From 337ce169ccc40e1688c973aa5203092cb7cd283f Mon Sep 17 00:00:00 2001
From: purplerain <purplerain@secbsd.org>
Date: Wed, 29 Jan 2025 19:22:50 +0000
Subject: [PATCH] sync with OpenBSD -current

---
 etc/rpki/arin.constraints         |   5 +-
 regress/gnu/usr.bin/perl/Makefile |   9 +--
 share/man/man4/virtio.4           |   9 +--
 share/man/man9/rwlock.9           |   8 +-
 sys/dev/pci/virtio_pci.c          |  36 +++++----
 sys/dev/pv/if_vio.c               |   7 +-
 sys/dev/pv/virtiovar.h            |   5 +-
 sys/kern/init_sysent.c            |   8 +-
 sys/kern/kern_rwlock.c            |  45 ++++++++++-
 sys/kern/syscalls.c               |   4 +-
 sys/kern/syscalls.master          |   6 +-
 sys/kern/vfs_syscalls.c           |  25 +++---
 sys/sys/rwlock.h                  |   3 +-
 sys/sys/syscall.h                 |   4 +-
 sys/sys/syscallargs.h             |   4 +-
 sys/uvm/uvm_fault.c               |  56 +++++++++++++-
 sys/uvm/uvm_map.c                 |   4 +-
 usr.sbin/bgpctl/output.c          |   4 +-
 usr.sbin/iscsid/connection.c      | 124 +++++++++++++++++++++++-------
 usr.sbin/iscsid/initiator.c       |  76 ++++++++++++------
 usr.sbin/iscsid/iscsid.h          |   4 +-
 usr.sbin/npppd/npppd/radius_req.c |   6 +-
 usr.sbin/radiusd/radiusd.c        |   6 +-
 usr.sbin/radiusd/radiusd_ipcp.c   |  11 ++-
 24 files changed, 337 insertions(+), 132 deletions(-)

diff --git a/etc/rpki/arin.constraints b/etc/rpki/arin.constraints
index fb7e10cf3..d64f6da4c 100644
--- a/etc/rpki/arin.constraints
+++ b/etc/rpki/arin.constraints
@@ -1,4 +1,4 @@
-#	$OpenBSD: arin.constraints,v 1.5 2024/04/17 14:31:59 job Exp $
+#	$OpenBSD: arin.constraints,v 1.6 2025/01/28 19:43:10 job Exp $
 
 # From https://www.iana.org/assignments/ipv6-unicast-address-assignments
 allow 2001:400::/23
@@ -9,6 +9,9 @@ allow 2610::/23
 allow 2620::/23
 allow 2630::/12
 
+# AS112 Project
+allow 2001:4:112::/48
+
 # LACNIC ASNs cannot be transferred to ARIN
 # From https://www.iana.org/assignments/as-numbers/as-numbers.xhtml
 deny 27648 - 28671
diff --git a/regress/gnu/usr.bin/perl/Makefile b/regress/gnu/usr.bin/perl/Makefile
index d6f5eaabb..ee5468cf7 100644
--- a/regress/gnu/usr.bin/perl/Makefile
+++ b/regress/gnu/usr.bin/perl/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.5 2023/07/09 13:30:03 bluhm Exp $
+# $OpenBSD: Makefile,v 1.6 2025/01/28 13:12:48 anton Exp $
 
 .if ! (make(clean) || make(cleandir) || make(obj))
 NCPU !=		/sbin/sysctl -n hw.ncpuonline
@@ -16,14 +16,13 @@ permissions:
 	# Match expectations of cpan/Test-Harness/t/source_handler.t for
 	# cpan/Test-Harness/t/source_tests/source*.sh executalbe bits.
 	# Remove symlink and fix permissions of copy in obj directory.
-	# cpan/autodie/t/chmod.t and cpan/autodie/t/chown.t modify themself,
-	# and cpan/autodie/t/utime.t touches touch_me.  Replace symlink.
+	# cpan/autodie/t/chmod.t and cpan/autodie/t/chown.t modify themself.
+	# Replace symlink.
 .for f in \
     cpan/Test-Harness/t/source_tests/source.sh \
     cpan/Test-Harness/t/source_tests/source_args.sh \
     cpan/autodie/t/chmod.t \
-    cpan/autodie/t/chown.t \
-    cpan/autodie/t/touch_me
+    cpan/autodie/t/chown.t
 	rm -f ${BSDOBJDIR}/gnu/usr.bin/perl/$f
 	cp ${BSDSRCDIR}/gnu/usr.bin/perl/$f ${BSDOBJDIR}/gnu/usr.bin/perl/$f
 	chmod +x ${BSDOBJDIR}/gnu/usr.bin/perl/$f
diff --git a/share/man/man4/virtio.4 b/share/man/man4/virtio.4
index 017dc55cd..a2095c782 100644
--- a/share/man/man4/virtio.4
+++ b/share/man/man4/virtio.4
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: virtio.4,v 1.17 2023/04/26 22:34:30 jmc Exp $
+.\"     $OpenBSD: virtio.4,v 1.18 2025/01/29 14:03:18 sf Exp $
 .\"
 .\" Copyright (c) 2012 Stefan Fritsch <sf@sfritsch.de>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: April 26 2023 $
+.Dd $Mdocdate: January 29 2025 $
 .Dt VIRTIO 4
 .Os
 .Sh NAME
@@ -60,9 +60,8 @@ The
 driver conforms to the virtio 0.9.5 specification.
 The virtio 1.0 standard is only supported for PCI devices.
 .Pp
-By default 0.9 is preferred over 1.0.
-This can be changed by setting the bit 0x4 in the flags.
-Setting the bit 0x8 in the flags disables 1.0 support completely.
+By default 1.x is preferred over 0.9.
+This can be changed by setting the bit 0x8 in the flags.
 .Sh SEE ALSO
 .Xr intro 4
 .Sh HISTORY
diff --git a/share/man/man9/rwlock.9 b/share/man/man9/rwlock.9
index f63f73268..54bf065cf 100644
--- a/share/man/man9/rwlock.9
+++ b/share/man/man9/rwlock.9
@@ -1,4 +1,4 @@
-.\" $OpenBSD: rwlock.9,v 1.26 2021/01/16 15:02:40 mvs Exp $
+.\" $OpenBSD: rwlock.9,v 1.27 2025/01/29 15:10:35 mpi Exp $
 .\"
 .\" Copyright (c) 2006 Pedro Martelletto <pedro@ambientworks.net>
 .\" All rights reserved.
@@ -15,7 +15,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: January 16 2021 $
+.Dd $Mdocdate: January 29 2025 $
 .Dt RWLOCK 9
 .Os
 .Sh NAME
@@ -139,6 +139,10 @@ Acquire an exclusive lock.
 .It Dv RW_DOWNGRADE
 Safely release an exclusive lock and acquire a shared lock without
 letting other exclusive locks in between.
+.It Dv RW_UPGRADE
+Upgrade a shared lock into an exclusive one.
+Must be combined with
+.Dv RW_NOSLEEP .
 .It Dv RW_INTR
 When waiting for a lock, allow signals to interrupt the sleep.
 .It Dv RW_NOSLEEP
diff --git a/sys/dev/pci/virtio_pci.c b/sys/dev/pci/virtio_pci.c
index 2c59e899c..6d3ccdbaa 100644
--- a/sys/dev/pci/virtio_pci.c
+++ b/sys/dev/pci/virtio_pci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: virtio_pci.c,v 1.50 2025/01/14 14:28:38 sf Exp $	*/
+/*	$OpenBSD: virtio_pci.c,v 1.51 2025/01/29 14:03:18 sf Exp $	*/
 /*	$NetBSD: virtio.c,v 1.3 2011/11/02 23:05:52 njoly Exp $	*/
 
