sync with OpenBSD -current

lib/libcrypto/crypto_internal.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: crypto_internal.h,v 1.14 2024/11/08 14:05:43 jsing Exp $ */
+/*	$OpenBSD: crypto_internal.h,v 1.15 2025/01/19 07:51:41 jsing Exp $ */
 /*
  * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
  *
@@ -256,6 +256,16 @@ crypto_store_htole32(uint8_t *dst, uint32_t v)
 }
 #endif
 
+#ifndef HAVE_CRYPTO_ADD_U32DW_U64
+static inline void
+crypto_add_u32dw_u64(uint32_t *h, uint32_t *l, uint64_t v)
+{
+	v += ((uint64_t)*h << 32) | *l;
+	*h = v >> 32;
+	*l = v;
+}
+#endif
+
 #ifndef HAVE_CRYPTO_ROL_U32
 static inline uint32_t
 crypto_rol_u32(uint32_t v, size_t shift)

lib/libcrypto/evp/pmeth_lib.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: pmeth_lib.c,v 1.41 2024/07/09 17:02:29 tb Exp $ */
+/* $OpenBSD: pmeth_lib.c,v 1.42 2025/01/20 12:57:28 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -244,6 +244,11 @@ EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype, int cmd,
 }
 LCRYPTO_ALIAS(EVP_PKEY_CTX_ctrl);
 
+/*
+ * This is practically unused and would best be a part of the openssl(1) code,
+ * but, unfortunately, openssl-ruby exposes this directly in an interface and
+ * it's currently the only way to do RSA-PSS in Ruby.
+ */
 int
 EVP_PKEY_CTX_ctrl_str(EVP_PKEY_CTX *ctx, const char *name, const char *value)
 {

lib/libcrypto/md5/md5.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: md5.c,v 1.23 2024/06/01 07:36:16 tb Exp $ */
+/* $OpenBSD: md5.c,v 1.24 2025/01/19 07:51:41 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -278,19 +278,13 @@ MD5_Update(MD5_CTX *c, const void *data_, size_t len)
 {
 	const unsigned char *data = data_;
 	unsigned char *p;
-	MD5_LONG l;
 	size_t n;
 
 	if (len == 0)
 		return 1;
 
-	l = (c->Nl + (((MD5_LONG)len) << 3))&0xffffffffUL;
+	/* Update message bit counter. */
-	/* 95-05-24 eay Fixed a bug with the overflow handling, thanks to
+	crypto_add_u32dw_u64(&c->Nh, &c->Nl, (uint64_t)len << 3);
-	 * Wei Dai <weidai@eskimo.com> for pointing it out. */
-	if (l < c->Nl) /* overflow */
-		c->Nh++;
-	c->Nh+=(MD5_LONG)(len>>29);	/* might cause compiler warning on 16-bit */
-	c->Nl = l;
 
 	n = c->num;
 	if (n != 0) {

lib/libcrypto/md5/md5.h

@@ -1,4 +1,4 @@
-/* $OpenBSD: md5.h,v 1.23 2024/06/01 07:44:11 tb Exp $ */
+/* $OpenBSD: md5.h,v 1.24 2025/01/19 07:51:41 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -60,12 +60,13 @@
 
 #ifndef HEADER_MD5_H
 #define HEADER_MD5_H
+
+#include <openssl/opensslconf.h>
+
 #if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__OpenBSD__)
 #define __bounded__(x, y, z)
 #endif
 
-#include <openssl/opensslconf.h>
-
 #ifdef  __cplusplus
 extern "C" {
 #endif
@@ -74,12 +75,6 @@ extern "C" {
 #error MD5 is disabled.
 #endif
 
-/*
- * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
- * ! MD5_LONG has to be at least 32 bits wide.                     !
- * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
- */
-
 #define MD5_LONG unsigned int
 
 #define MD5_CBLOCK	64

lib/libcrypto/sha/sha1_amd64_generic.S

@@ -1,4 +1,4 @@
-/* $OpenBSD: sha1_amd64_generic.S,v 1.1 2024/12/04 13:13:33 jsing Exp $ */
+/* $OpenBSD: sha1_amd64_generic.S,v 1.2 2025/01/18 02:56:07 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -180,9 +180,9 @@ sha1_block_generic:
 	andq	$~63, %rsp
 	movq	%rax, (64+0*8)(%rsp)
 
-	/* Compute and store end of message. */
+	/* Compute end of message. */
 	shlq	$6, num
-	leaq	(in, num, 1), %rbp
+	leaq	(in, num, 1), end
 
 	/* Load current hash state from context. */
 	movl	(0*4)(ctx), hs0

lib/libssl/man/SSL_CTX_add1_chain_cert.3

@@ -1,4 +1,4 @@
-.\" $OpenBSD: SSL_CTX_add1_chain_cert.3,v 1.1 2019/04/05 18:29:43 schwarze Exp $
+.\" $OpenBSD: SSL_CTX_add1_chain_cert.3,v 1.2 2025/01/18 10:45:12 tb Exp $
 .\" selective merge up to: OpenSSL df75c2bf Dec 9 01:02:36 2018 +0100
 .\"
 .\" This file was written by Dr. Stephen Henson <steve@openssl.org>
@@ -49,7 +49,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: April 5 2019 $
+.Dd $Mdocdate: January 18 2025 $
 .Dt SSL_CTX_ADD1_CHAIN_CERT 3
 .Os
 .Sh NAME
@@ -203,7 +203,7 @@ in the parent
 .Vt SSL_CTX .
 .Pp
 One chain can be set for each key type supported by a server.
-So, for example, an RSA and a DSA certificate can (and often will) have
+So, for example, an RSA and an ECDSA certificate can have
 different chains.
 .Pp
 If any certificates are added using these functions, no certificates

lib/libssl/man/SSL_CTX_add_extra_chain_cert.3

@@ -1,4 +1,4 @@
-.\" $OpenBSD: SSL_CTX_add_extra_chain_cert.3,v 1.7 2020/01/02 09:09:16 schwarze Exp $
+.\" $OpenBSD: SSL_CTX_add_extra_chain_cert.3,v 1.8 2025/01/18 10:45:12 tb Exp $
 .\" full merge up to: OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
 .\"
 .\" This file was written by Lutz Jaenicke <jaenicke@openssl.org> and
@@ -50,7 +50,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: January 2 2020 $
+.Dd $Mdocdate: January 18 2025 $
 .Dt SSL_CTX_ADD_EXTRA_CHAIN_CERT 3
 .Os
 .Sh NAME
@@ -152,7 +152,7 @@ Only one set of extra chain certificates can be specified per
 structure using
 .Fn SSL_CTX_add_extra_chain_cert .
 Different chains for different certificates (for example if both
-RSA and DSA certificates are specified by the same server) or
+RSA and ECDSA certificates are specified by the same server) or
 different SSL structures with the same parent
 .Vt SSL_CTX
 require using the functions documented in

lib/libssl/man/SSL_CTX_set_cipher_list.3

@@ -1,4 +1,4 @@
-.\" $OpenBSD: SSL_CTX_set_cipher_list.3,v 1.16 2022/12/11 20:53:27 tb Exp $
+.\" $OpenBSD: SSL_CTX_set_cipher_list.3,v 1.18 2025/01/18 12:20:02 tb Exp $
 .\" full merge up to: OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
 .\"
 .\" This file is a derived work.
@@ -65,7 +65,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: December 11 2022 $
+.Dd $Mdocdate: January 18 2025 $
 .Dt SSL_CTX_SET_CIPHER_LIST 3
 .Os
 .Sh NAME
@@ -311,18 +311,6 @@ The full words returned by the
 .Cm ciphers
 command can be used to select individual cipher suites.
 .Pp
-The following words do not match anything because
-LibreSSL no longer provides any such cipher suites:
-.Pp
-.Bl -tag -width Ds -compact
-.It Cm DES
-Cipher suites using single DES for symmetric encryption.
-.It Cm DSS
-Cipher suites using DSS server authentication.
-.It Cm IDEA
-Cipher suites using IDEA for symmetric encryption.
-.El
-.Pp
 The following are deprecated aliases:
 .Pp
 .Bl -column kEECDH ECDHE -compact -offset indent
@@ -350,10 +338,6 @@ RSA ciphers using DHE need a certificate and key and additional DH-parameters
 (see
 .Xr SSL_CTX_set_tmp_dh_callback 3 ) .
 .Pp
-A DSA cipher can only be chosen when a DSA certificate is available.
-DSA ciphers always use DH key exchange and therefore need DH-parameters (see
-.Xr SSL_CTX_set_tmp_dh_callback 3 ) .
-.Pp
 When these conditions are not met
 for any cipher suite in the list (for example, a
 client only supports export RSA ciphers with an asymmetric key length of 512

