null oldsp: refcount bug"));
 			key_freesp(&oldsp); /* second for our reference */
 			if (SPDCACHE_ENABLED()) /* refresh cache because of key_detach */
 				spdcache_clear();
 		}
 		key_freesp(&newsp);
 		return key_senderror(so, m, ENOBUFS);
 	}
 	if (oldsp != NULL)
 		key_detach(oldsp);
 	key_insertsp(newsp);
 	SPTREE_WUNLOCK();
 	if (oldsp != NULL) {
 		key_freesp(&oldsp); /* first for key_detach */
 		IPSEC_ASSERT(oldsp != NULL, ("null oldsp: refcount bug"));
 		key_freesp(&oldsp); /* second for our reference */
 	}
 	if (SPDCACHE_ENABLED())
 		spdcache_clear();
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SP(%p)\n", __func__, newsp));
 	KEYDBG(KEY_DATA, kdebug_secpolicy(newsp));
 
     {
 	struct mbuf *n, *mpolicy;
 	struct sadb_msg *newmsg;
 	int off;
 
 	/* create new sadb_msg to reply. */
 	if (lft) {
 		n = key_gather_mbuf(m, mhp, 2, 5, SADB_EXT_RESERVED,
 		    SADB_X_EXT_POLICY, SADB_EXT_LIFETIME_HARD,
 		    SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
 	} else {
 		n = key_gather_mbuf(m, mhp, 2, 4, SADB_EXT_RESERVED,
 		    SADB_X_EXT_POLICY,
 		    SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
 	}
 	if (!n)
 		return key_senderror(so, m, ENOBUFS);
 
 	if (n->m_len < sizeof(*newmsg)) {
 		n = m_pullup(n, sizeof(*newmsg));
 		if (!n)
 			return key_senderror(so, m, ENOBUFS);
 	}
 	newmsg = mtod(n, struct sadb_msg *);
 	newmsg->sadb_msg_errno = 0;
 	newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
 
 	off = 0;
 	mpolicy = m_pulldown(n, PFKEY_ALIGN8(sizeof(struct sadb_msg)),
 	    sizeof(*xpl), &off);
 	if (mpolicy == NULL) {
 		/* n is already freed */
 		return key_senderror(so, m, ENOBUFS);
 	}
 	xpl = (struct sadb_x_policy *)(mtod(mpolicy, caddr_t) + off);
 	if (xpl->sadb_x_policy_exttype != SADB_X_EXT_POLICY) {
 		m_freem(n);
 		return key_senderror(so, m, EINVAL);
 	}
 	xpl->sadb_x_policy_id = newsp->id;
 
 	m_freem(m);
 	return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
     }
 }
 
 /*
  * get new policy id.
  * OUT:
  *	0:	failure.
  *	others: success.
  */
 static uint32_t
 key_getnewspid(void)
 {
 	struct secpolicy *sp;
 	uint32_t newid = 0;
 	int tries, limit;
 
 	SPTREE_WLOCK_ASSERT();
 
 	limit = atomic_load_int(&V_key_spi_trycnt);
 	for (tries = 0; tries < limit; tries++) {
 		if (V_policy_id == ~0) /* overflowed */
 			newid = V_policy_id = 1;
 		else
 			newid = ++V_policy_id;
 		LIST_FOREACH(sp, SPHASH_HASH(newid), idhash) {
 			if (sp->id == newid)
 				break;
 		}
 		if (sp == NULL)
 			break;
 	}
 	if (tries == limit || newid == 0) {
 		ipseclog((LOG_DEBUG, "%s: failed to allocate policy id.\n",
 		    __func__));
 		return (0);
 	}
 	return (newid);
 }
 
 /*
  * SADB_SPDDELETE processing
  * receive
  *   <base, address(SD), policy(*)>
  * from the user(?), and set SADB_SASTATE_DEAD,
  * and send,
  *   <base, address(SD), policy(*)>
  * to the ikmpd.
  * policy(*) including direction of policy.
  *
  * m will always be freed.
  */
 static int
 key_spddelete(struct socket *so, struct mbuf *m,
     const struct sadb_msghdr *mhp)
 {
 	struct secpolicyindex spidx;
 	struct sadb_address *src0, *dst0;
 	struct sadb_x_policy *xpl0;
 	struct secpolicy *sp;
 
 	IPSEC_ASSERT(so != NULL, ("null so"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
 	    SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: missing required header.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) ||
 	    SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: wrong header size.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
 	dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
 	xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY];
 
 	/* check the direciton */
 	switch (xpl0->sadb_x_policy_dir) {
 	case IPSEC_DIR_INBOUND:
 	case IPSEC_DIR_OUTBOUND:
 		break;
 	default:
 		ipseclog((LOG_DEBUG, "%s: invalid SP direction.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	/* Only DISCARD, NONE and IPSEC are allowed */
 	if (xpl0->sadb_x_policy_type != IPSEC_POLICY_DISCARD &&
 	    xpl0->sadb_x_policy_type != IPSEC_POLICY_NONE &&
 	    xpl0->sadb_x_policy_type != IPSEC_POLICY_IPSEC) {
 		ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	if (key_checksockaddrs((struct sockaddr *)(src0 + 1),
 	    (struct sockaddr *)(dst0 + 1)) != 0 ||
 	    src0->sadb_address_proto != dst0->sadb_address_proto) {
 		ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	/* make secindex */
 	KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir,
 	                src0 + 1,
 	                dst0 + 1,
 	                src0->sadb_address_prefixlen,
 	                dst0->sadb_address_prefixlen,
 	                src0->sadb_address_proto,
 	                &spidx);
 
 	/* Is there SP in SPD ? */
 	if ((sp = key_getsp(&spidx)) == NULL) {
 		ipseclog((LOG_DEBUG, "%s: no SP found.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	/* save policy id to buffer to be returned. */
 	xpl0->sadb_x_policy_id = sp->id;
 
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SP(%p)\n", __func__, sp));
 	KEYDBG(KEY_DATA, kdebug_secpolicy(sp));
 	key_unlink(sp);
 	key_freesp(&sp);
 
     {
 	struct mbuf *n;
 	struct sadb_msg *newmsg;
 
 	/* create new sadb_msg to reply. */
 	n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED,
 	    SADB_X_EXT_POLICY, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
 	if (!n)
 		return key_senderror(so, m, ENOBUFS);
 
 	newmsg = mtod(n, struct sadb_msg *);
 	newmsg->sadb_msg_errno = 0;
 	newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
 
 	m_freem(m);
 	return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
     }
 }
 
 /*
  * SADB_SPDDELETE2 processing
  * receive
  *   <base, policy(*)>
  * from the user(?), and set SADB_SASTATE_DEAD,
  * and send,
  *   <base, policy(*)>
  * to the ikmpd.
  * policy(*) including direction of policy.
  *
  * m will always be freed.
  */
 static int
 key_spddelete2(struct socket *so, struct mbuf *m,
     const struct sadb_msghdr *mhp)
 {
 	struct secpolicy *sp;
 	uint32_t id;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	if (SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY) ||
 	    SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) {
 		ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	id = ((struct sadb_x_policy *)
 	    mhp->ext[SADB_X_EXT_POLICY])->sadb_x_policy_id;
 
 	/* Is there SP in SPD ? */
 	if ((sp = key_getspbyid(id)) == NULL) {
 		ipseclog((LOG_DEBUG, "%s: no SP found for id %u.\n",
 		    __func__, id));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SP(%p)\n", __func__, sp));
 	KEYDBG(KEY_DATA, kdebug_secpolicy(sp));
 	key_unlink(sp);
 	if (sp->state != IPSEC_SPSTATE_DEAD) {
 		ipseclog((LOG_DEBUG, "%s: failed to delete SP with id %u.\n",
 		    __func__, id));
 		key_freesp(&sp);
 		return (key_senderror(so, m, EACCES));
 	}
 	key_freesp(&sp);
 
     {
 	struct mbuf *n, *nn;
 	struct sadb_msg *newmsg;
 	int off, len;
 
 	/* create new sadb_msg to reply. */
 	len = PFKEY_ALIGN8(sizeof(struct sadb_msg));
 
 	n = key_mget(len);
 	if (n == NULL)
 		return key_senderror(so, m, ENOBUFS);
 
 	n->m_len = len;
 	n->m_next = NULL;
 	off = 0;
 
 	m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off);
 	off += PFKEY_ALIGN8(sizeof(struct sadb_msg));
 
 	IPSEC_ASSERT(off == len, ("length inconsistency (off %u len %u)",
 		off, len));
 
 	n->m_next = m_copym(m, mhp->extoff[SADB_X_EXT_POLICY],
 	    mhp->extlen[SADB_X_EXT_POLICY], M_NOWAIT);
 	if (!n->m_next) {
 		m_freem(n);
 		return key_senderror(so, m, ENOBUFS);
 	}
 
 	n->m_pkthdr.len = 0;
 	for (nn = n; nn; nn = nn->m_next)
 		n->m_pkthdr.len += nn->m_len;
 
 	newmsg = mtod(n, struct sadb_msg *);
 	newmsg->sadb_msg_errno = 0;
 	newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
 
 	m_freem(m);
 	return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
     }
 }
 
 /*
  * SADB_X_SPDGET processing
  * receive
  *   <base, policy(*)>
  * from the user(?),
  * and send,
  *   <base, address(SD), policy>
  * to the ikmpd.
  * policy(*) including direction of policy.
  *
  * m will always be freed.
  */
 static int
 key_spdget(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	struct secpolicy *sp;
 	struct mbuf *n;
 	uint32_t id;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	if (SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY) ||
 	    SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) {
 		ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	id = ((struct sadb_x_policy *)
 	    mhp->ext[SADB_X_EXT_POLICY])->sadb_x_policy_id;
 
 	/* Is there SP in SPD ? */
 	if ((sp = key_getspbyid(id)) == NULL) {
 		ipseclog((LOG_DEBUG, "%s: no SP found for id %u.\n",
 		    __func__, id));
 		return key_senderror(so, m, ENOENT);
 	}
 
 	n = key_setdumpsp(sp, SADB_X_SPDGET, mhp->msg->sadb_msg_seq,
 	    mhp->msg->sadb_msg_pid);
 	key_freesp(&sp);
 	if (n != NULL) {
 		m_freem(m);
 		return key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
 	} else
 		return key_senderror(so, m, ENOBUFS);
 }
 
 /*
  * SADB_X_SPDACQUIRE processing.
  * Acquire policy and SA(s) for a *OUTBOUND* packet.
  * send
  *   <base, policy(*)>
  * to KMD, and expect to receive
  *   <base> with SADB_X_SPDACQUIRE if error occurred,
  * or
  *   <base, policy>
  * with SADB_X_SPDUPDATE from KMD by PF_KEY.
  * policy(*) is without policy requests.
  *
  *    0     : succeed
  *    others: error number
  */
 int
 key_spdacquire(struct secpolicy *sp)
 {
 	struct mbuf *result = NULL, *m;
 	struct secspacq *newspacq;
 
 	IPSEC_ASSERT(sp != NULL, ("null secpolicy"));
 	IPSEC_ASSERT(sp->req == NULL, ("policy exists"));
 	IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
 		("policy not IPSEC %u", sp->policy));
 
 	/* Get an entry to check whether sent message or not. */
 	newspacq = key_getspacq(&sp->spidx);
 	if (newspacq != NULL) {
 		if (V_key_blockacq_count < newspacq->count) {
 			/* reset counter and do send message. */
 			newspacq->count = 0;
 		} else {
 			/* increment counter and do nothing. */
 			newspacq->count++;
 			SPACQ_UNLOCK();
 			return (0);
 		}
 		SPACQ_UNLOCK();
 	} else {
 		/* make new entry for blocking to send SADB_ACQUIRE. */
 		newspacq = key_newspacq(&sp->spidx);
 		if (newspacq == NULL)
 			return ENOBUFS;
 	}
 
 	/* create new sadb_msg to reply. */
 	m = key_setsadbmsg(SADB_X_SPDACQUIRE, 0, 0, 0, 0, 0);
 	if (!m)
 		return ENOBUFS;
 
 	result = m;
 
 	result->m_pkthdr.len = 0;
 	for (m = result; m; m = m->m_next)
 		result->m_pkthdr.len += m->m_len;
 
 	mtod(result, struct sadb_msg *)->sadb_msg_len =
 	    PFKEY_UNIT64(result->m_pkthdr.len);
 
 	return key_sendup_mbuf(NULL, m, KEY_SENDUP_REGISTERED);
 }
 
 /*
  * SADB_SPDFLUSH processing
  * receive
  *   <base>
  * from the user, and free all entries in secpctree.
  * and send,
  *   <base>
  * to the user.
  * NOTE: what to do is only marking SADB_SASTATE_DEAD.
  *
  * m will always be freed.
  */
 static int
 key_spdflush(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	struct secpolicy_queue drainq;
 	struct sadb_msg *newmsg;
 	struct secpolicy *sp, *nextsp;
 	u_int dir;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	if (m->m_len != PFKEY_ALIGN8(sizeof(struct sadb_msg)))
 		return key_senderror(so, m, EINVAL);
 
 	TAILQ_INIT(&drainq);
 	SPTREE_WLOCK();
 	for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
 		TAILQ_CONCAT(&drainq, &V_sptree[dir], chain);
 	}
 	/*
 	 * We need to set state to DEAD for each policy to be sure,
 	 * that another thread won't try to unlink it.
 	 * Also remove SP from sphash.
 	 */
 	TAILQ_FOREACH(sp, &drainq, chain) {
 		sp->state = IPSEC_SPSTATE_DEAD;
 		LIST_REMOVE(sp, idhash);
 	}
 	V_sp_genid++;
 	V_spd_size = 0;
 	SPTREE_WUNLOCK();
 	if (SPDCACHE_ENABLED())
 		spdcache_clear();
 	sp = TAILQ_FIRST(&drainq);
 	while (sp != NULL) {
 		nextsp = TAILQ_NEXT(sp, chain);
 		key_freesp(&sp);
 		sp = nextsp;
 	}
 
 	if (sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) {
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return key_senderror(so, m, ENOBUFS);
 	}
 
 	if (m->m_next)
 		m_freem(m->m_next);
 	m->m_next = NULL;
 	m->m_pkthdr.len = m->m_len = PFKEY_ALIGN8(sizeof(struct sadb_msg));
 	newmsg = mtod(m, struct sadb_msg *);
 	newmsg->sadb_msg_errno = 0;
 	newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len);
 
 	return key_sendup_mbuf(so, m, KEY_SENDUP_ALL);
 }
 
 static uint8_t
 key_satype2scopemask(uint8_t satype)
 {
 
 	if (satype == IPSEC_POLICYSCOPE_ANY)
 		return (0xff);
 	return (satype);
 }
 /*
  * SADB_SPDDUMP processing
  * receive
  *   <base>
  * from the user, and dump all SP leaves and send,
  *   <base> .....
  * to the ikmpd.
  *
  * NOTE:
  *   sadb_msg_satype is considered as mask of policy scopes.
  *   m will always be freed.
  */
 static int
 key_spddump(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	SPTREE_RLOCK_TRACKER;
 	struct secpolicy *sp;
 	struct mbuf *n;
 	int cnt;
 	u_int dir, scope;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	/* search SPD entry and get buffer size. */
 	cnt = 0;
 	scope = key_satype2scopemask(mhp->msg->sadb_msg_satype);
 	SPTREE_RLOCK();
 	for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
 		if (scope & IPSEC_POLICYSCOPE_GLOBAL) {
 			TAILQ_FOREACH(sp, &V_sptree[dir], chain)
 				cnt++;
 		}
 		if (scope & IPSEC_POLICYSCOPE_IFNET) {
 			TAILQ_FOREACH(sp, &V_sptree_ifnet[dir], chain)
 				cnt++;
 		}
 	}
 
 	if (cnt == 0) {
 		SPTREE_RUNLOCK();
 		return key_senderror(so, m, ENOENT);
 	}
 
 	for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
 		if (scope & IPSEC_POLICYSCOPE_GLOBAL) {
 			TAILQ_FOREACH(sp, &V_sptree[dir], chain) {
 				--cnt;
 				n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt,
 				    mhp->msg->sadb_msg_pid);
 
 				if (n != NULL)
 					key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
 			}
 		}
 		if (scope & IPSEC_POLICYSCOPE_IFNET) {
 			TAILQ_FOREACH(sp, &V_sptree_ifnet[dir], chain) {
 				--cnt;
 				n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt,
 				    mhp->msg->sadb_msg_pid);
 
 				if (n != NULL)
 					key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
 			}
 		}
 	}
 
 	SPTREE_RUNLOCK();
 	m_freem(m);
 	return (0);
 }
 
 static struct mbuf *
 key_setdumpsp(struct secpolicy *sp, u_int8_t type, u_int32_t seq,
     u_int32_t pid)
 {
 	struct mbuf *result = NULL, *m;
 	struct seclifetime lt;
 
 	m = key_setsadbmsg(type, 0, SADB_SATYPE_UNSPEC, seq, pid, sp->refcnt);
 	if (!m)
 		goto fail;
 	result = m;
 
 	m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC,
 	    &sp->spidx.src.sa, sp->spidx.prefs,
 	    sp->spidx.ul_proto);
 	if (!m)
 		goto fail;
 	m_cat(result, m);
 
 	m = key_setsadbaddr(SADB_EXT_ADDRESS_DST,
 	    &sp->spidx.dst.sa, sp->spidx.prefd,
 	    sp->spidx.ul_proto);
 	if (!m)
 		goto fail;
 	m_cat(result, m);
 
 	m = key_sp2mbuf(sp);
 	if (!m)
 		goto fail;
 	m_cat(result, m);
 
 	if(sp->lifetime){
 		lt.addtime=sp->created;
 		lt.usetime= sp->lastused;
 		m = key_setlifetime(&lt, SADB_EXT_LIFETIME_CURRENT);
 		if (!m)
 			goto fail;
 		m_cat(result, m);
 		
 		lt.addtime=sp->lifetime;
 		lt.usetime= sp->validtime;
 		m = key_setlifetime(&lt, SADB_EXT_LIFETIME_HARD);
 		if (!m)
 			goto fail;
 		m_cat(result, m);
 	}
 
 	if ((result->m_flags & M_PKTHDR) == 0)
 		goto fail;
 
 	if (result->m_len < sizeof(struct sadb_msg)) {
 		result = m_pullup(result, sizeof(struct sadb_msg));
 		if (result == NULL)
 			goto fail;
 	}
 
 	result->m_pkthdr.len = 0;
 	for (m = result; m; m = m->m_next)
 		result->m_pkthdr.len += m->m_len;
 
 	mtod(result, struct sadb_msg *)->sadb_msg_len =
 	    PFKEY_UNIT64(result->m_pkthdr.len);
 
 	return result;
 
 fail:
 	m_freem(result);
 	return NULL;
 }
 /*
  * get PFKEY message length for security policy and request.
  */
 static size_t
 key_getspreqmsglen(struct secpolicy *sp)
 {
 	size_t tlen, len;
 	int i;
 
 	tlen = sizeof(struct sadb_x_policy);
 	/* if is the policy for ipsec ? */
 	if (sp->policy != IPSEC_POLICY_IPSEC)
 		return (tlen);
 
 	/* get length of ipsec requests */
 	for (i = 0; i < sp->tcount; i++) {
 		len = sizeof(struct sadb_x_ipsecrequest)
 			+ sp->req[i]->saidx.src.sa.sa_len
 			+ sp->req[i]->saidx.dst.sa.sa_len;
 
 		tlen += PFKEY_ALIGN8(len);
 	}
 	return (tlen);
 }
 
 /*
  * SADB_SPDEXPIRE processing
  * send
  *   <base, address(SD), lifetime(CH), policy>
  * to KMD by PF_KEY.
  *
  * OUT:	0	: succeed
  *	others	: error number
  */
 static int
 key_spdexpire(struct secpolicy *sp)
 {
 	struct sadb_lifetime *lt;
 	struct mbuf *result = NULL, *m;
 	int len, error = -1;
 
 	IPSEC_ASSERT(sp != NULL, ("null secpolicy"));
 
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SP(%p)\n", __func__, sp));
 	KEYDBG(KEY_DATA, kdebug_secpolicy(sp));
 
 	/* set msg header */
 	m = key_setsadbmsg(SADB_X_SPDEXPIRE, 0, 0, 0, 0, 0);
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	result = m;
 
 	/* create lifetime extension (current and hard) */
 	len = PFKEY_ALIGN8(sizeof(*lt)) * 2;
 	m = m_get2(len, M_NOWAIT, MT_DATA, 0);
 	if (m == NULL) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	m_align(m, len);
 	m->m_len = len;
 	bzero(mtod(m, caddr_t), len);
 	lt = mtod(m, struct sadb_lifetime *);
 	lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime));
 	lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
 	lt->sadb_lifetime_allocations = 0;
 	lt->sadb_lifetime_bytes = 0;
 	lt->sadb_lifetime_addtime = sp->created;
 	lt->sadb_lifetime_usetime = sp->lastused;
 	lt = (struct sadb_lifetime *)(mtod(m, caddr_t) + len / 2);
 	lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime));
 	lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
 	lt->sadb_lifetime_allocations = 0;
 	lt->sadb_lifetime_bytes = 0;
 	lt->sadb_lifetime_addtime = sp->lifetime;
 	lt->sadb_lifetime_usetime = sp->validtime;
 	m_cat(result, m);
 
 	/* set sadb_address for source */
 	m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC,
 	    &sp->spidx.src.sa,
 	    sp->spidx.prefs, sp->spidx.ul_proto);
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	m_cat(result, m);
 
 	/* set sadb_address for destination */
 	m = key_setsadbaddr(SADB_EXT_ADDRESS_DST,
 	    &sp->spidx.dst.sa,
 	    sp->spidx.prefd, sp->spidx.ul_proto);
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	m_cat(result, m);
 
 	/* set secpolicy */
 	m = key_sp2mbuf(sp);
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	m_cat(result, m);
 
 	if ((result->m_flags & M_PKTHDR) == 0) {
 		error = EINVAL;
 		goto fail;
 	}
 
 	if (result->m_len < sizeof(struct sadb_msg)) {
 		result = m_pullup(result, sizeof(struct sadb_msg));
 		if (result == NULL) {
 			error = ENOBUFS;
 			goto fail;
 		}
 	}
 
 	result->m_pkthdr.len = 0;
 	for (m = result; m; m = m->m_next)
 		result->m_pkthdr.len += m->m_len;
 
 	mtod(result, struct sadb_msg *)->sadb_msg_len =
 	    PFKEY_UNIT64(result->m_pkthdr.len);
 
 	return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED);
 
  fail:
 	if (result)
 		m_freem(result);
 	return error;
 }
 
 /* %%% SAD management */
 /*
  * allocating and initialize new SA head.
  * OUT:	NULL	: failure due to the lack of memory.
  *	others	: pointer to new SA head.
  */
 static struct secashead *
 key_newsah(struct secasindex *saidx)
 {
 	struct secashead *sah;
 
 	sah = malloc(sizeof(struct secashead), M_IPSEC_SAH,
 	    M_NOWAIT | M_ZERO);
 	if (sah == NULL) {
 		PFKEYSTAT_INC(in_nomem);
 		return (NULL);
 	}
 	TAILQ_INIT(&sah->savtree_larval);
 	TAILQ_INIT(&sah->savtree_alive);
 	sah->saidx = *saidx;
 	sah->state = SADB_SASTATE_DEAD;
 	SAH_INITREF(sah);
 
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SAH(%p)\n", __func__, sah));
 	KEYDBG(KEY_DATA, kdebug_secash(sah, NULL));
 	return (sah);
 }
 
 static void
 key_freesah(struct secashead **psah)
 {
 	struct secashead *sah = *psah;
 
 	CURVNET_ASSERT_SET();
 
 	if (SAH_DELREF(sah) == 0)
 		return;
 
 	KEYDBG(KEY_STAMP,
 	    printf("%s: last reference to SAH(%p)\n", __func__, sah));
 	KEYDBG(KEY_DATA, kdebug_secash(sah, NULL));
 
 	*psah = NULL;
 	key_delsah(sah);
 }
 
 static void
 key_delsah(struct secashead *sah)
 {
 	IPSEC_ASSERT(sah != NULL, ("NULL sah"));
 	IPSEC_ASSERT(sah->state == SADB_SASTATE_DEAD,
 	    ("Attempt to free non DEAD SAH %p", sah));
 	IPSEC_ASSERT(TAILQ_EMPTY(&sah->savtree_larval),
 	    ("Attempt to free SAH %p with LARVAL SA", sah));
 	IPSEC_ASSERT(TAILQ_EMPTY(&sah->savtree_alive),
 	    ("Attempt to free SAH %p with ALIVE SA", sah));
 
 	free(sah, M_IPSEC_SAH);
 }
 
 /*
  * allocating a new SA for key_add() and key_getspi() call,
  * and copy the values of mhp into new buffer.
  * When SAD message type is SADB_GETSPI set SA state to LARVAL.
  * For SADB_ADD create and initialize SA with MATURE state.
  * OUT:	NULL	: fail
  *	others	: pointer to new secasvar.
  */
 static struct secasvar *
 key_newsav(const struct sadb_msghdr *mhp, struct secasindex *saidx,
     uint32_t spi, int *errp)
 {
 	struct secashead *sah;
 	struct secasvar *sav;
 	int isnew;
 
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 	IPSEC_ASSERT(mhp->msg->sadb_msg_type == SADB_GETSPI ||
 	    mhp->msg->sadb_msg_type == SADB_ADD, ("wrong message type"));
 
 	sav = NULL;
 	sah = NULL;
 	/* check SPI value */
 	switch (saidx->proto) {
 	case IPPROTO_ESP:
 	case IPPROTO_AH:
 		/*
 		 * RFC 4302, 2.4. Security Parameters Index (SPI), SPI values
 		 * 1-255 reserved by IANA for future use,
 		 * 0 for implementation specific, local use.
 		 */
 		if (ntohl(spi) <= 255) {
 			ipseclog((LOG_DEBUG, "%s: illegal range of SPI %u.\n",
 			    __func__, ntohl(spi)));
 			*errp = EINVAL;
 			goto done;
 		}
 		break;
 	}
 
 	sav = malloc(sizeof(struct secasvar), M_IPSEC_SA, M_NOWAIT | M_ZERO);
 	if (sav == NULL) {
 		*errp = ENOBUFS;
 		goto done;
 	}
 	sav->lock = malloc_aligned(max(sizeof(struct rmlock),
 	    CACHE_LINE_SIZE), CACHE_LINE_SIZE, M_IPSEC_MISC,
 	    M_NOWAIT | M_ZERO);
 	if (sav->lock == NULL) {
 		*errp = ENOBUFS;
 		goto done;
 	}
 	rm_init(sav->lock, "ipsec association");
 	sav->lft_c = uma_zalloc_pcpu(ipsec_key_lft_zone, M_NOWAIT | M_ZERO);
 	if (sav->lft_c == NULL) {
 		*errp = ENOBUFS;
 		goto done;
 	}
 
 	sav->spi = spi;
 	sav->seq = mhp->msg->sadb_msg_seq;
 	sav->state = SADB_SASTATE_LARVAL;
 	sav->pid = (pid_t)mhp->msg->sadb_msg_pid;
 	SAV_INITREF(sav);
 again:
 	sah = key_getsah(saidx);
 	if (sah == NULL) {
 		/* create a new SA index */
 		sah = key_newsah(saidx);
 		if (sah == NULL) {
 			ipseclog((LOG_DEBUG,
 			    "%s: No more memory.\n", __func__));
 			*errp = ENOBUFS;
 			goto done;
 		}
 		isnew = 1;
 	} else
 		isnew = 0;
 
 	sav->sah = sah;
 	if (mhp->msg->sadb_msg_type == SADB_GETSPI) {
 		sav->created = time_second;
 	} else if (sav->state == SADB_SASTATE_LARVAL) {
 		/*
 		 * Do not call key_setsaval() second time in case
 		 * of `goto again`. We will have MATURE state.
 		 */
 		*errp = key_setsaval(sav, mhp);
 		if (*errp != 0)
 			goto done;
 		sav->state = SADB_SASTATE_MATURE;
 	}
 
 	SAHTREE_WLOCK();
 	/*
 	 * Check that existing SAH wasn't unlinked.
 	 * Since we didn't hold the SAHTREE lock, it is possible,
 	 * that callout handler or key_flush() or key_delete() could
 	 * unlink this SAH.
 	 */
 	if (isnew == 0 && sah->state == SADB_SASTATE_DEAD) {
 		SAHTREE_WUNLOCK();
 		key_freesah(&sah);	/* reference from key_getsah() */
 		goto again;
 	}
 	if (isnew != 0) {
 		/*
 		 * Add new SAH into SADB.
 		 *
 		 * XXXAE: we can serialize key_add and key_getspi calls, so
 		 * several threads will not fight in the race.
 		 * Otherwise we should check under SAHTREE lock, that this
 		 * SAH would not added twice.
 		 */
 		TAILQ_INSERT_HEAD(&V_sahtree, sah, chain);
 		/* Add new SAH into hash by addresses */
 		LIST_INSERT_HEAD(SAHADDRHASH_HASH(saidx), sah, addrhash);
 		/* Now we are linked in the chain */
 		sah->state = SADB_SASTATE_MATURE;
 		/*
 		 * SAV references this new SAH.
 		 * In case of existing SAH we reuse reference
 		 * from key_getsah().
 		 */
 		SAH_ADDREF(sah);
 	}
 	/* Link SAV with SAH */
 	if (sav->state == SADB_SASTATE_MATURE)
 		TAILQ_INSERT_HEAD(&sah->savtree_alive, sav, chain);
 	else
 		TAILQ_INSERT_HEAD(&sah->savtree_larval, sav, chain);
 	/* Add SAV into SPI hash */
 	LIST_INSERT_HEAD(SAVHASH_HASH(sav->spi), sav, spihash);
 	SAHTREE_WUNLOCK();
 	*errp = 0;	/* success */
 done:
 	if (*errp != 0) {
 		if (sav != NULL) {
 			if (sav->lock != NULL) {
 				rm_destroy(sav->lock);
 				free(sav->lock, M_IPSEC_MISC);
 			}
 			if (sav->lft_c != NULL)
 				uma_zfree_pcpu(ipsec_key_lft_zone, sav->lft_c);
 			free(sav, M_IPSEC_SA), sav = NULL;
 		}
 		if (sah != NULL)
 			key_freesah(&sah);
 		if (*errp == ENOBUFS) {
 			ipseclog((LOG_DEBUG, "%s: No more memory.\n",
 			    __func__));
 			PFKEYSTAT_INC(in_nomem);
 		}
 	}
 	return (sav);
 }
 