 /*
@@ -362,8 +362,7 @@ virtio_pci_match(struct device *parent, void *match, void *aux)
 		return 1;
 	/* virtio 1.0 */
 	if (PCI_PRODUCT(pa->pa_id) >= 0x1040 &&
-	    PCI_PRODUCT(pa->pa_id) <= 0x107f &&
-	    PCI_REVISION(pa->pa_class) == 1)
+	    PCI_PRODUCT(pa->pa_id) <= 0x107f)
 		return 1;
 	return 0;
 }
@@ -595,21 +594,24 @@ virtio_pci_attach(struct device *parent, struct device *self, void *aux)
 	struct pci_attach_args *pa = (struct pci_attach_args *)aux;
 	pci_chipset_tag_t pc = pa->pa_pc;
 	pcitag_t tag = pa->pa_tag;
-	int revision, ret = ENODEV;
+	int revision, product, vendor, ret = ENODEV, flags;
 	pcireg_t id;
 	struct virtio_pci_attach_args vpa = { { 0 }, pa };
 
 	revision = PCI_REVISION(pa->pa_class);
-	switch (revision) {
-	case 0:
-		/* subsystem ID shows what I am */
+	product = PCI_PRODUCT(pa->pa_id);
+	vendor = PCI_VENDOR(pa->pa_id);
+	if (vendor == PCI_VENDOR_OPENBSD ||
+	    (product >= 0x1000 && product <= 0x103f && revision == 0)) {
+		/* OpenBSD VMMCI and virtio 0.9 */
 		id = PCI_PRODUCT(pci_conf_read(pc, tag, PCI_SUBSYS_ID_REG));
-		break;
-	case 1:
-		id = PCI_PRODUCT(pa->pa_id) - 0x1040;
-		break;
-	default:
-		printf("unknown revision 0x%02x; giving up\n", revision);
+	} else if (product >= 0x1040 && product <= 0x107f) {
+		/* virtio 1.0 */
+		id = product - 0x1040;
+		revision = 1;
+	} else {
+		printf("unknown device prod 0x%04x rev 0x%02x; giving up\n",
+		    product, revision);
 		return;
 	}
 
@@ -637,15 +639,15 @@ virtio_pci_attach(struct device *parent, struct device *self, void *aux)
 	    M_DEVBUF, M_WAITOK | M_ZERO);
 
 	vsc->sc_ops = &virtio_pci_ops;
-	if ((vsc->sc_dev.dv_cfdata->cf_flags & VIRTIO_CF_NO_VERSION_1) == 0 &&
-	    (revision == 1 ||
-	     (vsc->sc_dev.dv_cfdata->cf_flags & VIRTIO_CF_PREFER_VERSION_1))) {
+	flags = vsc->sc_dev.dv_cfdata->cf_flags;
+	if ((flags & VIRTIO_CF_PREFER_VERSION_09) == 0)
 		ret = virtio_pci_attach_10(sc, pa);
-	}
 	if (ret != 0 && revision == 0) {
 		/* revision 0 means 0.9 only or both 0.9 and 1.0 */
 		ret = virtio_pci_attach_09(sc, pa);
 	}
+	if (ret != 0 && (flags & VIRTIO_CF_PREFER_VERSION_09))
+		ret = virtio_pci_attach_10(sc, pa);
 	if (ret != 0) {
 		printf(": Cannot attach (%d)\n", ret);
 		goto free;
diff --git a/sys/dev/pv/if_vio.c b/sys/dev/pv/if_vio.c
index 1adf34d1c..389b92b2c 100644
--- a/sys/dev/pv/if_vio.c
+++ b/sys/dev/pv/if_vio.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_vio.c,v 1.67 2025/01/17 08:58:38 jan Exp $	*/
+/*	$OpenBSD: if_vio.c,v 1.68 2025/01/28 19:53:06 sf Exp $	*/
 
 /*
  * Copyright (c) 2012 Stefan Fritsch, Alexander Fiveg.
@@ -1514,6 +1514,11 @@ vio_rxeof(struct vio_queue *vioq)
 			hdr = mtod(m, struct virtio_net_hdr *);
 			m_adj(m, sc->sc_hdr_size);
 			m0 = mlast = m;
+			if (virtio_has_feature(vsc, VIRTIO_NET_F_MQ)) {
+				m->m_pkthdr.ph_flowid =
+				    vioq->viq_ifiq->ifiq_idx;
+				SET(m->m_pkthdr.csum_flags, M_FLOWID);
+			}
 			if (VIO_HAVE_MRG_RXBUF(sc))
 				bufs_left = hdr->num_buffers - 1;
 			else
diff --git a/sys/dev/pv/virtiovar.h b/sys/dev/pv/virtiovar.h
index 029f57438..a390c680d 100644
--- a/sys/dev/pv/virtiovar.h
+++ b/sys/dev/pv/virtiovar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: virtiovar.h,v 1.28 2025/01/14 12:30:57 sf Exp $	*/
+/*	$OpenBSD: virtiovar.h,v 1.29 2025/01/29 14:03:19 sf Exp $	*/
 /*	$NetBSD: virtiovar.h,v 1.1 2011/10/30 12:12:21 hannken Exp $	*/
 
