Merge sync of head

4 files changed, 96 insertions, 25 deletions

diff --git a/share/examples/Makefile b/share/examples/Makefile
index 79de48e..3a4d1c4 100644
--- a/share/examples/Makefile
+++ b/share/examples/Makefile
@@ -7,20 +7,17 @@
 LDIRS=	BSD_daemon \
 	FreeBSD_version \
 	IPv6 \
-	bhyve \
 	bootforth \
 	csh \
 	diskless \
 	drivers \
 	etc \
 	find_interface \
-	hast \
 	ibcs2 \
 	indent \
 	ipfw \
 	jails \
 	kld \
-	libusb20 \
 	libvgl \
 	mdoc \
 	netgraph \
@@ -30,7 +27,8 @@ LDIRS=	BSD_daemon \
 	printing \
 	ses \
 	scsi_target \
-	sunrpc
+	sunrpc \
+	uefisign
 
 XFILES=	BSD_daemon/FreeBSD.pfa \
 	BSD_daemon/README \
@@ -42,7 +40,6 @@ XFILES=	BSD_daemon/FreeBSD.pfa \
 	FreeBSD_version/Makefile \
 	FreeBSD_version/README \
 	IPv6/USAGE \
-	bhyve/vmrun.sh \
 	bootforth/README \
 	bootforth/boot.4th \
 	bootforth/frames.4th \
@@ -64,11 +61,6 @@ XFILES=	BSD_daemon/FreeBSD.pfa \
 	find_interface/Makefile \
 	find_interface/README \
 	find_interface/find_interface.c \
-	hast/ucarp.sh \
-	hast/ucarp_down.sh \
-	hast/ucarp_up.sh \
-	hast/vip-down.sh \
-	hast/vip-up.sh \
 	ibcs2/README \
 	ibcs2/hello.uu \
 	indent/indent.pro \
@@ -100,12 +92,6 @@ XFILES=	BSD_daemon/FreeBSD.pfa \
 	kld/syscall/module/syscall.c \
 	kld/syscall/test/Makefile \
 	kld/syscall/test/call.c \
-	libusb20/Makefile \
-	libusb20/README \
-	libusb20/util.c \
-	libusb20/util.h \
-	libusb20/bulk.c \
-	libusb20/control.c \
 	libvgl/Makefile \
 	libvgl/demo.c \
 	mdoc/POSIX-copyright \
@@ -196,12 +182,39 @@ XFILES=	BSD_daemon/FreeBSD.pfa \
 	sunrpc/sort/Makefile \
 	sunrpc/sort/rsort.c \
 	sunrpc/sort/sort.x \
-	sunrpc/sort/sort_proc.c
+	sunrpc/sort/sort_proc.c \
+	uefisign/uefikeys
 
 BINDIR= ${SHAREDIR}/examples
 
 NO_OBJ=
 
+.if ${MK_HAST} != "no"
+LDIRS+=		hast
+XFILES+=	hast/ucarp.sh \
+		hast/ucarp_down.sh \
+		hast/ucarp_up.sh \
+		hast/vip-down.sh \
+		hast/vip-up.sh
+.endif
+
+.if ${MK_USB} != "no"
+LDIRS+=		libusb20
+XFILES+=	libusb20/Makefile \
+		libusb20/README \
+		libusb20/util.c \
+		libusb20/util.h \
+		libusb20/bulk.c \
+		libusb20/control.c
+.endif
+
+.if ${MACHINE_CPUARCH} == "amd64"
+.if ${MK_BHYVE} != "no"
+LDIRS+=		bhyve
+XFILES+=	bhyve/vmrun.sh
+.endif
+.endif
+
 # Define SHARED to indicate whether you want symbolic links to the system
 # source (``symlinks''), or a separate copy (``copies''); (latter useful
 # in environments where it's not possible to keep /sys publicly readable)
diff --git a/share/examples/bhyve/vmrun.sh b/share/examples/bhyve/vmrun.sh
index 93f3c94..901404b 100755
--- a/share/examples/bhyve/vmrun.sh
+++ b/share/examples/bhyve/vmrun.sh
@@ -39,7 +39,13 @@ DEFAULT_CONSOLE=stdio
 DEFAULT_VIRTIO_DISK="./diskdev"
 DEFAULT_ISOFILE="./release.iso"
 
+errmsg() {
+	echo "*** $1"
+}
+
 usage() {
+	local msg=$1
+
 	echo "Usage: vmrun.sh [-ahi] [-c <CPUs>] [-C <console>] [-d <disk file>]"
 	echo "                [-e <name=value>] [-g <gdbport> ] [-H <directory>]"
 	echo "                [-I <location of installation iso>] [-m <memsize>]"
@@ -56,20 +62,21 @@ usage() {
 	echo "       -i: force boot of the Installation CDROM image"
 	echo "       -I: Installation CDROM image location (default is ${DEFAULT_ISOFILE})"
 	echo "       -m: memory size (default is ${DEFAULT_MEMSIZE})"
+	echo "       -p: pass-through a host PCI device at bus/slot/func (e.g. 10/0/0)"
 	echo "       -t: tap device for virtio-net (default is $DEFAULT_TAPDEV)"
 	echo ""
-	echo "       This script needs to be executed with superuser privileges"
-	echo ""
+	[ -n "$msg" ] && errmsg "$msg"
 	exit 1
 }
 
 if [ `id -u` -ne 0 ]; then
-	usage
+	errmsg "This script must be executed with superuser privileges"
+	exit 1
 fi
 
 kldstat -n vmm > /dev/null 2>&1 
 if [ $? -ne 0 ]; then
-	echo "vmm.ko is not loaded!"
+	errmsg "vmm.ko is not loaded"
 	exit 1
 fi
 