 /*
  * free() SA variable entry.
  */
 static void
 key_cleansav(struct secasvar *sav)
 {
 
 	if (sav->natt != NULL) {
 		free(sav->natt, M_IPSEC_MISC);
 		sav->natt = NULL;
 	}
 	if (sav->flags & SADB_X_EXT_F_CLONED)
 		return;
 	if (sav->tdb_xform != NULL) {
 		sav->tdb_xform->xf_cleanup(sav);
 		sav->tdb_xform = NULL;
 	}
 	if (sav->key_auth != NULL) {
 		zfree(sav->key_auth->key_data, M_IPSEC_MISC);
 		free(sav->key_auth, M_IPSEC_MISC);
 		sav->key_auth = NULL;
 	}
 	if (sav->key_enc != NULL) {
 		zfree(sav->key_enc->key_data, M_IPSEC_MISC);
 		free(sav->key_enc, M_IPSEC_MISC);
 		sav->key_enc = NULL;
 	}
 	if (sav->replay != NULL) {
 		mtx_destroy(&sav->replay->lock);
 		if (sav->replay->bitmap != NULL)
 			free(sav->replay->bitmap, M_IPSEC_MISC);
 		free(sav->replay, M_IPSEC_MISC);
 		sav->replay = NULL;
 	}
 	if (sav->lft_h != NULL) {
 		free(sav->lft_h, M_IPSEC_MISC);
 		sav->lft_h = NULL;
 	}
 	if (sav->lft_s != NULL) {
 		free(sav->lft_s, M_IPSEC_MISC);
 		sav->lft_s = NULL;
 	}
 }
 
 /*
  * free() SA variable entry.
  */
 static void
 key_delsav(struct secasvar *sav)
 {
 	IPSEC_ASSERT(sav != NULL, ("null sav"));
 	IPSEC_ASSERT(sav->state == SADB_SASTATE_DEAD,
 	    ("attempt to free non DEAD SA %p", sav));
 	IPSEC_ASSERT(sav->refcnt == 0, ("reference count %u > 0",
 	    sav->refcnt));
 
 	/*
 	 * SA must be unlinked from the chain and hashtbl.
 	 * If SA was cloned, we leave all fields untouched,
 	 * except NAT-T config.
 	 */
 	key_cleansav(sav);
 	if ((sav->flags & SADB_X_EXT_F_CLONED) == 0) {
 		rm_destroy(sav->lock);
 		free(sav->lock, M_IPSEC_MISC);
 		uma_zfree_pcpu(ipsec_key_lft_zone, sav->lft_c);
 	}
 	free(sav, M_IPSEC_SA);
 }
 
 /*
  * search SAH.
  * OUT:
  *	NULL	: not found
  *	others	: found, referenced pointer to a SAH.
  */
 static struct secashead *
 key_getsah(struct secasindex *saidx)
 {
 	SAHTREE_RLOCK_TRACKER;
 	struct secashead *sah;
 
 	SAHTREE_RLOCK();
 	LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) {
 	    if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID) != 0) {
 		    SAH_ADDREF(sah);
 		    break;
 	    }
 	}
 	SAHTREE_RUNLOCK();
 	return (sah);
 }
 
 /*
  * Check not to be duplicated SPI.
  * OUT:
  *	0	: not found
  *	1	: found SA with given SPI.
  */
 static int
 key_checkspidup(uint32_t spi)
 {
 	SAHTREE_RLOCK_TRACKER;
 	struct secasvar *sav;
 
 	/* Assume SPI is in network byte order */
 	SAHTREE_RLOCK();
 	LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) {
 		if (sav->spi == spi)
 			break;
 	}
 	SAHTREE_RUNLOCK();
 	return (sav != NULL);
 }
 
 /*
  * Search SA by SPI.
  * OUT:
  *	NULL	: not found
  *	others	: found, referenced pointer to a SA.
  */
 static struct secasvar *
 key_getsavbyspi(uint32_t spi)
 {
 	SAHTREE_RLOCK_TRACKER;
 	struct secasvar *sav;
 
 	/* Assume SPI is in network byte order */
 	SAHTREE_RLOCK();
 	LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) {
 		if (sav->spi != spi)
 			continue;
 		SAV_ADDREF(sav);
 		break;
 	}
 	SAHTREE_RUNLOCK();
 	return (sav);
 }
 
 static int
 key_updatelifetimes(struct secasvar *sav, const struct sadb_msghdr *mhp)
 {
 	struct seclifetime *lft_h, *lft_s, *tmp;
 
 	/* Lifetime extension is optional, check that it is present. */
 	if (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) &&
 	    SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) {
 		/*
 		 * In case of SADB_UPDATE we may need to change
 		 * existing lifetimes.
 		 */
 		if (sav->state == SADB_SASTATE_MATURE) {
 			lft_h = lft_s = NULL;
 			goto reset;
 		}
 		return (0);
 	}
 	/* Both HARD and SOFT extensions must present */
 	if ((SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) &&
 	    !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) ||
 	    (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) &&
 	    !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: missing required header.\n",
 		    __func__));
 		return (EINVAL);
 	}
 	if (SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_HARD) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_SOFT)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: wrong header size.\n", __func__));
 		return (EINVAL);
 	}
 	lft_h = key_dup_lifemsg((const struct sadb_lifetime *)
 	    mhp->ext[SADB_EXT_LIFETIME_HARD], M_IPSEC_MISC);
 	if (lft_h == NULL) {
 		PFKEYSTAT_INC(in_nomem);
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return (ENOBUFS);
 	}
 	lft_s = key_dup_lifemsg((const struct sadb_lifetime *)
 	    mhp->ext[SADB_EXT_LIFETIME_SOFT], M_IPSEC_MISC);
 	if (lft_s == NULL) {
 		PFKEYSTAT_INC(in_nomem);
 		free(lft_h, M_IPSEC_MISC);
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return (ENOBUFS);
 	}
 reset:
 	if (sav->state != SADB_SASTATE_LARVAL) {
 		/*
 		 * key_update() holds reference to this SA,
 		 * so it won't be deleted in meanwhile.
 		 */
 		SECASVAR_WLOCK(sav);
 		tmp = sav->lft_h;
 		sav->lft_h = lft_h;
 		lft_h = tmp;
 
 		tmp = sav->lft_s;
 		sav->lft_s = lft_s;
 		lft_s = tmp;
 		SECASVAR_WUNLOCK(sav);
 		if (lft_h != NULL)
 			free(lft_h, M_IPSEC_MISC);
 		if (lft_s != NULL)
 			free(lft_s, M_IPSEC_MISC);
 		return (0);
 	}
 	/* We can update lifetime without holding a lock */
 	IPSEC_ASSERT(sav->lft_h == NULL, ("lft_h is already initialized\n"));
 	IPSEC_ASSERT(sav->lft_s == NULL, ("lft_s is already initialized\n"));
 	sav->lft_h = lft_h;
 	sav->lft_s = lft_s;
 	return (0);
 }
 
 /*
  * copy SA values from PF_KEY message except *SPI, SEQ, PID and TYPE*.
  * You must update these if need. Expects only LARVAL SAs.
  * OUT:	0:	success.
  *	!0:	failure.
  */
 static int
 key_setsaval(struct secasvar *sav, const struct sadb_msghdr *mhp)
 {
 	const struct sadb_sa *sa0;
 	const struct sadb_key *key0;
 	uint32_t replay;
 	size_t len;
 	int error;
 
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 	IPSEC_ASSERT(sav->state == SADB_SASTATE_LARVAL,
 	    ("Attempt to update non LARVAL SA"));
 
 	/* XXX rewrite */
 	error = key_setident(sav->sah, mhp);
 	if (error != 0)
 		goto fail;
 
 	/* SA */
 	if (!SADB_CHECKHDR(mhp, SADB_EXT_SA)) {
 		if (SADB_CHECKLEN(mhp, SADB_EXT_SA)) {
 			error = EINVAL;
 			goto fail;
 		}
 		sa0 = (const struct sadb_sa *)mhp->ext[SADB_EXT_SA];
 		sav->alg_auth = sa0->sadb_sa_auth;
 		sav->alg_enc = sa0->sadb_sa_encrypt;
 		sav->flags = sa0->sadb_sa_flags;
 		if ((sav->flags & SADB_KEY_FLAGS_MAX) != sav->flags) {
 			ipseclog((LOG_DEBUG,
 			    "%s: invalid sa_flags 0x%08x.\n", __func__,
 			    sav->flags));
 			error = EINVAL;
 			goto fail;
 		}
 
 		/* Optional replay window */
 		replay = 0;
 		if ((sa0->sadb_sa_flags & SADB_X_EXT_OLD) == 0)
 			replay = sa0->sadb_sa_replay;
 		if (!SADB_CHECKHDR(mhp, SADB_X_EXT_SA_REPLAY)) {
 			if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA_REPLAY)) {
 				error = EINVAL;
 				goto fail;
 			}
 			replay = ((const struct sadb_x_sa_replay *)
 			    mhp->ext[SADB_X_EXT_SA_REPLAY])->sadb_x_sa_replay_replay;
 
 			if (replay > UINT32_MAX - 32) {
 				ipseclog((LOG_DEBUG,
 				    "%s: replay window too big.\n", __func__));
 				error = EINVAL;
 				goto fail;
 			}
 
 			replay = (replay + 7) >> 3;
 		}
 
 		sav->replay = malloc(sizeof(struct secreplay), M_IPSEC_MISC,
 		    M_NOWAIT | M_ZERO);
 		if (sav->replay == NULL) {
 			PFKEYSTAT_INC(in_nomem);
 			ipseclog((LOG_DEBUG, "%s: No more memory.\n",
 			    __func__));
 			error = ENOBUFS;
 			goto fail;
 		}
 		mtx_init(&sav->replay->lock, "ipsec replay", NULL, MTX_DEF);
 
 		if (replay != 0) {
 			/* number of 32b blocks to be allocated */
 			uint32_t bitmap_size;
 
 			/* RFC 6479:
 			 * - the allocated replay window size must be
 			 *   a power of two.
 			 * - use an extra 32b block as a redundant window.
 			 */
 			bitmap_size = 1;
 			while (replay + 4 > bitmap_size)
 				bitmap_size <<= 1;
 			bitmap_size = bitmap_size / 4;
 
 			sav->replay->bitmap = malloc(
 			    bitmap_size * sizeof(uint32_t), M_IPSEC_MISC,
 			    M_NOWAIT | M_ZERO);
 			if (sav->replay->bitmap == NULL) {
 				PFKEYSTAT_INC(in_nomem);
 				ipseclog((LOG_DEBUG, "%s: No more memory.\n",
 					__func__));
 				error = ENOBUFS;
 				goto fail;
 			}
 			sav->replay->bitmap_size = bitmap_size;
 			sav->replay->wsize = replay;
 		}
 	}
 
 	/* Authentication keys */
 	if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH)) {
 		if (SADB_CHECKLEN(mhp, SADB_EXT_KEY_AUTH)) {
 			error = EINVAL;
 			goto fail;
 		}
 		error = 0;
 		key0 = (const struct sadb_key *)mhp->ext[SADB_EXT_KEY_AUTH];
 		len = mhp->extlen[SADB_EXT_KEY_AUTH];
 		switch (mhp->msg->sadb_msg_satype) {
 		case SADB_SATYPE_AH:
 		case SADB_SATYPE_ESP:
 		case SADB_X_SATYPE_TCPSIGNATURE:
 			if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) &&
 			    sav->alg_auth != SADB_X_AALG_NULL)
 				error = EINVAL;
 			break;
 		case SADB_X_SATYPE_IPCOMP:
 		default:
 			error = EINVAL;
 			break;
 		}
 		if (error) {
 			ipseclog((LOG_DEBUG, "%s: invalid key_auth values.\n",
 				__func__));
 			goto fail;
 		}
 
 		sav->key_auth = key_dup_keymsg(key0, len, M_IPSEC_MISC);
 		if (sav->key_auth == NULL ) {
 			ipseclog((LOG_DEBUG, "%s: No more memory.\n",
 				  __func__));
 			PFKEYSTAT_INC(in_nomem);
 			error = ENOBUFS;
 			goto fail;
 		}
 	}
 
 	/* Encryption key */
 	if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT)) {
 		if (SADB_CHECKLEN(mhp, SADB_EXT_KEY_ENCRYPT)) {
 			error = EINVAL;
 			goto fail;
 		}
 		error = 0;
 		key0 = (const struct sadb_key *)mhp->ext[SADB_EXT_KEY_ENCRYPT];
 		len = mhp->extlen[SADB_EXT_KEY_ENCRYPT];
 		switch (mhp->msg->sadb_msg_satype) {
 		case SADB_SATYPE_ESP:
 			if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) &&
 			    sav->alg_enc != SADB_EALG_NULL) {
 				error = EINVAL;
 				break;
 			}
 			sav->key_enc = key_dup_keymsg(key0, len, M_IPSEC_MISC);
 			if (sav->key_enc == NULL) {
 				ipseclog((LOG_DEBUG, "%s: No more memory.\n",
 					__func__));
 				PFKEYSTAT_INC(in_nomem);
 				error = ENOBUFS;
 				goto fail;
 			}
 			break;
 		case SADB_X_SATYPE_IPCOMP:
 			if (len != PFKEY_ALIGN8(sizeof(struct sadb_key)))
 				error = EINVAL;
 			sav->key_enc = NULL;	/*just in case*/
 			break;
 		case SADB_SATYPE_AH:
 		case SADB_X_SATYPE_TCPSIGNATURE:
 		default:
 			error = EINVAL;
 			break;
 		}
 		if (error) {
 			ipseclog((LOG_DEBUG, "%s: invalid key_enc value.\n",
 				__func__));
 			goto fail;
 		}
 	}
 
 	/* set iv */
 	sav->ivlen = 0;
 	switch (mhp->msg->sadb_msg_satype) {
 	case SADB_SATYPE_AH:
 		if (sav->flags & SADB_X_EXT_DERIV) {
 			ipseclog((LOG_DEBUG, "%s: invalid flag (derived) "
 			    "given to AH SA.\n", __func__));
 			error = EINVAL;
 			goto fail;
 		}
 		if (sav->alg_enc != SADB_EALG_NONE) {
 			ipseclog((LOG_DEBUG, "%s: protocol and algorithm "
 			    "mismated.\n", __func__));
 			error = EINVAL;
 			goto fail;
 		}
 		error = xform_init(sav, XF_AH);
 		break;
 	case SADB_SATYPE_ESP:
 		if ((sav->flags & (SADB_X_EXT_OLD | SADB_X_EXT_DERIV)) ==
 		    (SADB_X_EXT_OLD | SADB_X_EXT_DERIV)) {
 			ipseclog((LOG_DEBUG, "%s: invalid flag (derived) "
 			    "given to old-esp.\n", __func__));
 			error = EINVAL;
 			goto fail;
 		}
 		error = xform_init(sav, XF_ESP);
 		break;
 	case SADB_X_SATYPE_IPCOMP:
 		if (sav->alg_auth != SADB_AALG_NONE) {
 			ipseclog((LOG_DEBUG, "%s: protocol and algorithm "
 			    "mismated.\n", __func__));
 			error = EINVAL;
 			goto fail;
 		}
 		if ((sav->flags & SADB_X_EXT_RAWCPI) == 0 &&
 		    ntohl(sav->spi) >= 0x10000) {
 			ipseclog((LOG_DEBUG, "%s: invalid cpi for IPComp.\n",
 			    __func__));
 			error = EINVAL;
 			goto fail;
 		}
 		error = xform_init(sav, XF_IPCOMP);
 		break;
 	case SADB_X_SATYPE_TCPSIGNATURE:
 		if (sav->alg_enc != SADB_EALG_NONE) {
 			ipseclog((LOG_DEBUG, "%s: protocol and algorithm "
 			    "mismated.\n", __func__));
 			error = EINVAL;
 			goto fail;
 		}
 		error = xform_init(sav, XF_TCPSIGNATURE);
 		break;
 	default:
 		ipseclog((LOG_DEBUG, "%s: Invalid satype.\n", __func__));
 		error = EPROTONOSUPPORT;
 		goto fail;
 	}
 	if (error) {
 		ipseclog((LOG_DEBUG, "%s: unable to initialize SA type %u.\n",
 		    __func__, mhp->msg->sadb_msg_satype));
 		goto fail;
 	}
 
 	/* Handle NAT-T headers */
 	error = key_setnatt(sav, mhp);
 	if (error != 0)
 		goto fail;
 
 	/* Initialize lifetime for CURRENT */
 	sav->firstused = 0;
 	sav->created = time_second;
 
 	/* lifetimes for HARD and SOFT */
 	error = key_updatelifetimes(sav, mhp);
 	if (error == 0)
 		return (0);
 fail:
 	key_cleansav(sav);
 	return (error);
 }
 
 /*
  * subroutine for SADB_GET and SADB_DUMP.
  */
 static struct mbuf *
 key_setdumpsa(struct secasvar *sav, uint8_t type, uint8_t satype,
     uint32_t seq, uint32_t pid)
 {
 	struct seclifetime lft_c;
 	struct mbuf *result = NULL, *tres = NULL, *m;
 	int i, dumporder[] = {
 		SADB_EXT_SA, SADB_X_EXT_SA2, SADB_X_EXT_SA_REPLAY,
 		SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT,
 		SADB_EXT_LIFETIME_CURRENT, SADB_EXT_ADDRESS_SRC,
 		SADB_EXT_ADDRESS_DST, SADB_EXT_ADDRESS_PROXY,
 		SADB_EXT_KEY_AUTH, SADB_EXT_KEY_ENCRYPT,
 		SADB_EXT_IDENTITY_SRC, SADB_EXT_IDENTITY_DST,
 		SADB_EXT_SENSITIVITY,
 		SADB_X_EXT_NAT_T_TYPE,
 		SADB_X_EXT_NAT_T_SPORT, SADB_X_EXT_NAT_T_DPORT,
 		SADB_X_EXT_NAT_T_OAI, SADB_X_EXT_NAT_T_OAR,
 		SADB_X_EXT_NAT_T_FRAG,
 	};
 	uint32_t replay_count;
 
 	SECASVAR_RLOCK_TRACKER;
 
 	m = key_setsadbmsg(type, 0, satype, seq, pid, sav->refcnt);
 	if (m == NULL)
 		goto fail;
 	result = m;
 
 	for (i = nitems(dumporder) - 1; i >= 0; i--) {
 		m = NULL;
 		switch (dumporder[i]) {
 		case SADB_EXT_SA:
 			m = key_setsadbsa(sav);
 			if (!m)
 				goto fail;
 			break;
 
 		case SADB_X_EXT_SA2: {
 			SECASVAR_RLOCK(sav);
 			replay_count = sav->replay ? sav->replay->count : 0;
 			SECASVAR_RUNLOCK(sav);
 			m = key_setsadbxsa2(sav->sah->saidx.mode, replay_count,
 					sav->sah->saidx.reqid);
 			if (!m)
 				goto fail;
 			break;
 		}
 		case SADB_X_EXT_SA_REPLAY:
 			if (sav->replay == NULL ||
 			    sav->replay->wsize <= UINT8_MAX)
 				continue;
 
 			m = key_setsadbxsareplay(sav->replay->wsize);
 			if (!m)
 				goto fail;
 			break;
 
 		case SADB_EXT_ADDRESS_SRC:
 			m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC,
 			    &sav->sah->saidx.src.sa,
 			    FULLMASK, IPSEC_ULPROTO_ANY);
 			if (!m)
 				goto fail;
 			break;
 
 		case SADB_EXT_ADDRESS_DST:
 			m = key_setsadbaddr(SADB_EXT_ADDRESS_DST,
 			    &sav->sah->saidx.dst.sa,
 			    FULLMASK, IPSEC_ULPROTO_ANY);
 			if (!m)
 				goto fail;
 			break;
 
 		case SADB_EXT_KEY_AUTH:
 			if (!sav->key_auth)
 				continue;
 			m = key_setkey(sav->key_auth, SADB_EXT_KEY_AUTH);
 			if (!m)
 				goto fail;
 			break;
 
 		case SADB_EXT_KEY_ENCRYPT:
 			if (!sav->key_enc)
 				continue;
 			m = key_setkey(sav->key_enc, SADB_EXT_KEY_ENCRYPT);
 			if (!m)
 				goto fail;
 			break;
 
 		case SADB_EXT_LIFETIME_CURRENT:
 			lft_c.addtime = sav->created;
 			lft_c.allocations = (uint32_t)counter_u64_fetch(
 			    sav->lft_c_allocations);
 			lft_c.bytes = counter_u64_fetch(sav->lft_c_bytes);
 			lft_c.usetime = sav->firstused;
 			m = key_setlifetime(&lft_c, SADB_EXT_LIFETIME_CURRENT);
 			if (!m)
 				goto fail;
 			break;
 
 		case SADB_EXT_LIFETIME_HARD:
 			if (!sav->lft_h)
 				continue;
 			m = key_setlifetime(sav->lft_h, 
 					    SADB_EXT_LIFETIME_HARD);
 			if (!m)
 				goto fail;
 			break;
 
 		case SADB_EXT_LIFETIME_SOFT:
 			if (!sav->lft_s)
 				continue;
 			m = key_setlifetime(sav->lft_s, 
 					    SADB_EXT_LIFETIME_SOFT);
 
 			if (!m)
 				goto fail;
 			break;
 
 		case SADB_X_EXT_NAT_T_TYPE:
 			if (sav->natt == NULL)
 				continue;
 			m = key_setsadbxtype(UDP_ENCAP_ESPINUDP);
 			if (!m)
 				goto fail;
 			break;
 
 		case SADB_X_EXT_NAT_T_DPORT:
 			if (sav->natt == NULL)
 				continue;
 			m = key_setsadbxport(sav->natt->dport,
 			    SADB_X_EXT_NAT_T_DPORT);
 			if (!m)
 				goto fail;
 			break;
 
 		case SADB_X_EXT_NAT_T_SPORT:
 			if (sav->natt == NULL)
 				continue;
 			m = key_setsadbxport(sav->natt->sport,
 			    SADB_X_EXT_NAT_T_SPORT);
 			if (!m)
 				goto fail;
 			break;
 
 		case SADB_X_EXT_NAT_T_OAI:
 			if (sav->natt == NULL ||
 			    (sav->natt->flags & IPSEC_NATT_F_OAI) == 0)
 				continue;
 			m = key_setsadbaddr(SADB_X_EXT_NAT_T_OAI,
 			    &sav->natt->oai.sa, FULLMASK, IPSEC_ULPROTO_ANY);
 			if (!m)
 				goto fail;
 			break;
 		case SADB_X_EXT_NAT_T_OAR:
 			if (sav->natt == NULL ||
 			    (sav->natt->flags & IPSEC_NATT_F_OAR) == 0)
 				continue;
 			m = key_setsadbaddr(SADB_X_EXT_NAT_T_OAR,
 			    &sav->natt->oar.sa, FULLMASK, IPSEC_ULPROTO_ANY);
 			if (!m)
 				goto fail;
 			break;
 		case SADB_X_EXT_NAT_T_FRAG:
 			/* We do not (yet) support those. */
 			continue;
 
 		case SADB_EXT_ADDRESS_PROXY:
 		case SADB_EXT_IDENTITY_SRC:
 		case SADB_EXT_IDENTITY_DST:
 			/* XXX: should we brought from SPD ? */
 		case SADB_EXT_SENSITIVITY:
 		default:
 			continue;
 		}
 
 		if (!m)
 			goto fail;
 		if (tres)
 			m_cat(m, tres);
 		tres = m;
 	}
 
 	m_cat(result, tres);
 	tres = NULL;
 	if (result->m_len < sizeof(struct sadb_msg)) {
 		result = m_pullup(result, sizeof(struct sadb_msg));
 		if (result == NULL)
 			goto fail;
 	}
 
 	result->m_pkthdr.len = 0;
 	for (m = result; m; m = m->m_next)
 		result->m_pkthdr.len += m->m_len;
 
 	mtod(result, struct sadb_msg *)->sadb_msg_len =
 	    PFKEY_UNIT64(result->m_pkthdr.len);
 
 	return result;
 
 fail:
 	m_freem(result);
 	m_freem(tres);
 	return NULL;
 }
 
 /*
  * set data into sadb_msg.
  */
 static struct mbuf *
 key_setsadbmsg(u_int8_t type, u_int16_t tlen, u_int8_t satype, u_int32_t seq,
     pid_t pid, u_int16_t reserved)
 {
 	struct mbuf *m;
 	struct sadb_msg *p;
 	int len;
 
 	len = PFKEY_ALIGN8(sizeof(struct sadb_msg));
 	if (len > MCLBYTES)
 		return NULL;
 	m = key_mget(len);
 	if (m == NULL)
 		return NULL;
 	m->m_pkthdr.len = m->m_len = len;
 	m->m_next = NULL;
 
 	p = mtod(m, struct sadb_msg *);
 
 	bzero(p, len);
 	p->sadb_msg_version = PF_KEY_V2;
 	p->sadb_msg_type = type;
 	p->sadb_msg_errno = 0;
 	p->sadb_msg_satype = satype;
 	p->sadb_msg_len = PFKEY_UNIT64(tlen);
 	p->sadb_msg_reserved = reserved;
 	p->sadb_msg_seq = seq;
 	p->sadb_msg_pid = (u_int32_t)pid;
 
 	return m;
 }
 
 /*
  * copy secasvar data into sadb_address.
  */
 static struct mbuf *
 key_setsadbsa(struct secasvar *sav)
 {
 	struct mbuf *m;
 	struct sadb_sa *p;
 	int len;
 
 	len = PFKEY_ALIGN8(sizeof(struct sadb_sa));
 	m = m_get2(len, M_NOWAIT, MT_DATA, 0);
 	if (m == NULL)
 		return (NULL);
 	m_align(m, len);
 	m->m_len = len;
 	p = mtod(m, struct sadb_sa *);
 	bzero(p, len);
 	p->sadb_sa_len = PFKEY_UNIT64(len);
 	p->sadb_sa_exttype = SADB_EXT_SA;
 	p->sadb_sa_spi = sav->spi;
 	p->sadb_sa_replay = sav->replay ?
 	    (sav->replay->wsize > UINT8_MAX ? UINT8_MAX :
 		sav->replay->wsize): 0;
 	p->sadb_sa_state = sav->state;
 	p->sadb_sa_auth = sav->alg_auth;
 	p->sadb_sa_encrypt = sav->alg_enc;
 	p->sadb_sa_flags = sav->flags & SADB_KEY_FLAGS_MAX;
 	return (m);
 }
 