 /*
@@ -82,8 +82,7 @@
 /* flags for config(8) */
 #define VIRTIO_CF_NO_INDIRECT		1
 #define VIRTIO_CF_NO_EVENT_IDX		2
-#define VIRTIO_CF_PREFER_VERSION_1	4
-#define VIRTIO_CF_NO_VERSION_1		8
+#define VIRTIO_CF_PREFER_VERSION_09	8
 
 struct virtio_attach_args {
 	int			 va_devid;	/* virtio device id */
diff --git a/sys/kern/init_sysent.c b/sys/kern/init_sysent.c
index c9632210f..53b5a69f1 100644
--- a/sys/kern/init_sysent.c
+++ b/sys/kern/init_sysent.c
@@ -1,10 +1,10 @@
-/*	$OpenBSD: init_sysent.c,v 1.284 2025/01/20 09:03:24 mpi Exp $	*/
+/*	$OpenBSD: init_sysent.c,v 1.285 2025/01/29 14:59:30 mpi Exp $	*/
 
 /*
  * System call switch table.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.267 2025/01/20 09:02:17 mpi Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.268 2025/01/29 14:58:28 mpi Exp 
  */
 
 #include <sys/param.h>
@@ -27,7 +27,7 @@ const struct sysent sysent[] = {
 	    sys_read },				/* 3 = read */
 	{ 3, s(struct sys_write_args), SY_NOLOCK | 0,
 	    sys_write },			/* 4 = write */
-	{ 3, s(struct sys_open_args), 0,
+	{ 3, s(struct sys_open_args), SY_NOLOCK | 0,
 	    sys_open },				/* 5 = open */
 	{ 1, s(struct sys_close_args), SY_NOLOCK | 0,
 	    sys_close },			/* 6 = close */
@@ -731,7 +731,7 @@ const struct sysent sysent[] = {
 	    sys_mkfifoat },			/* 319 = mkfifoat */
 	{ 4, s(struct sys_mknodat_args), 0,
 	    sys_mknodat },			/* 320 = mknodat */
-	{ 4, s(struct sys_openat_args), 0,
+	{ 4, s(struct sys_openat_args), SY_NOLOCK | 0,
 	    sys_openat },			/* 321 = openat */
 	{ 4, s(struct sys_readlinkat_args), 0,
 	    sys_readlinkat },			/* 322 = readlinkat */
diff --git a/sys/kern/kern_rwlock.c b/sys/kern/kern_rwlock.c
index 0971acc94..5ecda20c0 100644
--- a/sys/kern/kern_rwlock.c
+++ b/sys/kern/kern_rwlock.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_rwlock.c,v 1.53 2025/01/04 02:34:11 dlg Exp $	*/
+/*	$OpenBSD: kern_rwlock.c,v 1.55 2025/01/29 15:10:09 mpi Exp $	*/
 
 /*
  * Copyright (c) 2002, 2003 Artur Grabowski <art@openbsd.org>
@@ -74,6 +74,7 @@ static int	rw_do_enter_read(struct rwlock *, int);
 static void	rw_do_exit_read(struct rwlock *, unsigned long);
 static int	rw_do_enter_write(struct rwlock *, int);
 static int	rw_downgrade(struct rwlock *, int);
+static int	rw_upgrade(struct rwlock *, int);
 
 static void	rw_exited(struct rwlock *);
 
@@ -203,6 +204,9 @@ rw_enter(struct rwlock *rwl, int flags)
 	case RW_DOWNGRADE:
 		error = rw_downgrade(rwl, flags);
 		break;
+	case RW_UPGRADE:
+		error = rw_upgrade(rwl, flags);
+		break;
 	default:
 		panic("%s rwlock %p: %s unexpected op 0x%x",
 		    rwl->rwl_name, rwl, __func__, op);
@@ -246,6 +250,7 @@ rw_do_enter_write(struct rwlock *rwl, int flags)
 	 * can progress. Hence no spinning if we hold the kernel lock.
 	 */
 	if (!_kernel_lock_held()) {
+		struct schedstate_percpu *spc = &curcpu()->ci_schedstate;
 		int spins;
 
 		/*
@@ -253,6 +258,7 @@ rw_do_enter_write(struct rwlock *rwl, int flags)
 		 * is acquired by writer.
 		 */
 
+		spc->spc_spinning++;
 		for (spins = 0; spins < RW_SPINS; spins++) {
 			CPU_BUSY_CYCLE();
 			owner = atomic_load_long(&rwl->rwl_owner);
@@ -261,10 +267,12 @@ rw_do_enter_write(struct rwlock *rwl, int flags)
 
 			owner = rw_cas(&rwl->rwl_owner, 0, self);
 			if (owner == 0) {
+				spc->spc_spinning--;
 				/* ok, we won now. */
 				goto locked;
 			}
 		}
+		spc->spc_spinning--;
 	}
 #endif
 
@@ -434,6 +442,41 @@ rw_downgrade(struct rwlock *rwl, int flags)
 	return (0);
 }
 
+static int
+rw_upgrade(struct rwlock *rwl, int flags)
+{
+	unsigned long self = rw_self();
+	unsigned long owner;
+
+	KASSERTMSG(ISSET(flags, RW_NOSLEEP), "RW_UPGRADE without RW_NOSLEEP");
+
+	owner = atomic_cas_ulong(&rwl->rwl_owner, RWLOCK_READ_INCR, self);
+	if (owner != RWLOCK_READ_INCR) {
+		if (__predict_false(owner == 0)) {
+			panic("%s rwlock %p: upgrade on unowned lock",
+			    rwl->rwl_name, rwl);
+		}
+		if (__predict_false(ISSET(owner, RWLOCK_WRLOCK))) {
+			panic("%s rwlock %p: upgrade on write locked lock"
+			    "(owner 0x%lx, self 0x%lx)", rwl->rwl_name, rwl,
+			    owner, self);
+		}
+
+		return (EBUSY);
+	}
+
+#ifdef WITNESS
+	{
+		int lop_flags = LOP_NEWORDER;
+		if (ISSET(flags, RW_DUPOK))
+			lop_flags |= LOP_DUPOK;
+		WITNESS_UPGRADE(&rwl->rwl_lock_obj, lop_flags);
+	}
+#endif
+
+	return (0);
+}
+
 void
 rw_exit(struct rwlock *rwl)
 {
diff --git a/sys/kern/syscalls.c b/sys/kern/syscalls.c
index acb17cfd2..bf45d7a9e 100644
--- a/sys/kern/syscalls.c
+++ b/sys/kern/syscalls.c
@@ -1,10 +1,10 @@
-/*	$OpenBSD: syscalls.c,v 1.282 2025/01/20 09:03:24 mpi Exp $	*/
+/*	$OpenBSD: syscalls.c,v 1.283 2025/01/29 14:59:30 mpi Exp $	*/
 