lib/libssl/man/SSL_CTX_set_security_level.3

@@ -1,4 +1,4 @@
-.\" $OpenBSD: SSL_CTX_set_security_level.3,v 1.1 2022/07/13 20:52:36 schwarze Exp $
+.\" $OpenBSD: SSL_CTX_set_security_level.3,v 1.2 2025/01/18 10:45:12 tb Exp $
 .\"
 .\" Copyright (c) 2022 Ingo Schwarze <schwarze@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: July 13 2022 $
+.Dd $Mdocdate: January 18 2025 $
 .Dt SSL_CTX_SET_SECURITY_LEVEL 3
 .Os
 .Sh NAME
@@ -78,7 +78,7 @@ See SP800-57 below
 .Sx SEE ALSO
 for details on individual algorithms.
 .It RSA
-The minimum key length in bits for the RSA, DSA, and DH algorithms.
+The minimum key length in bits for the RSA and DH algorithms.
 .It ECC
 The minimum key length in bits for ECC algorithms.
 .It TLS

lib/libssl/man/SSL_CTX_set_tmp_dh_callback.3

@@ -1,4 +1,4 @@
-.\"	$OpenBSD: SSL_CTX_set_tmp_dh_callback.3,v 1.10 2022/03/31 17:27:18 naddy Exp $
+.\"	$OpenBSD: SSL_CTX_set_tmp_dh_callback.3,v 1.11 2025/01/18 10:45:12 tb Exp $
 .\"	OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
 .\"
 .\" This file was written by Lutz Jaenicke <jaenicke@openssl.org>.
@@ -48,7 +48,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: March 31 2022 $
+.Dd $Mdocdate: January 18 2025 $
 .Dt SSL_CTX_SET_TMP_DH_CALLBACK 3
 .Os
 .Sh NAME
@@ -104,7 +104,6 @@ These functions apply to SSL/TLS servers only.
 .Pp
 When using a cipher with RSA authentication,
 an ephemeral DH key exchange can take place.
-Ciphers with DSA keys always use ephemeral DH keys as well.
 In these cases, the session data are negotiated using the ephemeral/temporary
 DH key and the key supplied and certified by the certificate chain is only used
 for signing.

lib/libssl/man/SSL_CTX_use_certificate.3

@@ -1,4 +1,4 @@
-.\" $OpenBSD: SSL_CTX_use_certificate.3,v 1.16 2021/03/31 16:53:30 tb Exp $
+.\" $OpenBSD: SSL_CTX_use_certificate.3,v 1.17 2025/01/18 10:45:12 tb Exp $
 .\" full merge up to: OpenSSL 3aaa1bd0 Mar 28 16:35:25 2017 +1000
 .\" selective merge up to: OpenSSL d1f7a1e6 Apr 26 14:05:40 2018 +0100
 .\"
@@ -50,7 +50,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: March 31 2021 $
+.Dd $Mdocdate: January 18 2025 $
 .Dt SSL_CTX_USE_CERTIFICATE 3
 .Os
 .Sh NAME
@@ -315,7 +315,7 @@ It compares the
 key components and parameters of an OpenSSL private key with the
 corresponding certificate loaded into
 .Fa ctx .
-If more than one key/certificate pair (RSA/DSA) is installed,
+If more than one key/certificate pair (RSA/ECDSA) is installed,
 the last item installed will be compared.
 If, e.g., the last item was an RSA certificate or key,
 the RSA key/certificate pair will be checked.

lib/libssl/ssl_ciph.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_ciph.c,v 1.149 2024/08/31 12:46:55 jsing Exp $ */
+/* $OpenBSD: ssl_ciph.c,v 1.151 2025/01/18 12:20:37 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -218,14 +218,6 @@ static const SSL_CIPHER cipher_aliases[] = {
 		.name = SSL_TXT_aRSA,
 		.algorithm_auth = SSL_aRSA,
 	},
-	{
-		.name = SSL_TXT_aDSS,
-		.algorithm_auth = SSL_aDSS,
-	},
-	{
-		.name = SSL_TXT_DSS,
-		.algorithm_auth = SSL_aDSS,
-	},
 	{
 		.name = SSL_TXT_aNULL,
 		.algorithm_auth = SSL_aNULL,
@@ -1369,9 +1361,6 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
 	case SSL_aRSA:
 		au = "RSA";
 		break;
-	case SSL_aDSS:
-		au = "DSS";
-		break;
 	case SSL_aNULL:
 		au = "None";
 		break;
@@ -1546,8 +1535,6 @@ SSL_CIPHER_get_cipher_nid(const SSL_CIPHER *c)
 		return NID_camellia_256_cbc;
 	case SSL_CHACHA20POLY1305:
 		return NID_chacha20_poly1305;
-	case SSL_DES:
-		return NID_des_cbc;
 	case SSL_RC4:
 		return NID_rc4;
 	default:

lib/libssl/ssl_local.h

@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_local.h,v 1.24 2025/01/17 22:39:42 tb Exp $ */
+/* $OpenBSD: ssl_local.h,v 1.26 2025/01/18 12:20:37 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -202,16 +202,13 @@ __BEGIN_HIDDEN_DECLS
 
 /* Bits for algorithm_auth (server authentication) */
 #define SSL_aRSA		0x00000001L /* RSA auth */
-#define SSL_aDSS		0x00000002L /* DSS auth */
 #define SSL_aNULL		0x00000004L /* no auth (i.e. use ADH or AECDH) */
 #define SSL_aECDSA              0x00000040L /* ECDSA auth*/
 #define SSL_aTLS1_3		0x00000400L /* TLSv1.3 authentication */
 
 /* Bits for algorithm_enc (symmetric encryption) */
-#define SSL_DES			0x00000001L
 #define SSL_3DES		0x00000002L
 #define SSL_RC4			0x00000004L
-#define SSL_IDEA		0x00000008L
 #define SSL_eNULL		0x00000010L
 #define SSL_AES128		0x00000020L
 #define SSL_AES256		0x00000040L

lib/libssl/ssl_seclevel.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: ssl_seclevel.c,v 1.29 2024/10/17 06:19:06 tb Exp $ */
+/*	$OpenBSD: ssl_seclevel.c,v 1.30 2025/01/18 10:52:09 tb Exp $ */
 /*
  * Copyright (c) 2020-2022 Theo Buehler <tb@openbsd.org>
  *
@@ -309,11 +309,6 @@ ssl_cert_pubkey_security_bits(const X509 *x509)
 	if ((pkey = X509_get0_pubkey(x509)) == NULL)
 		return -1;
 
-	/*
-	 * XXX: DSA_security_bits() returns -1 on keys without parameters and
-	 * makes the default security callback fail.
-	 */
-
 	return EVP_PKEY_security_bits(pkey);
 }
 

lib/libssl/t1_lib.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_lib.c,v 1.198 2023/11/18 10:51:09 tb Exp $ */
+/* $OpenBSD: t1_lib.c,v 1.204 2025/01/18 14:17:05 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -128,9 +128,9 @@ int
 tls1_new(SSL *s)
 {
 	if (!ssl3_new(s))
-		return (0);
+		return 0;
 	s->method->ssl_clear(s);
-	return (1);
+	return 1;
 }
 
 void
@@ -628,46 +628,31 @@ tls1_check_group(SSL *s, uint16_t group_id)
 static int
 tls1_set_ec_id(uint16_t *group_id, uint8_t *comp_id, EC_KEY *ec)
 {
-	const EC_GROUP *grp;
+	const EC_GROUP *group;
-	const EC_METHOD *meth;
-	int prime_field;
 	int nid;
 
-	if (ec == NULL)
+	if ((group = EC_KEY_get0_group(ec)) == NULL)
-		return (0);
+		return 0;
-
-	/* Determine whether the group is defined over a prime field. */
-	if ((grp = EC_KEY_get0_group(ec)) == NULL)
-		return (0);
-	if ((meth = EC_GROUP_method_of(grp)) == NULL)
-		return (0);
-	prime_field = (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field);
 
 	/* Determine group ID. */
-	nid = EC_GROUP_get_curve_name(grp);
+	nid = EC_GROUP_get_curve_name(group);
-	/* If we have an ID set it, otherwise set arbitrary explicit group. */
 	if (!tls1_ec_nid2group_id(nid, group_id))
-		*group_id = prime_field ? 0xff01 : 0xff02;
+		return 0;
-
-	if (comp_id == NULL)
-		return (1);
 
 	/* Specify the compression identifier. */
 	if (EC_KEY_get0_public_key(ec) == NULL)
-		return (0);
+		return 0;
 	*comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 	if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED) {
-		*comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
+		*comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
-		if (prime_field)
-			*comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 	}
 
-	return (1);
+	return 1;
 }
 
 /* Check that an EC key is compatible with extensions. */
 static int
-tls1_check_ec_key(SSL *s, const uint16_t *group_id, const uint8_t *comp_id)
+tls1_check_ec_key(SSL *s, const uint16_t group_id, const uint8_t comp_id)
 {
 	size_t groupslen, formatslen, i;
 	const uint16_t *groups;
@@ -678,29 +663,29 @@ tls1_check_ec_key(SSL *s, const uint16_t *group_id, const uint8_t *comp_id)
 	 * is supported (see RFC4492).
 	 */
 	tls1_get_formatlist(s, 1, &formats, &formatslen);
-	if (comp_id != NULL && formats != NULL) {
+	if (formats != NULL) {
 		for (i = 0; i < formatslen; i++) {
-			if (formats[i] == *comp_id)
+			if (formats[i] == comp_id)
 				break;
 		}
 		if (i == formatslen)
-			return (0);
+			return 0;
 	}
 