 /*
  * set data into sadb_address.
  */
 static struct mbuf *
 key_setsadbaddr(u_int16_t exttype, const struct sockaddr *saddr,
     u_int8_t prefixlen, u_int16_t ul_proto)
 {
 	struct mbuf *m;
 	struct sadb_address *p;
 	size_t len;
 
 	len = PFKEY_ALIGN8(sizeof(struct sadb_address)) +
 	    PFKEY_ALIGN8(saddr->sa_len);
 	m = m_get2(len, M_NOWAIT, MT_DATA, 0);
 	if (m == NULL)
 		return (NULL);
 	m_align(m, len);
 	m->m_len = len;
 	p = mtod(m, struct sadb_address *);
 
 	bzero(p, len);
 	p->sadb_address_len = PFKEY_UNIT64(len);
 	p->sadb_address_exttype = exttype;
 	p->sadb_address_proto = ul_proto;
 	if (prefixlen == FULLMASK) {
 		switch (saddr->sa_family) {
 		case AF_INET:
 			prefixlen = sizeof(struct in_addr) << 3;
 			break;
 		case AF_INET6:
 			prefixlen = sizeof(struct in6_addr) << 3;
 			break;
 		default:
 			; /*XXX*/
 		}
 	}
 	p->sadb_address_prefixlen = prefixlen;
 	p->sadb_address_reserved = 0;
 
 	bcopy(saddr,
 	    mtod(m, caddr_t) + PFKEY_ALIGN8(sizeof(struct sadb_address)),
 	    saddr->sa_len);
 
 	return m;
 }
 
 /*
  * set data into sadb_x_sa2.
  */
 static struct mbuf *
 key_setsadbxsa2(u_int8_t mode, u_int32_t seq, u_int32_t reqid)
 {
 	struct mbuf *m;
 	struct sadb_x_sa2 *p;
 	size_t len;
 
 	len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa2));
 	m = m_get2(len, M_NOWAIT, MT_DATA, 0);
 	if (m == NULL)
 		return (NULL);
 	m_align(m, len);
 	m->m_len = len;
 	p = mtod(m, struct sadb_x_sa2 *);
 
 	bzero(p, len);
 	p->sadb_x_sa2_len = PFKEY_UNIT64(len);
 	p->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
 	p->sadb_x_sa2_mode = mode;
 	p->sadb_x_sa2_reserved1 = 0;
 	p->sadb_x_sa2_reserved2 = 0;
 	p->sadb_x_sa2_sequence = seq;
 	p->sadb_x_sa2_reqid = reqid;
 
 	return m;
 }
 
 /*
  * Set data into sadb_x_sa_replay.
  */
 static struct mbuf *
 key_setsadbxsareplay(u_int32_t replay)
 {
 	struct mbuf *m;
 	struct sadb_x_sa_replay *p;
 	size_t len;
 
 	len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa_replay));
 	m = m_get2(len, M_NOWAIT, MT_DATA, 0);
 	if (m == NULL)
 		return (NULL);
 	m_align(m, len);
 	m->m_len = len;
 	p = mtod(m, struct sadb_x_sa_replay *);
 
 	bzero(p, len);
 	p->sadb_x_sa_replay_len = PFKEY_UNIT64(len);
 	p->sadb_x_sa_replay_exttype = SADB_X_EXT_SA_REPLAY;
 	p->sadb_x_sa_replay_replay = (replay << 3);
 
 	return m;
 }
 
 /*
  * Set a type in sadb_x_nat_t_type.
  */
 static struct mbuf *
 key_setsadbxtype(u_int16_t type)
 {
 	struct mbuf *m;
 	size_t len;
 	struct sadb_x_nat_t_type *p;
 
 	len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_type));
 
 	m = m_get2(len, M_NOWAIT, MT_DATA, 0);
 	if (m == NULL)
 		return (NULL);
 	m_align(m, len);
 	m->m_len = len;
 	p = mtod(m, struct sadb_x_nat_t_type *);
 
 	bzero(p, len);
 	p->sadb_x_nat_t_type_len = PFKEY_UNIT64(len);
 	p->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE;
 	p->sadb_x_nat_t_type_type = type;
 
 	return (m);
 }
 /*
  * Set a port in sadb_x_nat_t_port.
  * In contrast to default RFC 2367 behaviour, port is in network byte order.
  */
 static struct mbuf *
 key_setsadbxport(u_int16_t port, u_int16_t type)
 {
 	struct mbuf *m;
 	size_t len;
 	struct sadb_x_nat_t_port *p;
 
 	len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_port));
 
 	m = m_get2(len, M_NOWAIT, MT_DATA, 0);
 	if (m == NULL)
 		return (NULL);
 	m_align(m, len);
 	m->m_len = len;
 	p = mtod(m, struct sadb_x_nat_t_port *);
 
 	bzero(p, len);
 	p->sadb_x_nat_t_port_len = PFKEY_UNIT64(len);
 	p->sadb_x_nat_t_port_exttype = type;
 	p->sadb_x_nat_t_port_port = port;
 
 	return (m);
 }
 
 /*
  * Get port from sockaddr. Port is in network byte order.
  */
 uint16_t
 key_portfromsaddr(struct sockaddr *sa)
 {
 
 	switch (sa->sa_family) {
 #ifdef INET
 	case AF_INET:
 		return ((struct sockaddr_in *)sa)->sin_port;
 #endif
 #ifdef INET6
 	case AF_INET6:
 		return ((struct sockaddr_in6 *)sa)->sin6_port;
 #endif
 	}
 	return (0);
 }
 
 /*
  * Set port in struct sockaddr. Port is in network byte order.
  */
 void
 key_porttosaddr(struct sockaddr *sa, uint16_t port)
 {
 
 	switch (sa->sa_family) {
 #ifdef INET
 	case AF_INET:
 		((struct sockaddr_in *)sa)->sin_port = port;
 		break;
 #endif
 #ifdef INET6
 	case AF_INET6:
 		((struct sockaddr_in6 *)sa)->sin6_port = port;
 		break;
 #endif
 	default:
 		ipseclog((LOG_DEBUG, "%s: unexpected address family %d.\n",
 			__func__, sa->sa_family));
 		break;
 	}
 }
 
 /*
  * set data into sadb_x_policy
  */
 static struct mbuf *
 key_setsadbxpolicy(u_int16_t type, u_int8_t dir, u_int32_t id, u_int32_t priority)
 {
 	struct mbuf *m;
 	struct sadb_x_policy *p;
 	size_t len;
 
 	len = PFKEY_ALIGN8(sizeof(struct sadb_x_policy));
 	m = m_get2(len, M_NOWAIT, MT_DATA, 0);
 	if (m == NULL)
 		return (NULL);
 	m_align(m, len);
 	m->m_len = len;
 	p = mtod(m, struct sadb_x_policy *);
 
 	bzero(p, len);
 	p->sadb_x_policy_len = PFKEY_UNIT64(len);
 	p->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
 	p->sadb_x_policy_type = type;
 	p->sadb_x_policy_dir = dir;
 	p->sadb_x_policy_id = id;
 	p->sadb_x_policy_priority = priority;
 
 	return m;
 }
 
 /* %%% utilities */
 /* Take a key message (sadb_key) from the socket and turn it into one
  * of the kernel's key structures (seckey).
  *
  * IN: pointer to the src
  * OUT: NULL no more memory
  */
 struct seckey *
 key_dup_keymsg(const struct sadb_key *src, size_t len,
     struct malloc_type *type)
 {
 	struct seckey *dst;
 
 	dst = malloc(sizeof(*dst), type, M_NOWAIT);
 	if (dst != NULL) {
 		dst->bits = src->sadb_key_bits;
 		dst->key_data = malloc(len, type, M_NOWAIT);
 		if (dst->key_data != NULL) {
 			bcopy((const char *)(src + 1), dst->key_data, len);
 		} else {
 			ipseclog((LOG_DEBUG, "%s: No more memory.\n",
 			    __func__));
 			free(dst, type);
 			dst = NULL;
 		}
 	} else {
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n",
 		    __func__));
 	}
 	return (dst);
 }
 
 /* Take a lifetime message (sadb_lifetime) passed in on a socket and
  * turn it into one of the kernel's lifetime structures (seclifetime).
  *
  * IN: pointer to the destination, source and malloc type
  * OUT: NULL, no more memory
  */
 
 static struct seclifetime *
 key_dup_lifemsg(const struct sadb_lifetime *src, struct malloc_type *type)
 {
 	struct seclifetime *dst;
 
 	dst = malloc(sizeof(*dst), type, M_NOWAIT);
 	if (dst == NULL) {
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return (NULL);
 	}
 	dst->allocations = src->sadb_lifetime_allocations;
 	dst->bytes = src->sadb_lifetime_bytes;
 	dst->addtime = src->sadb_lifetime_addtime;
 	dst->usetime = src->sadb_lifetime_usetime;
 	return (dst);
 }
 
 /*
  * compare two secasindex structure.
  * flag can specify to compare 2 saidxes.
  * compare two secasindex structure without both mode and reqid.
  * don't compare port.
  * IN:  
  *      saidx0: source, it can be in SAD.
  *      saidx1: object.
  * OUT: 
  *      1 : equal
  *      0 : not equal
  */
 static int
 key_cmpsaidx(const struct secasindex *saidx0, const struct secasindex *saidx1,
     int flag)
 {
 
 	/* sanity */
 	if (saidx0 == NULL && saidx1 == NULL)
 		return 1;
 
 	if (saidx0 == NULL || saidx1 == NULL)
 		return 0;
 
 	if (saidx0->proto != saidx1->proto)
 		return 0;
 
 	if (flag == CMP_EXACTLY) {
 		if (saidx0->mode != saidx1->mode)
 			return 0;
 		if (saidx0->reqid != saidx1->reqid)
 			return 0;
 		if (bcmp(&saidx0->src, &saidx1->src,
 		    saidx0->src.sa.sa_len) != 0 ||
 		    bcmp(&saidx0->dst, &saidx1->dst,
 		    saidx0->dst.sa.sa_len) != 0)
 			return 0;
 	} else {
 		/* CMP_MODE_REQID, CMP_REQID, CMP_HEAD */
 		if (flag == CMP_MODE_REQID || flag == CMP_REQID) {
 			/*
 			 * If reqid of SPD is non-zero, unique SA is required.
 			 * The result must be of same reqid in this case.
 			 */
 			if (saidx1->reqid != 0 &&
 			    saidx0->reqid != saidx1->reqid)
 				return 0;
 		}
 
 		if (flag == CMP_MODE_REQID) {
 			if (saidx0->mode != IPSEC_MODE_ANY
 			 && saidx0->mode != saidx1->mode)
 				return 0;
 		}
 
 		if (key_sockaddrcmp(&saidx0->src.sa, &saidx1->src.sa, 0) != 0)
 			return 0;
 		if (key_sockaddrcmp(&saidx0->dst.sa, &saidx1->dst.sa, 0) != 0)
 			return 0;
 	}
 
 	return 1;
 }
 
 /*
  * compare two secindex structure exactly.
  * IN:
  *	spidx0: source, it is often in SPD.
  *	spidx1: object, it is often from PFKEY message.
  * OUT:
  *	1 : equal
  *	0 : not equal
  */
 static int
 key_cmpspidx_exactly(struct secpolicyindex *spidx0,
     struct secpolicyindex *spidx1)
 {
 	/* sanity */
 	if (spidx0 == NULL && spidx1 == NULL)
 		return 1;
 
 	if (spidx0 == NULL || spidx1 == NULL)
 		return 0;
 
 	if (spidx0->prefs != spidx1->prefs
 	 || spidx0->prefd != spidx1->prefd
 	 || spidx0->ul_proto != spidx1->ul_proto
 	 || spidx0->dir != spidx1->dir)
 		return 0;
 
 	return key_sockaddrcmp(&spidx0->src.sa, &spidx1->src.sa, 1) == 0 &&
 	       key_sockaddrcmp(&spidx0->dst.sa, &spidx1->dst.sa, 1) == 0;
 }
 
 /*
  * compare two secindex structure with mask.
  * IN:
  *	spidx0: source, it is often in SPD.
  *	spidx1: object, it is often from IP header.
  * OUT:
  *	1 : equal
  *	0 : not equal
  */
 static int
 key_cmpspidx_withmask(struct secpolicyindex *spidx0,
     struct secpolicyindex *spidx1)
 {
 	/* sanity */
 	if (spidx0 == NULL && spidx1 == NULL)
 		return 1;
 
 	if (spidx0 == NULL || spidx1 == NULL)
 		return 0;
 
 	if (spidx0->src.sa.sa_family != spidx1->src.sa.sa_family ||
 	    spidx0->dst.sa.sa_family != spidx1->dst.sa.sa_family ||
 	    spidx0->src.sa.sa_len != spidx1->src.sa.sa_len ||
 	    spidx0->dst.sa.sa_len != spidx1->dst.sa.sa_len)
 		return 0;
 
 	/* if spidx.ul_proto == IPSEC_ULPROTO_ANY, ignore. */
 	if (spidx0->ul_proto != (u_int16_t)IPSEC_ULPROTO_ANY
 	 && spidx0->ul_proto != spidx1->ul_proto)
 		return 0;
 
 	switch (spidx0->src.sa.sa_family) {
 	case AF_INET:
 		if (spidx0->src.sin.sin_port != IPSEC_PORT_ANY
 		 && spidx0->src.sin.sin_port != spidx1->src.sin.sin_port)
 			return 0;
 		if (!key_bbcmp(&spidx0->src.sin.sin_addr,
 		    &spidx1->src.sin.sin_addr, spidx0->prefs))
 			return 0;
 		break;
 	case AF_INET6:
 		if (spidx0->src.sin6.sin6_port != IPSEC_PORT_ANY
 		 && spidx0->src.sin6.sin6_port != spidx1->src.sin6.sin6_port)
 			return 0;
 		/*
 		 * scope_id check. if sin6_scope_id is 0, we regard it
 		 * as a wildcard scope, which matches any scope zone ID. 
 		 */
 		if (spidx0->src.sin6.sin6_scope_id &&
 		    spidx1->src.sin6.sin6_scope_id &&
 		    spidx0->src.sin6.sin6_scope_id != spidx1->src.sin6.sin6_scope_id)
 			return 0;
 		if (!key_bbcmp(&spidx0->src.sin6.sin6_addr,
 		    &spidx1->src.sin6.sin6_addr, spidx0->prefs))
 			return 0;
 		break;
 	default:
 		/* XXX */
 		if (bcmp(&spidx0->src, &spidx1->src, spidx0->src.sa.sa_len) != 0)
 			return 0;
 		break;
 	}
 
 	switch (spidx0->dst.sa.sa_family) {
 	case AF_INET:
 		if (spidx0->dst.sin.sin_port != IPSEC_PORT_ANY
 		 && spidx0->dst.sin.sin_port != spidx1->dst.sin.sin_port)
 			return 0;
 		if (!key_bbcmp(&spidx0->dst.sin.sin_addr,
 		    &spidx1->dst.sin.sin_addr, spidx0->prefd))
 			return 0;
 		break;
 	case AF_INET6:
 		if (spidx0->dst.sin6.sin6_port != IPSEC_PORT_ANY
 		 && spidx0->dst.sin6.sin6_port != spidx1->dst.sin6.sin6_port)
 			return 0;
 		/*
 		 * scope_id check. if sin6_scope_id is 0, we regard it
 		 * as a wildcard scope, which matches any scope zone ID. 
 		 */
 		if (spidx0->dst.sin6.sin6_scope_id &&
 		    spidx1->dst.sin6.sin6_scope_id &&
 		    spidx0->dst.sin6.sin6_scope_id != spidx1->dst.sin6.sin6_scope_id)
 			return 0;
 		if (!key_bbcmp(&spidx0->dst.sin6.sin6_addr,
 		    &spidx1->dst.sin6.sin6_addr, spidx0->prefd))
 			return 0;
 		break;
 	default:
 		/* XXX */
 		if (bcmp(&spidx0->dst, &spidx1->dst, spidx0->dst.sa.sa_len) != 0)
 			return 0;
 		break;
 	}
 
 	/* XXX Do we check other field ?  e.g. flowinfo */
 
 	return 1;
 }
 
 #ifdef satosin
 #undef satosin
 #endif
 #define satosin(s) ((const struct sockaddr_in *)s)
 #ifdef satosin6
 #undef satosin6
 #endif
 #define satosin6(s) ((const struct sockaddr_in6 *)s)
 /* returns 0 on match */
 int
 key_sockaddrcmp(const struct sockaddr *sa1, const struct sockaddr *sa2,
     int port)
 {
 	if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len)
 		return 1;
 
 	switch (sa1->sa_family) {
 #ifdef INET
 	case AF_INET:
 		if (sa1->sa_len != sizeof(struct sockaddr_in))
 			return 1;
 		if (satosin(sa1)->sin_addr.s_addr !=
 		    satosin(sa2)->sin_addr.s_addr) {
 			return 1;
 		}
 		if (port && satosin(sa1)->sin_port != satosin(sa2)->sin_port)
 			return 1;
 		break;
 #endif
 #ifdef INET6
 	case AF_INET6:
 		if (sa1->sa_len != sizeof(struct sockaddr_in6))
 			return 1;	/*EINVAL*/
 		if (satosin6(sa1)->sin6_scope_id !=
 		    satosin6(sa2)->sin6_scope_id) {
 			return 1;
 		}
 		if (!IN6_ARE_ADDR_EQUAL(&satosin6(sa1)->sin6_addr,
 		    &satosin6(sa2)->sin6_addr)) {
 			return 1;
 		}
 		if (port &&
 		    satosin6(sa1)->sin6_port != satosin6(sa2)->sin6_port) {
 			return 1;
 		}
 		break;
 #endif
 	default:
 		if (bcmp(sa1, sa2, sa1->sa_len) != 0)
 			return 1;
 		break;
 	}
 
 	return 0;
 }
 
 /* returns 0 on match */
 int
 key_sockaddrcmp_withmask(const struct sockaddr *sa1,
     const struct sockaddr *sa2, size_t mask)
 {
 	if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len)
 		return (1);
 
 	switch (sa1->sa_family) {
 #ifdef INET
 	case AF_INET:
 		return (!key_bbcmp(&satosin(sa1)->sin_addr,
 		    &satosin(sa2)->sin_addr, mask));
 #endif
 #ifdef INET6
 	case AF_INET6:
 		if (satosin6(sa1)->sin6_scope_id !=
 		    satosin6(sa2)->sin6_scope_id)
 			return (1);
 		return (!key_bbcmp(&satosin6(sa1)->sin6_addr,
 		    &satosin6(sa2)->sin6_addr, mask));
 #endif
 	}
 	return (1);
 }
 #undef satosin
 #undef satosin6
 
 /*
  * compare two buffers with mask.
  * IN:
  *	addr1: source
  *	addr2: object
  *	bits:  Number of bits to compare
  * OUT:
  *	1 : equal
  *	0 : not equal
  */
 static int
 key_bbcmp(const void *a1, const void *a2, u_int bits)
 {
 	const unsigned char *p1 = a1;
 	const unsigned char *p2 = a2;
 
 	/* XXX: This could be considerably faster if we compare a word
 	 * at a time, but it is complicated on LSB Endian machines */
 
 	/* Handle null pointers */
 	if (p1 == NULL || p2 == NULL)
 		return (p1 == p2);
 
 	while (bits >= 8) {
 		if (*p1++ != *p2++)
 			return 0;
 		bits -= 8;
 	}
 
 	if (bits > 0) {
 		u_int8_t mask = ~((1<<(8-bits))-1);
 		if ((*p1 & mask) != (*p2 & mask))
 			return 0;
 	}
 	return 1;	/* Match! */
 }
 
 static void
 key_flush_spd(time_t now)
 {
 	SPTREE_RLOCK_TRACKER;
 	struct secpolicy_list drainq;
 	struct secpolicy *sp, *nextsp;
 	u_int dir;
 
 	LIST_INIT(&drainq);
 	SPTREE_RLOCK();
 	for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
 		TAILQ_FOREACH(sp, &V_sptree[dir], chain) {
 			if (sp->lifetime == 0 && sp->validtime == 0)
 				continue;
 			if ((sp->lifetime &&
 			    now - sp->created > sp->lifetime) ||
 			    (sp->validtime &&
 			    now - sp->lastused > sp->validtime)) {
 				/* Hold extra reference to send SPDEXPIRE */
 				SP_ADDREF(sp);
 				LIST_INSERT_HEAD(&drainq, sp, drainq);
 			}
 		}
 	}
 	SPTREE_RUNLOCK();
 	if (LIST_EMPTY(&drainq))
 		return;
 
 	SPTREE_WLOCK();
 	sp = LIST_FIRST(&drainq);
 	while (sp != NULL) {
 		nextsp = LIST_NEXT(sp, drainq);
 		/* Check that SP is still linked */
 		if (sp->state != IPSEC_SPSTATE_ALIVE) {
 			LIST_REMOVE(sp, drainq);
 			key_freesp(&sp); /* release extra reference */
 			sp = nextsp;
 			continue;
 		}
 		TAILQ_REMOVE(&V_sptree[sp->spidx.dir], sp, chain);
 		V_spd_size--;
 		LIST_REMOVE(sp, idhash);
 		sp->state = IPSEC_SPSTATE_DEAD;
 		sp = nextsp;
 	}
 	V_sp_genid++;
 	SPTREE_WUNLOCK();
 	if (SPDCACHE_ENABLED())
 		spdcache_clear();
 
 	sp = LIST_FIRST(&drainq);
 	while (sp != NULL) {
 		nextsp = LIST_NEXT(sp, drainq);
 		key_spdexpire(sp);
 		key_freesp(&sp); /* release extra reference */
 		key_freesp(&sp); /* release last reference */
 		sp = nextsp;
 	}
 }
 
 static void
 key_flush_sad(time_t now)
 {
 	SAHTREE_RLOCK_TRACKER;
 	struct secashead_list emptyq;
 	struct secasvar_list drainq, hexpireq, sexpireq, freeq;
 	struct secashead *sah, *nextsah;
 	struct secasvar *sav, *nextsav;
 
 	SECASVAR_RLOCK_TRACKER;
 
 	LIST_INIT(&drainq);
 	LIST_INIT(&hexpireq);
 	LIST_INIT(&sexpireq);
 	LIST_INIT(&emptyq);
 
 	SAHTREE_RLOCK();
 	TAILQ_FOREACH(sah, &V_sahtree, chain) {
 		/* Check for empty SAH */
 		if (TAILQ_EMPTY(&sah->savtree_larval) &&
 		    TAILQ_EMPTY(&sah->savtree_alive)) {
 			SAH_ADDREF(sah);
 			LIST_INSERT_HEAD(&emptyq, sah, drainq);
 			continue;
 		}
 		/* Add all stale LARVAL SAs into drainq */
 		TAILQ_FOREACH(sav, &sah->savtree_larval, chain) {
 			if (now - sav->created < V_key_larval_lifetime)
 				continue;
 			SAV_ADDREF(sav);
 			LIST_INSERT_HEAD(&drainq, sav, drainq);
 		}
 		TAILQ_FOREACH(sav, &sah->savtree_alive, chain) {
 			/* lifetimes aren't specified */
 			if (sav->lft_h == NULL)
 				continue;
 			SECASVAR_RLOCK(sav);
 			/*
 			 * Check again with lock held, because it may
 			 * be updated by SADB_UPDATE.
 			 */
 			if (sav->lft_h == NULL) {
 				SECASVAR_RUNLOCK(sav);
 				continue;
 			}
 			/*
 			 * RFC 2367:
 			 * HARD lifetimes MUST take precedence over SOFT
 			 * lifetimes, meaning if the HARD and SOFT lifetimes
 			 * are the same, the HARD lifetime will appear on the
 			 * EXPIRE message.
 			 */
 			/* check HARD lifetime */
 			if ((sav->lft_h->addtime != 0 &&
 			    now - sav->created > sav->lft_h->addtime) ||
 			    (sav->lft_h->usetime != 0 && sav->firstused &&
 			    now - sav->firstused > sav->lft_h->usetime) ||
 			    (sav->lft_h->bytes != 0 && counter_u64_fetch(
 			        sav->lft_c_bytes) > sav->lft_h->bytes)) {
 				SECASVAR_RUNLOCK(sav);
 				SAV_ADDREF(sav);
 				LIST_INSERT_HEAD(&hexpireq, sav, drainq);
 				continue;
 			}
 			/* check SOFT lifetime (only for MATURE SAs) */
 			if (sav->state == SADB_SASTATE_MATURE && (
 			    (sav->lft_s->addtime != 0 &&
 			    now - sav->created > sav->lft_s->addtime) ||
 			    (sav->lft_s->usetime != 0 && sav->firstused &&
 			    now - sav->firstused > sav->lft_s->usetime) ||
 			    (sav->lft_s->bytes != 0 && counter_u64_fetch(
 				sav->lft_c_bytes) > sav->lft_s->bytes) ||
 			    (!(sav->flags & SADB_X_SAFLAGS_ESN) &&
 			    (sav->replay != NULL) && (
 			    (sav->replay->count > UINT32_80PCT) ||
 			    (sav->replay->last > UINT32_80PCT))))) {
 				SECASVAR_RUNLOCK(sav);
 				SAV_ADDREF(sav);
 				LIST_INSERT_HEAD(&sexpireq, sav, drainq);
 				continue;
 			}
 			SECASVAR_RUNLOCK(sav);
 		}
 	}
 	SAHTREE_RUNLOCK();
 
 	if (LIST_EMPTY(&emptyq) && LIST_EMPTY(&drainq) &&
 	    LIST_EMPTY(&hexpireq) && LIST_EMPTY(&sexpireq))
 		return;
 
 	LIST_INIT(&freeq);
 	SAHTREE_WLOCK();
 	/* Unlink stale LARVAL SAs */
 	sav = LIST_FIRST(&drainq);
 	while (sav != NULL) {
 		nextsav = LIST_NEXT(sav, drainq);
 		/* Check that SA is still LARVAL */
 		if (sav->state != SADB_SASTATE_LARVAL) {
 			LIST_REMOVE(sav, drainq);
 			LIST_INSERT_HEAD(&freeq, sav, drainq);
 			sav = nextsav;
 			continue;
 		}
 		TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain);
 		LIST_REMOVE(sav, spihash);
 		sav->state = SADB_SASTATE_DEAD;
 		sav = nextsav;
 	}
 	/* Unlink all SAs with expired HARD lifetime */
 	sav = LIST_FIRST(&hexpireq);
 	while (sav != NULL) {
 		nextsav = LIST_NEXT(sav, drainq);
 		/* Check that SA is not unlinked */
 		if (sav->state == SADB_SASTATE_DEAD) {
 			LIST_REMOVE(sav, drainq);
 			LIST_INSERT_HEAD(&freeq, sav, drainq);
 			sav = nextsav;
 			continue;
 		}
 		TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain);
 		LIST_REMOVE(sav, spihash);
 		sav->state = SADB_SASTATE_DEAD;
 		sav = nextsav;
 	}
 	/* Mark all SAs with expired SOFT lifetime as DYING */
 	sav = LIST_FIRST(&sexpireq);
 	while (sav != NULL) {
 		nextsav = LIST_NEXT(sav, drainq);
 		/* Check that SA is not unlinked */
 		if (sav->state == SADB_SASTATE_DEAD) {
 			LIST_REMOVE(sav, drainq);
 			LIST_INSERT_HEAD(&freeq, sav, drainq);
 			sav = nextsav;
 			continue;
 		}
 		/*
 		 * NOTE: this doesn't change SA order in the chain.
 		 */
 		sav->state = SADB_SASTATE_DYING;
 		sav = nextsav;
 	}
 	/* Unlink empty SAHs */
 	sah = LIST_FIRST(&emptyq);
 	while (sah != NULL) {
 		nextsah = LIST_NEXT(sah, drainq);
 		/* Check that SAH is still empty and not unlinked */
 		if (sah->state == SADB_SASTATE_DEAD ||
 		    !TAILQ_EMPTY(&sah->savtree_larval) ||
 		    !TAILQ_EMPTY(&sah->savtree_alive)) {
 			LIST_REMOVE(sah, drainq);
 			key_freesah(&sah); /* release extra reference */
 			sah = nextsah;
 			continue;
 		}
 		TAILQ_REMOVE(&V_sahtree, sah, chain);
 		LIST_REMOVE(sah, addrhash);
 		sah->state = SADB_SASTATE_DEAD;
 		sah = nextsah;
 	}
 	SAHTREE_WUNLOCK();
 
 	/* Send SPDEXPIRE messages */
 	sav = LIST_FIRST(&hexpireq);
 	while (sav != NULL) {
 		nextsav = LIST_NEXT(sav, drainq);
 		key_expire(sav, 1);
 		key_freesah(&sav->sah); /* release reference from SAV */
 		key_freesav(&sav); /* release extra reference */
 		key_freesav(&sav); /* release last reference */
 		sav = nextsav;
 	}
 	sav = LIST_FIRST(&sexpireq);
 	while (sav != NULL) {
 		nextsav = LIST_NEXT(sav, drainq);
 		key_expire(sav, 0);
 		key_freesav(&sav); /* release extra reference */
 		sav = nextsav;
 	}
 	/* Free stale LARVAL SAs */
 	sav = LIST_FIRST(&drainq);
 	while (sav != NULL) {
 		nextsav = LIST_NEXT(sav, drainq);
 		key_freesah(&sav->sah); /* release reference from SAV */
 		key_freesav(&sav); /* release extra reference */
 		key_freesav(&sav); /* release last reference */
 		sav = nextsav;
 	}
 	/* Free SAs that were unlinked/changed by someone else */
 	sav = LIST_FIRST(&freeq);
 	while (sav != NULL) {
 		nextsav = LIST_NEXT(sav, drainq);
 		key_freesav(&sav); /* release extra reference */
 		sav = nextsav;
 	}
 	/* Free empty SAH */
 	sah = LIST_FIRST(&emptyq);
 	while (sah != NULL) {
 		nextsah = LIST_NEXT(sah, drainq);
 		key_freesah(&sah); /* release extra reference */
 		key_freesah(&sah); /* release last reference */
 		sah = nextsah;
 	}
 }
 
 static void
 key_flush_acq(time_t now)
 {
 	struct secacq *acq, *nextacq;
 
 	/* ACQ tree */
 	ACQ_LOCK();
 	acq = LIST_FIRST(&V_acqtree);
 	while (acq != NULL) {
 		nextacq = LIST_NEXT(acq, chain);
 		if (now - acq->created > V_key_blockacq_lifetime) {
 			LIST_REMOVE(acq, chain);
 			LIST_REMOVE(acq, addrhash);
 			LIST_REMOVE(acq, seqhash);
 			free(acq, M_IPSEC_SAQ);
 		}
 		acq = nextacq;
 	}
 	ACQ_UNLOCK();
 }
 
 static void
 key_flush_spacq(time_t now)
 {
 	struct secspacq *acq, *nextacq;
 
 	/* SP ACQ tree */
 	SPACQ_LOCK();
 	for (acq = LIST_FIRST(&V_spacqtree); acq != NULL; acq = nextacq) {
 		nextacq = LIST_NEXT(acq, chain);
 		if (now - acq->created > V_key_blockacq_lifetime
 		 && __LIST_CHAINED(acq)) {
 			LIST_REMOVE(acq, chain);
 			free(acq, M_IPSEC_SAQ);
 		}
 	}
 	SPACQ_UNLOCK();
 }
 