 /*
  * System call names.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.267 2025/01/20 09:02:17 mpi Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.268 2025/01/29 14:58:28 mpi Exp 
  */
 
 const char *const syscallnames[] = {
diff --git a/sys/kern/syscalls.master b/sys/kern/syscalls.master
index 6624eb28c..cd088ef57 100644
--- a/sys/kern/syscalls.master
+++ b/sys/kern/syscalls.master
@@ -1,4 +1,4 @@
-;	$OpenBSD: syscalls.master,v 1.267 2025/01/20 09:02:17 mpi Exp $
+;	$OpenBSD: syscalls.master,v 1.268 2025/01/29 14:58:28 mpi Exp $
 ;	$NetBSD: syscalls.master,v 1.32 1996/04/23 10:24:21 mycroft Exp $
 
 ;	@(#)syscalls.master	8.2 (Berkeley) 1/13/94
@@ -52,7 +52,7 @@
 3	STD NOLOCK	{ ssize_t sys_read(int fd, void *buf, size_t nbyte); }
 4	STD NOLOCK	{ ssize_t sys_write(int fd, const void *buf, \
 			    size_t nbyte); }
-5	STD		{ int sys_open(const char *path, \
+5	STD NOLOCK	{ int sys_open(const char *path, \
 			    int flags, ... mode_t mode); }
 6	STD NOLOCK	{ int sys_close(int fd); }
 7	STD NOLOCK	{ int sys_getentropy(void *buf, size_t nbyte); }
@@ -553,7 +553,7 @@
 			    mode_t mode); }
 320	STD		{ int sys_mknodat(int fd, const char *path, \
 			    mode_t mode, dev_t dev); }
-321	STD		{ int sys_openat(int fd, const char *path, int flags, \
+321	STD NOLOCK	{ int sys_openat(int fd, const char *path, int flags, \
 			    ... mode_t mode); }
 322	STD		{ ssize_t sys_readlinkat(int fd, const char *path, \
 			    char *buf, size_t count); }
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 34c4b061d..acbbf58f6 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vfs_syscalls.c,v 1.371 2025/01/20 09:02:17 mpi Exp $	*/
+/*	$OpenBSD: vfs_syscalls.c,v 1.372 2025/01/29 14:57:19 mpi Exp $	*/
 /*	$NetBSD: vfs_syscalls.c,v 1.71 1996/04/23 10:29:02 mycroft Exp $	*/
 
 /*
@@ -1120,23 +1120,20 @@ doopenat(struct proc *p, int fd, const char *path, int oflags, mode_t mode,
 		localtrunc = 1;
 		flags &= ~O_TRUNC;	/* Must do truncate ourselves */
 	}
+	KERNEL_LOCK();
 	if ((error = vn_open(&nd, flags, cmode)) != 0) {
 		fdplock(fdp);
 		if (error == ENODEV &&
 		    p->p_dupfd >= 0 &&			/* XXX from fdopen */
 		    (error =
 			dupfdopen(p, indx, flags)) == 0) {
-			fdpunlock(fdp);
-			closef(fp, p);
 			*retval = indx;
-			return (error);
+			goto error;
 		}
 		if (error == ERESTART)
 			error = EINTR;
 		fdremove(fdp, indx);
-		fdpunlock(fdp);
-		closef(fp, p);
-		return (error);
+		goto error;
 	}
 	p->p_dupfd = 0;
 	vp = nd.ni_vp;
@@ -1161,9 +1158,7 @@ doopenat(struct proc *p, int fd, const char *path, int oflags, mode_t mode,
 			fdplock(fdp);
 			/* closef will vn_close the file for us. */
 			fdremove(fdp, indx);
-			fdpunlock(fdp);
-			closef(fp, p);
-			return (error);
+			goto error;
 		}
 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
 		atomic_setbits_int(&fp->f_iflags, FIF_HASLOCK);
@@ -1185,18 +1180,22 @@ doopenat(struct proc *p, int fd, const char *path, int oflags, mode_t mode,
 			fdplock(fdp);
 			/* closef will close the file for us. */
 			fdremove(fdp, indx);
-			fdpunlock(fdp);
-			closef(fp, p);
-			return (error);
+			goto error;
 		}
 	}
 	VOP_UNLOCK(vp);
+	KERNEL_UNLOCK();
 	*retval = indx;
 	fdplock(fdp);
 	fdinsert(fdp, indx, cloexec, fp);
 	fdpunlock(fdp);
 	FRELE(fp, p);
 	return (error);
+error:
+	KERNEL_UNLOCK();
+	fdpunlock(fdp);
+	closef(fp, p);
+	return (error);
 }
 
 /*
diff --git a/sys/sys/rwlock.h b/sys/sys/rwlock.h
index 5429fee95..a04be8f16 100644
--- a/sys/sys/rwlock.h
+++ b/sys/sys/rwlock.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rwlock.h,v 1.31 2025/01/04 02:34:11 dlg Exp $	*/
+/*	$OpenBSD: rwlock.h,v 1.32 2025/01/29 15:10:09 mpi Exp $	*/
 /*
  * Copyright (c) 2002 Artur Grabowski <art@openbsd.org>
  *
@@ -110,6 +110,7 @@ struct rwlock {
 #define RW_WRITE		0x0001UL /* exclusive lock */
 #define RW_READ			0x0002UL /* shared lock */
 #define RW_DOWNGRADE		0x0004UL /* downgrade exclusive to shared */
+#define RW_UPGRADE		0x0005UL
 #define RW_OPMASK		0x0007UL
 
 #define RW_INTR			0x0010UL /* interruptible sleep */
diff --git a/sys/sys/syscall.h b/sys/sys/syscall.h
index 1b15a3083..cb6996ae0 100644
--- a/sys/sys/syscall.h
+++ b/sys/sys/syscall.h
@@ -1,10 +1,10 @@
-/*	$OpenBSD: syscall.h,v 1.280 2025/01/20 09:03:24 mpi Exp $	*/
+/*	$OpenBSD: syscall.h,v 1.281 2025/01/29 14:59:31 mpi Exp $	*/
 