 	/*
 	 * Check group list if present, otherwise everything is supported.
 	 */
 	tls1_get_group_list(s, 1, &groups, &groupslen);
-	if (group_id != NULL && groups != NULL) {
+	if (groups != NULL) {
 		for (i = 0; i < groupslen; i++) {
-			if (groups[i] == *group_id)
+			if (groups[i] == group_id)
 				break;
 		}
 		if (i == groupslen)
-			return (0);
+			return 0;
 	}
 
-	return (1);
+	return 1;
 }
 
 /* Check EC server key is compatible with client extensions. */
@@ -714,15 +699,15 @@ tls1_check_ec_server_key(SSL *s)
 	EVP_PKEY *pkey;
 
 	if (cpk->x509 == NULL || cpk->privatekey == NULL)
-		return (0);
+		return 0;
 	if ((pkey = X509_get0_pubkey(cpk->x509)) == NULL)
-		return (0);
+		return 0;
 	if ((eckey = EVP_PKEY_get0_EC_KEY(pkey)) == NULL)
-		return (0);
+		return 0;
 	if (!tls1_set_ec_id(&group_id, &comp_id, eckey))
-		return (0);
+		return 0;
 
-	return tls1_check_ec_key(s, &group_id, &comp_id);
+	return tls1_check_ec_key(s, group_id, comp_id);
 }
 
 int

regress/lib/libcrypto/md/md_test.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: md_test.c,v 1.1.1.1 2022/09/02 13:34:48 tb Exp $ */
+/*	$OpenBSD: md_test.c,v 1.3 2025/01/19 10:17:39 tb Exp $ */
 /*
  * Copyright (c) 2022 Joshua Sing <joshua@hypera.dev>
  *
@@ -200,6 +200,17 @@ md_hash_from_algorithm(int algorithm, const char **out_label,
 	return 1;
 }
 
+static void
+hexdump(const unsigned char *buf, size_t len)
+{
+	size_t i;
+
+	for (i = 1; i <= len; i++)
+		fprintf(stderr, " 0x%02hhx,%s", buf[i - 1], i % 8 ? "" : "\n");
+
+	fprintf(stderr, "\n");
+}
+
 static int
 md_test(void)
 {
@@ -290,12 +301,66 @@ md_test(void)
 	return failed;
 }
 
+static int
+md5_large_test(void)
+{
+	MD5_CTX ctx;
+	uint8_t in[1024];
+	uint8_t out[EVP_MAX_MD_SIZE];
+	unsigned int out_len;
+	size_t in_len;
+	size_t i;
+	const char *label;
+	uint8_t want[] = {
+		0xd8, 0xbc, 0xae, 0x13, 0xb5, 0x5a, 0xb0, 0xfc,
+		0x7f, 0x8a, 0xe1, 0x78, 0x27, 0x8d, 0x44, 0x1b,
+	};
+	int failed = 1;
+
+	memset(in, 'A', sizeof(in));
+	in_len = sizeof(in);
+
+	memset(out, 0, sizeof(out));
+	out_len = 16;
+
+	label = "md5";
+
+	MD5_Init(&ctx);
+
+	for (i = 0; i < (1<<29) + 1; i += in_len) {
+		if (!MD5_Update(&ctx, in, in_len)) {
+			fprintf(stderr, "FAIL (%s): MD5_Update failed\n", label);
+			goto failed;
+		}
+	}
+	if (!MD5_Final(out, &ctx)) {
+		fprintf(stderr, "FAIL (%s): MD5_Final failed\n", label);
+		goto failed;
+	}
+
+	if (memcmp(out, want, out_len) != 0) {
+		fprintf(stderr, "FAIL (%s): MD5 mismatch\n", label);
+		hexdump(out, out_len);
+		goto failed;
+	}
+	if (ctx.Nh != 0x1 || ctx.Nl != 0x2000) {
+		fprintf(stderr, "FAIL (%s): MD5 incorrect bit length\n", label);
+		goto failed;
+	}
+
+	failed = 0;
+
+ failed:
+	return failed;
+}
+
 int
 main(int argc, char **argv)
 {
 	int failed = 0;
 
 	failed |= md_test();
+	failed |= md5_large_test();
 
 	return failed;
 }

regress/usr.bin/mandoc/mdoc/Rs/Makefile

@@ -1,9 +1,9 @@
-# $OpenBSD: Makefile,v 1.12 2020/02/27 01:25:58 schwarze Exp $
+# $OpenBSD: Makefile,v 1.13 2025/01/19 23:01:27 schwarze Exp $
 
-REGRESS_TARGETS	 = allch args break empty paragraph three_authors transp
+REGRESS_TARGETS	 = allch args break empty paragraph three_authors rfc transp
 UTF8_TARGETS	 = allch break empty three_authors
 LINT_TARGETS	 = allch args empty
-HTML_TARGETS	 = paragraph
+HTML_TARGETS	 = paragraph rfc
 
 # groff-1.22.3 defect:
 # - arguments after .Rs cause the macro to be ignored

regress/usr.bin/mandoc/mdoc/Rs/rfc.in

@@ -0,0 +1,18 @@
+.\" $OpenBSD: rfc.in,v 1.1 2025/01/19 23:01:27 schwarze Exp $
+.Dd $Mdocdate: January 19 2025 $
+.Dt RS-RFC 1
+.Os
+.Sh NAME
+.Nm Rs-RFC
+.Nd reference an RFC
+.Sh STANDARDS
+BEGINTEST
+.Pp
+.Rs
+.%A David Waitzman
+.%T A Standard for the Transmission of IP Datagrams on Avian Carriers
+.%R RFC 1149
+.%D April 1990
+.Re
+.Pp
+ENDTEST

regress/usr.bin/mandoc/mdoc/Rs/rfc.out_ascii

@@ -0,0 +1,14 @@
+RS-RFC(1)                   General Commands Manual                  RS-RFC(1)
+
+NNAAMMEE
+     RRss--RRFFCC - reference an RFC
+
+SSTTAANNDDAARRDDSS
+     BEGINTEST
+
+     David Waitzman, _A _S_t_a_n_d_a_r_d _f_o_r _t_h_e _T_r_a_n_s_m_i_s_s_i_o_n _o_f _I_P _D_a_t_a_g_r_a_m_s _o_n _A_v_i_a_n
+     _C_a_r_r_i_e_r_s, RFC 1149, April 1990.
+
+     ENDTEST
+
+OpenBSD                        January 19, 2025                        OpenBSD

regress/usr.bin/mandoc/mdoc/Rs/rfc.out_html

@@ -0,0 +1,5 @@
+<p class="Pp"><cite class="Rs"><span class="RsA">David Waitzman</span>,
+    <span class="RsT">A Standard for the Transmission of IP Datagrams on Avian
+    Carriers</span>,
+    <a class="RsR" href="https://www.rfc-editor.org/rfc/rfc1149.html">RFC
+    1149</a>, <span class="RsD">April 1990</span>.</cite></p>

regress/usr.bin/mandoc/mdoc/Rs/rfc.out_markdown

@@ -0,0 +1,18 @@
+RS-RFC(1) - General Commands Manual
+
+# NAME
+
+**Rs-RFC** - reference an RFC
+
+# STANDARDS
+
+BEGINTEST
+
+David Waitzman,
+*A Standard for the Transmission of IP Datagrams on Avian Carriers*,
+[RFC 1149](http://www.rfc-editor.org/rfc/rfc1149.html),
+April 1990.
+
+ENDTEST
+
+OpenBSD - January 19, 2025

regress/usr.bin/openssl/appstest.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# $OpenBSD: appstest.sh,v 1.66 2025/01/15 05:02:01 tb Exp $
+# $OpenBSD: appstest.sh,v 1.67 2025/01/19 11:04:35 tb Exp $
 #
 # Copyright (c) 2016 Kinichiro Inoguchi <inoguchi@openbsd.org>
 #
@@ -338,7 +338,7 @@ function test_key {
 
 		echo -n "ec - $curve ... ecparam ... "
 		$openssl_bin ecparam -out $ecparam -name $curve -genkey \
-			-param_enc explicit -conv_form compressed -C
+			-param_enc explicit -conv_form compressed
 		check_exit_status $?
 
 		echo -n "ec ... "
@@ -934,7 +934,7 @@ __EOF__
 	check_exit_status $?
 