 /*
  * time handler.
  * scanning SPD and SAD to check status for each entries,
  * and do to remove or to expire.
  * XXX: year 2038 problem may remain.
  */
 static void
 key_timehandler(void *arg)
 {
 	VNET_ITERATOR_DECL(vnet_iter);
 	time_t now = time_second;
 
 	VNET_LIST_RLOCK_NOSLEEP();
 	VNET_FOREACH(vnet_iter) {
 		CURVNET_SET(vnet_iter);
 		key_flush_spd(now);
 		key_flush_sad(now);
 		key_flush_acq(now);
 		key_flush_spacq(now);
 		CURVNET_RESTORE();
 	}
 	VNET_LIST_RUNLOCK_NOSLEEP();
 
 #ifndef IPSEC_DEBUG2
 	/* do exchange to tick time !! */
 	callout_schedule(&key_timer, hz);
 #endif /* IPSEC_DEBUG2 */
 }
 
 u_long
 key_random(void)
 {
 	u_long value;
 
 	arc4random_buf(&value, sizeof(value));
 	return value;
 }
 
 /*
  * map SADB_SATYPE_* to IPPROTO_*.
  * if satype == SADB_SATYPE then satype is mapped to ~0.
  * OUT:
  *	0: invalid satype.
  */
 static uint8_t
 key_satype2proto(uint8_t satype)
 {
 	switch (satype) {
 	case SADB_SATYPE_UNSPEC:
 		return IPSEC_PROTO_ANY;
 	case SADB_SATYPE_AH:
 		return IPPROTO_AH;
 	case SADB_SATYPE_ESP:
 		return IPPROTO_ESP;
 	case SADB_X_SATYPE_IPCOMP:
 		return IPPROTO_IPCOMP;
 	case SADB_X_SATYPE_TCPSIGNATURE:
 		return IPPROTO_TCP;
 	default:
 		return 0;
 	}
 	/* NOTREACHED */
 }
 
 /*
  * map IPPROTO_* to SADB_SATYPE_*
  * OUT:
  *	0: invalid protocol type.
  */
 static uint8_t
 key_proto2satype(uint8_t proto)
 {
 	switch (proto) {
 	case IPPROTO_AH:
 		return SADB_SATYPE_AH;
 	case IPPROTO_ESP:
 		return SADB_SATYPE_ESP;
 	case IPPROTO_IPCOMP:
 		return SADB_X_SATYPE_IPCOMP;
 	case IPPROTO_TCP:
 		return SADB_X_SATYPE_TCPSIGNATURE;
 	default:
 		return 0;
 	}
 	/* NOTREACHED */
 }
 
 /* %%% PF_KEY */
 /*
  * SADB_GETSPI processing is to receive
  *	<base, (SA2), src address, dst address, (SPI range)>
  * from the IKMPd, to assign a unique spi value, to hang on the INBOUND
  * tree with the status of LARVAL, and send
  *	<base, SA(*), address(SD)>
  * to the IKMPd.
  *
  * IN:	mhp: pointer to the pointer to each header.
  * OUT:	NULL if fail.
  *	other if success, return pointer to the message to send.
  */
 static int
 key_getspi(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	struct secasindex saidx;
 	struct sadb_address *src0, *dst0;
 	struct secasvar *sav;
 	uint32_t reqid, spi;
 	int error;
 	uint8_t mode, proto;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST)
 #ifdef PFKEY_STRICT_CHECKS
 	    || SADB_CHECKHDR(mhp, SADB_EXT_SPIRANGE)
 #endif
 	    ) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: missing required header.\n",
 		    __func__));
 		error = EINVAL;
 		goto fail;
 	}
 	if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)
 #ifdef PFKEY_STRICT_CHECKS
 	    || SADB_CHECKLEN(mhp, SADB_EXT_SPIRANGE)
 #endif
 	    ) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: wrong header size.\n", __func__));
 		error = EINVAL;
 		goto fail;
 	}
 	if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) {
 		mode = IPSEC_MODE_ANY;
 		reqid = 0;
 	} else {
 		if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) {
 			ipseclog((LOG_DEBUG,
 			    "%s: invalid message: wrong header size.\n",
 			    __func__));
 			error = EINVAL;
 			goto fail;
 		}
 		mode = ((struct sadb_x_sa2 *)
 		    mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode;
 		reqid = ((struct sadb_x_sa2 *)
 		    mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid;
 	}
 
 	src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]);
 	dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]);
 
 	/* map satype to proto */
 	if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
 			__func__));
 		error = EINVAL;
 		goto fail;
 	}
 	error = key_checksockaddrs((struct sockaddr *)(src0 + 1),
 	    (struct sockaddr *)(dst0 + 1));
 	if (error != 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
 		error = EINVAL;
 		goto fail;
 	}
 	KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
 
 	/* SPI allocation */
 	SPI_ALLOC_LOCK();
 	spi = key_do_getnewspi(
 	    (struct sadb_spirange *)mhp->ext[SADB_EXT_SPIRANGE], &saidx);
 	if (spi == 0) {
 		/*
 		 * Requested SPI or SPI range is not available or
 		 * already used.
 		 */
 		SPI_ALLOC_UNLOCK();
 		error = EEXIST;
 		goto fail;
 	}
 	sav = key_newsav(mhp, &saidx, spi, &error);
 	SPI_ALLOC_UNLOCK();
 	if (sav == NULL)
 		goto fail;
 
 	if (sav->seq != 0) {
 		/*
 		 * RFC2367:
 		 * If the SADB_GETSPI message is in response to a
 		 * kernel-generated SADB_ACQUIRE, the sadb_msg_seq
 		 * MUST be the same as the SADB_ACQUIRE message.
 		 *
 		 * XXXAE: However it doesn't definethe behaviour how to
 		 * check this and what to do if it doesn't match.
 		 * Also what we should do if it matches?
 		 *
 		 * We can compare saidx used in SADB_ACQUIRE with saidx
 		 * used in SADB_GETSPI, but this probably can break
 		 * existing software. For now just warn if it doesn't match.
 		 *
 		 * XXXAE: anyway it looks useless.
 		 */
 		key_acqdone(&saidx, sav->seq);
 	}
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SA(%p)\n", __func__, sav));
 	KEYDBG(KEY_DATA, kdebug_secasv(sav));
 
     {
 	struct mbuf *n, *nn;
 	struct sadb_sa *m_sa;
 	struct sadb_msg *newmsg;
 	int off, len;
 
 	/* create new sadb_msg to reply. */
 	len = PFKEY_ALIGN8(sizeof(struct sadb_msg)) +
 	    PFKEY_ALIGN8(sizeof(struct sadb_sa));
 
 	n = key_mget(len);
 	if (n == NULL) {
 		error = ENOBUFS;
 		goto fail;
 	}
 
 	n->m_len = len;
 	n->m_next = NULL;
 	off = 0;
 
 	m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off);
 	off += PFKEY_ALIGN8(sizeof(struct sadb_msg));
 
 	m_sa = (struct sadb_sa *)(mtod(n, caddr_t) + off);
 	m_sa->sadb_sa_len = PFKEY_UNIT64(sizeof(struct sadb_sa));
 	m_sa->sadb_sa_exttype = SADB_EXT_SA;
 	m_sa->sadb_sa_spi = spi; /* SPI is already in network byte order */
 	off += PFKEY_ALIGN8(sizeof(struct sadb_sa));
 
 	IPSEC_ASSERT(off == len,
 		("length inconsistency (off %u len %u)", off, len));
 
 	n->m_next = key_gather_mbuf(m, mhp, 0, 2, SADB_EXT_ADDRESS_SRC,
 	    SADB_EXT_ADDRESS_DST);
 	if (!n->m_next) {
 		m_freem(n);
 		error = ENOBUFS;
 		goto fail;
 	}
 
 	if (n->m_len < sizeof(struct sadb_msg)) {
 		n = m_pullup(n, sizeof(struct sadb_msg));
 		if (n == NULL)
 			return key_sendup_mbuf(so, m, KEY_SENDUP_ONE);
 	}
 
 	n->m_pkthdr.len = 0;
 	for (nn = n; nn; nn = nn->m_next)
 		n->m_pkthdr.len += nn->m_len;
 
 	newmsg = mtod(n, struct sadb_msg *);
 	newmsg->sadb_msg_seq = sav->seq;
 	newmsg->sadb_msg_errno = 0;
 	newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
 
 	m_freem(m);
 	return key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
     }
 
 fail:
 	return (key_senderror(so, m, error));
 }
 
 /*
  * allocating new SPI
  * called by key_getspi().
  * OUT:
  *	0:	failure.
  *	others: success, SPI in network byte order.
  */
 static uint32_t
 key_do_getnewspi(struct sadb_spirange *spirange, struct secasindex *saidx)
 {
 	uint32_t min, max, newspi, t;
 	int tries, limit;
 
 	SPI_ALLOC_LOCK_ASSERT();
 
 	/* set spi range to allocate */
 	if (spirange != NULL) {
 		min = spirange->sadb_spirange_min;
 		max = spirange->sadb_spirange_max;
 	} else {
 		min = V_key_spi_minval;
 		max = V_key_spi_maxval;
 	}
 	/* IPCOMP needs 2-byte SPI */
 	if (saidx->proto == IPPROTO_IPCOMP) {
 		if (min >= 0x10000)
 			min = 0xffff;
 		if (max >= 0x10000)
 			max = 0xffff;
 		if (min > max) {
 			t = min; min = max; max = t;
 		}
 	}
 
 	if (min == max) {
 		if (key_checkspidup(htonl(min))) {
 			ipseclog((LOG_DEBUG, "%s: SPI %u exists already.\n",
 			    __func__, min));
 			return 0;
 		}
 
 		tries = 1;
 		newspi = min;
 	} else {
 		/* init SPI */
 		newspi = 0;
 
 		limit = atomic_load_int(&V_key_spi_trycnt);
 		/* when requesting to allocate spi ranged */
 		for (tries = 0; tries < limit; tries++) {
 			/* generate pseudo-random SPI value ranged. */
 			newspi = min + (key_random() % (max - min + 1));
 			if (!key_checkspidup(htonl(newspi)))
 				break;
 		}
 
 		if (tries == limit || newspi == 0) {
 			ipseclog((LOG_DEBUG,
 			    "%s: failed to allocate SPI.\n", __func__));
 			return 0;
 		}
 	}
 
 	/* statistics */
 	keystat.getspi_count =
 	    (keystat.getspi_count + tries) / 2;
 
 	return (htonl(newspi));
 }
 
 /*
  * Find TCP-MD5 SA with corresponding secasindex.
  * If not found, return NULL and fill SPI with usable value if needed.
  */
 static struct secasvar *
 key_getsav_tcpmd5(struct secasindex *saidx, uint32_t *spi)
 {
 	SAHTREE_RLOCK_TRACKER;
 	struct secashead *sah;
 	struct secasvar *sav;
 
 	IPSEC_ASSERT(saidx->proto == IPPROTO_TCP, ("wrong proto"));
 	SAHTREE_RLOCK();
 	LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) {
 		if (sah->saidx.proto != IPPROTO_TCP)
 			continue;
 		if (!key_sockaddrcmp(&saidx->dst.sa, &sah->saidx.dst.sa, 0) &&
 		    !key_sockaddrcmp(&saidx->src.sa, &sah->saidx.src.sa, 0))
 			break;
 	}
 	if (sah != NULL) {
 		if (V_key_preferred_oldsa)
 			sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue);
 		else
 			sav = TAILQ_FIRST(&sah->savtree_alive);
 		if (sav != NULL) {
 			SAV_ADDREF(sav);
 			SAHTREE_RUNLOCK();
 			return (sav);
 		}
 	}
 	if (spi == NULL) {
 		/* No SPI required */
 		SAHTREE_RUNLOCK();
 		return (NULL);
 	}
 	/* Check that SPI is unique */
 	LIST_FOREACH(sav, SAVHASH_HASH(*spi), spihash) {
 		if (sav->spi == *spi)
 			break;
 	}
 	if (sav == NULL) {
 		SAHTREE_RUNLOCK();
 		/* SPI is already unique */
 		return (NULL);
 	}
 	SAHTREE_RUNLOCK();
 	/* XXX: not optimal */
 	*spi = key_do_getnewspi(NULL, saidx);
 	return (NULL);
 }
 
 static int
 key_updateaddresses(struct socket *so, struct mbuf *m,
     const struct sadb_msghdr *mhp, struct secasvar *sav,
     struct secasindex *saidx)
 {
 	struct sockaddr *newaddr;
 	struct secashead *sah;
 	struct secasvar *newsav, *tmp;
 	struct mbuf *n;
 	int error, isnew;
 
 	/* Check that we need to change SAH */
 	if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC)) {
 		newaddr = (struct sockaddr *)(
 		    ((struct sadb_address *)
 		    mhp->ext[SADB_X_EXT_NEW_ADDRESS_SRC]) + 1);
 		bcopy(newaddr, &saidx->src, newaddr->sa_len);
 		key_porttosaddr(&saidx->src.sa, 0);
 	}
 	if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) {
 		newaddr = (struct sockaddr *)(
 		    ((struct sadb_address *)
 		    mhp->ext[SADB_X_EXT_NEW_ADDRESS_DST]) + 1);
 		bcopy(newaddr, &saidx->dst, newaddr->sa_len);
 		key_porttosaddr(&saidx->dst.sa, 0);
 	}
 	if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC) ||
 	    !SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) {
 		error = key_checksockaddrs(&saidx->src.sa, &saidx->dst.sa);
 		if (error != 0) {
 			ipseclog((LOG_DEBUG, "%s: invalid new sockaddr.\n",
 			    __func__));
 			return (error);
 		}
 
 		sah = key_getsah(saidx);
 		if (sah == NULL) {
 			/* create a new SA index */
 			sah = key_newsah(saidx);
 			if (sah == NULL) {
 				ipseclog((LOG_DEBUG,
 				    "%s: No more memory.\n", __func__));
 				return (ENOBUFS);
 			}
 			isnew = 2; /* SAH is new */
 		} else
 			isnew = 1; /* existing SAH is referenced */
 	} else {
 		/*
 		 * src and dst addresses are still the same.
 		 * Do we want to change NAT-T config?
 		 */
 		if (sav->sah->saidx.proto != IPPROTO_ESP ||
 		    SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) ||
 		    SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_SPORT) ||
 		    SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_DPORT)) {
 			ipseclog((LOG_DEBUG,
 			    "%s: invalid message: missing required header.\n",
 			    __func__));
 			return (EINVAL);
 		}
 		/* We hold reference to SA, thus SAH will be referenced too. */
 		sah = sav->sah;
 		isnew = 0;
 	}
 
 	newsav = malloc(sizeof(struct secasvar), M_IPSEC_SA,
 	    M_NOWAIT | M_ZERO);
 	if (newsav == NULL) {
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		error = ENOBUFS;
 		goto fail;
 	}
 
 	/* Clone SA's content into newsav */
 	SAV_INITREF(newsav);
 	bcopy(sav, newsav, offsetof(struct secasvar, chain));
 	/*
 	 * We create new NAT-T config if it is needed.
 	 * Old NAT-T config will be freed by key_cleansav() when
 	 * last reference to SA will be released.
 	 */
 	newsav->natt = NULL;
 	newsav->sah = sah;
 	newsav->state = SADB_SASTATE_MATURE;
 	error = key_setnatt(newsav, mhp);
 	if (error != 0)
 		goto fail;
 
 	SAHTREE_WLOCK();
 	/* Check that SA is still alive */
 	if (sav->state == SADB_SASTATE_DEAD) {
 		/* SA was unlinked */
 		SAHTREE_WUNLOCK();
 		error = ESRCH;
 		goto fail;
 	}
 
 	/* Unlink SA from SAH and SPI hash */
 	IPSEC_ASSERT((sav->flags & SADB_X_EXT_F_CLONED) == 0,
 	    ("SA is already cloned"));
 	IPSEC_ASSERT(sav->state == SADB_SASTATE_MATURE ||
 	    sav->state == SADB_SASTATE_DYING,
 	    ("Wrong SA state %u\n", sav->state));
 	TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain);
 	LIST_REMOVE(sav, spihash);
 	sav->state = SADB_SASTATE_DEAD;
 
 	/*
 	 * Link new SA with SAH. Keep SAs ordered by
 	 * create time (newer are first).
 	 */
 	TAILQ_FOREACH(tmp, &sah->savtree_alive, chain) {
 		if (newsav->created > tmp->created) {
 			TAILQ_INSERT_BEFORE(tmp, newsav, chain);
 			break;
 		}
 	}
 	if (tmp == NULL)
 		TAILQ_INSERT_TAIL(&sah->savtree_alive, newsav, chain);
 
 	/* Add new SA into SPI hash. */
 	LIST_INSERT_HEAD(SAVHASH_HASH(newsav->spi), newsav, spihash);
 
 	/* Add new SAH into SADB. */
 	if (isnew == 2) {
 		TAILQ_INSERT_HEAD(&V_sahtree, sah, chain);
 		LIST_INSERT_HEAD(SAHADDRHASH_HASH(saidx), sah, addrhash);
 		sah->state = SADB_SASTATE_MATURE;
 		SAH_ADDREF(sah); /* newsav references new SAH */
 	}
 	/*
 	 * isnew == 1 -> @sah was referenced by key_getsah().
 	 * isnew == 0 -> we use the same @sah, that was used by @sav,
 	 *	and we use its reference for @newsav.
 	 */
 	SECASVAR_WLOCK(sav);
 	/* XXX: replace cntr with pointer? */
 	newsav->cntr = sav->cntr;
 	sav->flags |= SADB_X_EXT_F_CLONED;
 	SECASVAR_WUNLOCK(sav);
 
 	SAHTREE_WUNLOCK();
 
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SA(%p) cloned into SA(%p)\n",
 	    __func__, sav, newsav));
 	KEYDBG(KEY_DATA, kdebug_secasv(newsav));
 
 	key_freesav(&sav); /* release last reference */
 
 	/* set msg buf from mhp */
 	n = key_getmsgbuf_x1(m, mhp);
 	if (n == NULL) {
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return (ENOBUFS);
 	}
 	m_freem(m);
 	key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
 	return (0);
 fail:
 	if (isnew != 0)
 		key_freesah(&sah);
 	if (newsav != NULL) {
 		if (newsav->natt != NULL)
 			free(newsav->natt, M_IPSEC_MISC);
 		free(newsav, M_IPSEC_SA);
 	}
 	return (error);
 }
 
 /*
  * SADB_UPDATE processing
  * receive
  *   <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),)
  *       key(AE), (identity(SD),) (sensitivity)>
  * from the ikmpd, and update a secasvar entry whose status is SADB_SASTATE_LARVAL.
  * and send
  *   <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),)
  *       (identity(SD),) (sensitivity)>
  * to the ikmpd.
  *
  * m will always be freed.
  */
 static int
 key_update(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	struct secasindex saidx;
 	struct sadb_address *src0, *dst0;
 	struct sadb_sa *sa0;
 	struct secasvar *sav;
 	uint32_t reqid;
 	int error;
 	uint8_t mode, proto;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	/* map satype to proto */
 	if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	if (SADB_CHECKHDR(mhp, SADB_EXT_SA) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
 	    (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) &&
 		!SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) ||
 	    (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) &&
 		!SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: missing required header.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	if (SADB_CHECKLEN(mhp, SADB_EXT_SA) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: wrong header size.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) {
 		mode = IPSEC_MODE_ANY;
 		reqid = 0;
 	} else {
 		if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) {
 			ipseclog((LOG_DEBUG,
 			    "%s: invalid message: wrong header size.\n",
 			    __func__));
 			return key_senderror(so, m, EINVAL);
 		}
 		mode = ((struct sadb_x_sa2 *)
 		    mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode;
 		reqid = ((struct sadb_x_sa2 *)
 		    mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid;
 	}
 
 	sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA];
 	src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]);
 	dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]);
 
 	/*
 	 * Only SADB_SASTATE_MATURE SAs may be submitted in an
 	 * SADB_UPDATE message.
 	 */
 	if (sa0->sadb_sa_state != SADB_SASTATE_MATURE) {
 		ipseclog((LOG_DEBUG, "%s: invalid state.\n", __func__));
 #ifdef PFKEY_STRICT_CHECKS
 		return key_senderror(so, m, EINVAL);
 #endif
 	}
 	error = key_checksockaddrs((struct sockaddr *)(src0 + 1),
 	    (struct sockaddr *)(dst0 + 1));
 	if (error != 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
 		return key_senderror(so, m, error);
 	}
 	KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
 	sav = key_getsavbyspi(sa0->sadb_sa_spi);
 	if (sav == NULL) {
 		ipseclog((LOG_DEBUG, "%s: no SA found for SPI %u\n",
 		    __func__, ntohl(sa0->sadb_sa_spi)));
 		return key_senderror(so, m, EINVAL);
 	}
 	/*
 	 * Check that SADB_UPDATE issued by the same process that did
 	 * SADB_GETSPI or SADB_ADD.
 	 */
 	if (sav->pid != mhp->msg->sadb_msg_pid) {
 		ipseclog((LOG_DEBUG,
 		    "%s: pid mismatched (SPI %u, pid %u vs. %u)\n", __func__,
 		    ntohl(sav->spi), sav->pid, mhp->msg->sadb_msg_pid));
 		key_freesav(&sav);
 		return key_senderror(so, m, EINVAL);
 	}
 	/* saidx should match with SA. */
 	if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_MODE_REQID) == 0) {
 		ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u\n",
 		    __func__, ntohl(sav->spi)));
 		key_freesav(&sav);
 		return key_senderror(so, m, ESRCH);
 	}
 
 	if (sav->state == SADB_SASTATE_LARVAL) {
 		if ((mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP &&
 		    SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT)) ||
 		    (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH &&
 		    SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH))) {
 			ipseclog((LOG_DEBUG,
 			    "%s: invalid message: missing required header.\n",
 			    __func__));
 			key_freesav(&sav);
 			return key_senderror(so, m, EINVAL);
 		}
 		/*
 		 * We can set any values except src, dst and SPI.
 		 */
 		error = key_setsaval(sav, mhp);
 		if (error != 0) {
 			key_freesav(&sav);
 			return (key_senderror(so, m, error));
 		}
 		/* Change SA state to MATURE */
 		SAHTREE_WLOCK();
 		if (sav->state != SADB_SASTATE_LARVAL) {
 			/* SA was deleted or another thread made it MATURE. */
 			SAHTREE_WUNLOCK();
 			key_freesav(&sav);
 			return (key_senderror(so, m, ESRCH));
 		}
 		/*
 		 * NOTE: we keep SAs in savtree_alive ordered by created
 		 * time. When SA's state changed from LARVAL to MATURE,
 		 * we update its created time in key_setsaval() and move
 		 * it into head of savtree_alive.
 		 */
 		TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain);
 		TAILQ_INSERT_HEAD(&sav->sah->savtree_alive, sav, chain);
 		sav->state = SADB_SASTATE_MATURE;
 		SAHTREE_WUNLOCK();
 	} else {
 		/*
 		 * For DYING and MATURE SA we can change only state
 		 * and lifetimes. Report EINVAL if something else attempted
 		 * to change.
 		 */
 		if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT) ||
 		    !SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH)) {
 			key_freesav(&sav);
 			return (key_senderror(so, m, EINVAL));
 		}
 		error = key_updatelifetimes(sav, mhp);
 		if (error != 0) {
 			key_freesav(&sav);
 			return (key_senderror(so, m, error));
 		}
 		/*
 		 * This is FreeBSD extension to RFC2367.
 		 * IKEd can specify SADB_X_EXT_NEW_ADDRESS_SRC and/or
 		 * SADB_X_EXT_NEW_ADDRESS_DST when it wants to change
 		 * SA addresses (for example to implement MOBIKE protocol
 		 * as described in RFC4555). Also we allow to change
 		 * NAT-T config.
 		 */
 		if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC) ||
 		    !SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST) ||
 		    !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) ||
 		    sav->natt != NULL) {
 			error = key_updateaddresses(so, m, mhp, sav, &saidx);
 			key_freesav(&sav);
 			if (error != 0)
 				return (key_senderror(so, m, error));
 			return (0);
 		}
 		/* Check that SA is still alive */
 		SAHTREE_WLOCK();
 		if (sav->state == SADB_SASTATE_DEAD) {
 			/* SA was unlinked */
 			SAHTREE_WUNLOCK();
 			key_freesav(&sav);
 			return (key_senderror(so, m, ESRCH));
 		}
 		/*
 		 * NOTE: there is possible state moving from DYING to MATURE,
 		 * but this doesn't change created time, so we won't reorder
 		 * this SA.
 		 */
 		sav->state = SADB_SASTATE_MATURE;
 		SAHTREE_WUNLOCK();
 	}
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SA(%p)\n", __func__, sav));
 	KEYDBG(KEY_DATA, kdebug_secasv(sav));
 	key_freesav(&sav);
 
     {
 	struct mbuf *n;
 
 	/* set msg buf from mhp */
 	n = key_getmsgbuf_x1(m, mhp);
 	if (n == NULL) {
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return key_senderror(so, m, ENOBUFS);
 	}
 
 	m_freem(m);
 	return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
     }
 }
 
 /*
  * SADB_ADD processing
  * add an entry to SA database, when received
  *   <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),)
  *       key(AE), (identity(SD),) (sensitivity)>
  * from the ikmpd,
  * and send
  *   <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),)
  *       (identity(SD),) (sensitivity)>
  * to the ikmpd.
  *
  * IGNORE identity and sensitivity messages.
  *
  * m will always be freed.
  */
 static int
 key_add(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	struct secasindex saidx;
 	struct sadb_address *src0, *dst0;
 	struct sadb_sa *sa0;
 	struct secasvar *sav;
 	uint32_t reqid, spi;
 	uint8_t mode, proto;
 	int error;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	/* map satype to proto */
 	if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	if (SADB_CHECKHDR(mhp, SADB_EXT_SA) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
 	    (mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP && (
 		SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT) ||
 		SADB_CHECKLEN(mhp, SADB_EXT_KEY_ENCRYPT))) ||
 	    (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH && (
 		SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH) ||
 		SADB_CHECKLEN(mhp, SADB_EXT_KEY_AUTH))) ||
 	    (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) &&
 		!SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) ||
 	    (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) &&
 		!SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: missing required header.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	if (SADB_CHECKLEN(mhp, SADB_EXT_SA) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: wrong header size.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) {
 		mode = IPSEC_MODE_ANY;
 		reqid = 0;
 	} else {
 		if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) {
 			ipseclog((LOG_DEBUG,
 			    "%s: invalid message: wrong header size.\n",
 			    __func__));
 			return key_senderror(so, m, EINVAL);
 		}
 		mode = ((struct sadb_x_sa2 *)
 		    mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode;
 		reqid = ((struct sadb_x_sa2 *)
 		    mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid;
 	}
 
 	sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA];
 	src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
 	dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
 
 	/*
 	 * Only SADB_SASTATE_MATURE SAs may be submitted in an
 	 * SADB_ADD message.
 	 */
 	if (sa0->sadb_sa_state != SADB_SASTATE_MATURE) {
 		ipseclog((LOG_DEBUG, "%s: invalid state.\n", __func__));
 #ifdef PFKEY_STRICT_CHECKS
 		return key_senderror(so, m, EINVAL);
 #endif
 	}
 	error = key_checksockaddrs((struct sockaddr *)(src0 + 1),
 	    (struct sockaddr *)(dst0 + 1));
 	if (error != 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
 		return key_senderror(so, m, error);
 	}
 	KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
 	spi = sa0->sadb_sa_spi;
 	/*
 	 * For TCP-MD5 SAs we don't use SPI. Check the uniqueness using
 	 * secasindex.
 	 * XXXAE: IPComp seems also doesn't use SPI.
 	 */
 	SPI_ALLOC_LOCK();
 	if (proto == IPPROTO_TCP) {
 		sav = key_getsav_tcpmd5(&saidx, &spi);
 		if (sav == NULL && spi == 0) {
 			SPI_ALLOC_UNLOCK();
 			/* Failed to allocate SPI */
 			ipseclog((LOG_DEBUG, "%s: SA already exists.\n",
 			    __func__));
 			return key_senderror(so, m, EEXIST);
 		}
 		/* XXX: SPI that we report back can have another value */
 	} else {
 		/* We can create new SA only if SPI is different. */
 		sav = key_getsavbyspi(spi);
 	}
 	if (sav != NULL) {
 		SPI_ALLOC_UNLOCK();
 		key_freesav(&sav);
 		ipseclog((LOG_DEBUG, "%s: SA already exists.\n", __func__));
 		return key_senderror(so, m, EEXIST);
 	}
 
 	sav = key_newsav(mhp, &saidx, spi, &error);
 	SPI_ALLOC_UNLOCK();
 	if (sav == NULL)
 		return key_senderror(so, m, error);
 	KEYDBG(KEY_STAMP,
 	    printf("%s: return SA(%p)\n", __func__, sav));
 	KEYDBG(KEY_DATA, kdebug_secasv(sav));
 	/*
 	 * If SADB_ADD was in response to SADB_ACQUIRE, we need to schedule
 	 * ACQ for deletion.
 	 */
 	if (sav->seq != 0)
 		key_acqdone(&saidx, sav->seq);
 
     {
 	/*
 	 * Don't call key_freesav() on error here, as we would like to
 	 * keep the SA in the database.
 	 */
 	struct mbuf *n;
 
 	/* set msg buf from mhp */
 	n = key_getmsgbuf_x1(m, mhp);
 	if (n == NULL) {
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return key_senderror(so, m, ENOBUFS);
 	}
 
 	m_freem(m);
 	return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
     }
 }
 