 /*
  * System call numbers.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.267 2025/01/20 09:02:17 mpi Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.268 2025/01/29 14:58:28 mpi Exp 
  */
 
 /* syscall: "exit" ret: "void" args: "int" */
diff --git a/sys/sys/syscallargs.h b/sys/sys/syscallargs.h
index 19184569b..d92a24f0d 100644
--- a/sys/sys/syscallargs.h
+++ b/sys/sys/syscallargs.h
@@ -1,10 +1,10 @@
-/*	$OpenBSD: syscallargs.h,v 1.283 2025/01/20 09:03:24 mpi Exp $	*/
+/*	$OpenBSD: syscallargs.h,v 1.284 2025/01/29 14:59:31 mpi Exp $	*/
 
 /*
  * System call argument lists.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.267 2025/01/20 09:02:17 mpi Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.268 2025/01/29 14:58:28 mpi Exp 
  */
 
 #ifdef	syscallarg
diff --git a/sys/uvm/uvm_fault.c b/sys/uvm/uvm_fault.c
index a6f5f8ddb..68c35bb38 100644
--- a/sys/uvm/uvm_fault.c
+++ b/sys/uvm/uvm_fault.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_fault.c,v 1.162 2025/01/22 10:52:09 mpi Exp $	*/
+/*	$OpenBSD: uvm_fault.c,v 1.163 2025/01/29 15:22:33 mpi Exp $	*/
 /*	$NetBSD: uvm_fault.c,v 1.51 2000/08/06 00:22:53 thorpej Exp $	*/
 
 /*
@@ -655,7 +655,11 @@ uvm_fault(vm_map_t orig_map, vaddr_t vaddr, vm_fault_t fault_type,
 	flt.access_type = access_type;
 	flt.narrow = FALSE;		/* assume normal fault for now */
 	flt.wired = FALSE;		/* assume non-wired fault for now */
+#if notyet
+	flt.lower_lock_type = RW_READ;	/* shared lock for now */
+#else
 	flt.lower_lock_type = RW_WRITE;	/* exclusive lock for now */
+#endif
 
 	error = ERESTART;
 	while (error == ERESTART) { /* ReFault: */
@@ -757,6 +761,8 @@ uvm_fault_check(struct uvm_faultinfo *ufi, struct uvm_faultctx *flt,
 		flt->access_type = flt->enter_prot; /* full access for wired */
 		/*  don't look for neighborhood * pages on "wire" fault */
 		flt->narrow = TRUE;
+		/* wiring pages requires a write lock. */
+		flt->lower_lock_type = RW_WRITE;
 	}
 
 	/* handle "needs_copy" case. */
@@ -843,6 +849,14 @@ uvm_fault_check(struct uvm_faultinfo *ufi, struct uvm_faultctx *flt,
 		*ranons = NULL;	/* to be safe */
 	}
 
+	if ((flt->access_type & PROT_WRITE) != 0) {
+		/*
+		 * we are about to dirty the object and that
+		 * requires a write lock.
+		 */
+		flt->lower_lock_type = RW_WRITE;
+	}
+
 	/*
 	 * for MADV_SEQUENTIAL mappings we want to deactivate the back pages
 	 * now and then forget about them (for the rest of the fault).
@@ -853,12 +867,15 @@ uvm_fault_check(struct uvm_faultinfo *ufi, struct uvm_faultctx *flt,
 			uvmfault_anonflush(*ranons, nback);
 
 		/*
-		 * flush object?
+		 * flush object?  change lock type to RW_WRITE, to avoid
+		 * excessive competition between read/write locks if many
+		 * threads doing "sequential access".
 		 */
 		if (uobj) {
 			voff_t uoff;
 
 			uoff = (flt->startva - ufi->entry->start) + ufi->entry->offset;
+			flt->lower_lock_type = RW_WRITE;
 			rw_enter(uobj->vmobjlock, RW_WRITE);
 			(void) uobj->pgops->pgo_flush(uobj, uoff, uoff +
 			    ((vsize_t)nback << PAGE_SHIFT), PGO_DEACTIVATE);
@@ -1227,6 +1244,35 @@ uvm_fault_lower_lookup(
 	return uobjpage;
 }
 
+/*
+ * uvm_fault_lower_upgrade: upgrade lower lock, reader -> writer
+ */
+static inline int
+uvm_fault_lower_upgrade(struct uvm_faultinfo *ufi, struct uvm_faultctx *flt,
+    struct vm_amap *amap, struct uvm_object *uobj)
+{
+	KASSERT(uobj != NULL);
+	KASSERT(flt->lower_lock_type == rw_status(uobj->vmobjlock));
+
+	/*
+	 * fast path.
+	 */
+	if (flt->lower_lock_type == RW_WRITE)
+		return 0;
+
+	/*
+	 * otherwise try for the upgrade.  if we don't get it, unlock
+	 * everything, restart the fault and next time around get a writer
+	 * lock.
+	 */
+	flt->lower_lock_type = RW_WRITE;
+	if (rw_enter(uobj->vmobjlock, RW_UPGRADE|RW_NOSLEEP)) {
+		uvmfault_unlockall(ufi, amap, uobj);
+		return ERESTART;
+	}
+	KASSERT(flt->lower_lock_type == rw_status(uobj->vmobjlock));
+	return 0;
+}
 /*
  * uvm_fault_lower: handle lower fault.
  *
@@ -1516,7 +1562,7 @@ uvm_fault_lower_io(
 	struct vm_page *pg;
 	boolean_t locked;
 	int gotpages, advice;
-	int result;
+	int error, result;
 	voff_t uoff;
 	vm_prot_t access_type;
 
@@ -1525,6 +1571,10 @@ uvm_fault_lower_io(
 	access_type = flt->access_type & MASK(ufi->entry);
 	advice = ufi->entry->advice;
 
+	/* Upgrade to a write lock if needed. */
+	error = uvm_fault_lower_upgrade(ufi, flt, amap, uobj);
+	if (error != 0)
+		return error;
 	uvmfault_unlockall(ufi, amap, NULL);
 