@@ -83,8 +90,9 @@ disk_total=0
 apic_opt=""
 gdbport=0
 loader_opt=""
+pass_total=0
 
-while getopts ac:C:d:e:g:hH:iI:m:t: c ; do
+while getopts ac:C:d:e:g:hH:iI:m:p:t: c ; do
 	case $c in
 	a)
 		apic_opt="-a"
@@ -117,6 +125,10 @@ while getopts ac:C:d:e:g:hH:iI:m:t: c ; do
 	m)
 		memsize=${OPTARG}
 		;;
+	p)
+		eval "pass_dev${pass_total}=\"${OPTARG}\""
+		pass_total=$(($pass_total + 1))
+		;;
 	t)
 		eval "tap_dev${tap_total}=\"${OPTARG}\""
 		tap_total=$(($tap_total + 1))
@@ -140,7 +152,7 @@ fi
 shift $((${OPTIND} - 1))
 
 if [ $# -ne 1 ]; then
-	usage
+	usage "virtual machine name not specified"
 fi
 
 vmname="$1"
@@ -231,6 +243,14 @@ while [ 1 ]; do
 	    i=$(($i + 1))
 	done
 
+	i=0
+	while [ $i -lt $pass_total ] ; do
+	    eval "pass=\$pass_dev${i}"
+	    devargs="$devargs -s $nextslot:0,passthru,${pass} "
+	    nextslot=$(($nextslot + 1))
+	    i=$(($i + 1))
+        done
+
 	${FBSDRUN} -c ${cpus} -m ${memsize} ${apic_opt} -A -H -P	\
 		-g ${gdbport}						\
 		-s 0:0,hostbridge					\
diff --git a/share/examples/etc/make.conf b/share/examples/etc/make.conf
index ca0ea36..613eb02 100644
--- a/share/examples/etc/make.conf
+++ b/share/examples/etc/make.conf
@@ -44,8 +44,9 @@
 #				if omitted), ultrasparc3
 # Additionally the following CPU types are recognized by clang:
 #   Intel x86 architecture (for both amd64 and i386):
-#       (AMD CPUs)	bdver3, bdver2, bdver1, btver2, btver1
-#       (Intel CPUs)	slm, core-avx2, core-avx-i, corei7-avx, corei7, atom
+#       (AMD CPUs)	bdver4, bdver3, bdver2, bdver1, btver2, btver1
+#       (Intel CPUs)	skylake, knl, broadwell, haswell, ivybridge,
+#			sandybridge, westmere, nehalem, silvermont, bonnell
 #
 # (?= allows to buildworld for a different CPUTYPE.)
 #
diff --git a/share/examples/uefisign/uefikeys b/share/examples/uefisign/uefikeys
new file mode 100755
index 0000000..dd31aa2
--- /dev/null
+++ b/share/examples/uefisign/uefikeys
@@ -0,0 +1,37 @@
+#!/bin/sh
+#
+# See uefisign(8) manual page for usage instructions.
+#
+# $FreeBSD$
+#
+
+die() {
+	echo "$*" > /dev/stderr
+	exit 1
+}
+
+if [ $# -ne 1 ]; then
+	echo "usage: $0 common-name"
+	exit 1
+fi
+
+certfile="${1}.pem"
+efifile="${1}.cer"
+keyfile="${1}.key"
+# XXX: Set this to ten years; we don't want system to suddenly stop booting
+#      due to certificate expiration.  Better way would be to use Authenticode
+#      Timestamp.  That said, the rumor is UEFI implementations ignore it anyway.
+days="3650"
+subj="/CN=${1}"
+
+[ ! -e "${certfile}" ] || die "${certfile} already exists"
+[ ! -e "${efifile}" ] || die "${efifile} already exists"
+[ ! -e "${keyfile}" ] || die "${keyfile} already exists"
+
+umask 077 || die "umask 077 failed"
+
+openssl genrsa -out "${keyfile}" 2048 2> /dev/null || die "openssl genrsa failed"
+openssl req -new -x509 -sha256 -days "${days}" -subj "${subj}" -key "${keyfile}" -out "${certfile}" || die "openssl req failed"
+openssl x509 -inform PEM -outform DER -in "${certfile}" -out "${efifile}" || die "openssl x509 failed"
+
+echo "certificate: ${certfile}; private key: ${keyfile}; certificate to enroll in UEFI: ${efifile}"