 	start_message "x509 ... get detail info about server cert#1"
-	$openssl_bin x509 -in $sv_rsa_cert -text -C -dates -startdate -enddate \
+	$openssl_bin x509 -in $sv_rsa_cert -text -dates -startdate -enddate \
 		-fingerprint -issuer -issuer_hash -issuer_hash_old \
 		-subject -hash -subject_hash -subject_hash_old -ocsp_uri \
 		-ocspid -modulus -pubkey -serial -email -noout -trustout \

share/man/man9/pmap.9

@@ -1,4 +1,4 @@
-.\"	$OpenBSD: pmap.9,v 1.20 2023/04/13 15:23:21 miod Exp $
+.\"	$OpenBSD: pmap.9,v 1.21 2025/01/19 22:14:45 kettenis Exp $
 .\"
 .\" Copyright (c) 2001, 2002, 2003 CubeSoft Communications, Inc.
 .\" <http://www.csoft.org>
@@ -24,7 +24,7 @@
 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: April 13 2023 $
+.Dd $Mdocdate: January 19 2025 $
 .Dt PMAP_INIT 9
 .Os
 .Sh NAME
@@ -49,6 +49,7 @@
 .Nm pmap_growkernel ,
 .Nm pmap_update ,
 .Nm pmap_collect ,
+.Nm pmap_populate ,
 .Nm pmap_virtual_space
 .Nd machine dependent interface to the MMU
 .Sh SYNOPSIS
@@ -364,6 +365,8 @@ it contains no valid mappings.
 .Ft void
 .Fn pmap_collect "pmap_t pmap"
 .Ft void
+.Fn pmap_populate "pmap_t pmap" "vaddr_t va"
+.Ft void
 .Fn pmap_virtual_space "vaddr_t *vstartp" "vaddr_t *vendp"
 .nr nS 0
 .Pp
@@ -384,6 +387,14 @@ function notifies the
 module to force processing of all delayed actions for all pmaps.
 .Pp
 The
+.Fn pmap_populate
+function makes sure the resources necessary for mapping the specified
+virtual address
+.Fa va
+are allocated in the target physical map
+.Fa pmap .
+.Pp
+The
 .Fn pmap_collect
 function informs the
 .Nm pmap

share/zoneinfo/datfiles/antarctica

@@ -1,4 +1,4 @@
-# $OpenBSD: antarctica,v 1.49 2024/10/02 17:08:47 millert Exp $
+# $OpenBSD: antarctica,v 1.50 2025/01/19 22:03:27 millert Exp $
 # tzdb data for Antarctica and environs
 
 # This file is in the public domain, so clarified as of
@@ -184,6 +184,8 @@ Zone Antarctica/DumontDUrville 0 -	-00	1947
 
 # France & Italy - year-round base
 # Concordia, -750600+1232000, since 2005
+# https://en.wikipedia.org/wiki/Concordia_Station
+# Can use Asia/Singapore, which it has agreed with since inception.
 
 # Germany - year-round base
 # Neumayer III, -704080-0081602, since 2009

share/zoneinfo/datfiles/asia

@@ -1,4 +1,4 @@
-# $OpenBSD: asia,v 1.110 2024/10/02 17:08:47 millert Exp $
+# $OpenBSD: asia,v 1.111 2025/01/19 22:03:27 millert Exp $
 # tzdb data for Asia and environs
 
 # This file is in the public domain, so clarified as of
@@ -3716,21 +3716,70 @@ Zone	Asia/Hebron	2:20:23	-	LMT	1900 Oct
 # be immediately followed by 1845-01-01; see R.H. van Gent's
 # History of the International Date Line
 # https://webspace.science.uu.nl/~gent0113/idl/idl_philippines.htm
-# The rest of the data entries are from Shanks & Pottenger.
 
-# From Jesper Nørgaard Welen (2006-04-26):
+# From P Chan (2021-05-10):
-# ... claims that Philippines had DST last time in 1990:
+# Here's a fairly comprehensive article in Japanese:
-# http://story.philippinetimes.com/p.x/ct/9/id/145be20cc6b121c0/cid/3e5bbccc730d258c/
+#	https://wiki.suikawiki.org/n/Philippine%20Time
-# [a story dated 2006-04-25 by Cris Larano of Dow Jones Newswires,
+# (2021-05-16):
-# but no details]
+# According to the references listed in the article,
-
+# the periods that the Philippines (Manila) observed DST or used +9 are:
-# From Paul Eggert (2014-08-14):
+#
-# The following source says DST may be instituted November-January and again
+# 1936-10-31 24:00 to 1937-01-15 24:00
-# March-June, but this is not definite.  It also says DST was last proclaimed
+#	(Proclamation No. 104, Proclamation No. 126)
-# during the Ramos administration (1992-1998); but again, no details.
+# 1941-12-15 24:00 to 1945-11-30 24:00
-# Carcamo D. PNoy urged to declare use of daylight saving time.
+#	(Proclamation No. 789, Proclamation No. 20)
-# Philippine Star 2014-08-05
+# 1954-04-11 24:00 to 1954-06-04 24:00
-# http://www.philstar.com/headlines/2014/08/05/1354152/pnoy-urged-declare-use-daylight-saving-time
+#	(Proclamation No. 13, Proclamation No. 33)
+# 1977-03-27 24:00 to 1977-09-21 24:00
+#	(Proclamation No. 1629, Proclamation No. 1641)
+# 1990-05-21 00:00 to 1990-07-28 24:00
+#	(National Emergency Memorandum Order No. 17, Executive Order No. 415)
+#
+# Proclamation No. 104 ... October 30, 1936
+#  https://www.officialgazette.gov.ph/1936/10/30/proclamation-no-104-s-1936/
+# Proclamation No. 126 ... January 15, 1937
+#  https://www.officialgazette.gov.ph/1937/01/15/proclamation-no-126-s-1937/
+# Proclamation No. 789 ... December 13, 1941
+#  https://www.officialgazette.gov.ph/1941/12/13/proclamation-no-789-s-1941/
+# Proclamation No. 20 ... November 11, 1945
+#  https://www.officialgazette.gov.ph/1945/11/11/proclamation-no-20-s-1945/
+# Proclamation No. 13 ... April 6, 1954
+#  https://www.officialgazette.gov.ph/1954/04/06/proclamation-no-13-s-1954/
+# Proclamation No. 33 ... June 3, 1954
+#  https://www.officialgazette.gov.ph/1954/06/03/proclamation-no-33-s-1954/
+# Proclamation No. 1629 ... March 25, 1977
+#  https://www.officialgazette.gov.ph/1977/03/25/proclamation-no-1629-s-1977/
+# Proclamation No. 1641 ...May 26, 1977
+#  https://www.officialgazette.gov.ph/1977/05/26/proclamation-no-1641-s-1977/
+# National Emergency Memorandum Order No. 17 ... May 2, 1990
+#  https://www.officialgazette.gov.ph/1990/05/02/national-emergency-memorandum-order-no-17-s-1990/
+# Executive Order No. 415 ... July 20, 1990
+#  https://www.officialgazette.gov.ph/1990/07/20/executive-order-no-415-s-1990/
+#
+# During WWII, Proclamation No. 789 fixed two periods of DST. The first period
+# was set to continue only until January 31, 1942. But Manila was occupied by
+# the Japanese earlier in the month....
+#
+# For the date of the adoption of standard time, Shank[s] gives 1899-05-11.
+# The article is not able to state the basis of that. I guess it was based on
+# a US War Department Circular issued on that date.
+#	https://books.google.com/books?id=JZ1PAAAAYAAJ&pg=RA3-PA8
+#
+# However, according to other sources, standard time was adopted on
+# 1899-09-06.  Also, the LMT was GMT+8:03:52
+#	https://books.google.com/books?id=MOYIAQAAIAAJ&pg=PA521
+#	https://books.google.com/books?id=lSnqqatpYikC&pg=PA21
+#
+# From Paul Eggert (2024-09-05):
+# The penultimate URL in P Chan's email refers to page 521 of
+# Selga M, The Time Service in the Philippines.
+# Proc Pan-Pacific Science Congress. Vol. 1 (1923), 519-532.
+# It says, "The change from the meridian 120° 58' 04" to the 120th implied a
+# change of 3 min. 52s.26 in time; consequently on 6th September, 1899,
+# Manila Observatory gave the noon signal 3 min. 52s.26 later than before".
+#
+# Wikipedia says the US declared Manila liberated on March 4, 1945;
+# this doesn't affect clocks, just our time zone abbreviation and DST flag.
 
 # From Paul Goyette (2018-06-15) with URLs updated by Guy Harris (2024-02-15):
 # In the Philippines, there is a national law, Republic Act No. 10535
@@ -3748,24 +3797,26 @@ Zone	Asia/Hebron	2:20:23	-	LMT	1900 Oct
 # influence of the sources.  There is no current abbreviation for DST,
 # so use "PDT", the usual American style.
 