 	/* update rusage counters */
diff --git a/sys/uvm/uvm_map.c b/sys/uvm/uvm_map.c
index 418593cee..0042c0c3d 100644
--- a/sys/uvm/uvm_map.c
+++ b/sys/uvm/uvm_map.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_map.c,v 1.337 2024/12/27 12:04:40 mpi Exp $	*/
+/*	$OpenBSD: uvm_map.c,v 1.338 2025/01/29 15:25:31 mpi Exp $	*/
 /*	$NetBSD: uvm_map.c,v 1.86 2000/11/27 08:40:03 chs Exp $	*/
 
 /*
@@ -2954,7 +2954,7 @@ uvm_page_printit(struct vm_page *pg, boolean_t full,
 	(*pr)("PAGE %p:\n", pg);
 	(*pr)("  flags=%b, vers=%d, wire_count=%d, pa=0x%llx\n",
 	    pg->pg_flags, page_flagbits, pg->pg_version, pg->wire_count,
-	    (long long)pg->phys_addr);
+	    (long long)VM_PAGE_TO_PHYS(pg));
 	(*pr)("  uobject=%p, uanon=%p, offset=0x%llx\n",
 	    pg->uobject, pg->uanon, (long long)pg->offset);
 #if defined(UVM_PAGE_TRKOWN)
diff --git a/usr.sbin/bgpctl/output.c b/usr.sbin/bgpctl/output.c
index 714a06e0b..04c390749 100644
--- a/usr.sbin/bgpctl/output.c
+++ b/usr.sbin/bgpctl/output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: output.c,v 1.58 2024/12/13 19:22:01 claudio Exp $ */
+/*	$OpenBSD: output.c,v 1.59 2025/01/29 13:14:41 claudio Exp $ */
 
 /*
  * Copyright (c) 2003 Henning Brauer <henning@openbsd.org>
@@ -66,7 +66,7 @@ show_head(struct parse_result *res)
 			break;
 		printf("flags: "
 		    "* = Valid, > = Selected, I = via IBGP, A = Announced,\n"
-		    "       S = Stale, E = Error, F = Filtered\n");
+		    "       S = Stale, E = Error, F = Filtered, L = Leaked\n");
 		printf("origin validation state: "
 		    "N = not-found, V = valid, ! = invalid\n");
 		printf("aspa validation state: "
diff --git a/usr.sbin/iscsid/connection.c b/usr.sbin/iscsid/connection.c
index 8c86c1dba..be6cbe0d8 100644
--- a/usr.sbin/iscsid/connection.c
+++ b/usr.sbin/iscsid/connection.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: connection.c,v 1.24 2025/01/22 10:14:54 claudio Exp $ */
+/*	$OpenBSD: connection.c,v 1.25 2025/01/28 20:41:44 claudio Exp $ */
 
 /*
  * Copyright (c) 2009 Claudio Jeker <claudio@openbsd.org>
@@ -335,42 +335,108 @@ log_debug("conn_parse_kvp: %s = %s", k->key, k->value);
 #undef SET_BOOL
 #undef SET_DIGEST
 
+#define GET_BOOL_P(dst, req, k, src, f)				\
+do {								\
+	if (f == 0 && !strcmp(req, #k)) {			\
+	(dst)->key = #k;					\
+	(dst)->value = ((src)->mine.k) ? "Yes" : "No";		\
+	f++;							\
+	}							\
+} while (0)
+
+#define GET_DIGEST_P(dst, req, k, src, f)				\
+do {									\
+	if (f == 0 && !strcmp(req, #k)) {				\
+		(dst)->key = #k;					\
+		(dst)->value =						\
+		    ((src)->mine.k == DIGEST_NONE) ? "None" : "CRC32C,None";\
+		f++;							\
+	}								\
+} while (0)
+
+#define GET_NUM_P(dst, req, k, src, f, e)				\
+do {									\
+	if (f == 0 && !strcmp(req, #k)) {				\
+		(dst)->key = #k;					\
+		if (asprintf(&((dst)->value), "%u", (src)->mine.k) == -1)\
+			e++;						\
+		else							\
+			(dst)->flags |= KVP_VALUE_ALLOCED;		\
+		f++;							\
+	}								\
+} while (0)
+
+#define GET_STR_C(dst, req, k, src, f)				\
+do {								\
+	if (f == 0 && !strcmp(req, #k)) {			\
+		(dst)->key = #k;				\
+		(dst)->value = (src)->config.k;			\
+		f++;						\
+	}							\
+} while (0)
+
+#define GET_STYPE_C(dst, req, k, src, f)				\
+do {									\
+	if (f == 0 && !strcmp(req, #k)) {				\
+		(dst)->key = #k;					\
+		(dst)->value = ((src)->config.k == SESSION_TYPE_DISCOVERY)\
+		    ? "Discovery" : "Normal";				\
+		f++;							\
+	}								\
+} while (0)
+
 int
-conn_gen_kvp(struct connection *c, struct kvp *kvp, size_t *nkvp)
+kvp_set_from_mine(struct kvp *kvp, const char *key, struct connection *c)
 {
-	struct session *s = c->session;
-	size_t i = 0;
+	int e = 0, f = 0;
 