 /*
  * NAT-T support.
  * IKEd may request the use ESP in UDP encapsulation when it detects the
  * presence of NAT. It uses NAT-T extension headers for such SAs to specify
  * parameters needed for encapsulation and decapsulation. These PF_KEY
  * extension headers are not standardized, so this comment addresses our
  * implementation.
  * SADB_X_EXT_NAT_T_TYPE specifies type of encapsulation, we support only
  * UDP_ENCAP_ESPINUDP as described in RFC3948.
  * SADB_X_EXT_NAT_T_SPORT/DPORT specifies source and destination ports for
  * UDP header. We use these ports in UDP encapsulation procedure, also we
  * can check them in UDP decapsulation procedure.
  * SADB_X_EXT_NAT_T_OA[IR] specifies original address of initiator or
  * responder. These addresses can be used for transport mode to adjust
  * checksum after decapsulation and decryption. Since original IP addresses
  * used by peer usually different (we detected presence of NAT), TCP/UDP
  * pseudo header checksum and IP header checksum was calculated using original
  * addresses. After decapsulation and decryption we need to adjust checksum
  * to have correct datagram.
  *
  * We expect presence of NAT-T extension headers only in SADB_ADD and
  * SADB_UPDATE messages. We report NAT-T extension headers in replies
  * to SADB_ADD, SADB_UPDATE, SADB_GET, and SADB_DUMP messages.
  */
 static int
 key_setnatt(struct secasvar *sav, const struct sadb_msghdr *mhp)
 {
 	struct sadb_x_nat_t_port *port;
 	struct sadb_x_nat_t_type *type;
 	struct sadb_address *oai, *oar;
 	struct sockaddr *sa;
 	uint32_t addr;
 	uint16_t cksum;
+	int i;
 
 	IPSEC_ASSERT(sav->natt == NULL, ("natt is already initialized"));
 	/*
 	 * Ignore NAT-T headers if sproto isn't ESP.
 	 */
 	if (sav->sah->saidx.proto != IPPROTO_ESP)
 		return (0);
 
 	if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) &&
 	    !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_SPORT) &&
 	    !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_DPORT)) {
 		if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_TYPE) ||
 		    SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_SPORT) ||
 		    SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_DPORT)) {
 			ipseclog((LOG_DEBUG,
 			    "%s: invalid message: wrong header size.\n",
 			    __func__));
 			return (EINVAL);
 		}
 	} else
 		return (0);
 
 	type = (struct sadb_x_nat_t_type *)mhp->ext[SADB_X_EXT_NAT_T_TYPE];
 	if (type->sadb_x_nat_t_type_type != UDP_ENCAP_ESPINUDP) {
 		ipseclog((LOG_DEBUG, "%s: unsupported NAT-T type %u.\n",
 		    __func__, type->sadb_x_nat_t_type_type));
 		return (EINVAL);
 	}
 	/*
 	 * Allocate storage for NAT-T config.
 	 * On error it will be released by key_cleansav().
 	 */
 	sav->natt = malloc(sizeof(struct secnatt), M_IPSEC_MISC,
 	    M_NOWAIT | M_ZERO);
 	if (sav->natt == NULL) {
 		PFKEYSTAT_INC(in_nomem);
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return (ENOBUFS);
 	}
 	port = (struct sadb_x_nat_t_port *)mhp->ext[SADB_X_EXT_NAT_T_SPORT];
 	if (port->sadb_x_nat_t_port_port == 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid NAT-T sport specified.\n",
 		    __func__));
 		return (EINVAL);
 	}
 	sav->natt->sport = port->sadb_x_nat_t_port_port;
 	port = (struct sadb_x_nat_t_port *)mhp->ext[SADB_X_EXT_NAT_T_DPORT];
 	if (port->sadb_x_nat_t_port_port == 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid NAT-T dport specified.\n",
 		    __func__));
 		return (EINVAL);
 	}
 	sav->natt->dport = port->sadb_x_nat_t_port_port;
 
 	/*
 	 * SADB_X_EXT_NAT_T_OAI and SADB_X_EXT_NAT_T_OAR are optional
 	 * and needed only for transport mode IPsec.
 	 * Usually NAT translates only one address, but it is possible,
 	 * that both addresses could be translated.
 	 * NOTE: Value of SADB_X_EXT_NAT_T_OAI is equal to SADB_X_EXT_NAT_T_OA.
 	 */
 	if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_OAI)) {
 		if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_OAI)) {
 			ipseclog((LOG_DEBUG,
 			    "%s: invalid message: wrong header size.\n",
 			    __func__));
 			return (EINVAL);
 		}
 		oai = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAI];
 	} else
 		oai = NULL;
 	if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_OAR)) {
 		if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_OAR)) {
 			ipseclog((LOG_DEBUG,
 			    "%s: invalid message: wrong header size.\n",
 			    __func__));
 			return (EINVAL);
 		}
 		oar = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAR];
 	} else
 		oar = NULL;
 
 	/* Initialize addresses only for transport mode */
 	if (sav->sah->saidx.mode != IPSEC_MODE_TUNNEL) {
 		cksum = 0;
 		if (oai != NULL) {
-			/* Currently we support only AF_INET */
 			sa = (struct sockaddr *)(oai + 1);
-			if (sa->sa_family != AF_INET ||
-			    sa->sa_len != sizeof(struct sockaddr_in)) {
+			switch (sa->sa_family) {
+#ifdef AF_INET
+			case AF_INET:
+				if (sa->sa_len != sizeof(struct sockaddr_in)) {
+					ipseclog((LOG_DEBUG,
+					    "%s: wrong NAT-OAi header.\n",
+					    __func__));
+					return (EINVAL);
+				}
+				/* Ignore address if it the same */
+				if (((struct sockaddr_in *)sa)->sin_addr.s_addr !=
+				    sav->sah->saidx.src.sin.sin_addr.s_addr) {
+					bcopy(sa, &sav->natt->oai.sa, sa->sa_len);
+					sav->natt->flags |= IPSEC_NATT_F_OAI;
+					/* Calculate checksum delta */
+					addr = sav->sah->saidx.src.sin.sin_addr.s_addr;
+					cksum = in_addword(cksum, ~addr >> 16);
+					cksum = in_addword(cksum, ~addr & 0xffff);
+					addr = sav->natt->oai.sin.sin_addr.s_addr;
+					cksum = in_addword(cksum, addr >> 16);
+					cksum = in_addword(cksum, addr & 0xffff);
+				}
+				break;
+#endif
+#ifdef AF_INET6
+			case AF_INET6:
+				if (sa->sa_len != sizeof(struct sockaddr_in6)) {
+					ipseclog((LOG_DEBUG,
+					    "%s: wrong NAT-OAi header.\n",
+					    __func__));
+					return (EINVAL);
+				}
+				/* Ignore address if it the same */
+				if (memcmp(&((struct sockaddr_in6 *)sa)->sin6_addr.s6_addr,
+				    &sav->sah->saidx.src.sin6.sin6_addr.s6_addr,
+				    sizeof(struct in6_addr)) != 0) {
+					bcopy(sa, &sav->natt->oai.sa, sa->sa_len);
+					sav->natt->flags |= IPSEC_NATT_F_OAI;
+					/* Calculate checksum delta */
+					for (i = 0; i < 8; i++) {
+						cksum = in_addword(cksum,
+						  ~sav->sah->saidx.src.sin6.sin6_addr.s6_addr16[i]);
+						cksum = in_addword(cksum,
+						   sav->natt->oai.sin6.sin6_addr.s6_addr16[i]);
+					}
+				}
+				break;
+#endif
+			default:
 				ipseclog((LOG_DEBUG,
 				    "%s: wrong NAT-OAi header.\n",
 				    __func__));
 				return (EINVAL);
 			}
-			/* Ignore address if it the same */
-			if (((struct sockaddr_in *)sa)->sin_addr.s_addr !=
-			    sav->sah->saidx.src.sin.sin_addr.s_addr) {
-				bcopy(sa, &sav->natt->oai.sa, sa->sa_len);
-				sav->natt->flags |= IPSEC_NATT_F_OAI;
-				/* Calculate checksum delta */
-				addr = sav->sah->saidx.src.sin.sin_addr.s_addr;
-				cksum = in_addword(cksum, ~addr >> 16);
-				cksum = in_addword(cksum, ~addr & 0xffff);
-				addr = sav->natt->oai.sin.sin_addr.s_addr;
-				cksum = in_addword(cksum, addr >> 16);
-				cksum = in_addword(cksum, addr & 0xffff);
-			}
 		}
 		if (oar != NULL) {
-			/* Currently we support only AF_INET */
 			sa = (struct sockaddr *)(oar + 1);
-			if (sa->sa_family != AF_INET ||
-			    sa->sa_len != sizeof(struct sockaddr_in)) {
+			switch (sa->sa_family) {
+#ifdef AF_INET
+			case AF_INET:
+				if (sa->sa_len != sizeof(struct sockaddr_in)) {
+					ipseclog((LOG_DEBUG,
+					    "%s: wrong NAT-OAr header.\n",
+					    __func__));
+					return (EINVAL);
+				}
+				/* Ignore address if it the same */
+				if (((struct sockaddr_in *)sa)->sin_addr.s_addr !=
+				    sav->sah->saidx.dst.sin.sin_addr.s_addr) {
+					bcopy(sa, &sav->natt->oar.sa, sa->sa_len);
+					sav->natt->flags |= IPSEC_NATT_F_OAR;
+					/* Calculate checksum delta */
+					addr = sav->sah->saidx.dst.sin.sin_addr.s_addr;
+					cksum = in_addword(cksum, ~addr >> 16);
+					cksum = in_addword(cksum, ~addr & 0xffff);
+					addr = sav->natt->oar.sin.sin_addr.s_addr;
+					cksum = in_addword(cksum, addr >> 16);
+					cksum = in_addword(cksum, addr & 0xffff);
+				}
+				break;
+#endif
+#ifdef AF_INET6
+			case AF_INET6:
+				if (sa->sa_len != sizeof(struct sockaddr_in6)) {
+					ipseclog((LOG_DEBUG,
+					    "%s: wrong NAT-OAr header.\n",
+					    __func__));
+					return (EINVAL);
+				}
+				/* Ignore address if it the same */
+				if (memcmp(&((struct sockaddr_in6 *)sa)->sin6_addr.s6_addr,
+				           &sav->sah->saidx.dst.sin6.sin6_addr.s6_addr, 16) != 0) {
+					bcopy(sa, &sav->natt->oar.sa, sa->sa_len);
+					sav->natt->flags |= IPSEC_NATT_F_OAR;
+					/* Calculate checksum delta */
+					for (i = 0; i < 8; i++) {
+						cksum = in_addword(cksum,
+						   ~sav->sah->saidx.dst.sin6.sin6_addr.s6_addr16[i]);
+						cksum = in_addword(cksum,
+						   sav->natt->oar.sin6.sin6_addr.s6_addr16[i]);
+					}
+				}
+				break;
+#endif
+			default:
 				ipseclog((LOG_DEBUG,
 				    "%s: wrong NAT-OAr header.\n",
 				    __func__));
 				return (EINVAL);
 			}
-			/* Ignore address if it the same */
-			if (((struct sockaddr_in *)sa)->sin_addr.s_addr !=
-			    sav->sah->saidx.dst.sin.sin_addr.s_addr) {
-				bcopy(sa, &sav->natt->oar.sa, sa->sa_len);
-				sav->natt->flags |= IPSEC_NATT_F_OAR;
-				/* Calculate checksum delta */
-				addr = sav->sah->saidx.dst.sin.sin_addr.s_addr;
-				cksum = in_addword(cksum, ~addr >> 16);
-				cksum = in_addword(cksum, ~addr & 0xffff);
-				addr = sav->natt->oar.sin.sin_addr.s_addr;
-				cksum = in_addword(cksum, addr >> 16);
-				cksum = in_addword(cksum, addr & 0xffff);
-			}
 		}
 		sav->natt->cksum = cksum;
 	}
 	return (0);
 }
 
 static int
 key_setident(struct secashead *sah, const struct sadb_msghdr *mhp)
 {
 	const struct sadb_ident *idsrc, *iddst;
 
 	IPSEC_ASSERT(sah != NULL, ("null secashead"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	/* don't make buffer if not there */
 	if (SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_SRC) &&
 	    SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_DST)) {
 		sah->idents = NULL;
 		sah->identd = NULL;
 		return (0);
 	}
 
 	if (SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_SRC) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_DST)) {
 		ipseclog((LOG_DEBUG, "%s: invalid identity.\n", __func__));
 		return (EINVAL);
 	}
 
 	idsrc = (const struct sadb_ident *)mhp->ext[SADB_EXT_IDENTITY_SRC];
 	iddst = (const struct sadb_ident *)mhp->ext[SADB_EXT_IDENTITY_DST];
 
 	/* validity check */
 	if (idsrc->sadb_ident_type != iddst->sadb_ident_type) {
 		ipseclog((LOG_DEBUG, "%s: ident type mismatch.\n", __func__));
 		return EINVAL;
 	}
 
 	switch (idsrc->sadb_ident_type) {
 	case SADB_IDENTTYPE_PREFIX:
 	case SADB_IDENTTYPE_FQDN:
 	case SADB_IDENTTYPE_USERFQDN:
 	default:
 		/* XXX do nothing */
 		sah->idents = NULL;
 		sah->identd = NULL;
 	 	return 0;
 	}
 
 	/* make structure */
 	sah->idents = malloc(sizeof(struct secident), M_IPSEC_MISC, M_NOWAIT);
 	if (sah->idents == NULL) {
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return ENOBUFS;
 	}
 	sah->identd = malloc(sizeof(struct secident), M_IPSEC_MISC, M_NOWAIT);
 	if (sah->identd == NULL) {
 		free(sah->idents, M_IPSEC_MISC);
 		sah->idents = NULL;
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return ENOBUFS;
 	}
 	sah->idents->type = idsrc->sadb_ident_type;
 	sah->idents->id = idsrc->sadb_ident_id;
 
 	sah->identd->type = iddst->sadb_ident_type;
 	sah->identd->id = iddst->sadb_ident_id;
 
 	return 0;
 }
 
 /*
  * m will not be freed on return.
  * it is caller's responsibility to free the result.
  *
  * Called from SADB_ADD and SADB_UPDATE. Reply will contain headers
  * from the request in defined order.
  */
 static struct mbuf *
 key_getmsgbuf_x1(struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	struct mbuf *n;
 
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	/* create new sadb_msg to reply. */
 	n = key_gather_mbuf(m, mhp, 1, 16, SADB_EXT_RESERVED,
 	    SADB_EXT_SA, SADB_X_EXT_SA2,
 	    SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST,
 	    SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT,
 	    SADB_EXT_IDENTITY_SRC, SADB_EXT_IDENTITY_DST,
 	    SADB_X_EXT_NAT_T_TYPE, SADB_X_EXT_NAT_T_SPORT,
 	    SADB_X_EXT_NAT_T_DPORT, SADB_X_EXT_NAT_T_OAI,
 	    SADB_X_EXT_NAT_T_OAR, SADB_X_EXT_NEW_ADDRESS_SRC,
 	    SADB_X_EXT_NEW_ADDRESS_DST);
 	if (!n)
 		return NULL;
 
 	if (n->m_len < sizeof(struct sadb_msg)) {
 		n = m_pullup(n, sizeof(struct sadb_msg));
 		if (n == NULL)
 			return NULL;
 	}
 	mtod(n, struct sadb_msg *)->sadb_msg_errno = 0;
 	mtod(n, struct sadb_msg *)->sadb_msg_len =
 	    PFKEY_UNIT64(n->m_pkthdr.len);
 
 	return n;
 }
 
 /*
  * SADB_DELETE processing
  * receive
  *   <base, SA(*), address(SD)>
  * from the ikmpd, and set SADB_SASTATE_DEAD,
  * and send,
  *   <base, SA(*), address(SD)>
  * to the ikmpd.
  *
  * m will always be freed.
  */
 static int
 key_delete(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	struct secasindex saidx;
 	struct sadb_address *src0, *dst0;
 	struct secasvar *sav;
 	struct sadb_sa *sa0;
 	uint8_t proto;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	/* map satype to proto */
 	if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) {
 		ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]);
 	dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]);
 
 	if (key_checksockaddrs((struct sockaddr *)(src0 + 1),
 	    (struct sockaddr *)(dst0 + 1)) != 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
 		return (key_senderror(so, m, EINVAL));
 	}
 	KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx);
 	if (SADB_CHECKHDR(mhp, SADB_EXT_SA)) {
 		/*
 		 * Caller wants us to delete all non-LARVAL SAs
 		 * that match the src/dst.  This is used during
 		 * IKE INITIAL-CONTACT.
 		 * XXXAE: this looks like some extension to RFC2367.
 		 */
 		ipseclog((LOG_DEBUG, "%s: doing delete all.\n", __func__));
 		return (key_delete_all(so, m, mhp, &saidx));
 	}
 	if (SADB_CHECKLEN(mhp, SADB_EXT_SA)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: wrong header size.\n", __func__));
 		return (key_senderror(so, m, EINVAL));
 	}
 	sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA];
 	SPI_ALLOC_LOCK();
 	if (proto == IPPROTO_TCP)
 		sav = key_getsav_tcpmd5(&saidx, NULL);
 	else
 		sav = key_getsavbyspi(sa0->sadb_sa_spi);
 	SPI_ALLOC_UNLOCK();
 	if (sav == NULL) {
 		ipseclog((LOG_DEBUG, "%s: no SA found for SPI %u.\n",
 		    __func__, ntohl(sa0->sadb_sa_spi)));
 		return (key_senderror(so, m, ESRCH));
 	}
 	if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_HEAD) == 0) {
 		ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u.\n",
 		    __func__, ntohl(sav->spi)));
 		key_freesav(&sav);
 		return (key_senderror(so, m, ESRCH));
 	}
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SA(%p)\n", __func__, sav));
 	KEYDBG(KEY_DATA, kdebug_secasv(sav));
 	key_unlinksav(sav);
 	key_freesav(&sav);
 
     {
 	struct mbuf *n;
 	struct sadb_msg *newmsg;
 
 	/* create new sadb_msg to reply. */
 	n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED,
 	    SADB_EXT_SA, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
 	if (!n)
 		return key_senderror(so, m, ENOBUFS);
 
 	if (n->m_len < sizeof(struct sadb_msg)) {
 		n = m_pullup(n, sizeof(struct sadb_msg));
 		if (n == NULL)
 			return key_senderror(so, m, ENOBUFS);
 	}
 	newmsg = mtod(n, struct sadb_msg *);
 	newmsg->sadb_msg_errno = 0;
 	newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
 
 	m_freem(m);
 	return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
     }
 }
 
 /*
  * delete all SAs for src/dst.  Called from key_delete().
  */
 static int
 key_delete_all(struct socket *so, struct mbuf *m,
     const struct sadb_msghdr *mhp, struct secasindex *saidx)
 {
 	struct secasvar_queue drainq;
 	struct secashead *sah;
 	struct secasvar *sav, *nextsav;
 
 	TAILQ_INIT(&drainq);
 	SAHTREE_WLOCK();
 	LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) {
 		if (key_cmpsaidx(&sah->saidx, saidx, CMP_HEAD) == 0)
 			continue;
 		/* Move all ALIVE SAs into drainq */
 		TAILQ_CONCAT(&drainq, &sah->savtree_alive, chain);
 	}
 	/* Unlink all queued SAs from SPI hash */
 	TAILQ_FOREACH(sav, &drainq, chain) {
 		sav->state = SADB_SASTATE_DEAD;
 		LIST_REMOVE(sav, spihash);
 	}
 	SAHTREE_WUNLOCK();
 	/* Now we can release reference for all SAs in drainq */
 	sav = TAILQ_FIRST(&drainq);
 	while (sav != NULL) {
 		KEYDBG(KEY_STAMP,
 		    printf("%s: SA(%p)\n", __func__, sav));
 		KEYDBG(KEY_DATA, kdebug_secasv(sav));
 		nextsav = TAILQ_NEXT(sav, chain);
 		key_freesah(&sav->sah); /* release reference from SAV */
 		key_freesav(&sav); /* release last reference */
 		sav = nextsav;
 	}
 
     {
 	struct mbuf *n;
 	struct sadb_msg *newmsg;
 
 	/* create new sadb_msg to reply. */
 	n = key_gather_mbuf(m, mhp, 1, 3, SADB_EXT_RESERVED,
 	    SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
 	if (!n)
 		return key_senderror(so, m, ENOBUFS);
 
 	if (n->m_len < sizeof(struct sadb_msg)) {
 		n = m_pullup(n, sizeof(struct sadb_msg));
 		if (n == NULL)
 			return key_senderror(so, m, ENOBUFS);
 	}
 	newmsg = mtod(n, struct sadb_msg *);
 	newmsg->sadb_msg_errno = 0;
 	newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
 
 	m_freem(m);
 	return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
     }
 }
 
 /*
  * Delete all alive SAs for corresponding xform.
  * Larval SAs have not initialized tdb_xform, so it is safe to leave them
  * here when xform disappears.
  */
 void
 key_delete_xform(const struct xformsw *xsp)
 {
 	struct secasvar_queue drainq;
 	struct secashead *sah;
 	struct secasvar *sav, *nextsav;
 
 	TAILQ_INIT(&drainq);
 	SAHTREE_WLOCK();
 	TAILQ_FOREACH(sah, &V_sahtree, chain) {
 		sav = TAILQ_FIRST(&sah->savtree_alive);
 		if (sav == NULL)
 			continue;
 		if (sav->tdb_xform != xsp)
 			continue;
 		/*
 		 * It is supposed that all SAs in the chain are related to
 		 * one xform.
 		 */
 		TAILQ_CONCAT(&drainq, &sah->savtree_alive, chain);
 	}
 	/* Unlink all queued SAs from SPI hash */
 	TAILQ_FOREACH(sav, &drainq, chain) {
 		sav->state = SADB_SASTATE_DEAD;
 		LIST_REMOVE(sav, spihash);
 	}
 	SAHTREE_WUNLOCK();
 
 	/* Now we can release reference for all SAs in drainq */
 	sav = TAILQ_FIRST(&drainq);
 	while (sav != NULL) {
 		KEYDBG(KEY_STAMP,
 		    printf("%s: SA(%p)\n", __func__, sav));
 		KEYDBG(KEY_DATA, kdebug_secasv(sav));
 		nextsav = TAILQ_NEXT(sav, chain);
 		key_freesah(&sav->sah); /* release reference from SAV */
 		key_freesav(&sav); /* release last reference */
 		sav = nextsav;
 	}
 }
 
 /*
  * SADB_GET processing
  * receive
  *   <base, SA(*), address(SD)>
  * from the ikmpd, and get a SP and a SA to respond,
  * and send,
  *   <base, SA, (lifetime(HSC),) address(SD), (address(P),) key(AE),
  *       (identity(SD),) (sensitivity)>
  * to the ikmpd.
  *
  * m will always be freed.
  */
 static int
 key_get(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	struct secasindex saidx;
 	struct sadb_address *src0, *dst0;
 	struct sadb_sa *sa0;
 	struct secasvar *sav;
 	uint8_t proto;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	/* map satype to proto */
 	if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
 			__func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	if (SADB_CHECKHDR(mhp, SADB_EXT_SA) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: missing required header.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	if (SADB_CHECKLEN(mhp, SADB_EXT_SA) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: wrong header size.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA];
 	src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
 	dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
 
 	if (key_checksockaddrs((struct sockaddr *)(src0 + 1),
 	    (struct sockaddr *)(dst0 + 1)) != 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx);
 
 	SPI_ALLOC_LOCK();
 	if (proto == IPPROTO_TCP)
 		sav = key_getsav_tcpmd5(&saidx, NULL);
 	else
 		sav = key_getsavbyspi(sa0->sadb_sa_spi);
 	SPI_ALLOC_UNLOCK();
 	if (sav == NULL) {
 		ipseclog((LOG_DEBUG, "%s: no SA found.\n", __func__));
 		return key_senderror(so, m, ESRCH);
 	}
 	if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_HEAD) == 0) {
 		ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u.\n",
 		    __func__, ntohl(sa0->sadb_sa_spi)));
 		key_freesav(&sav);
 		return (key_senderror(so, m, ESRCH));
 	}
 
     {
 	struct mbuf *n;
 	uint8_t satype;
 
 	/* map proto to satype */
 	if ((satype = key_proto2satype(sav->sah->saidx.proto)) == 0) {
 		ipseclog((LOG_DEBUG, "%s: there was invalid proto in SAD.\n",
 		    __func__));
 		key_freesav(&sav);
 		return key_senderror(so, m, EINVAL);
 	}
 
 	/* create new sadb_msg to reply. */
 	n = key_setdumpsa(sav, SADB_GET, satype, mhp->msg->sadb_msg_seq,
 	    mhp->msg->sadb_msg_pid);
 
 	key_freesav(&sav);
 	if (!n)
 		return key_senderror(so, m, ENOBUFS);
 
 	m_freem(m);
 	return key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
     }
 }
 
 /* XXX make it sysctl-configurable? */
 static void
 key_getcomb_setlifetime(struct sadb_comb *comb)
 {
 
 	comb->sadb_comb_soft_allocations = 1;
 	comb->sadb_comb_hard_allocations = 1;
 	comb->sadb_comb_soft_bytes = 0;
 	comb->sadb_comb_hard_bytes = 0;
 	comb->sadb_comb_hard_addtime = 86400;	/* 1 day */
 	comb->sadb_comb_soft_addtime = comb->sadb_comb_soft_addtime * 80 / 100;
 	comb->sadb_comb_soft_usetime = 28800;	/* 8 hours */
 	comb->sadb_comb_hard_usetime = comb->sadb_comb_hard_usetime * 80 / 100;
 }
 
 /*
  * XXX reorder combinations by preference
  * XXX no idea if the user wants ESP authentication or not
  */
 static struct mbuf *
 key_getcomb_ealg(void)
 {
 	struct sadb_comb *comb;
 	const struct enc_xform *algo;
 	struct mbuf *result = NULL, *m, *n;
 	int encmin;
 	int i, off, o;
 	int totlen;
 	const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb));
 
 	m = NULL;
 	for (i = 1; i <= SADB_EALG_MAX; i++) {
 		algo = enc_algorithm_lookup(i);
 		if (algo == NULL)
 			continue;
 
 		/* discard algorithms with key size smaller than system min */
 		if (_BITS(algo->maxkey) < V_ipsec_esp_keymin)
 			continue;
 		if (_BITS(algo->minkey) < V_ipsec_esp_keymin)
 			encmin = V_ipsec_esp_keymin;
 		else
 			encmin = _BITS(algo->minkey);
 
 		if (V_ipsec_esp_auth)
 			m = key_getcomb_ah();
 		else {
 			IPSEC_ASSERT(l <= MLEN,
 				("l=%u > MLEN=%lu", l, (u_long) MLEN));
 			MGET(m, M_NOWAIT, MT_DATA);
 			if (m) {
 				M_ALIGN(m, l);
 				m->m_len = l;
 				m->m_next = NULL;
 				bzero(mtod(m, caddr_t), m->m_len);
 			}
 		}
 		if (!m)
 			goto fail;
 
 		totlen = 0;
 		for (n = m; n; n = n->m_next)
 			totlen += n->m_len;
 		IPSEC_ASSERT((totlen % l) == 0, ("totlen=%u, l=%u", totlen, l));
 
 		for (off = 0; off < totlen; off += l) {
 			n = m_pulldown(m, off, l, &o);
 			if (!n) {
 				/* m is already freed */
 				goto fail;
 			}
 			comb = (struct sadb_comb *)(mtod(n, caddr_t) + o);
 			bzero(comb, sizeof(*comb));
 			key_getcomb_setlifetime(comb);
 			comb->sadb_comb_encrypt = i;
 			comb->sadb_comb_encrypt_minbits = encmin;
 			comb->sadb_comb_encrypt_maxbits = _BITS(algo->maxkey);
 		}
 
 		if (!result)
 			result = m;
 		else
 			m_cat(result, m);
 	}
 
 	return result;
 
  fail:
 	if (result)
 		m_freem(result);
 	return NULL;
 }
 
 static void
 key_getsizes_ah(const struct auth_hash *ah, int alg, u_int16_t* min,
     u_int16_t* max)
 {
 
 	*min = *max = ah->hashsize;
 	if (ah->keysize == 0) {
 		/*
 		 * Transform takes arbitrary key size but algorithm
 		 * key size is restricted.  Enforce this here.
 		 */
 		switch (alg) {
 		case SADB_X_AALG_NULL:	*min = 1; *max = 256; break;
 		case SADB_X_AALG_SHA2_256: *min = *max = 32; break;
 		case SADB_X_AALG_SHA2_384: *min = *max = 48; break;
 		case SADB_X_AALG_SHA2_512: *min = *max = 64; break;
 		default:
 			DPRINTF(("%s: unknown AH algorithm %u\n",
 				__func__, alg));
 			break;
 		}
 	}
 }
 