-# From P Chan (2021-05-10):
-# Here's a fairly comprehensive article in Japanese:
-# https://wiki.suikawiki.org/n/Philippine%20Time
-# From Paul Eggert (2021-05-10):
-# The info in the Japanese table has not been absorbed (yet) below.
-
 # Rule	NAME	FROM	TO	-	IN	ON	AT	SAVE	LETTER/S
-Rule	Phil	1936	only	-	Nov	1	0:00	1:00	D
+Rule	Phil	1936	only	-	Oct	31	24:00	1:00	D
-Rule	Phil	1937	only	-	Feb	1	0:00	0	S
+Rule	Phil	1937	only	-	Jan	15	24:00	0	S
-Rule	Phil	1954	only	-	Apr	12	0:00	1:00	D
+Rule	Phil	1941	only	-	Dec	15	24:00	1:00	D
-Rule	Phil	1954	only	-	Jul	1	0:00	0	S
+# The following three rules were canceled by Japan:
-Rule	Phil	1978	only	-	Mar	22	0:00	1:00	D
+#Rule	Phil	1942	only	-	Jan	31	24:00	0	S
-Rule	Phil	1978	only	-	Sep	21	0:00	0	S
+#Rule	Phil	1942	only	-	Mar	 1	 0:00	1:00	D
+#Rule	Phil	1942	only	-	Jun	30	24:00	0	S
+Rule	Phil	1945	only	-	Nov	30	24:00	0	S
+Rule	Phil	1954	only	-	Apr	11	24:00	1:00	D
+Rule	Phil	1954	only	-	Jun	 4	24:00	0	S
+Rule	Phil	1977	only	-	Mar	27	24:00	1:00	D
+Rule	Phil	1977	only	-	Sep	21	24:00	0	S
+Rule	Phil	1990	only	-	May	21	 0:00	1:00	D
+Rule	Phil	1990	only	-	Jul	28	24:00	0	S
 # Zone	NAME		STDOFF	RULES	FORMAT	[UNTIL]
-Zone	Asia/Manila	-15:56:00 -	LMT	1844 Dec 31
+Zone	Asia/Manila	-15:56:08 -	LMT	1844 Dec 31
-			8:04:00 -	LMT	1899 May 11
+			8:03:52 -	LMT	1899 Sep  6  4:00u
-			8:00	Phil	P%sT	1942 May
+			8:00	Phil	P%sT	1942 Feb 11 24:00
-			9:00	-	JST	1944 Nov
+			9:00	-	JST	1945 Mar  4
 			8:00	Phil	P%sT
 
 # Qatar

share/zoneinfo/datfiles/australasia

@@ -1,4 +1,4 @@
-# $OpenBSD: australasia,v 1.80 2024/10/02 17:08:47 millert Exp $
+# $OpenBSD: australasia,v 1.81 2025/01/19 22:03:27 millert Exp $
 # tzdb data for Australasia and environs, and for much of the Pacific
 
 # This file is in the public domain, so clarified as of
@@ -1302,10 +1302,10 @@ Zone	Pacific/Wallis	12:15:20 -	LMT	1901
 # The 1992 ending date used in the rules is a best guess;
 # it matches what was used in the past.
 
-# The Australian Bureau of Meteorology FAQ
+# From Christopher Hunt (2006-11-21), after an advance warning
-# http://www.bom.gov.au/faq/faqgen.htm
+# from Jesper Nørgaard Welen (2006-11-01):
-# (1999-09-27) writes that Giles Meteorological Station uses
+# WA are trialing DST for three years.
-# South Australian time even though it's located in Western Australia.
+# http://www.parliament.wa.gov.au/parliament/bills.nsf/9A1B183144403DA54825721200088DF1/$File/Bill175-1B.pdf
 
 # From Paul Eggert (2018-04-01):
 # The Guardian Express of Perth, Australia reported today that the
@@ -1317,54 +1317,10 @@ Zone	Pacific/Wallis	12:15:20 -	LMT	1901
 # https://www.communitynews.com.au/guardian-express/news/exclusive-daylight-savings-coming-wa-summer-2018/
 # [The article ends with "Today's date is April 1."]
 
-# Queensland
+# The Australian Bureau of Meteorology FAQ
-
+# http://www.bom.gov.au/faq/faqgen.htm
-# From Paul Eggert (2018-02-26):
+# (1999-09-27) writes that Giles Meteorological Station uses
-# I lack access to the following source for Queensland DST:
+# South Australian time even though it's located in Western Australia.
-# Pearce C. History of daylight saving time in Queensland.
-# Queensland Hist J. 2017 Aug;23(6):389-403
-# https://search.informit.com.au/documentSummary;dn=994682348436426;res=IELHSS
-
-# From George Shepherd via Simon Woodhead via Robert Elz (1991-03-06):
-# #   The state of QUEENSLAND.. [ Courtesy Qld. Dept Premier Econ&Trade Devel ]
-# #						[ Dec 1990 ]
-# ...
-# Zone	Australia/Queensland	10:00	AQ	%sST
-# ...
-# Rule	AQ	1971	only	-	Oct	lastSun	2:00	1:00	D
-# Rule	AQ	1972	only	-	Feb	lastSun	3:00	0	E
-# Rule	AQ	1989	max	-	Oct	lastSun	2:00	1:00	D
-# Rule	AQ	1990	max	-	Mar	Sun>=1	3:00	0	E
-
-# From Bradley White (1989-12-24):
-# "Australia/Queensland" now observes daylight time (i.e. from
-# October 1989).
-
-# From Bradley White (1991-03-04):
-# A recent excerpt from an Australian newspaper...
-# ...Queensland...[has] agreed to end daylight saving
-# at 3am tomorrow (March 3)...
-
-# From John Mackin (1991-03-06):
-# I can certainly confirm for my part that Daylight Saving in NSW did in fact
-# end on Sunday, 3 March.  I don't know at what hour, though.  (It surprised
-# me.)
-
-# From Bradley White (1992-03-08):
-# ...there was recently a referendum in Queensland which resulted
-# in the experimental daylight saving system being abandoned. So, ...
-# ...
-# Rule	QLD	1989	1991	-	Oct	lastSun	2:00	1:00	D
-# Rule	QLD	1990	1992	-	Mar	Sun>=1	3:00	0	S
-# ...
-
-# From Arthur David Olson (1992-03-08):
-# The chosen rules the union of the 1971/1972 change and the 1989-1992 changes.
-
-# From Christopher Hunt (2006-11-21), after an advance warning
-# from Jesper Nørgaard Welen (2006-11-01):
-# WA are trialing DST for three years.
-# http://www.parliament.wa.gov.au/parliament/bills.nsf/9A1B183144403DA54825721200088DF1/$File/Bill175-1B.pdf
 
 # From Rives McDow (2002-04-09):
 # The most interesting region I have found consists of three towns on the
@@ -1422,6 +1378,59 @@ Zone	Pacific/Wallis	12:15:20 -	LMT	1901
 # For lack of better info, assume the tradition dates back to the
 # introduction of standard time in 1895.
 
+# From Stuart Bishop (2024-11-12):
+# An article discussing the in-use but technically unofficial timezones
+# in the Western Australian portion of the Nullarbor Plain.
+# https://www.abc.net.au/news/2024-11-22/outback-wa-properties-strange-time-zones/104542494
+# From Paul Eggert (2024-11-12):
+# As the article says, the Eyre Bird Observatory and nearby sheep stations
+# can use Tokyo time.  Other possibilities include Asia/Chita, Asia/Seoul,
+# and Asia/Jayapura.
+
+# Queensland
+
+# From Paul Eggert (2018-02-26):
+# I lack access to the following source for Queensland DST:
+# Pearce C. History of daylight saving time in Queensland.
+# Queensland Hist J. 2017 Aug;23(6):389-403
+# https://search.informit.com.au/documentSummary;dn=994682348436426;res=IELHSS
+
+# From George Shepherd via Simon Woodhead via Robert Elz (1991-03-06):
+# #   The state of QUEENSLAND.. [ Courtesy Qld. Dept Premier Econ&Trade Devel ]
+# #						[ Dec 1990 ]
+# ...
+# Zone	Australia/Queensland	10:00	AQ	%sST
+# ...
+# Rule	AQ	1971	only	-	Oct	lastSun	2:00	1:00	D
+# Rule	AQ	1972	only	-	Feb	lastSun	3:00	0	E
+# Rule	AQ	1989	max	-	Oct	lastSun	2:00	1:00	D
+# Rule	AQ	1990	max	-	Mar	Sun>=1	3:00	0	E
+
+# From Bradley White (1989-12-24):
+# "Australia/Queensland" now observes daylight time (i.e. from
+# October 1989).
+
+# From Bradley White (1991-03-04):
+# A recent excerpt from an Australian newspaper...
+# ...Queensland...[has] agreed to end daylight saving
+# at 3am tomorrow (March 3)...
+
+# From John Mackin (1991-03-06):
+# I can certainly confirm for my part that Daylight Saving in NSW did in fact
+# end on Sunday, 3 March.  I don't know at what hour, though.  (It surprised
+# me.)
+
+# From Bradley White (1992-03-08):
+# ...there was recently a referendum in Queensland which resulted
+# in the experimental daylight saving system being abandoned. So, ...
+# ...
+# Rule	QLD	1989	1991	-	Oct	lastSun	2:00	1:00	D
+# Rule	QLD	1990	1992	-	Mar	Sun>=1	3:00	0	S
+# ...
+
+# From Arthur David Olson (1992-03-08):
+# The chosen rules the union of the 1971/1972 change and the 1989-1992 changes.
+
 
 # southeast Australia
 #

share/zoneinfo/datfiles/etcetera

@@ -1,4 +1,4 @@
-# $OpenBSD: etcetera,v 1.23 2024/10/02 17:08:47 millert Exp $
+# $OpenBSD: etcetera,v 1.24 2025/01/19 22:03:27 millert Exp $
 # tzdb data for ships at sea and other miscellany
 
 # This file is in the public domain, so clarified as of
@@ -52,6 +52,10 @@ Link	Etc/GMT				GMT
 # so we moved the names into the Etc subdirectory.
 # Also, the time zone abbreviations are now compatible with %z.
 