-	if (s->mine.MaxConnections != iscsi_sess_defaults.MaxConnections) {
-		if (kvp && i < *nkvp) {
-			kvp[i].key = "MaxConnections";
-			if (asprintf(&kvp[i].value, "%hu",
-			    s->mine.MaxConnections) == -1) {
-				kvp[i].value = NULL;
-				return -1;
-			}
-			kvp[i].flags |= KVP_VALUE_ALLOCED;
-		}
-		i++;
+	if (kvp->flags & KVP_KEY_ALLOCED)
+		free(kvp->key);
+	kvp->key = NULL;
+	if (kvp->flags & KVP_VALUE_ALLOCED)
+		free(kvp->value);
+	kvp->value = NULL;
+	kvp->flags = 0;
+
+	/* XXX handle at least CHAP */
+	if (!strcmp(key, "AuthMethod")) {
+		kvp->key = "AuthMethod";
+		kvp->value = "None";
+		return 0;
 	}
-	if (c->mine.MaxRecvDataSegmentLength !=
-	    iscsi_conn_defaults.MaxRecvDataSegmentLength) {
-		if (kvp && i < *nkvp) {
-			kvp[i].key = "MaxRecvDataSegmentLength";
-			if (asprintf(&kvp[i].value, "%u",
-			    c->mine.MaxRecvDataSegmentLength) == -1) {
-				kvp[i].value = NULL;
-				return -1;
-			}
-			kvp[i].flags |= KVP_VALUE_ALLOCED;
-		}
-		i++;
+	GET_DIGEST_P(kvp, key, HeaderDigest, c, f);
+	GET_DIGEST_P(kvp, key, DataDigest, c, f);
+	GET_NUM_P(kvp, key, MaxConnections, c->session, f, e);
+	GET_STR_C(kvp, key, TargetName, c->session, f);
+	GET_STR_C(kvp, key, InitiatorName, c->session, f);
+	GET_BOOL_P(kvp, key, InitialR2T, c->session, f);
+	GET_BOOL_P(kvp, key, ImmediateData, c->session, f);
+	GET_NUM_P(kvp, key, MaxRecvDataSegmentLength, c, f, e);
+	GET_NUM_P(kvp, key, MaxBurstLength, c->session, f, e);
+	GET_NUM_P(kvp, key, FirstBurstLength, c->session, f, e);
+	GET_NUM_P(kvp, key, DefaultTime2Wait, c->session, f, e);
+	GET_NUM_P(kvp, key, DefaultTime2Retain, c->session, f, e);
+	GET_NUM_P(kvp, key, MaxOutstandingR2T, c->session, f, e);
+	GET_BOOL_P(kvp, key, DataPDUInOrder, c->session, f);
+	GET_BOOL_P(kvp, key, DataSequenceInOrder, c->session, f);
+	GET_NUM_P(kvp, key, ErrorRecoveryLevel, c->session, f, e);
+	GET_STYPE_C(kvp, key, SessionType, c->session, f);
+	/* XXX handle TaskReporting */
+
+	if (f == 0) {
+		errno = EINVAL;
+		return 1;
 	}
 
-	*nkvp = i;
-	return 0;
+	return e;
 }
 
+#undef GET_BOOL_P
+#undef GET_DIGEST_P
+#undef GET_NUM_P
+#undef GET_STR_C
+#undef GET_STYPE_C
+
 void
 conn_pdu_write(struct connection *c, struct pdu *p)
 {
diff --git a/usr.sbin/iscsid/initiator.c b/usr.sbin/iscsid/initiator.c
index d873ac13d..325234f2f 100644
--- a/usr.sbin/iscsid/initiator.c
+++ b/usr.sbin/iscsid/initiator.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: initiator.c,v 1.20 2025/01/22 16:06:36 claudio Exp $ */
+/*	$OpenBSD: initiator.c,v 1.21 2025/01/28 20:41:44 claudio Exp $ */
 
 /*
  * Copyright (c) 2009 Claudio Jeker <claudio@openbsd.org>
@@ -48,6 +48,7 @@ struct task_logout {
 	u_int8_t		 reason;
 };
 
+int		 conn_is_leading(struct connection *);
 struct kvp	*initiator_login_kvp(struct connection *, u_int8_t);
 struct pdu	*initiator_login_build(struct connection *,
 		    struct task_login *);
@@ -308,49 +309,76 @@ initiator_nop_in_imm(struct connection *c, struct pdu *p)
 	conn_task_issue(c, t);
 }
 
+int
+conn_is_leading(struct connection *c)
+{
+	return c == TAILQ_FIRST(&c->session->connections);
+}
+
+#define MINE_NOT_DEFAULT(c, k) ((c)->mine.k != iscsi_conn_defaults.k)
+
 struct kvp *
 initiator_login_kvp(struct connection *c, u_int8_t stage)
 {
-	struct kvp *kvp;
-	size_t nkvp;
+	struct kvp *kvp = NULL;
+	size_t i = 0, len;
+	const char *discovery[] = {"SessionType", "InitiatorName",
+	    "AuthMethod", NULL};
+	const char *leading_only[] = {"MaxConnections", "InitialR2T",
+	    "ImmediateData", "MaxBurstLength", "FirstBurstLength",
+	    "DefaultTime2Wait", "DefaultTime2Retain", "MaxOutstandingR2T",
+	    "DataPDUInOrder", "DataSequenceInOrder", "ErrorRecoveryLevel",
+	    NULL};
+	const char *opneg_always[] = {"HeaderDigest", "DataDigest", NULL};
+	const char *secneg[] = {"SessionType", "InitiatorName", "TargetName",
+	    "AuthMethod", NULL};
+	const char **p, **q;
 
 	switch (stage) {
 	case ISCSI_LOGIN_STG_SECNEG:
-		if (!(kvp = calloc(5, sizeof(*kvp))))
-			return NULL;
-		kvp[0].key = "AuthMethod";
-		kvp[0].value = "None";
-		kvp[1].key = "InitiatorName";
-		kvp[1].value = c->session->config.InitiatorName;
-
 		if (c->session->config.SessionType == SESSION_TYPE_DISCOVERY) {
-			kvp[2].key = "SessionType";
-			kvp[2].value = "Discovery";
+			len = sizeof(discovery) / sizeof(*discovery);
+			q = discovery;
 		} else {
-			kvp[2].key = "SessionType";
-			kvp[2].value = "Normal";
-			kvp[3].key = "TargetName";
-			kvp[3].value = c->session->config.TargetName;
+			len = sizeof(secneg) / sizeof(*secneg);
+			q = secneg;
 		}
+		if (!(kvp = calloc(len + 1, sizeof(*kvp))))
+			return NULL;
+		for (p = q; *p != NULL; i++, p++)
+			if (kvp_set_from_mine(&kvp[i], *p, c))
+				goto fail;
 		break;
 	case ISCSI_LOGIN_STG_OPNEG:
-		if (conn_gen_kvp(c, NULL, &nkvp) == -1)
+		len = sizeof(opneg_always) / sizeof(*opneg_always);
+		if (conn_is_leading(c))
+			len += sizeof(leading_only) / sizeof(*leading_only);
+		if (MINE_NOT_DEFAULT(c, MaxRecvDataSegmentLength))
+			len++;
+		if (!(kvp = calloc(len + 1, sizeof(*kvp))))
 			return NULL;
-		nkvp += 1; /* add slot for terminator */
-		if (!(kvp = calloc(nkvp, sizeof(*kvp))))
-			return NULL;
-		if (conn_gen_kvp(c, kvp, &nkvp) == -1) {
-			kvp_free(kvp);
-			return NULL;
-		}
+		for (p = opneg_always; *p != NULL; i++, p++)
+			if (kvp_set_from_mine(&kvp[i], *p, c))
+				goto fail;
+		if (conn_is_leading(c))
+			for (p = leading_only; *p != NULL; i++, p++)
+				if (kvp_set_from_mine(&kvp[i], *p, c))
+					goto fail;
+		if (MINE_NOT_DEFAULT(c, MaxRecvDataSegmentLength) &&
+		    kvp_set_from_mine(&kvp[i], "MaxRecvDataSegmentLength", c))
+			goto fail;
 		break;
 	default:
 		log_warnx("initiator_login_kvp: exit stage left");
 		return NULL;
 	}
 	return kvp;
+fail:
+	kvp_free(kvp);
+	return NULL;
 }
 