 /*
  * XXX reorder combinations by preference
  */
 static struct mbuf *
 key_getcomb_ah(void)
 {
 	const struct auth_hash *algo;
 	struct sadb_comb *comb;
 	struct mbuf *m;
 	u_int16_t minkeysize, maxkeysize;
 	int i;
 	const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb));
 
 	m = NULL;
 	for (i = 1; i <= SADB_AALG_MAX; i++) {
 #if 1
 		/* we prefer HMAC algorithms, not old algorithms */
 		if (i != SADB_AALG_SHA1HMAC &&
 		    i != SADB_X_AALG_SHA2_256 &&
 		    i != SADB_X_AALG_SHA2_384 &&
 		    i != SADB_X_AALG_SHA2_512)
 			continue;
 #endif
 		algo = auth_algorithm_lookup(i);
 		if (!algo)
 			continue;
 		key_getsizes_ah(algo, i, &minkeysize, &maxkeysize);
 		/* discard algorithms with key size smaller than system min */
 		if (_BITS(minkeysize) < V_ipsec_ah_keymin)
 			continue;
 
 		if (!m) {
 			IPSEC_ASSERT(l <= MLEN,
 				("l=%u > MLEN=%lu", l, (u_long) MLEN));
 			MGET(m, M_NOWAIT, MT_DATA);
 			if (m) {
 				M_ALIGN(m, l);
 				m->m_len = l;
 				m->m_next = NULL;
 			}
 		} else
 			M_PREPEND(m, l, M_NOWAIT);
 		if (!m)
 			return NULL;
 
 		comb = mtod(m, struct sadb_comb *);
 		bzero(comb, sizeof(*comb));
 		key_getcomb_setlifetime(comb);
 		comb->sadb_comb_auth = i;
 		comb->sadb_comb_auth_minbits = _BITS(minkeysize);
 		comb->sadb_comb_auth_maxbits = _BITS(maxkeysize);
 	}
 
 	return m;
 }
 
 /*
  * not really an official behavior.  discussed in pf_key@inner.net in Sep2000.
  * XXX reorder combinations by preference
  */
 static struct mbuf *
 key_getcomb_ipcomp(void)
 {
 	const struct comp_algo *algo;
 	struct sadb_comb *comb;
 	struct mbuf *m;
 	int i;
 	const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb));
 
 	m = NULL;
 	for (i = 1; i <= SADB_X_CALG_MAX; i++) {
 		algo = comp_algorithm_lookup(i);
 		if (!algo)
 			continue;
 
 		if (!m) {
 			IPSEC_ASSERT(l <= MLEN,
 				("l=%u > MLEN=%lu", l, (u_long) MLEN));
 			MGET(m, M_NOWAIT, MT_DATA);
 			if (m) {
 				M_ALIGN(m, l);
 				m->m_len = l;
 				m->m_next = NULL;
 			}
 		} else
 			M_PREPEND(m, l, M_NOWAIT);
 		if (!m)
 			return NULL;
 
 		comb = mtod(m, struct sadb_comb *);
 		bzero(comb, sizeof(*comb));
 		key_getcomb_setlifetime(comb);
 		comb->sadb_comb_encrypt = i;
 		/* what should we set into sadb_comb_*_{min,max}bits? */
 	}
 
 	return m;
 }
 
 /*
  * XXX no way to pass mode (transport/tunnel) to userland
  * XXX replay checking?
  * XXX sysctl interface to ipsec_{ah,esp}_keymin
  */
 static struct mbuf *
 key_getprop(const struct secasindex *saidx)
 {
 	struct sadb_prop *prop;
 	struct mbuf *m, *n;
 	const int l = PFKEY_ALIGN8(sizeof(struct sadb_prop));
 	int totlen;
 
 	switch (saidx->proto)  {
 	case IPPROTO_ESP:
 		m = key_getcomb_ealg();
 		break;
 	case IPPROTO_AH:
 		m = key_getcomb_ah();
 		break;
 	case IPPROTO_IPCOMP:
 		m = key_getcomb_ipcomp();
 		break;
 	default:
 		return NULL;
 	}
 
 	if (!m)
 		return NULL;
 	M_PREPEND(m, l, M_NOWAIT);
 	if (!m)
 		return NULL;
 
 	totlen = 0;
 	for (n = m; n; n = n->m_next)
 		totlen += n->m_len;
 
 	prop = mtod(m, struct sadb_prop *);
 	bzero(prop, sizeof(*prop));
 	prop->sadb_prop_len = PFKEY_UNIT64(totlen);
 	prop->sadb_prop_exttype = SADB_EXT_PROPOSAL;
 	prop->sadb_prop_replay = 32;	/* XXX */
 
 	return m;
 }
 
 /*
  * SADB_ACQUIRE processing called by key_checkrequest() and key_acquire2().
  * send
  *   <base, SA, address(SD), (address(P)), x_policy,
  *       (identity(SD),) (sensitivity,) proposal>
  * to KMD, and expect to receive
  *   <base> with SADB_ACQUIRE if error occurred,
  * or
  *   <base, src address, dst address, (SPI range)> with SADB_GETSPI
  * from KMD by PF_KEY.
  *
  * XXX x_policy is outside of RFC2367 (KAME extension).
  * XXX sensitivity is not supported.
  * XXX for ipcomp, RFC2367 does not define how to fill in proposal.
  * see comment for key_getcomb_ipcomp().
  *
  * OUT:
  *    0     : succeed
  *    others: error number
  */
 static int
 key_acquire(const struct secasindex *saidx, struct secpolicy *sp)
 {
 	union sockaddr_union addr;
 	struct mbuf *result, *m;
 	uint32_t seq;
 	int error;
 	uint16_t ul_proto;
 	uint8_t mask, satype;
 
 	IPSEC_ASSERT(saidx != NULL, ("null saidx"));
 	satype = key_proto2satype(saidx->proto);
 	IPSEC_ASSERT(satype != 0, ("null satype, protocol %u", saidx->proto));
 
 	error = -1;
 	result = NULL;
 	ul_proto = IPSEC_ULPROTO_ANY;
 
 	/* Get seq number to check whether sending message or not. */
 	seq = key_getacq(saidx, &error);
 	if (seq == 0)
 		return (error);
 
 	m = key_setsadbmsg(SADB_ACQUIRE, 0, satype, seq, 0, 0);
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	result = m;
 
 	/*
 	 * set sadb_address for saidx's.
 	 *
 	 * Note that if sp is supplied, then we're being called from
 	 * key_allocsa_policy() and should supply port and protocol
 	 * information.
 	 * XXXAE: why only TCP and UDP? ICMP and SCTP looks applicable too.
 	 * XXXAE: probably we can handle this in the ipsec[46]_allocsa().
 	 * XXXAE: it looks like we should save this info in the ACQ entry.
 	 */
 	if (sp != NULL && (sp->spidx.ul_proto == IPPROTO_TCP ||
 	    sp->spidx.ul_proto == IPPROTO_UDP))
 		ul_proto = sp->spidx.ul_proto;
 
 	addr = saidx->src;
 	mask = FULLMASK;
 	if (ul_proto != IPSEC_ULPROTO_ANY) {
 		switch (sp->spidx.src.sa.sa_family) {
 		case AF_INET:
 			if (sp->spidx.src.sin.sin_port != IPSEC_PORT_ANY) {
 				addr.sin.sin_port = sp->spidx.src.sin.sin_port;
 				mask = sp->spidx.prefs;
 			}
 			break;
 		case AF_INET6:
 			if (sp->spidx.src.sin6.sin6_port != IPSEC_PORT_ANY) {
 				addr.sin6.sin6_port =
 				    sp->spidx.src.sin6.sin6_port;
 				mask = sp->spidx.prefs;
 			}
 			break;
 		default:
 			break;
 		}
 	}
 	m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, &addr.sa, mask, ul_proto);
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	m_cat(result, m);
 
 	addr = saidx->dst;
 	mask = FULLMASK;
 	if (ul_proto != IPSEC_ULPROTO_ANY) {
 		switch (sp->spidx.dst.sa.sa_family) {
 		case AF_INET:
 			if (sp->spidx.dst.sin.sin_port != IPSEC_PORT_ANY) {
 				addr.sin.sin_port = sp->spidx.dst.sin.sin_port;
 				mask = sp->spidx.prefd;
 			}
 			break;
 		case AF_INET6:
 			if (sp->spidx.dst.sin6.sin6_port != IPSEC_PORT_ANY) {
 				addr.sin6.sin6_port =
 				    sp->spidx.dst.sin6.sin6_port;
 				mask = sp->spidx.prefd;
 			}
 			break;
 		default:
 			break;
 		}
 	}
 	m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, &addr.sa, mask, ul_proto);
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	m_cat(result, m);
 
 	/* XXX proxy address (optional) */
 
 	/*
 	 * Set sadb_x_policy. This is KAME extension to RFC2367.
 	 */
 	if (sp != NULL) {
 		m = key_setsadbxpolicy(sp->policy, sp->spidx.dir, sp->id,
 		    sp->priority);
 		if (!m) {
 			error = ENOBUFS;
 			goto fail;
 		}
 		m_cat(result, m);
 	}
 
 	/*
 	 * Set sadb_x_sa2 extension if saidx->reqid is not zero.
 	 * This is FreeBSD extension to RFC2367.
 	 */
 	if (saidx->reqid != 0) {
 		m = key_setsadbxsa2(saidx->mode, 0, saidx->reqid);
 		if (m == NULL) {
 			error = ENOBUFS;
 			goto fail;
 		}
 		m_cat(result, m);
 	}
 	/* XXX identity (optional) */
 #if 0
 	if (idexttype && fqdn) {
 		/* create identity extension (FQDN) */
 		struct sadb_ident *id;
 		int fqdnlen;
 
 		fqdnlen = strlen(fqdn) + 1;	/* +1 for terminating-NUL */
 		id = (struct sadb_ident *)p;
 		bzero(id, sizeof(*id) + PFKEY_ALIGN8(fqdnlen));
 		id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(fqdnlen));
 		id->sadb_ident_exttype = idexttype;
 		id->sadb_ident_type = SADB_IDENTTYPE_FQDN;
 		bcopy(fqdn, id + 1, fqdnlen);
 		p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(fqdnlen);
 	}
 
 	if (idexttype) {
 		/* create identity extension (USERFQDN) */
 		struct sadb_ident *id;
 		int userfqdnlen;
 
 		if (userfqdn) {
 			/* +1 for terminating-NUL */
 			userfqdnlen = strlen(userfqdn) + 1;
 		} else
 			userfqdnlen = 0;
 		id = (struct sadb_ident *)p;
 		bzero(id, sizeof(*id) + PFKEY_ALIGN8(userfqdnlen));
 		id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(userfqdnlen));
 		id->sadb_ident_exttype = idexttype;
 		id->sadb_ident_type = SADB_IDENTTYPE_USERFQDN;
 		/* XXX is it correct? */
 		if (curproc && curproc->p_cred)
 			id->sadb_ident_id = curproc->p_cred->p_ruid;
 		if (userfqdn && userfqdnlen)
 			bcopy(userfqdn, id + 1, userfqdnlen);
 		p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(userfqdnlen);
 	}
 #endif
 
 	/* XXX sensitivity (optional) */
 
 	/* create proposal/combination extension */
 	m = key_getprop(saidx);
 #if 0
 	/*
 	 * spec conformant: always attach proposal/combination extension,
 	 * the problem is that we have no way to attach it for ipcomp,
 	 * due to the way sadb_comb is declared in RFC2367.
 	 */
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	m_cat(result, m);
 #else
 	/*
 	 * outside of spec; make proposal/combination extension optional.
 	 */
 	if (m)
 		m_cat(result, m);
 #endif
 
 	if ((result->m_flags & M_PKTHDR) == 0) {
 		error = EINVAL;
 		goto fail;
 	}
 
 	if (result->m_len < sizeof(struct sadb_msg)) {
 		result = m_pullup(result, sizeof(struct sadb_msg));
 		if (result == NULL) {
 			error = ENOBUFS;
 			goto fail;
 		}
 	}
 
 	result->m_pkthdr.len = 0;
 	for (m = result; m; m = m->m_next)
 		result->m_pkthdr.len += m->m_len;
 
 	mtod(result, struct sadb_msg *)->sadb_msg_len =
 	    PFKEY_UNIT64(result->m_pkthdr.len);
 
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SP(%p)\n", __func__, sp));
 	KEYDBG(KEY_DATA, kdebug_secasindex(saidx, NULL));
 
 	return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED);
 
  fail:
 	if (result)
 		m_freem(result);
 	return error;
 }
 
 static uint32_t
 key_newacq(const struct secasindex *saidx, int *perror)
 {
 	struct secacq *acq;
 	uint32_t seq;
 
 	acq = malloc(sizeof(*acq), M_IPSEC_SAQ, M_NOWAIT | M_ZERO);
 	if (acq == NULL) {
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		*perror = ENOBUFS;
 		return (0);
 	}
 
 	/* copy secindex */
 	bcopy(saidx, &acq->saidx, sizeof(acq->saidx));
 	acq->created = time_second;
 	acq->count = 0;
 
 	/* add to acqtree */
 	ACQ_LOCK();
 	seq = acq->seq = (V_acq_seq == ~0 ? 1 : ++V_acq_seq);
 	LIST_INSERT_HEAD(&V_acqtree, acq, chain);
 	LIST_INSERT_HEAD(ACQADDRHASH_HASH(saidx), acq, addrhash);
 	LIST_INSERT_HEAD(ACQSEQHASH_HASH(seq), acq, seqhash);
 	ACQ_UNLOCK();
 	*perror = 0;
 	return (seq);
 }
 
 static uint32_t
 key_getacq(const struct secasindex *saidx, int *perror)
 {
 	struct secacq *acq;
 	uint32_t seq;
 
 	ACQ_LOCK();
 	LIST_FOREACH(acq, ACQADDRHASH_HASH(saidx), addrhash) {
 		if (key_cmpsaidx(&acq->saidx, saidx, CMP_EXACTLY)) {
 			if (acq->count > V_key_blockacq_count) {
 				/*
 				 * Reset counter and send message.
 				 * Also reset created time to keep ACQ for
 				 * this saidx.
 				 */
 				acq->created = time_second;
 				acq->count = 0;
 				seq = acq->seq;
 			} else {
 				/*
 				 * Increment counter and do nothing.
 				 * We send SADB_ACQUIRE message only
 				 * for each V_key_blockacq_count packet.
 				 */
 				acq->count++;
 				seq = 0;
 			}
 			break;
 		}
 	}
 	ACQ_UNLOCK();
 	if (acq != NULL) {
 		*perror = 0;
 		return (seq);
 	}
 	/* allocate new  entry */
 	return (key_newacq(saidx, perror));
 }
 
 static int
 key_acqreset(uint32_t seq)
 {
 	struct secacq *acq;
 
 	ACQ_LOCK();
 	LIST_FOREACH(acq, ACQSEQHASH_HASH(seq), seqhash) {
 		if (acq->seq == seq) {
 			acq->count = 0;
 			acq->created = time_second;
 			break;
 		}
 	}
 	ACQ_UNLOCK();
 	if (acq == NULL)
 		return (ESRCH);
 	return (0);
 }
 /*
  * Mark ACQ entry as stale to remove it in key_flush_acq().
  * Called after successful SADB_GETSPI message.
  */
 static int
 key_acqdone(const struct secasindex *saidx, uint32_t seq)
 {
 	struct secacq *acq;
 
 	ACQ_LOCK();
 	LIST_FOREACH(acq, ACQSEQHASH_HASH(seq), seqhash) {
 		if (acq->seq == seq)
 			break;
 	}
 	if (acq != NULL) {
 		if (key_cmpsaidx(&acq->saidx, saidx, CMP_EXACTLY) == 0) {
 			ipseclog((LOG_DEBUG,
 			    "%s: Mismatched saidx for ACQ %u\n", __func__, seq));
 			acq = NULL;
 		} else {
 			acq->created = 0;
 		}
 	} else {
 		ipseclog((LOG_DEBUG,
 		    "%s: ACQ %u is not found.\n", __func__, seq));
 	}
 	ACQ_UNLOCK();
 	if (acq == NULL)
 		return (ESRCH);
 	return (0);
 }
 
 static struct secspacq *
 key_newspacq(struct secpolicyindex *spidx)
 {
 	struct secspacq *acq;
 
 	/* get new entry */
 	acq = malloc(sizeof(struct secspacq), M_IPSEC_SAQ, M_NOWAIT|M_ZERO);
 	if (acq == NULL) {
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return NULL;
 	}
 
 	/* copy secindex */
 	bcopy(spidx, &acq->spidx, sizeof(acq->spidx));
 	acq->created = time_second;
 	acq->count = 0;
 
 	/* add to spacqtree */
 	SPACQ_LOCK();
 	LIST_INSERT_HEAD(&V_spacqtree, acq, chain);
 	SPACQ_UNLOCK();
 
 	return acq;
 }
 
 static struct secspacq *
 key_getspacq(struct secpolicyindex *spidx)
 {
 	struct secspacq *acq;
 
 	SPACQ_LOCK();
 	LIST_FOREACH(acq, &V_spacqtree, chain) {
 		if (key_cmpspidx_exactly(spidx, &acq->spidx)) {
 			/* NB: return holding spacq_lock */
 			return acq;
 		}
 	}
 	SPACQ_UNLOCK();
 
 	return NULL;
 }
 
 /*
  * SADB_ACQUIRE processing,
  * in first situation, is receiving
  *   <base>
  * from the ikmpd, and clear sequence of its secasvar entry.
  *
  * In second situation, is receiving
  *   <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal>
  * from a user land process, and return
  *   <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal>
  * to the socket.
  *
  * m will always be freed.
  */
 static int
 key_acquire2(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	SAHTREE_RLOCK_TRACKER;
 	struct sadb_address *src0, *dst0;
 	struct secasindex saidx;
 	struct secashead *sah;
 	uint32_t reqid;
 	int error;
 	uint8_t mode, proto;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	/*
 	 * Error message from KMd.
 	 * We assume that if error was occurred in IKEd, the length of PFKEY
 	 * message is equal to the size of sadb_msg structure.
 	 * We do not raise error even if error occurred in this function.
 	 */
 	if (mhp->msg->sadb_msg_len == PFKEY_UNIT64(sizeof(struct sadb_msg))) {
 		/* check sequence number */
 		if (mhp->msg->sadb_msg_seq == 0 ||
 		    mhp->msg->sadb_msg_errno == 0) {
 			ipseclog((LOG_DEBUG, "%s: must specify sequence "
 				"number and errno.\n", __func__));
 		} else {
 			/*
 			 * IKEd reported that error occurred.
 			 * XXXAE: what it expects from the kernel?
 			 * Probably we should send SADB_ACQUIRE again?
 			 * If so, reset ACQ's state.
 			 * XXXAE: it looks useless.
 			 */
 			key_acqreset(mhp->msg->sadb_msg_seq);
 		}
 		m_freem(m);
 		return (0);
 	}
 
 	/*
 	 * This message is from user land.
 	 */
 
 	/* map satype to proto */
 	if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
 	    SADB_CHECKHDR(mhp, SADB_EXT_PROPOSAL)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: missing required header.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) ||
 	    SADB_CHECKLEN(mhp, SADB_EXT_PROPOSAL)) {
 		ipseclog((LOG_DEBUG,
 		    "%s: invalid message: wrong header size.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) {
 		mode = IPSEC_MODE_ANY;
 		reqid = 0;
 	} else {
 		if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) {
 			ipseclog((LOG_DEBUG,
 			    "%s: invalid message: wrong header size.\n",
 			    __func__));
 			return key_senderror(so, m, EINVAL);
 		}
 		mode = ((struct sadb_x_sa2 *)
 		    mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode;
 		reqid = ((struct sadb_x_sa2 *)
 		    mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid;
 	}
 
 	src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
 	dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
 
 	error = key_checksockaddrs((struct sockaddr *)(src0 + 1),
 	    (struct sockaddr *)(dst0 + 1));
 	if (error != 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
 
 	/* get a SA index */
 	SAHTREE_RLOCK();
 	LIST_FOREACH(sah, SAHADDRHASH_HASH(&saidx), addrhash) {
 		if (key_cmpsaidx(&sah->saidx, &saidx, CMP_MODE_REQID))
 			break;
 	}
 	SAHTREE_RUNLOCK();
 	if (sah != NULL) {
 		ipseclog((LOG_DEBUG, "%s: a SA exists already.\n", __func__));
 		return key_senderror(so, m, EEXIST);
 	}
 
 	error = key_acquire(&saidx, NULL);
 	if (error != 0) {
 		ipseclog((LOG_DEBUG,
 		    "%s: error %d returned from key_acquire()\n",
 			__func__, error));
 		return key_senderror(so, m, error);
 	}
 	m_freem(m);
 	return (0);
 }
 
 /*
  * SADB_REGISTER processing.
  * If SATYPE_UNSPEC has been passed as satype, only return sabd_supported.
  * receive
  *   <base>
  * from the ikmpd, and register a socket to send PF_KEY messages,
  * and send
  *   <base, supported>
  * to KMD by PF_KEY.
  * If socket is detached, must free from regnode.
  *
  * m will always be freed.
  */
 static int
 key_register(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	struct secreg *reg, *newreg = NULL;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	/* check for invalid register message */
 	if (mhp->msg->sadb_msg_satype >= sizeof(V_regtree)/sizeof(V_regtree[0]))
 		return key_senderror(so, m, EINVAL);
 
 	/* When SATYPE_UNSPEC is specified, only return sabd_supported. */
 	if (mhp->msg->sadb_msg_satype == SADB_SATYPE_UNSPEC)
 		goto setmsg;
 
 	/* check whether existing or not */
 	REGTREE_LOCK();
 	LIST_FOREACH(reg, &V_regtree[mhp->msg->sadb_msg_satype], chain) {
 		if (reg->so == so) {
 			REGTREE_UNLOCK();
 			ipseclog((LOG_DEBUG, "%s: socket exists already.\n",
 				__func__));
 			return key_senderror(so, m, EEXIST);
 		}
 	}
 
 	/* create regnode */
 	newreg =  malloc(sizeof(struct secreg), M_IPSEC_SAR, M_NOWAIT|M_ZERO);
 	if (newreg == NULL) {
 		REGTREE_UNLOCK();
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return key_senderror(so, m, ENOBUFS);
 	}
 
 	newreg->so = so;
 	((struct keycb *)(so->so_pcb))->kp_registered++;
 
 	/* add regnode to regtree. */
 	LIST_INSERT_HEAD(&V_regtree[mhp->msg->sadb_msg_satype], newreg, chain);
 	REGTREE_UNLOCK();
 
   setmsg:
     {
 	struct mbuf *n;
 	struct sadb_msg *newmsg;
 	struct sadb_supported *sup;
 	u_int len, alen, elen;
 	int off;
 	int i;
 	struct sadb_alg *alg;
 
 	/* create new sadb_msg to reply. */
 	alen = 0;
 	for (i = 1; i <= SADB_AALG_MAX; i++) {
 		if (auth_algorithm_lookup(i))
 			alen += sizeof(struct sadb_alg);
 	}
 	if (alen)
 		alen += sizeof(struct sadb_supported);
 	elen = 0;
 	for (i = 1; i <= SADB_EALG_MAX; i++) {
 		if (enc_algorithm_lookup(i))
 			elen += sizeof(struct sadb_alg);
 	}
 	if (elen)
 		elen += sizeof(struct sadb_supported);
 
 	len = sizeof(struct sadb_msg) + alen + elen;
 
 	if (len > MCLBYTES)
 		return key_senderror(so, m, ENOBUFS);
 
 	n = key_mget(len);
 	if (n == NULL)
 		return key_senderror(so, m, ENOBUFS);
 
 	n->m_pkthdr.len = n->m_len = len;
 	n->m_next = NULL;
 	off = 0;
 
 	m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off);
 	newmsg = mtod(n, struct sadb_msg *);
 	newmsg->sadb_msg_errno = 0;
 	newmsg->sadb_msg_len = PFKEY_UNIT64(len);
 	off += PFKEY_ALIGN8(sizeof(struct sadb_msg));
 
 	/* for authentication algorithm */
 	if (alen) {
 		sup = (struct sadb_supported *)(mtod(n, caddr_t) + off);
 		sup->sadb_supported_len = PFKEY_UNIT64(alen);
 		sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH;
 		off += PFKEY_ALIGN8(sizeof(*sup));
 
 		for (i = 1; i <= SADB_AALG_MAX; i++) {
 			const struct auth_hash *aalgo;
 			u_int16_t minkeysize, maxkeysize;
 
 			aalgo = auth_algorithm_lookup(i);
 			if (!aalgo)
 				continue;
 			alg = (struct sadb_alg *)(mtod(n, caddr_t) + off);
 			alg->sadb_alg_id = i;
 			alg->sadb_alg_ivlen = 0;
 			key_getsizes_ah(aalgo, i, &minkeysize, &maxkeysize);
 			alg->sadb_alg_minbits = _BITS(minkeysize);
 			alg->sadb_alg_maxbits = _BITS(maxkeysize);
 			off += PFKEY_ALIGN8(sizeof(*alg));
 		}
 	}
 
 	/* for encryption algorithm */
 	if (elen) {
 		sup = (struct sadb_supported *)(mtod(n, caddr_t) + off);
 		sup->sadb_supported_len = PFKEY_UNIT64(elen);
 		sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT;
 		off += PFKEY_ALIGN8(sizeof(*sup));
 
 		for (i = 1; i <= SADB_EALG_MAX; i++) {
 			const struct enc_xform *ealgo;
 
 			ealgo = enc_algorithm_lookup(i);
 			if (!ealgo)
 				continue;
 			alg = (struct sadb_alg *)(mtod(n, caddr_t) + off);
 			alg->sadb_alg_id = i;
 			alg->sadb_alg_ivlen = ealgo->ivsize;
 			alg->sadb_alg_minbits = _BITS(ealgo->minkey);
 			alg->sadb_alg_maxbits = _BITS(ealgo->maxkey);
 			off += PFKEY_ALIGN8(sizeof(struct sadb_alg));
 		}
 	}
 
 	IPSEC_ASSERT(off == len,
 		("length assumption failed (off %u len %u)", off, len));
 
 	m_freem(m);
 	return key_sendup_mbuf(so, n, KEY_SENDUP_REGISTERED);
     }
 }
 
 /*
  * free secreg entry registered.
  * XXX: I want to do free a socket marked done SADB_RESIGER to socket.
  */
 void
 key_freereg(struct socket *so)
 {
 	struct secreg *reg;
 	int i;
 
 	IPSEC_ASSERT(so != NULL, ("NULL so"));
 
 	/*
 	 * check whether existing or not.
 	 * check all type of SA, because there is a potential that
 	 * one socket is registered to multiple type of SA.
 	 */
 	REGTREE_LOCK();
 	for (i = 0; i <= SADB_SATYPE_MAX; i++) {
 		LIST_FOREACH(reg, &V_regtree[i], chain) {
 			if (reg->so == so && __LIST_CHAINED(reg)) {
 				LIST_REMOVE(reg, chain);
 				free(reg, M_IPSEC_SAR);
 				break;
 			}
 		}
 	}
 	REGTREE_UNLOCK();
 }
 
 /*
  * SADB_EXPIRE processing
  * send
  *   <base, SA, SA2, lifetime(C and one of HS), address(SD)>
  * to KMD by PF_KEY.
  * NOTE: We send only soft lifetime extension.
  *
  * OUT:	0	: succeed
  *	others	: error number
  */
 static int
 key_expire(struct secasvar *sav, int hard)
 {
 	struct mbuf *result = NULL, *m;
 	struct sadb_lifetime *lt;
 	uint32_t replay_count;
 	int error, len;
 	uint8_t satype;
 
 	SECASVAR_RLOCK_TRACKER;
 
 	IPSEC_ASSERT (sav != NULL, ("null sav"));
 	IPSEC_ASSERT (sav->sah != NULL, ("null sa header"));
 
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SA(%p) expired %s lifetime\n", __func__,
 		sav, hard ? "hard": "soft"));
 	KEYDBG(KEY_DATA, kdebug_secasv(sav));
 	/* set msg header */
 	satype = key_proto2satype(sav->sah->saidx.proto);
 	IPSEC_ASSERT(satype != 0, ("invalid proto, satype %u", satype));
 	m = key_setsadbmsg(SADB_EXPIRE, 0, satype, sav->seq, 0, sav->refcnt);
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	result = m;
 
 	/* create SA extension */
 	m = key_setsadbsa(sav);
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	m_cat(result, m);
 
 	/* create SA extension */
 	SECASVAR_RLOCK(sav);
 	replay_count = sav->replay ? sav->replay->count : 0;
 	SECASVAR_RUNLOCK(sav);
 
 	m = key_setsadbxsa2(sav->sah->saidx.mode, replay_count,
 			sav->sah->saidx.reqid);
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	m_cat(result, m);
 
 	if (sav->replay && sav->replay->wsize > UINT8_MAX) {
 		m = key_setsadbxsareplay(sav->replay->wsize);
 		if (!m) {
 			error = ENOBUFS;
 			goto fail;
 		}
 		m_cat(result, m);
 	}
 
 	/* create lifetime extension (current and soft) */
 	len = PFKEY_ALIGN8(sizeof(*lt)) * 2;
 	m = m_get2(len, M_NOWAIT, MT_DATA, 0);
 	if (m == NULL) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	m_align(m, len);
 	m->m_len = len;
 	bzero(mtod(m, caddr_t), len);
 	lt = mtod(m, struct sadb_lifetime *);
 	lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime));
 	lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
 	lt->sadb_lifetime_allocations =
 	    (uint32_t)counter_u64_fetch(sav->lft_c_allocations);
 	lt->sadb_lifetime_bytes =
 	    counter_u64_fetch(sav->lft_c_bytes);
 	lt->sadb_lifetime_addtime = sav->created;
 	lt->sadb_lifetime_usetime = sav->firstused;
 	lt = (struct sadb_lifetime *)(mtod(m, caddr_t) + len / 2);
 	lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime));
 	if (hard) {
 		lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
 		lt->sadb_lifetime_allocations = sav->lft_h->allocations;
 		lt->sadb_lifetime_bytes = sav->lft_h->bytes;
 		lt->sadb_lifetime_addtime = sav->lft_h->addtime;
 		lt->sadb_lifetime_usetime = sav->lft_h->usetime;
 	} else {
 		lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
 		lt->sadb_lifetime_allocations = sav->lft_s->allocations;
 		lt->sadb_lifetime_bytes = sav->lft_s->bytes;
 		lt->sadb_lifetime_addtime = sav->lft_s->addtime;
 		lt->sadb_lifetime_usetime = sav->lft_s->usetime;
 	}
 	m_cat(result, m);
 