+# There is no "Etc/Unknown" entry, as CLDR says that "Etc/Unknown"
+# corresponds to an unknown or invalid time zone, and things would get
+# confusing if Etc/Unknown were made valid here.
+
 Zone	Etc/GMT-14	14	-	%z
 Zone	Etc/GMT-13	13	-	%z
 Zone	Etc/GMT-12	12	-	%z

share/zoneinfo/datfiles/europe

@@ -1,4 +1,4 @@
-# $OpenBSD: europe,v 1.93 2024/10/02 17:08:47 millert Exp $
+# $OpenBSD: europe,v 1.94 2025/01/19 22:03:27 millert Exp $
 # tzdb data for Europe and environs
 
 # This file is in the public domain, so clarified as of
@@ -1209,7 +1209,7 @@ Zone Atlantic/Faroe	-0:27:04 -	LMT	1908 Jan 11 # Tórshavn
 # However, Greenland will change to Daylight Saving Time again in 2024
 # and onwards.
 
-# From a contributor who wishes to remain anonymous for now (2023-10-29):
+# From Jule Dabars (2023-10-29):
 # https://www.dr.dk/nyheder/seneste/i-nat-skal-uret-stilles-en-time-tilbage-men-foerste-gang-sker-det-ikke-i-groenland
 # with a link to that page:
 # https://naalakkersuisut.gl/Nyheder/2023/10/2710_sommertid

share/zoneinfo/datfiles/factory

@@ -1,4 +1,4 @@
-# $OpenBSD: factory,v 1.13 2019/07/02 15:31:43 millert Exp $
+# $OpenBSD: factory,v 1.14 2025/01/19 22:03:27 millert Exp $
 # tzdb data for noncommittal factory settings
 
 # This file is in the public domain, so clarified as of
@@ -9,5 +9,15 @@
 # time zone abbreviation "-00", indicating that the actual time zone
 # is unknown.
 
+# TZ="Factory" was added to TZDB in 1989, and in 2016 its abbreviation
+# was changed to "-00" from a longish English-language error message.
+# Around 2010, CLDR added "Etc/Unknown" for use with TZDB, to stand
+# for an unknown or invalid time zone.  These two notions differ:
+# TZ="Factory" is a valid timezone, so tzalloc("Factory") succeeds, whereas
+# TZ="Etc/Unknown" is invalid and tzalloc("Etc/Unknown") fails.
+# Also, a downstream distributor could modify Factory to be a
+# default timezone suitable for the devices it manufactures,
+# whereas that cannot happen for Etc/Unknown.
+
 # Zone	NAME	STDOFF	RULES	FORMAT
 Zone	Factory	0	-	-00

share/zoneinfo/datfiles/leap-seconds.list

@@ -1,4 +1,4 @@
-#	$OpenBSD: leap-seconds.list,v 1.4 2024/10/02 17:08:47 millert Exp $
+#	$OpenBSD: leap-seconds.list,v 1.5 2025/01/19 22:03:27 millert Exp $
 #	ATOMIC TIME
 #	Coordinated Universal Time (UTC) is the reference time scale derived
 #	from The "Temps Atomique International" (TAI) calculated by the Bureau
@@ -61,15 +61,15 @@
 #
 #	The following line shows the last update of this file in NTP timestamp:
 #
-#$	3929093563
+#$	3945196800
 #
 #	2) Expiration date of the file given on a semi-annual basis: last June or last December
 #
-#	File expires on 28 June 2025
+#	File expires on 28 December 2025
 #
 #	Expire date in NTP timestamp:
 #
-#@	3960057600
+#@	3975868800
 #
 #
 #	LIST OF LEAP SECONDS
@@ -118,4 +118,4 @@
 #	please see the readme file in the 'source' directory :
 #	https://hpiers.obspm.fr/iers/bul/bulc/ntp/sources/README
 #
-#h	be738595 57b0cf1b b0218343 fb77062f 5a775e7
+#h	848434d5 570f7ea8 d79ba227 a00fc821 f608e2d4

share/zoneinfo/datfiles/northamerica

@@ -1,4 +1,4 @@
-# $OpenBSD: northamerica,v 1.87 2024/10/02 17:08:47 millert Exp $
+# $OpenBSD: northamerica,v 1.88 2025/01/19 22:03:27 millert Exp $
 # tzdb data for North and Central America and environs
 
 # This file is in the public domain, so clarified as of
@@ -28,9 +28,12 @@
 # in New York City (1869-10).  His 1870 proposal was based on Washington, DC,
 # but in 1872-05 he moved the proposed origin to Greenwich.
 
-# From Paul Eggert (2018-03-20):
+# From Paul Eggert (2024-11-18):
 # Dowd's proposal left many details unresolved, such as where to draw
-# lines between time zones.  The key individual who made time zones
+# lines between time zones.  Sandford Fleming of the Canadian Pacific Railway
+# argued for Dowd's proposal in 1876, and Cleveland Abbe of the American
+# Meteorology Society published a report in 1879 recommending four US time
+# zones based on GMT.  However, the key individual who made time zones
 # work in the US was William Frederick Allen - railway engineer,
 # managing editor of the Travelers' Guide, and secretary of the
 # General Time Convention, a railway standardization group.  Allen

share/zoneinfo/datfiles/southamerica

@@ -1,4 +1,4 @@
-# $OpenBSD: southamerica,v 1.82 2024/10/02 17:08:47 millert Exp $
+# $OpenBSD: southamerica,v 1.83 2025/01/19 22:03:27 millert Exp $
 # tzdb data for South America and environs
 
 # This file is in the public domain, so clarified as of
@@ -1701,7 +1701,7 @@ Rule	Para	2005	2009	-	Mar	Sun>=8	0:00	0	-
 # and that on the first Sunday of the month of October, it is to be set
 # forward 60 minutes, in all the territory of the Paraguayan Republic.
 # ...
-Rule	Para	2010	max	-	Oct	Sun>=1	0:00	1:00	-
+Rule	Para	2010	2024	-	Oct	Sun>=1	0:00	1:00	-
 Rule	Para	2010	2012	-	Apr	Sun>=8	0:00	0	-
 #
 # From Steffen Thorsen (2013-03-07):
@@ -1720,14 +1720,35 @@ Rule	Para	2010	2012	-	Apr	Sun>=8	0:00	0	-
 # https://www.abc.com.py/politica/2023/07/12/promulgacion-el-cambio-de-hora-sera-por-ley/
 # From Carlos Raúl Perasso (2023-07-27):
 # http://silpy.congreso.gov.py/descarga/ley-144138
-Rule	Para	2013	max	-	Mar	Sun>=22	0:00	0	-
+Rule	Para	2013	2024	-	Mar	Sun>=22	0:00	0	-
+#
+# From Heitor David Pinto (2024-09-24):
+# Today the Congress of Paraguay passed a bill to observe UTC-3 permanently....
+# The text of the bill says that it would enter into force on the first
+# Sunday in October 2024, the same date currently scheduled to start DST....
+# https://silpy.congreso.gov.py/web/expediente/132531
+# (2024-10-14):
+# The president approved the law on 11 October 2024,
+# and it was officially published on 14 October 2024.
+# https://www.gacetaoficial.gov.py/index/detalle_publicacion/89723
+# The text of the law says that it enters into force on the first
+# Sunday in October 2024 (6 October 2024).  But the constitution
+# prohibits retroactive effect, and the civil code says that laws
+# enter into force on the day after their publication or on the day
+# that they specify, and it also says that they don't have retroactive
+# effect.  So I think that the time change on 6 October 2024 should
+# still be considered as DST according to the previous law, and
+# permanently UTC-3 from 15 October 2024 according to the new law....
+# https://www.constituteproject.org/constitution/Paraguay_2011
+# https://www.oas.org/dil/esp/codigo_civil_paraguay.pdf
 
 # Zone	NAME		STDOFF	RULES	FORMAT	[UNTIL]
 Zone America/Asuncion	-3:50:40 -	LMT	1890
 			-3:50:40 -	AMT	1931 Oct 10 # Asunción Mean Time
 			-4:00	-	%z	1972 Oct
 			-3:00	-	%z	1974 Apr
-			-4:00	Para	%z
+			-4:00	Para	%z	2024 Oct 15
+			-3:00	-	%z
 