+#undef MINE_NOT_DEFAULT
 struct pdu *
 initiator_login_build(struct connection *c, struct task_login *tl)
 {
diff --git a/usr.sbin/iscsid/iscsid.h b/usr.sbin/iscsid/iscsid.h
index aad1dc05b..d09ce8562 100644
--- a/usr.sbin/iscsid/iscsid.h
+++ b/usr.sbin/iscsid/iscsid.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: iscsid.h,v 1.23 2025/01/22 16:06:36 claudio Exp $ */
+/*	$OpenBSD: iscsid.h,v 1.24 2025/01/28 20:41:44 claudio Exp $ */
 
 /*
  * Copyright (c) 2009 Claudio Jeker <claudio@openbsd.org>
@@ -367,7 +367,7 @@ void	conn_task_issue(struct connection *, struct task *);
 void	conn_task_schedule(struct connection *);
 void	conn_task_cleanup(struct connection *, struct task *);
 int	conn_parse_kvp(struct connection *, struct kvp *);
-int	conn_gen_kvp(struct connection *, struct kvp *, size_t *);
+int	kvp_set_from_mine(struct kvp *, const char *, struct connection *);
 void	conn_pdu_write(struct connection *, struct pdu *);
 void	conn_fail(struct connection *);
 void	conn_fsm(struct connection *, enum c_event);
diff --git a/usr.sbin/npppd/npppd/radius_req.c b/usr.sbin/npppd/npppd/radius_req.c
index de6edf2b0..91e56bddc 100644
--- a/usr.sbin/npppd/npppd/radius_req.c
+++ b/usr.sbin/npppd/npppd/radius_req.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: radius_req.c,v 1.12 2024/02/26 08:47:28 yasuoka Exp $ */
+/*	$OpenBSD: radius_req.c,v 1.13 2025/01/29 10:21:03 yasuoka Exp $ */
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -28,7 +28,7 @@
 /**@file
  * This file provides functions for RADIUS request using radius(3) and event(3).
  * @author	Yasuoka Masahiko
- * $Id: radius_req.c,v 1.12 2024/02/26 08:47:28 yasuoka Exp $
+ * $Id: radius_req.c,v 1.13 2025/01/29 10:21:03 yasuoka Exp $
  */
 #include <sys/types.h>
 #include <sys/time.h>
@@ -329,7 +329,7 @@ radius_cancel_request(RADIUS_REQUEST_CTX ctx)
 	}
 	radius_req_setting_unref(lap->setting);
 
-	memset(lap->secret, 0x41, sizeof(lap->secret));
+	explicit_bzero(lap->secret, sizeof(lap->secret));
 
 	free(lap);
 }
diff --git a/usr.sbin/radiusd/radiusd.c b/usr.sbin/radiusd/radiusd.c
index 992bb5a48..94a1b260a 100644
--- a/usr.sbin/radiusd/radiusd.c
+++ b/usr.sbin/radiusd/radiusd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: radiusd.c,v 1.61 2024/11/21 13:43:10 claudio Exp $	*/
+/*	$OpenBSD: radiusd.c,v 1.62 2025/01/29 10:12:22 yasuoka Exp $	*/
 
 /*
  * Copyright (c) 2013, 2023 Internet Initiative Japan Inc.
@@ -946,11 +946,11 @@ radiusd_on_sigchld(int fd, short evmask, void *ctx)
 		}
 		if (!module) {
 			if (WIFEXITED(status))
-				log_warnx("unkown child process pid=%d exited "
+				log_warnx("unknown child process pid=%d exited "
 				    "with status %d", (int)pid,
 				     WEXITSTATUS(status));
 			else
-				log_warnx("unkown child process pid=%d exited "
+				log_warnx("unknown child process pid=%d exited "
 				    "by signal %d", (int)pid,
 				    WTERMSIG(status));
 		}
diff --git a/usr.sbin/radiusd/radiusd_ipcp.c b/usr.sbin/radiusd/radiusd_ipcp.c
index 4c021ffd5..7c381c16c 100644
--- a/usr.sbin/radiusd/radiusd_ipcp.c
+++ b/usr.sbin/radiusd/radiusd_ipcp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: radiusd_ipcp.c,v 1.21 2024/11/28 11:51:45 yasuoka Exp $	*/
+/*	$OpenBSD: radiusd_ipcp.c,v 1.23 2025/01/29 10:16:05 yasuoka Exp $	*/
 
 /*
  * Copyright (c) 2024 Internet Initiative Japan Inc.
@@ -897,6 +897,13 @@ ipcp_resdeco(void *ctx, u_int q_id, const u_char *req, size_t reqlen,
 		else if (radius_has_attr(radreq, RADIUS_TYPE_EAP_MESSAGE))
 			strlcpy(assigned->auth_method, "EAP",
 			    sizeof(assigned->auth_method));
+
+		radius_get_ipv4_attr(radreq, RADIUS_TYPE_NAS_IP_ADDRESS,
+		    &assigned->nas_ipv4);
+		radius_get_ipv6_attr(radreq, RADIUS_TYPE_NAS_IPV6_ADDRESS,
+		    &assigned->nas_ipv6);
+		radius_get_string_attr(radreq, RADIUS_TYPE_NAS_IDENTIFIER,
+		    assigned->nas_id, sizeof(assigned->nas_id));
 	}
 
 	if (self->name_server[0].s_addr != 0) {
@@ -937,7 +944,7 @@ ipcp_resdeco(void *ctx, u_int q_id, const u_char *req, size_t reqlen,
 		    RADIUS_VTYPE_MS_SECONDARY_NBNS_SERVER,
 		    self->netbios_server[1]);
 	}
-	if (!self->no_session_timeout &&
+	if (!self->no_session_timeout && assigned != NULL &&
 	    radius_has_attr(radres, RADIUS_TYPE_SESSION_TIMEOUT)) {
 		radius_get_uint32_attr(radres, RADIUS_TYPE_SESSION_TIMEOUT,
 		    &assigned->session_timeout);