 	/* set sadb_address for source */
 	m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC,
 	    &sav->sah->saidx.src.sa,
 	    FULLMASK, IPSEC_ULPROTO_ANY);
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	m_cat(result, m);
 
 	/* set sadb_address for destination */
 	m = key_setsadbaddr(SADB_EXT_ADDRESS_DST,
 	    &sav->sah->saidx.dst.sa,
 	    FULLMASK, IPSEC_ULPROTO_ANY);
 	if (!m) {
 		error = ENOBUFS;
 		goto fail;
 	}
 	m_cat(result, m);
 
 	/*
 	 * XXX-BZ Handle NAT-T extensions here.
 	 * XXXAE: it doesn't seem quite useful. IKEs should not depend on
 	 * this information, we report only significant SA fields.
 	 */
 
 	if ((result->m_flags & M_PKTHDR) == 0) {
 		error = EINVAL;
 		goto fail;
 	}
 
 	if (result->m_len < sizeof(struct sadb_msg)) {
 		result = m_pullup(result, sizeof(struct sadb_msg));
 		if (result == NULL) {
 			error = ENOBUFS;
 			goto fail;
 		}
 	}
 
 	result->m_pkthdr.len = 0;
 	for (m = result; m; m = m->m_next)
 		result->m_pkthdr.len += m->m_len;
 
 	mtod(result, struct sadb_msg *)->sadb_msg_len =
 	    PFKEY_UNIT64(result->m_pkthdr.len);
 
 	return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED);
 
  fail:
 	if (result)
 		m_freem(result);
 	return error;
 }
 
 static void
 key_freesah_flushed(struct secashead_queue *flushq)
 {
 	struct secashead *sah, *nextsah;
 	struct secasvar *sav, *nextsav;
 
 	sah = TAILQ_FIRST(flushq);
 	while (sah != NULL) {
 		sav = TAILQ_FIRST(&sah->savtree_larval);
 		while (sav != NULL) {
 			nextsav = TAILQ_NEXT(sav, chain);
 			TAILQ_REMOVE(&sah->savtree_larval, sav, chain);
 			key_freesav(&sav); /* release last reference */
 			key_freesah(&sah); /* release reference from SAV */
 			sav = nextsav;
 		}
 		sav = TAILQ_FIRST(&sah->savtree_alive);
 		while (sav != NULL) {
 			nextsav = TAILQ_NEXT(sav, chain);
 			TAILQ_REMOVE(&sah->savtree_alive, sav, chain);
 			key_freesav(&sav); /* release last reference */
 			key_freesah(&sah); /* release reference from SAV */
 			sav = nextsav;
 		}
 		nextsah = TAILQ_NEXT(sah, chain);
 		key_freesah(&sah);	/* release last reference */
 		sah = nextsah;
 	}
 }
 
 /*
  * SADB_FLUSH processing
  * receive
  *   <base>
  * from the ikmpd, and free all entries in secastree.
  * and send,
  *   <base>
  * to the ikmpd.
  * NOTE: to do is only marking SADB_SASTATE_DEAD.
  *
  * m will always be freed.
  */
 static int
 key_flush(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	struct secashead_queue flushq;
 	struct sadb_msg *newmsg;
 	struct secashead *sah, *nextsah;
 	struct secasvar *sav;
 	uint8_t proto;
 	int i;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	/* map satype to proto */
 	if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
 			__func__));
 		return key_senderror(so, m, EINVAL);
 	}
 	KEYDBG(KEY_STAMP,
 	    printf("%s: proto %u\n", __func__, proto));
 
 	TAILQ_INIT(&flushq);
 	if (proto == IPSEC_PROTO_ANY) {
 		/* no SATYPE specified, i.e. flushing all SA. */
 		SAHTREE_WLOCK();
 		/* Move all SAHs into flushq */
 		TAILQ_CONCAT(&flushq, &V_sahtree, chain);
 		/* Flush all buckets in SPI hash */
 		for (i = 0; i < V_savhash_mask + 1; i++)
 			LIST_INIT(&V_savhashtbl[i]);
 		/* Flush all buckets in SAHADDRHASH */
 		for (i = 0; i < V_sahaddrhash_mask + 1; i++)
 			LIST_INIT(&V_sahaddrhashtbl[i]);
 		/* Mark all SAHs as unlinked */
 		TAILQ_FOREACH(sah, &flushq, chain) {
 			sah->state = SADB_SASTATE_DEAD;
 			/*
 			 * Callout handler makes its job using
 			 * RLOCK and drain queues. In case, when this
 			 * function will be called just before it
 			 * acquires WLOCK, we need to mark SAs as
 			 * unlinked to prevent second unlink.
 			 */
 			TAILQ_FOREACH(sav, &sah->savtree_larval, chain) {
 				sav->state = SADB_SASTATE_DEAD;
 			}
 			TAILQ_FOREACH(sav, &sah->savtree_alive, chain) {
 				sav->state = SADB_SASTATE_DEAD;
 			}
 		}
 		SAHTREE_WUNLOCK();
 	} else {
 		SAHTREE_WLOCK();
 		sah = TAILQ_FIRST(&V_sahtree);
 		while (sah != NULL) {
 			IPSEC_ASSERT(sah->state != SADB_SASTATE_DEAD,
 			    ("DEAD SAH %p in SADB_FLUSH", sah));
 			nextsah = TAILQ_NEXT(sah, chain);
 			if (sah->saidx.proto != proto) {
 				sah = nextsah;
 				continue;
 			}
 			sah->state = SADB_SASTATE_DEAD;
 			TAILQ_REMOVE(&V_sahtree, sah, chain);
 			LIST_REMOVE(sah, addrhash);
 			/* Unlink all SAs from SPI hash */
 			TAILQ_FOREACH(sav, &sah->savtree_larval, chain) {
 				LIST_REMOVE(sav, spihash);
 				sav->state = SADB_SASTATE_DEAD;
 			}
 			TAILQ_FOREACH(sav, &sah->savtree_alive, chain) {
 				LIST_REMOVE(sav, spihash);
 				sav->state = SADB_SASTATE_DEAD;
 			}
 			/* Add SAH into flushq */
 			TAILQ_INSERT_HEAD(&flushq, sah, chain);
 			sah = nextsah;
 		}
 		SAHTREE_WUNLOCK();
 	}
 
 	key_freesah_flushed(&flushq);
 	/* Free all queued SAs and SAHs */
 	if (m->m_len < sizeof(struct sadb_msg) ||
 	    sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) {
 		ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
 		return key_senderror(so, m, ENOBUFS);
 	}
 
 	if (m->m_next)
 		m_freem(m->m_next);
 	m->m_next = NULL;
 	m->m_pkthdr.len = m->m_len = sizeof(struct sadb_msg);
 	newmsg = mtod(m, struct sadb_msg *);
 	newmsg->sadb_msg_errno = 0;
 	newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len);
 
 	return key_sendup_mbuf(so, m, KEY_SENDUP_ALL);
 }
 
 /*
  * SADB_DUMP processing
  * dump all entries including status of DEAD in SAD.
  * receive
  *   <base>
  * from the ikmpd, and dump all secasvar leaves
  * and send,
  *   <base> .....
  * to the ikmpd.
  *
  * m will always be freed.
  */
 static int
 key_dump(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	SAHTREE_RLOCK_TRACKER;
 	struct secashead *sah;
 	struct secasvar *sav;
 	struct mbuf *n;
 	uint32_t cnt;
 	uint8_t proto, satype;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	/* map satype to proto */
 	if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
 		ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
 		    __func__));
 		return key_senderror(so, m, EINVAL);
 	}
 
 	/* count sav entries to be sent to the userland. */
 	cnt = 0;
 	SAHTREE_RLOCK();
 	TAILQ_FOREACH(sah, &V_sahtree, chain) {
 		if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC &&
 		    proto != sah->saidx.proto)
 			continue;
 
 		TAILQ_FOREACH(sav, &sah->savtree_larval, chain)
 			cnt++;
 		TAILQ_FOREACH(sav, &sah->savtree_alive, chain)
 			cnt++;
 	}
 
 	if (cnt == 0) {
 		SAHTREE_RUNLOCK();
 		return key_senderror(so, m, ENOENT);
 	}
 
 	/* send this to the userland, one at a time. */
 	TAILQ_FOREACH(sah, &V_sahtree, chain) {
 		if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC &&
 		    proto != sah->saidx.proto)
 			continue;
 
 		/* map proto to satype */
 		if ((satype = key_proto2satype(sah->saidx.proto)) == 0) {
 			SAHTREE_RUNLOCK();
 			ipseclog((LOG_DEBUG, "%s: there was invalid proto in "
 			    "SAD.\n", __func__));
 			return key_senderror(so, m, EINVAL);
 		}
 		TAILQ_FOREACH(sav, &sah->savtree_larval, chain) {
 			n = key_setdumpsa(sav, SADB_DUMP, satype,
 			    --cnt, mhp->msg->sadb_msg_pid);
 			if (n == NULL) {
 				SAHTREE_RUNLOCK();
 				return key_senderror(so, m, ENOBUFS);
 			}
 			key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
 		}
 		TAILQ_FOREACH(sav, &sah->savtree_alive, chain) {
 			n = key_setdumpsa(sav, SADB_DUMP, satype,
 			    --cnt, mhp->msg->sadb_msg_pid);
 			if (n == NULL) {
 				SAHTREE_RUNLOCK();
 				return key_senderror(so, m, ENOBUFS);
 			}
 			key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
 		}
 	}
 	SAHTREE_RUNLOCK();
 	m_freem(m);
 	return (0);
 }
 /*
  * SADB_X_PROMISC processing
  *
  * m will always be freed.
  */
 static int
 key_promisc(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
 {
 	int olen;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
 
 	olen = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len);
 
 	if (olen < sizeof(struct sadb_msg)) {
 #if 1
 		return key_senderror(so, m, EINVAL);
 #else
 		m_freem(m);
 		return 0;
 #endif
 	} else if (olen == sizeof(struct sadb_msg)) {
 		/* enable/disable promisc mode */
 		struct keycb *kp;
 
 		if ((kp = so->so_pcb) == NULL)
 			return key_senderror(so, m, EINVAL);
 		mhp->msg->sadb_msg_errno = 0;
 		switch (mhp->msg->sadb_msg_satype) {
 		case 0:
 		case 1:
 			kp->kp_promisc = mhp->msg->sadb_msg_satype;
 			break;
 		default:
 			return key_senderror(so, m, EINVAL);
 		}
 
 		/* send the original message back to everyone */
 		mhp->msg->sadb_msg_errno = 0;
 		return key_sendup_mbuf(so, m, KEY_SENDUP_ALL);
 	} else {
 		/* send packet as is */
 
 		m_adj(m, PFKEY_ALIGN8(sizeof(struct sadb_msg)));
 
 		/* TODO: if sadb_msg_seq is specified, send to specific pid */
 		return key_sendup_mbuf(so, m, KEY_SENDUP_ALL);
 	}
 }
 
 static int (*key_typesw[])(struct socket *, struct mbuf *,
     const struct sadb_msghdr *) = {
 	[SADB_RESERVED] =	NULL,
 	[SADB_GETSPI] =		key_getspi,
 	[SADB_UPDATE] =		key_update,
 	[SADB_ADD] =		key_add,
 	[SADB_DELETE] =		key_delete,
 	[SADB_GET] =		key_get,
 	[SADB_ACQUIRE] =	key_acquire2,
 	[SADB_REGISTER] =	key_register,
 	[SADB_EXPIRE] =		NULL,
 	[SADB_FLUSH] =		key_flush,
 	[SADB_DUMP] =		key_dump,
 	[SADB_X_PROMISC] =	key_promisc,
 	[SADB_X_PCHANGE] =	NULL,
 	[SADB_X_SPDUPDATE] =	key_spdadd,
 	[SADB_X_SPDADD] =	key_spdadd,
 	[SADB_X_SPDDELETE] =	key_spddelete,
 	[SADB_X_SPDGET] =	key_spdget,
 	[SADB_X_SPDACQUIRE] =	NULL,
 	[SADB_X_SPDDUMP] =	key_spddump,
 	[SADB_X_SPDFLUSH] =	key_spdflush,
 	[SADB_X_SPDSETIDX] =	key_spdadd,
 	[SADB_X_SPDEXPIRE] =	NULL,
 	[SADB_X_SPDDELETE2] =	key_spddelete2,
 };
 
 /*
  * parse sadb_msg buffer to process PFKEYv2,
  * and create a data to response if needed.
  * I think to be dealed with mbuf directly.
  * IN:
  *     msgp  : pointer to pointer to a received buffer pulluped.
  *             This is rewrited to response.
  *     so    : pointer to socket.
  * OUT:
  *    length for buffer to send to user process.
  */
 int
 key_parse(struct mbuf *m, struct socket *so)
 {
 	struct sadb_msg *msg;
 	struct sadb_msghdr mh;
 	u_int orglen;
 	int error;
 	int target;
 
 	IPSEC_ASSERT(so != NULL, ("null socket"));
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 
 	if (m->m_len < sizeof(struct sadb_msg)) {
 		m = m_pullup(m, sizeof(struct sadb_msg));
 		if (!m)
 			return ENOBUFS;
 	}
 	msg = mtod(m, struct sadb_msg *);
 	orglen = PFKEY_UNUNIT64(msg->sadb_msg_len);
 	target = KEY_SENDUP_ONE;
 
 	if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len != orglen) {
 		ipseclog((LOG_DEBUG, "%s: invalid message length.\n",__func__));
 		PFKEYSTAT_INC(out_invlen);
 		error = EINVAL;
 		goto senderror;
 	}
 
 	if (msg->sadb_msg_version != PF_KEY_V2) {
 		ipseclog((LOG_DEBUG, "%s: PF_KEY version %u is mismatched.\n",
 		    __func__, msg->sadb_msg_version));
 		PFKEYSTAT_INC(out_invver);
 		error = EINVAL;
 		goto senderror;
 	}
 
 	if (msg->sadb_msg_type > SADB_MAX) {
 		ipseclog((LOG_DEBUG, "%s: invalid type %u is passed.\n",
 		    __func__, msg->sadb_msg_type));
 		PFKEYSTAT_INC(out_invmsgtype);
 		error = EINVAL;
 		goto senderror;
 	}
 
 	/* for old-fashioned code - should be nuked */
 	if (m->m_pkthdr.len > MCLBYTES) {
 		m_freem(m);
 		return ENOBUFS;
 	}
 	if (m->m_next) {
 		struct mbuf *n;
 
 		n = key_mget(m->m_pkthdr.len);
 		if (n == NULL) {
 			m_freem(m);
 			return ENOBUFS;
 		}
 		m_copydata(m, 0, m->m_pkthdr.len, mtod(n, caddr_t));
 		n->m_pkthdr.len = n->m_len = m->m_pkthdr.len;
 		n->m_next = NULL;
 		m_freem(m);
 		m = n;
 	}
 
 	/* align the mbuf chain so that extensions are in contiguous region. */
 	error = key_align(m, &mh);
 	if (error)
 		return error;
 
 	msg = mh.msg;
 
 	/* We use satype as scope mask for spddump */
 	if (msg->sadb_msg_type == SADB_X_SPDDUMP) {
 		switch (msg->sadb_msg_satype) {
 		case IPSEC_POLICYSCOPE_ANY:
 		case IPSEC_POLICYSCOPE_GLOBAL:
 		case IPSEC_POLICYSCOPE_IFNET:
 		case IPSEC_POLICYSCOPE_PCB:
 			break;
 		default:
 			ipseclog((LOG_DEBUG, "%s: illegal satype=%u\n",
 			    __func__, msg->sadb_msg_type));
 			PFKEYSTAT_INC(out_invsatype);
 			error = EINVAL;
 			goto senderror;
 		}
 	} else {
 		switch (msg->sadb_msg_satype) { /* check SA type */
 		case SADB_SATYPE_UNSPEC:
 			switch (msg->sadb_msg_type) {
 			case SADB_GETSPI:
 			case SADB_UPDATE:
 			case SADB_ADD:
 			case SADB_DELETE:
 			case SADB_GET:
 			case SADB_ACQUIRE:
 			case SADB_EXPIRE:
 				ipseclog((LOG_DEBUG, "%s: must specify satype "
 				    "when msg type=%u.\n", __func__,
 				    msg->sadb_msg_type));
 				PFKEYSTAT_INC(out_invsatype);
 				error = EINVAL;
 				goto senderror;
 			}
 			break;
 		case SADB_SATYPE_AH:
 		case SADB_SATYPE_ESP:
 		case SADB_X_SATYPE_IPCOMP:
 		case SADB_X_SATYPE_TCPSIGNATURE:
 			switch (msg->sadb_msg_type) {
 			case SADB_X_SPDADD:
 			case SADB_X_SPDDELETE:
 			case SADB_X_SPDGET:
 			case SADB_X_SPDFLUSH:
 			case SADB_X_SPDSETIDX:
 			case SADB_X_SPDUPDATE:
 			case SADB_X_SPDDELETE2:
 				ipseclog((LOG_DEBUG, "%s: illegal satype=%u\n",
 				    __func__, msg->sadb_msg_type));
 				PFKEYSTAT_INC(out_invsatype);
 				error = EINVAL;
 				goto senderror;
 			}
 			break;
 		case SADB_SATYPE_RSVP:
 		case SADB_SATYPE_OSPFV2:
 		case SADB_SATYPE_RIPV2:
 		case SADB_SATYPE_MIP:
 			ipseclog((LOG_DEBUG, "%s: type %u isn't supported.\n",
 			    __func__, msg->sadb_msg_satype));
 			PFKEYSTAT_INC(out_invsatype);
 			error = EOPNOTSUPP;
 			goto senderror;
 		case 1:	/* XXX: What does it do? */
 			if (msg->sadb_msg_type == SADB_X_PROMISC)
 				break;
 			/*FALLTHROUGH*/
 		default:
 			ipseclog((LOG_DEBUG, "%s: invalid type %u is passed.\n",
 			    __func__, msg->sadb_msg_satype));
 			PFKEYSTAT_INC(out_invsatype);
 			error = EINVAL;
 			goto senderror;
 		}
 	}
 
 	/* check field of upper layer protocol and address family */
 	if (mh.ext[SADB_EXT_ADDRESS_SRC] != NULL
 	 && mh.ext[SADB_EXT_ADDRESS_DST] != NULL) {
 		struct sadb_address *src0, *dst0;
 		u_int plen;
 
 		src0 = (struct sadb_address *)(mh.ext[SADB_EXT_ADDRESS_SRC]);
 		dst0 = (struct sadb_address *)(mh.ext[SADB_EXT_ADDRESS_DST]);
 
 		/* check upper layer protocol */
 		if (src0->sadb_address_proto != dst0->sadb_address_proto) {
 			ipseclog((LOG_DEBUG, "%s: upper layer protocol "
 				"mismatched.\n", __func__));
 			PFKEYSTAT_INC(out_invaddr);
 			error = EINVAL;
 			goto senderror;
 		}
 
 		/* check family */
 		if (PFKEY_ADDR_SADDR(src0)->sa_family !=
 		    PFKEY_ADDR_SADDR(dst0)->sa_family) {
 			ipseclog((LOG_DEBUG, "%s: address family mismatched.\n",
 				__func__));
 			PFKEYSTAT_INC(out_invaddr);
 			error = EINVAL;
 			goto senderror;
 		}
 		if (PFKEY_ADDR_SADDR(src0)->sa_len !=
 		    PFKEY_ADDR_SADDR(dst0)->sa_len) {
 			ipseclog((LOG_DEBUG, "%s: address struct size "
 				"mismatched.\n", __func__));
 			PFKEYSTAT_INC(out_invaddr);
 			error = EINVAL;
 			goto senderror;
 		}
 
 		switch (PFKEY_ADDR_SADDR(src0)->sa_family) {
 		case AF_INET:
 			if (PFKEY_ADDR_SADDR(src0)->sa_len !=
 			    sizeof(struct sockaddr_in)) {
 				PFKEYSTAT_INC(out_invaddr);
 				error = EINVAL;
 				goto senderror;
 			}
 			break;
 		case AF_INET6:
 			if (PFKEY_ADDR_SADDR(src0)->sa_len !=
 			    sizeof(struct sockaddr_in6)) {
 				PFKEYSTAT_INC(out_invaddr);
 				error = EINVAL;
 				goto senderror;
 			}
 			break;
 		default:
 			ipseclog((LOG_DEBUG, "%s: unsupported address family\n",
 				__func__));
 			PFKEYSTAT_INC(out_invaddr);
 			error = EAFNOSUPPORT;
 			goto senderror;
 		}
 
 		switch (PFKEY_ADDR_SADDR(src0)->sa_family) {
 		case AF_INET:
 			plen = sizeof(struct in_addr) << 3;
 			break;
 		case AF_INET6:
 			plen = sizeof(struct in6_addr) << 3;
 			break;
 		default:
 			plen = 0;	/*fool gcc*/
 			break;
 		}
 
 		/* check max prefix length */
 		if (src0->sadb_address_prefixlen > plen ||
 		    dst0->sadb_address_prefixlen > plen) {
 			ipseclog((LOG_DEBUG, "%s: illegal prefixlen.\n",
 				__func__));
 			PFKEYSTAT_INC(out_invaddr);
 			error = EINVAL;
 			goto senderror;
 		}
 
 		/*
 		 * prefixlen == 0 is valid because there can be a case when
 		 * all addresses are matched.
 		 */
 	}
 
 	if (msg->sadb_msg_type >= nitems(key_typesw) ||
 	    key_typesw[msg->sadb_msg_type] == NULL) {
 		PFKEYSTAT_INC(out_invmsgtype);
 		error = EINVAL;
 		goto senderror;
 	}
 
 	return (*key_typesw[msg->sadb_msg_type])(so, m, &mh);
 
 senderror:
 	msg->sadb_msg_errno = error;
 	return key_sendup_mbuf(so, m, target);
 }
 
 static int
 key_senderror(struct socket *so, struct mbuf *m, int code)
 {
 	struct sadb_msg *msg;
 
 	IPSEC_ASSERT(m->m_len >= sizeof(struct sadb_msg),
 		("mbuf too small, len %u", m->m_len));
 
 	msg = mtod(m, struct sadb_msg *);
 	msg->sadb_msg_errno = code;
 	return key_sendup_mbuf(so, m, KEY_SENDUP_ONE);
 }
 
 /*
  * set the pointer to each header into message buffer.
  * m will be freed on error.
  * XXX larger-than-MCLBYTES extension?
  */
 static int
 key_align(struct mbuf *m, struct sadb_msghdr *mhp)
 {
 	struct mbuf *n;
 	struct sadb_ext *ext;
 	size_t off, end;
 	int extlen;
 	int toff;
 
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
 	IPSEC_ASSERT(m->m_len >= sizeof(struct sadb_msg),
 		("mbuf too small, len %u", m->m_len));
 
 	/* initialize */
 	bzero(mhp, sizeof(*mhp));
 
 	mhp->msg = mtod(m, struct sadb_msg *);
 	mhp->ext[0] = (struct sadb_ext *)mhp->msg;	/*XXX backward compat */
 
 	end = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len);
 	extlen = end;	/*just in case extlen is not updated*/
 	for (off = sizeof(struct sadb_msg); off < end; off += extlen) {
 		n = m_pulldown(m, off, sizeof(struct sadb_ext), &toff);
 		if (!n) {
 			/* m is already freed */
 			return ENOBUFS;
 		}
 		ext = (struct sadb_ext *)(mtod(n, caddr_t) + toff);
 
 		/* set pointer */
 		switch (ext->sadb_ext_type) {
 		case SADB_EXT_SA:
 		case SADB_EXT_ADDRESS_SRC:
 		case SADB_EXT_ADDRESS_DST:
 		case SADB_EXT_ADDRESS_PROXY:
 		case SADB_EXT_LIFETIME_CURRENT:
 		case SADB_EXT_LIFETIME_HARD:
 		case SADB_EXT_LIFETIME_SOFT:
 		case SADB_EXT_KEY_AUTH:
 		case SADB_EXT_KEY_ENCRYPT:
 		case SADB_EXT_IDENTITY_SRC:
 		case SADB_EXT_IDENTITY_DST:
 		case SADB_EXT_SENSITIVITY:
 		case SADB_EXT_PROPOSAL:
 		case SADB_EXT_SUPPORTED_AUTH:
 		case SADB_EXT_SUPPORTED_ENCRYPT:
 		case SADB_EXT_SPIRANGE:
 		case SADB_X_EXT_POLICY:
 		case SADB_X_EXT_SA2:
 		case SADB_X_EXT_NAT_T_TYPE:
 		case SADB_X_EXT_NAT_T_SPORT:
 		case SADB_X_EXT_NAT_T_DPORT:
 		case SADB_X_EXT_NAT_T_OAI:
 		case SADB_X_EXT_NAT_T_OAR:
 		case SADB_X_EXT_NAT_T_FRAG:
 		case SADB_X_EXT_SA_REPLAY:
 		case SADB_X_EXT_NEW_ADDRESS_SRC:
 		case SADB_X_EXT_NEW_ADDRESS_DST:
 			/* duplicate check */
 			/*
 			 * XXX Are there duplication payloads of either
 			 * KEY_AUTH or KEY_ENCRYPT ?
 			 */
 			if (mhp->ext[ext->sadb_ext_type] != NULL) {
 				ipseclog((LOG_DEBUG, "%s: duplicate ext_type "
 					"%u\n", __func__, ext->sadb_ext_type));
 				m_freem(m);
 				PFKEYSTAT_INC(out_dupext);
 				return EINVAL;
 			}
 			break;
 		default:
 			ipseclog((LOG_DEBUG, "%s: invalid ext_type %u\n",
 				__func__, ext->sadb_ext_type));
 			m_freem(m);
 			PFKEYSTAT_INC(out_invexttype);
 			return EINVAL;
 		}
 
 		extlen = PFKEY_UNUNIT64(ext->sadb_ext_len);
 
 		if (key_validate_ext(ext, extlen)) {
 			m_freem(m);
 			PFKEYSTAT_INC(out_invlen);
 			return EINVAL;
 		}
 
 		n = m_pulldown(m, off, extlen, &toff);
 		if (!n) {
 			/* m is already freed */
 			return ENOBUFS;
 		}
 		ext = (struct sadb_ext *)(mtod(n, caddr_t) + toff);
 
 		mhp->ext[ext->sadb_ext_type] = ext;
 		mhp->extoff[ext->sadb_ext_type] = off;
 		mhp->extlen[ext->sadb_ext_type] = extlen;
 	}
 
 	if (off != end) {
 		m_freem(m);
 		PFKEYSTAT_INC(out_invlen);
 		return EINVAL;
 	}
 
 	return 0;
 }
 
 static int
 key_validate_ext(const struct sadb_ext *ext, int len)
 {
 	const struct sockaddr *sa;
 	enum { NONE, ADDR } checktype = NONE;
 	int baselen = 0;
 	const int sal = offsetof(struct sockaddr, sa_len) + sizeof(sa->sa_len);
 
 	if (len != PFKEY_UNUNIT64(ext->sadb_ext_len))
 		return EINVAL;
 
 	/* if it does not match minimum/maximum length, bail */
 	if (ext->sadb_ext_type >= nitems(minsize) ||
 	    ext->sadb_ext_type >= nitems(maxsize))
 		return EINVAL;
 	if (!minsize[ext->sadb_ext_type] || len < minsize[ext->sadb_ext_type])
 		return EINVAL;
 	if (maxsize[ext->sadb_ext_type] && len > maxsize[ext->sadb_ext_type])
 		return EINVAL;
 
 	/* more checks based on sadb_ext_type XXX need more */
 	switch (ext->sadb_ext_type) {
 	case SADB_EXT_ADDRESS_SRC:
 	case SADB_EXT_ADDRESS_DST:
 	case SADB_EXT_ADDRESS_PROXY:
 	case SADB_X_EXT_NAT_T_OAI:
 	case SADB_X_EXT_NAT_T_OAR:
 	case SADB_X_EXT_NEW_ADDRESS_SRC:
 	case SADB_X_EXT_NEW_ADDRESS_DST:
 		baselen = PFKEY_ALIGN8(sizeof(struct sadb_address));
 		checktype = ADDR;
 		break;
 	case SADB_EXT_IDENTITY_SRC:
 	case SADB_EXT_IDENTITY_DST:
 		if (((const struct sadb_ident *)ext)->sadb_ident_type ==
 		    SADB_X_IDENTTYPE_ADDR) {
 			baselen = PFKEY_ALIGN8(sizeof(struct sadb_ident));
 			checktype = ADDR;
 		} else
 			checktype = NONE;
 		break;
 	default:
 		checktype = NONE;
 		break;
 	}
 
 	switch (checktype) {
 	case NONE:
 		break;
 	case ADDR:
 		sa = (const struct sockaddr *)(((const u_int8_t*)ext)+baselen);
 		if (len < baselen + sal)
 			return EINVAL;
 		if (baselen + PFKEY_ALIGN8(sa->sa_len) != len)
 			return EINVAL;
 		break;
 	}
 
 	return 0;
 }
 
 void
 spdcache_init(void)
 {
 	int i;
 