 # Peru
 #

share/zoneinfo/datfiles/zone.tab

@@ -1,4 +1,4 @@
-# $OpenBSD: zone.tab,v 1.77 2024/10/02 17:08:47 millert Exp $
+# $OpenBSD: zone.tab,v 1.78 2025/01/19 22:03:27 millert Exp $
 # tzdb timezone descriptions (deprecated version)
 #
 # This file is in the public domain, so clarified as of
@@ -311,7 +311,7 @@ PF	-0900-13930	Pacific/Marquesas	Marquesas Islands
 PF	-2308-13457	Pacific/Gambier	Gambier Islands
 PG	-0930+14710	Pacific/Port_Moresby	most of Papua New Guinea
 PG	-0613+15534	Pacific/Bougainville	Bougainville
-PH	+1435+12100	Asia/Manila
+PH	+143512+1205804	Asia/Manila
 PK	+2452+06703	Asia/Karachi
 PL	+5215+02100	Europe/Warsaw
 PM	+4703-05620	America/Miquelon

share/zoneinfo/datfiles/zone1970.tab

@@ -1,4 +1,4 @@
-# $OpenBSD: zone1970.tab,v 1.30 2024/10/02 17:08:47 millert Exp $
+# $OpenBSD: zone1970.tab,v 1.31 2025/01/19 22:03:27 millert Exp $
 # tzdb timezone descriptions
 #
 # This file is in the public domain.
@@ -184,7 +184,7 @@ IR	+3540+05126	Asia/Tehran
 IT,SM,VA	+4154+01229	Europe/Rome
 JM	+175805-0764736	America/Jamaica
 JO	+3157+03556	Asia/Amman
-JP	+353916+1394441	Asia/Tokyo
+JP,AU	+353916+1394441	Asia/Tokyo	Eyre Bird Observatory
 KE,DJ,ER,ET,KM,MG,SO,TZ,UG,YT	-0117+03649	Africa/Nairobi
 KG	+4254+07436	Asia/Bishkek
 KI,MH,TV,UM,WF	+0125+17300	Pacific/Tarawa	Gilberts, Marshalls, Wake
@@ -247,7 +247,7 @@ PF	-0900-13930	Pacific/Marquesas	Marquesas Islands
 PF	-2308-13457	Pacific/Gambier	Gambier Islands
 PG,AQ,FM	-0930+14710	Pacific/Port_Moresby	Papua New Guinea (most areas), Chuuk, Yap, Dumont d'Urville
 PG	-0613+15534	Pacific/Bougainville	Bougainville
-PH	+1435+12100	Asia/Manila
+PH	+143512+1205804	Asia/Manila
 PK	+2452+06703	Asia/Karachi
 PL	+5215+02100	Europe/Warsaw
 PM	+4703-05620	America/Miquelon
@@ -294,7 +294,7 @@ RU	+6445+17729	Asia/Anadyr	MSK+09 - Bering Sea
 SA,AQ,KW,YE	+2438+04643	Asia/Riyadh	Syowa
 SB,FM	-0932+16012	Pacific/Guadalcanal	Pohnpei
 SD	+1536+03232	Africa/Khartoum
-SG,MY	+0117+10351	Asia/Singapore	peninsular Malaysia
+SG,AQ,MY	+0117+10351	Asia/Singapore	peninsular Malaysia, Concordia
 SR	+0550-05510	America/Paramaribo
 SS	+0451+03137	Africa/Juba
 ST	+0020+00644	Africa/Sao_Tome

share/zoneinfo/datfiles/zonenow.tab

@@ -97,9 +97,6 @@ XX	+1828-06954	America/Santo_Domingo	Atlantic Standard ("AST") - eastern Caribbe
 # -04/-03 (Chile DST)
 XX	-3327-07040	America/Santiago	most of Chile
 #
-# -04/-03 (Paraguay DST)
-XX	-2516-05740	America/Asuncion	Paraguay
-#
 # -04/-03 - AST/ADT (North America DST)
 XX	+4439-06336	America/Halifax	Atlantic ("AST/ADT") - Canada; Bermuda
 #
@@ -224,7 +221,7 @@ XX	+1345+10031	Asia/Bangkok	Russia; Indochina; Christmas Island
 XX	-0610+10648	Asia/Jakarta	Indonesia ("WIB")
 #
 # +08
-XX	+0117+10351	Asia/Singapore	Russia; Brunei; Malaysia; Singapore
+XX	+0117+10351	Asia/Singapore	Russia; Brunei; Malaysia; Singapore; Concordia
 #
 # +08 - AWST
 XX	-3157+11551	Australia/Perth	Western Australia ("AWST")
@@ -236,7 +233,7 @@ XX	+3114+12128	Asia/Shanghai	China ("CST")
 XX	+2217+11409	Asia/Hong_Kong	Hong Kong ("HKT")
 #
 # +08 - PHT
-XX	+1435+12100	Asia/Manila	Philippines ("PHT")
+XX	+143512+1205804	Asia/Manila	Philippines ("PHT")
 #
 # +08 - WITA
 XX	-0507+11924	Asia/Makassar	Indonesia ("WITA")
@@ -248,7 +245,7 @@ XX	-3143+12852	Australia/Eucla	Eucla
 XX	+5203+11328	Asia/Chita	Russia; Palau; East Timor
 #
 # +09 - JST
-XX	+353916+1394441	Asia/Tokyo	Japan ("JST")
+XX	+353916+1394441	Asia/Tokyo	Japan ("JST"); Eyre Bird Observatory
 #
 # +09 - KST
 XX	+3733+12658	Asia/Seoul	Korea ("KST")

sys/arch/arm64/arm64/pmap.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: pmap.c,v 1.105 2024/11/09 12:58:29 kettenis Exp $ */
+/* $OpenBSD: pmap.c,v 1.106 2025/01/18 16:35:30 kettenis Exp $ */
 /*
  * Copyright (c) 2008-2009,2014-2016 Dale Rahn <drahn@dalerahn.com>
  *
@@ -443,6 +443,67 @@ pmap_vp_enter(pmap_t pm, vaddr_t va, struct pte_desc *pted, int flags)
 	return 0;
 }
 
+void
+pmap_vp_populate(pmap_t pm, vaddr_t va)
+{
+	struct pte_desc *pted;
+	struct pmapvp1 *vp1;
+	struct pmapvp2 *vp2;
+	struct pmapvp3 *vp3;
+	void *vp;
+
+	pted = pool_get(&pmap_pted_pool, PR_WAITOK | PR_ZERO);
+	vp = pool_get(&pmap_vp_pool, PR_WAITOK | PR_ZERO);
+
+	pmap_lock(pm);
+
+	if (pm->have_4_level_pt) {
+		vp1 = pm->pm_vp.l0->vp[VP_IDX0(va)];
+		if (vp1 == NULL) {
+			vp1 = vp; vp = NULL;
+			pmap_set_l1(pm, va, vp1);
+		}
+	} else {
+		vp1 = pm->pm_vp.l1;
+	}
+
+	if (vp == NULL) {
+		pmap_unlock(pm);
+		vp = pool_get(&pmap_vp_pool, PR_WAITOK | PR_ZERO);
+		pmap_lock(pm);
+	}
+
+	vp2 = vp1->vp[VP_IDX1(va)];
+	if (vp2 == NULL) {
+		vp2 = vp; vp = NULL;
+		pmap_set_l2(pm, va, vp1, vp2);
+	}
+	
+	if (vp == NULL) {
+		pmap_unlock(pm);
+		vp = pool_get(&pmap_vp_pool, PR_WAITOK | PR_ZERO);
+		pmap_lock(pm);
+	}
+
+	vp3 = vp2->vp[VP_IDX2(va)];
+	if (vp3 == NULL) {
+		vp3 = vp; vp = NULL;
+		pmap_set_l3(pm, va, vp2, vp3);
+	}
+
+	if (vp3->vp[VP_IDX3(va)] == NULL) {
+		vp3->vp[VP_IDX3(va)] = pted;
+		pted = NULL;
+	}
+
+	pmap_unlock(pm);
+
+	if (vp)
+		pool_put(&pmap_vp_pool, vp);
+	if (pted)
+		pool_put(&pmap_pted_pool, pted);
+}
+
 void *
 pmap_vp_page_alloc(struct pool *pp, int flags, int *slowdown)
 {
@@ -616,6 +677,11 @@ out:
 	return error;
 }
 
+void
+pmap_populate(pmap_t pm, vaddr_t va)
+{
+	pmap_vp_populate(pm, va);
+}
 
 /*
  * Remove the given range of mapping entries.

sys/arch/arm64/include/pmap.h

@@ -1,4 +1,4 @@
-/* $OpenBSD: pmap.h,v 1.25 2023/12/11 22:12:53 kettenis Exp $ */
+/* $OpenBSD: pmap.h,v 1.26 2025/01/18 16:35:30 kettenis Exp $ */
 /*
  * Copyright (c) 2008,2009,2014 Dale Rahn <drahn@dalerahn.com>
  *
@@ -123,6 +123,7 @@ struct pv_entry;
 int	pmap_fault_fixup(pmap_t, vaddr_t, vm_prot_t);
 
 #define __HAVE_PMAP_MPSAFE_ENTER_COW
+#define __HAVE_PMAP_POPULATE
 
 #endif /* _KERNEL && !_LOCORE */
 

sys/dev/ic/ufshci.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: ufshci.c,v 1.45 2025/01/11 20:48:27 mglocker Exp $ */
+/*	$OpenBSD: ufshci.c,v 1.46 2025/01/18 19:42:39 mglocker Exp $ */
 