 	TUNABLE_INT_FETCH("net.key.spdcache.maxentries",
 	    &V_key_spdcache_maxentries);
 	TUNABLE_INT_FETCH("net.key.spdcache.threshold",
 	    &V_key_spdcache_threshold);
 
 	if (V_key_spdcache_maxentries) {
 		V_key_spdcache_maxentries = MAX(V_key_spdcache_maxentries,
 		    SPDCACHE_MAX_ENTRIES_PER_HASH);
 		V_spdcachehashtbl = hashinit(V_key_spdcache_maxentries /
 		    SPDCACHE_MAX_ENTRIES_PER_HASH,
 		    M_IPSEC_SPDCACHE, &V_spdcachehash_mask);
 		V_key_spdcache_maxentries = (V_spdcachehash_mask + 1)
 		    * SPDCACHE_MAX_ENTRIES_PER_HASH;
 
 		V_spdcache_lock = malloc(sizeof(struct mtx) *
 		    (V_spdcachehash_mask + 1),
 		    M_IPSEC_SPDCACHE, M_WAITOK | M_ZERO);
 
 		for (i = 0; i < V_spdcachehash_mask + 1; ++i)
 			SPDCACHE_LOCK_INIT(i);
 	}
 }
 
 struct spdcache_entry *
 spdcache_entry_alloc(const struct secpolicyindex *spidx, struct secpolicy *sp)
 {
 	struct spdcache_entry *entry;
 
 	entry = malloc(sizeof(struct spdcache_entry), M_IPSEC_SPDCACHE,
 	    M_NOWAIT | M_ZERO);
 	if (entry == NULL)
 		return (NULL);
 
 	if (sp != NULL)
 		SP_ADDREF(sp);
 
 	entry->spidx = *spidx;
 	entry->sp = sp;
 
 	return (entry);
 }
 
 void
 spdcache_entry_free(struct spdcache_entry *entry)
 {
 
 	if (entry->sp != NULL)
 		key_freesp(&entry->sp);
 	free(entry, M_IPSEC_SPDCACHE);
 }
 
 void
 spdcache_clear(void)
 {
 	struct spdcache_entry *entry;
 	int i;
 
 	for (i = 0; i < V_spdcachehash_mask + 1; ++i) {
 		SPDCACHE_LOCK(i);
 		while (!LIST_EMPTY(&V_spdcachehashtbl[i])) {
 			entry = LIST_FIRST(&V_spdcachehashtbl[i]);
 			LIST_REMOVE(entry, chain);
 			spdcache_entry_free(entry);
 		}
 		SPDCACHE_UNLOCK(i);
 	}
 }
 
 #ifdef VIMAGE
 void
 spdcache_destroy(void)
 {
 	int i;
 
 	if (SPDCACHE_ENABLED()) {
 		spdcache_clear();
 		hashdestroy(V_spdcachehashtbl, M_IPSEC_SPDCACHE, V_spdcachehash_mask);
 
 		for (i = 0; i < V_spdcachehash_mask + 1; ++i)
 			SPDCACHE_LOCK_DESTROY(i);
 
 		free(V_spdcache_lock, M_IPSEC_SPDCACHE);
 	}
 }
 #endif
 
 static void
 key_vnet_init(void *arg __unused)
 {
 	int i;
 
 	for (i = 0; i < IPSEC_DIR_MAX; i++) {
 		TAILQ_INIT(&V_sptree[i]);
 		TAILQ_INIT(&V_sptree_ifnet[i]);
 	}
 
 	TAILQ_INIT(&V_sahtree);
 	V_sphashtbl = hashinit(SPHASH_NHASH, M_IPSEC_SP, &V_sphash_mask);
 	V_savhashtbl = hashinit(SAVHASH_NHASH, M_IPSEC_SA, &V_savhash_mask);
 	V_sahaddrhashtbl = hashinit(SAHHASH_NHASH, M_IPSEC_SAH,
 	    &V_sahaddrhash_mask);
 	V_acqaddrhashtbl = hashinit(ACQHASH_NHASH, M_IPSEC_SAQ,
 	    &V_acqaddrhash_mask);
 	V_acqseqhashtbl = hashinit(ACQHASH_NHASH, M_IPSEC_SAQ,
 	    &V_acqseqhash_mask);
 
 	spdcache_init();
 
 	for (i = 0; i <= SADB_SATYPE_MAX; i++)
 		LIST_INIT(&V_regtree[i]);
 
 	LIST_INIT(&V_acqtree);
 	LIST_INIT(&V_spacqtree);
 }
 VNET_SYSINIT(key_vnet_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_SECOND,
     key_vnet_init, NULL);
 
 static void
 key_init(void *arg __unused)
 {
 
 	ipsec_key_lft_zone = uma_zcreate("IPsec SA lft_c",
 	    sizeof(uint64_t) * 2, NULL, NULL, NULL, NULL,
 	    UMA_ALIGN_PTR, UMA_ZONE_PCPU);
 
 	SPTREE_LOCK_INIT();
 	REGTREE_LOCK_INIT();
 	SAHTREE_LOCK_INIT();
 	ACQ_LOCK_INIT();
 	SPACQ_LOCK_INIT();
 	SPI_ALLOC_LOCK_INIT();
 
 #ifndef IPSEC_DEBUG2
 	callout_init(&key_timer, 1);
 	callout_reset(&key_timer, hz, key_timehandler, NULL);
 #endif /*IPSEC_DEBUG2*/
 
 	/* initialize key statistics */
 	keystat.getspi_count = 1;
 
 	if (bootverbose)
 		printf("IPsec: Initialized Security Association Processing.\n");
 }
 SYSINIT(key_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST, key_init, NULL);
 
 #ifdef VIMAGE
 static void
 key_vnet_destroy(void *arg __unused)
 {
 	struct secashead_queue sahdrainq;
 	struct secpolicy_queue drainq;
 	struct secpolicy *sp, *nextsp;
 	struct secacq *acq, *nextacq;
 	struct secspacq *spacq, *nextspacq;
 	struct secashead *sah;
 	struct secasvar *sav;
 	struct secreg *reg;
 	int i;
 
 	/*
 	 * XXX: can we just call free() for each object without
 	 * walking through safe way with releasing references?
 	 */
 	TAILQ_INIT(&drainq);
 	SPTREE_WLOCK();
 	for (i = 0; i < IPSEC_DIR_MAX; i++) {
 		TAILQ_CONCAT(&drainq, &V_sptree[i], chain);
 		TAILQ_CONCAT(&drainq, &V_sptree_ifnet[i], chain);
 	}
 	for (i = 0; i < V_sphash_mask + 1; i++)
 		LIST_INIT(&V_sphashtbl[i]);
 	SPTREE_WUNLOCK();
 	spdcache_destroy();
 
 	sp = TAILQ_FIRST(&drainq);
 	while (sp != NULL) {
 		nextsp = TAILQ_NEXT(sp, chain);
 		key_freesp(&sp);
 		sp = nextsp;
 	}
 
 	TAILQ_INIT(&sahdrainq);
 	SAHTREE_WLOCK();
 	TAILQ_CONCAT(&sahdrainq, &V_sahtree, chain);
 	for (i = 0; i < V_savhash_mask + 1; i++)
 		LIST_INIT(&V_savhashtbl[i]);
 	for (i = 0; i < V_sahaddrhash_mask + 1; i++)
 		LIST_INIT(&V_sahaddrhashtbl[i]);
 	TAILQ_FOREACH(sah, &sahdrainq, chain) {
 		sah->state = SADB_SASTATE_DEAD;
 		TAILQ_FOREACH(sav, &sah->savtree_larval, chain) {
 			sav->state = SADB_SASTATE_DEAD;
 		}
 		TAILQ_FOREACH(sav, &sah->savtree_alive, chain) {
 			sav->state = SADB_SASTATE_DEAD;
 		}
 	}
 	SAHTREE_WUNLOCK();
 
 	key_freesah_flushed(&sahdrainq);
 	hashdestroy(V_sphashtbl, M_IPSEC_SP, V_sphash_mask);
 	hashdestroy(V_savhashtbl, M_IPSEC_SA, V_savhash_mask);
 	hashdestroy(V_sahaddrhashtbl, M_IPSEC_SAH, V_sahaddrhash_mask);
 
 	REGTREE_LOCK();
 	for (i = 0; i <= SADB_SATYPE_MAX; i++) {
 		LIST_FOREACH(reg, &V_regtree[i], chain) {
 			if (__LIST_CHAINED(reg)) {
 				LIST_REMOVE(reg, chain);
 				free(reg, M_IPSEC_SAR);
 				break;
 			}
 		}
 	}
 	REGTREE_UNLOCK();
 
 	ACQ_LOCK();
 	acq = LIST_FIRST(&V_acqtree);
 	while (acq != NULL) {
 		nextacq = LIST_NEXT(acq, chain);
 		LIST_REMOVE(acq, chain);
 		free(acq, M_IPSEC_SAQ);
 		acq = nextacq;
 	}
 	for (i = 0; i < V_acqaddrhash_mask + 1; i++)
 		LIST_INIT(&V_acqaddrhashtbl[i]);
 	for (i = 0; i < V_acqseqhash_mask + 1; i++)
 		LIST_INIT(&V_acqseqhashtbl[i]);
 	ACQ_UNLOCK();
 
 	SPACQ_LOCK();
 	for (spacq = LIST_FIRST(&V_spacqtree); spacq != NULL;
 	    spacq = nextspacq) {
 		nextspacq = LIST_NEXT(spacq, chain);
 		if (__LIST_CHAINED(spacq)) {
 			LIST_REMOVE(spacq, chain);
 			free(spacq, M_IPSEC_SAQ);
 		}
 	}
 	SPACQ_UNLOCK();
 	hashdestroy(V_acqaddrhashtbl, M_IPSEC_SAQ, V_acqaddrhash_mask);
 	hashdestroy(V_acqseqhashtbl, M_IPSEC_SAQ, V_acqseqhash_mask);
 }
 VNET_SYSUNINIT(key_vnet_destroy, SI_SUB_PROTO_DOMAIN, SI_ORDER_SECOND,
     key_vnet_destroy, NULL);
 #endif
 
 /*
  * XXX: as long as domains are not unloadable, this function is never called,
  * provided for consistensy and future unload support.
  */
 static void
 key_destroy(void *arg __unused)
 {
 	uma_zdestroy(ipsec_key_lft_zone);
 
 #ifndef IPSEC_DEBUG2
 	callout_drain(&key_timer);
 #endif
 	SPTREE_LOCK_DESTROY();
 	REGTREE_LOCK_DESTROY();
 	SAHTREE_LOCK_DESTROY();
 	ACQ_LOCK_DESTROY();
 	SPACQ_LOCK_DESTROY();
 	SPI_ALLOC_LOCK_DESTROY();
 }
 SYSUNINIT(key_destroy, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST, key_destroy, NULL);
 
 /* record data transfer on SA, and update timestamps */
 void
 key_sa_recordxfer(struct secasvar *sav, struct mbuf *m)
 {
 	IPSEC_ASSERT(sav != NULL, ("Null secasvar"));
 	IPSEC_ASSERT(m != NULL, ("Null mbuf"));
 
 	/*
 	 * XXX Currently, there is a difference of bytes size
 	 * between inbound and outbound processing.
 	 */
 	counter_u64_add(sav->lft_c_bytes, m->m_pkthdr.len);
 
 	/*
 	 * We use the number of packets as the unit of
 	 * allocations.  We increment the variable
 	 * whenever {esp,ah}_{in,out}put is called.
 	 */
 	counter_u64_add(sav->lft_c_allocations, 1);
 
 	/*
 	 * NOTE: We record CURRENT usetime by using wall clock,
 	 * in seconds.  HARD and SOFT lifetime are measured by the time
 	 * difference (again in seconds) from usetime.
 	 *
 	 *	usetime
 	 *	v     expire   expire
 	 * -----+-----+--------+---> t
 	 *	<--------------> HARD
 	 *	<-----> SOFT
 	 */
 	if (sav->firstused == 0)
 		sav->firstused = time_second;
 }
 
 /*
  * Take one of the kernel's security keys and convert it into a PF_KEY
  * structure within an mbuf, suitable for sending up to a waiting
  * application in user land.
  * 
  * IN: 
  *    src: A pointer to a kernel security key.
  *    exttype: Which type of key this is. Refer to the PF_KEY data structures.
  * OUT:
  *    a valid mbuf or NULL indicating an error
  *
  */
 
 static struct mbuf *
 key_setkey(struct seckey *src, uint16_t exttype) 
 {
 	struct mbuf *m;
 	struct sadb_key *p;
 	int len;
 
 	if (src == NULL)
 		return NULL;
 
 	len = PFKEY_ALIGN8(sizeof(struct sadb_key) + _KEYLEN(src));
 	m = m_get2(len, M_NOWAIT, MT_DATA, 0);
 	if (m == NULL)
 		return NULL;
 	m_align(m, len);
 	m->m_len = len;
 	p = mtod(m, struct sadb_key *);
 	bzero(p, len);
 	p->sadb_key_len = PFKEY_UNIT64(len);
 	p->sadb_key_exttype = exttype;
 	p->sadb_key_bits = src->bits;
 	bcopy(src->key_data, _KEYBUF(p), _KEYLEN(src));
 
 	return m;
 }
 
 /*
  * Take one of the kernel's lifetime data structures and convert it
  * into a PF_KEY structure within an mbuf, suitable for sending up to
  * a waiting application in user land.
  * 
  * IN: 
  *    src: A pointer to a kernel lifetime structure.
  *    exttype: Which type of lifetime this is. Refer to the PF_KEY 
  *             data structures for more information.
  * OUT:
  *    a valid mbuf or NULL indicating an error
  *
  */
 
 static struct mbuf *
 key_setlifetime(struct seclifetime *src, uint16_t exttype)
 {
 	struct mbuf *m = NULL;
 	struct sadb_lifetime *p;
 	int len = PFKEY_ALIGN8(sizeof(struct sadb_lifetime));
 
 	if (src == NULL)
 		return NULL;
 
 	m = m_get2(len, M_NOWAIT, MT_DATA, 0);
 	if (m == NULL)
 		return m;
 	m_align(m, len);
 	m->m_len = len;
 	p = mtod(m, struct sadb_lifetime *);
 
 	bzero(p, len);
 	p->sadb_lifetime_len = PFKEY_UNIT64(len);
 	p->sadb_lifetime_exttype = exttype;
 	p->sadb_lifetime_allocations = src->allocations;
 	p->sadb_lifetime_bytes = src->bytes;
 	p->sadb_lifetime_addtime = src->addtime;
 	p->sadb_lifetime_usetime = src->usetime;
 
 	return m;
 
 }
 
 const struct enc_xform *
 enc_algorithm_lookup(int alg)
 {
 	int i;
 
 	for (i = 0; i < nitems(supported_ealgs); i++)
 		if (alg == supported_ealgs[i].sadb_alg)
 			return (supported_ealgs[i].xform);
 	return (NULL);
 }
 
 const struct auth_hash *
 auth_algorithm_lookup(int alg)
 {
 	int i;
 
 	for (i = 0; i < nitems(supported_aalgs); i++)
 		if (alg == supported_aalgs[i].sadb_alg)
 			return (supported_aalgs[i].xform);
 	return (NULL);
 }
 
 const struct comp_algo *
 comp_algorithm_lookup(int alg)
 {
 	int i;
 
 	for (i = 0; i < nitems(supported_calgs); i++)
 		if (alg == supported_calgs[i].sadb_alg)
 			return (supported_calgs[i].xform);
 	return (NULL);
 }
diff --git a/sys/netipsec/udpencap.c b/sys/netipsec/udpencap.c
index 118e0be317a0..960e7d3d1c9f 100644
--- a/sys/netipsec/udpencap.c
+++ b/sys/netipsec/udpencap.c
@@ -1,291 +1,409 @@
 /*-
  * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include <sys/cdefs.h>
 #include "opt_inet.h"
+#include "opt_inet6.h"
 #include "opt_ipsec.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
 #include <sys/mbuf.h>
 #include <sys/protosw.h>
 #include <sys/socket.h>
 #include <sys/sockopt.h>
 #include <sys/sysctl.h>
 
 #include <netinet/in.h>
 #include <netinet/in_pcb.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
+#include <netinet/ip6.h>
 #include <netinet/ip_var.h>
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
 #include <netinet/udp_var.h>
 
+#include <netinet6/ip6_var.h>
+
 #include <net/vnet.h>
 
 #include <netipsec/ipsec.h>
 #include <netipsec/esp.h>
 #include <netipsec/esp_var.h>
 #include <netipsec/xform.h>
 
 #include <netipsec/key.h>
 #include <netipsec/key_debug.h>
 #include <netipsec/ipsec_support.h>
 #include <machine/in_cksum.h>
 
 /*
  * Handle UDP_ENCAP socket option. Always return with released INP_WLOCK.
  */
 int
 udp_ipsec_pcbctl(struct inpcb *inp, struct sockopt *sopt)
 {
 	struct udpcb *up;
 	int error, optval;
 
 	INP_WLOCK_ASSERT(inp);
 	if (sopt->sopt_name != UDP_ENCAP) {
 		INP_WUNLOCK(inp);
 		return (ENOPROTOOPT);
 	}
 
 	up = intoudpcb(inp);
 	if (sopt->sopt_dir == SOPT_GET) {
 		if (up->u_flags & UF_ESPINUDP)
 			optval = UDP_ENCAP_ESPINUDP;
 		else
 			optval = 0;
 		INP_WUNLOCK(inp);
 		return (sooptcopyout(sopt, &optval, sizeof(optval)));
 	}
 	INP_WUNLOCK(inp);
 
 	error = sooptcopyin(sopt, &optval, sizeof(optval), sizeof(optval));
 	if (error != 0)
 		return (error);
 
 	INP_WLOCK(inp);
 	switch (optval) {
 	case 0:
 		up->u_flags &= ~UF_ESPINUDP;
 		break;
 	case UDP_ENCAP_ESPINUDP:
 		up->u_flags |= UF_ESPINUDP;
 		break;
 	default:
 		error = EINVAL;
 	}
 	INP_WUNLOCK(inp);
 	return (error);
 }
 
 /*
  * Potentially decap ESP in UDP frame.  Check for an ESP header.
  * If present, strip the UDP header and push the result through IPSec.
  *
  * Returns error if mbuf consumed and/or processed, otherwise 0.
  */
 int
 udp_ipsec_input(struct mbuf *m, int off, int af)
 {
 	union sockaddr_union dst;
 	struct secasvar *sav;
 	struct udphdr *udp;
-	struct ip *ip;
 	uint32_t spi;
 	int hlen;
 
 	/*
 	 * Just return if packet doesn't have enough data.
 	 * We need at least [IP header + UDP header + ESP header].
 	 * NAT-Keepalive packet has only one byte of payload, so it
 	 * by default will not be processed.
 	 */
 	if (m->m_pkthdr.len < off + sizeof(struct esp))
 		return (0);
 
 	m_copydata(m, off, sizeof(uint32_t), (caddr_t)&spi);
 	if (spi == 0)	/* Non-ESP marker. */
 		return (0);
 
 	/*
 	 * Find SA and check that it is configured for UDP
 	 * encapsulation.
 	 */
 	bzero(&dst, sizeof(dst));
 	dst.sa.sa_family = af;
 	switch (af) {
 #ifdef INET
-	case AF_INET:
+	case AF_INET: {
+		struct ip *ip;
+
 		dst.sin.sin_len = sizeof(struct sockaddr_in);
 		ip = mtod(m, struct ip *);
 		ip->ip_p = IPPROTO_ESP;
 		off = offsetof(struct ip, ip_p);
 		hlen = ip->ip_hl << 2;
 		dst.sin.sin_addr = ip->ip_dst;
 		break;
+	}
 #endif
 #ifdef INET6
-	case AF_INET6:
-		/* Not yet */
-		/* FALLTHROUGH */
+	case AF_INET6: {
+		struct ip6_hdr *ip6;
+
+		dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
+		ip6 = mtod(m, struct ip6_hdr *);
+		ip6->ip6_nxt = IPPROTO_ESP;
+		off = offsetof(struct ip6_hdr, ip6_nxt);
+		hlen = sizeof(struct ip6_hdr);
+		dst.sin6.sin6_addr = ip6->ip6_dst;
+		break;
+	}
 #endif
 	default:
 		ESPSTAT_INC(esps_nopf);
 		m_freem(m);
 		return (EPFNOSUPPORT);
 	}
 
 	sav = key_allocsa(&dst, IPPROTO_ESP, spi);
 	if (sav == NULL) {
 		ESPSTAT_INC(esps_notdb);
 		m_freem(m);
 		return (ENOENT);
 	}
 	udp = mtodo(m, hlen);
 	if (sav->natt == NULL ||
 	    sav->natt->sport != udp->uh_sport ||
 	    sav->natt->dport != udp->uh_dport) {
 		/* XXXAE: should we check source address? */
 		ESPSTAT_INC(esps_notdb);
 		key_freesav(&sav);
 		m_freem(m);
 		return (ENOENT);
 	}
 	/*
 	 * Remove the UDP header
 	 * Before:
 	 *   <--- off --->
 	 *   +----+------+-----+
 	 *   | IP |  UDP | ESP |
 	 *   +----+------+-----+
 	 *        <-skip->
 	 * After:
 	 *          +----+-----+
 	 *          | IP | ESP |
 	 *          +----+-----+
 	 *   <-skip->
 	 */
 	m_striphdr(m, hlen, sizeof(*udp));
+
 	/*
 	 * We cannot yet update the cksums so clear any h/w cksum flags
 	 * as they are no longer valid.
 	 */
-	if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)
-		m->m_pkthdr.csum_flags &= ~(CSUM_DATA_VALID | CSUM_PSEUDO_HDR);
+	switch (af) {
+#ifdef INET
+	case AF_INET:
+		if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)
+			m->m_pkthdr.csum_flags &= ~(CSUM_DATA_VALID | CSUM_PSEUDO_HDR);
+		break;
+#endif /* INET */
+#ifdef INET6
+	case AF_INET6:
+		if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID_IPV6)
+			m->m_pkthdr.csum_flags &= ~(CSUM_DATA_VALID_IPV6 | CSUM_PSEUDO_HDR);
+		break;
+#endif /* INET6 */
+	default:
+		ESPSTAT_INC(esps_nopf);
+		m_freem(m);
+		return (EPFNOSUPPORT);
+	}
+
 	/*
 	 * We can update ip_len and ip_sum here, but ipsec4_input_cb()
 	 * will do this anyway, so don't touch them here.
 	 */
 	ESPSTAT_INC(esps_input);
 	(*sav->tdb_xform->xf_input)(m, sav, hlen, off);
 	return (EINPROGRESS);	/* Consumed by IPsec. */
 }
 
 int
 udp_ipsec_output(struct mbuf *m, struct secasvar *sav)
 {
 	struct udphdr *udp;
 	struct mbuf *n;
-	struct ip *ip;
 	int hlen, off;
 
 	IPSEC_ASSERT(sav->natt != NULL, ("UDP encapsulation isn't required."));
 
-	if (sav->sah->saidx.dst.sa.sa_family == AF_INET6)
+	switch (sav->sah->saidx.dst.sa.sa_family) {
+#ifdef INET
+	case AF_INET: {
+		struct ip *ip;
+		ip = mtod(m, struct ip *);
+		hlen = ip->ip_hl << 2;
+		break;
+	}
+#endif
+#ifdef INET6
+	case AF_INET6:
+		KASSERT(ip6->ip6_nxt == IPPROTO_ESP,
+		    ("unexpected next header type %d", ip->ip6_nxt));
+		hlen = sizeof(struct ip6_hdr);
+		break;
+#endif
+	default:
+		ESPSTAT_INC(esps_nopf);
 		return (EAFNOSUPPORT);
+	}
 
-	ip = mtod(m, struct ip *);
-	hlen = ip->ip_hl << 2;
 	n = m_makespace(m, hlen, sizeof(*udp), &off);
 	if (n == NULL) {
 		DPRINTF(("%s: m_makespace for udphdr failed\n", __func__));
 		return (ENOBUFS);
 	}
 
 	udp = mtodo(n, off);
 	udp->uh_dport = sav->natt->dport;
 	udp->uh_sport = sav->natt->sport;
 	udp->uh_sum = 0;
 	udp->uh_ulen = htons(m->m_pkthdr.len - hlen);
 
-	ip = mtod(m, struct ip *);
-	ip->ip_len = htons(m->m_pkthdr.len);
-	ip->ip_p = IPPROTO_UDP;
+	switch (sav->sah->saidx.dst.sa.sa_family) {
+#ifdef INET
+	case AF_INET: {
+		struct ip *ip;
+
+		ip = mtod(m, struct ip *);
+		ip->ip_len = htons(m->m_pkthdr.len);
+		ip->ip_p = IPPROTO_UDP;
+		break;
+	}
+#endif
+#ifdef INET6
+	case AF_INET6: {
+		struct ip6_hdr *ip6;
+
+		ip6 = mtod(m, struct ip6_hdr *);
+		ip6->ip6_plen = htons(m->m_pkthdr.len);
+		ip6->ip6_nxt = IPPROTO_UDP;
+		udp->uh_sum = in6_cksum_pseudo(ip6,
+		    m->m_pkthdr.len - hlen, ip6->ip6_nxt, 0);
+		m->m_pkthdr.csum_flags = CSUM_UDP_IPV6;
+		m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
+		break;
+	}
+#endif
+	default:
+		ESPSTAT_INC(esps_nopf);
+		return (EAFNOSUPPORT);
+	}
+
 	return (0);
 }
 
 void
 udp_ipsec_adjust_cksum(struct mbuf *m, struct secasvar *sav, int proto,
     int skip)
 {
-	struct ip *ip;
 	uint16_t cksum, off;
 
 	IPSEC_ASSERT(sav->natt != NULL, ("NAT-T isn't required"));
 	IPSEC_ASSERT(proto == IPPROTO_UDP || proto == IPPROTO_TCP,
 	    ("unexpected protocol %u", proto));
 
 	if (proto == IPPROTO_UDP)
 		off = offsetof(struct udphdr, uh_sum);
 	else
 		off = offsetof(struct tcphdr, th_sum);
 
 	if (V_natt_cksum_policy == 0) {	/* auto */
 		if (sav->natt->cksum != 0) {
 			/* Incrementally recompute. */
 			m_copydata(m, skip + off, sizeof(cksum),
 			    (caddr_t)&cksum);
 			/* Do not adjust UDP checksum if it is zero. */
 			if (proto == IPPROTO_UDP && cksum == 0)
 				return;
 			cksum = in_addword(cksum, sav->natt->cksum);
 		} else {
 			/* No OA from IKEd. */
 			if (proto == IPPROTO_TCP) {
 				/* Ignore for TCP. */
 				m->m_pkthdr.csum_data = 0xffff;
-				m->m_pkthdr.csum_flags |= (CSUM_DATA_VALID |
-				    CSUM_PSEUDO_HDR);
+				switch (sav->sah->saidx.dst.sa.sa_family) {
+#ifdef INET
+				case AF_INET:
+					m->m_pkthdr.csum_flags |= (CSUM_DATA_VALID |
+					    CSUM_PSEUDO_HDR);
+					break;
+#endif
+#ifdef INET6
+				case AF_INET6:
+					m->m_pkthdr.csum_flags |= (CSUM_DATA_VALID_IPV6 |
+					    CSUM_PSEUDO_HDR);
+					break;
+#endif
+				default:
+					break;
+				}
 				return;
 			}
 			cksum = 0; /* Reset for UDP. */
 		}
 		m_copyback(m, skip + off, sizeof(cksum), (caddr_t)&cksum);
 	} else { /* Fully recompute */
-		ip = mtod(m, struct ip *);
-		cksum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
-		    htons(m->m_pkthdr.len - skip + proto));
-		m_copyback(m, skip + off, sizeof(cksum), (caddr_t)&cksum);
-		m->m_pkthdr.csum_flags =
-		    (proto == IPPROTO_UDP) ? CSUM_UDP: CSUM_TCP;
-		m->m_pkthdr.csum_data = off;
-		in_delayed_cksum(m);
-		m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
+		switch (sav->sah->saidx.dst.sa.sa_family) {
+#ifdef INET
+		case AF_INET: {
+			struct ip *ip;
+
+			ip = mtod(m, struct ip *);
+			cksum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
+			    htons(m->m_pkthdr.len - skip + proto));
+			m_copyback(m, skip + off, sizeof(cksum),
+		            (caddr_t)&cksum);
+			m->m_pkthdr.csum_flags =
+			    (proto == IPPROTO_UDP) ? CSUM_UDP : CSUM_TCP;
+			m->m_pkthdr.csum_data = off;
+			in_delayed_cksum(m);
+			m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
+			break;
+		}
+#endif
+#ifdef INET6
+		case AF_INET6: {
+			struct ip6_hdr *ip6;
+
+			ip6 = mtod(m, struct ip6_hdr *);
+			cksum = in6_cksum_pseudo(ip6, m->m_pkthdr.len - skip,
+			   proto, 0);
+			m_copyback(m, skip + off, sizeof(cksum),
+			   (caddr_t)&cksum);
+			m->m_pkthdr.csum_flags =
+			   (proto == IPPROTO_UDP) ? CSUM_UDP_IPV6 : CSUM_TCP_IPV6;
+			m->m_pkthdr.csum_data = off;
+			in6_delayed_cksum(m,
+			   m->m_pkthdr.len - sizeof(struct ip6_hdr),
+			   sizeof(struct ip6_hdr));
+			m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
+			break;
+		}
+#endif
+		default:
+			break;
+		}
 	}
 }