 /*
  * Copyright (c) 2022 Marcus Glocker <mglocker@openbsd.org>
@@ -21,6 +21,8 @@
  * on the JEDEC JESD223C.pdf and JESD220C-2_1.pdf specifications.
  */
 
+#include "kstat.h"
+
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/buf.h>
@@ -30,6 +32,7 @@
 #include <sys/queue.h>
 #include <sys/mutex.h>
 #include <sys/pool.h>
+#include <sys/kstat.h>
 
 #include <sys/atomic.h>
 
@@ -109,8 +112,10 @@ int			 ufshci_hibernate_io(dev_t, daddr_t, vaddr_t, size_t,
 			     int, void *);
 #endif
 
-#ifdef UFSHCI_DEBUG
+#if NKSTAT > 0
-void			 ufshci_stats_print(void *);
+void			 ufshci_kstat_attach(struct ufshci_softc *);
+int			 ufshci_kstat_read_ccb(struct kstat *);
+int			 ufshci_kstat_read_slot(struct kstat *);
 #endif
 
 const struct scsi_adapter ufshci_switch = {
@@ -263,17 +268,8 @@ ufshci_attach(struct ufshci_softc *sc)
 	saa.saa_pool = &sc->sc_iopool;
 	saa.saa_quirks = saa.saa_flags = 0;
 	saa.saa_wwpn = saa.saa_wwnn = 0;
-
+#if NKSTAT > 0
-#ifdef UFSHCI_DEBUG
+	ufshci_kstat_attach(sc);
-	/* Collect some debugging statistics */
-	sc->sc_stats_slots = mallocarray(sc->sc_nutrs, sizeof(int), M_DEVBUF,
-	    M_WAITOK | M_ZERO);
-	if (sc->sc_stats_slots == NULL)
-		printf("%s: Can't allocate stats array\n", sc->sc_dev.dv_xname);
-	else if (ufshci_debug > 2) {
-		timeout_set(&sc->sc_stats_timo, ufshci_stats_print, sc);
-		timeout_add_sec(&sc->sc_stats_timo, 5);
-	}
 #endif
 	config_found(&sc->sc_dev, &saa, scsiprint);
 
@@ -1198,8 +1194,7 @@ ufshci_utr_cmd_io(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	    sizeof(*utrd) * slot, sizeof(*utrd), BUS_DMASYNC_PREWRITE);
 	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_ucd),
 	    sizeof(*ucd) * slot, sizeof(*ucd), BUS_DMASYNC_PREWRITE);
-
+#if NKSTAT > 0
-#ifdef UFSHCI_DEBUG
 	if (sc->sc_stats_slots)
 		sc->sc_stats_slots[slot]++;
 #endif
@@ -2017,16 +2012,113 @@ ufshci_hibernate_io(dev_t dev, daddr_t blkno, vaddr_t addr, size_t size,
 }
 #endif /* HIBERNATE */
 
-#ifdef UFSHCI_DEBUG
+#if NKSTAT > 0
-void
+struct kstat_kv ufshci_counters_slot[CCB_STATUS_COUNT] = {
-ufshci_stats_print(void *arg)
+	KSTAT_KV_UNIT_INITIALIZER("slots free", KSTAT_KV_T_COUNTER16,
-{
+	    KSTAT_KV_U_NONE),
-	struct ufshci_softc *sc = arg;
+	KSTAT_KV_UNIT_INITIALIZER("slots inpr", KSTAT_KV_T_COUNTER16,
-	struct ufshci_ccb *ccb;
+	    KSTAT_KV_U_NONE),
-	int i;
+	KSTAT_KV_UNIT_INITIALIZER("slots r2fr", KSTAT_KV_T_COUNTER16,
-	int ready2free, inprogress, free;
+	    KSTAT_KV_U_NONE),
+};
 
-	ready2free = inprogress = free = 0;
+void
+ufshci_kstat_attach(struct ufshci_softc *sc)
+{
+	struct kstat *ks;
+	struct kstat_kv *kvs;
+	char name[KSTAT_KV_NAMELEN];
+	int i;
+
+	/*
+	 * Allocate array to count ccb slot utilization.
+	 */
+	sc->sc_stats_slots = mallocarray(sc->sc_nutrs, sizeof(uint64_t),
+	    M_DEVBUF, M_WAITOK | M_ZERO);
+	if (sc->sc_stats_slots == NULL) {
+		printf("%s: can't allocate stats_slots array\n",
+		    sc->sc_dev.dv_xname);
+		return;
+	}
+
+	/*
+	 * Setup 'ccbs' kstat.
+	 */
+	kvs = mallocarray(sc->sc_nutrs, sizeof(*kvs), M_DEVBUF,
+	    M_WAITOK | M_ZERO);
+	if (kvs == NULL) {
+		printf("%s: can't allocate kvs ccbs array\n",
+		    sc->sc_dev.dv_xname);
+		return;
+	}
+	for (i = 0; i < sc->sc_nutrs; i++) {
+		snprintf(name, sizeof(name), "slot %d ccbs", i);
+		kstat_kv_unit_init(&kvs[i], name, KSTAT_KV_T_COUNTER64,
+		    KSTAT_KV_U_NONE);
+	}
+
+	mtx_init(&sc->sc_kstat_mtx_ccb, IPL_SOFTCLOCK);
+
+	ks = kstat_create(sc->sc_dev.dv_xname, 0, "ccbs", 0, KSTAT_T_KV, 0);
+	if (ks == NULL) {
+		printf("%s: can't create ccbs kstats\n", sc->sc_dev.dv_xname);
+		free(kvs, M_DEVBUF, sc->sc_nutrs * sizeof(*kvs));
+		return;
+	}
+
+	kstat_set_mutex(ks, &sc->sc_kstat_mtx_ccb);
+	ks->ks_softc = sc;
+	ks->ks_data = kvs;
+	ks->ks_datalen = sc->sc_nutrs * sizeof(*kvs);
+	ks->ks_read = ufshci_kstat_read_ccb;
+
+	sc->sc_kstat_ccb = ks;
+	kstat_install(ks);
+
+	/*
+	 * Setup 'slots' kstat.
+	 */
+	mtx_init(&sc->sc_kstat_mtx_slot, IPL_SOFTCLOCK);
+
+	ks = kstat_create(sc->sc_dev.dv_xname, 0, "slots", 0, KSTAT_T_KV, 0);
+	if (ks == NULL) {
+		printf("%s: can't create slots kstats\n", sc->sc_dev.dv_xname);
+		return;
+	}
+
+	kstat_set_mutex(ks, &sc->sc_kstat_mtx_slot);
+	ks->ks_softc = sc;
+	ks->ks_data = ufshci_counters_slot;
+	ks->ks_datalen = CCB_STATUS_COUNT * sizeof(*kvs);
+	ks->ks_read = ufshci_kstat_read_slot;
+
+	sc->sc_kstat_slot = ks;
+	kstat_install(ks);
+}
+
+int
+ufshci_kstat_read_ccb(struct kstat *ks)
+{
+	struct ufshci_softc *sc = ks->ks_softc;
+	struct kstat_kv *kvs = ks->ks_data;
+	int i;
+
+	for (i = 0; i < sc->sc_nutrs; i++)
+		kstat_kv_u64(&kvs[i]) = sc->sc_stats_slots[i];
+
+	return 0;
+}
+
+int
+ufshci_kstat_read_slot(struct kstat *ks)
+{
+	struct ufshci_softc *sc = ks->ks_softc;
+	struct kstat_kv *kvs = ks->ks_data;
+	struct ufshci_ccb *ccb;
+	uint16_t free, inprogress, ready2free;
+	int i;
+
+	free = inprogress = ready2free = 0;
 
 	for (i = 0; i < sc->sc_nutrs; i++) {
 		ccb = &sc->sc_ccbs[i];
@@ -2041,20 +2133,13 @@ ufshci_stats_print(void *arg)
 		case CCB_STATUS_READY2FREE:
 			ready2free++;
 			break;
-		default:
-			printf("unknown ccb status 0x%x!\n", ccb->ccb_status);
-			break;
 		}
 	}
-	printf("ccbs free                  : %02d\n", free);
-	printf("ccbs in-progress           : %02d\n", inprogress);
-	printf("ccbs ready2free            : %02d\n", ready2free);
 
-	for (i = 0; i < sc->sc_nutrs; i++) {
+	kstat_kv_u16(&kvs[0]) = free;
-		printf("ccb slot %02d i/o operations : %d\n",
+	kstat_kv_u16(&kvs[1]) = inprogress;
-		    i, sc->sc_stats_slots[i]);
+	kstat_kv_u16(&kvs[2]) = ready2free;
-	}
 
-	timeout_add_sec(&sc->sc_stats_timo, 5);
+	return 0;
 }
-#endif /* UFSHCI_DEBUG */
+#endif /* NKSTAT > 0 */

sys/dev/ic/ufshcivar.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: ufshcivar.h,v 1.11 2025/01/11 20:48:27 mglocker Exp $ */
+/*	$OpenBSD: ufshcivar.h,v 1.12 2025/01/18 19:42:39 mglocker Exp $ */
 
 /*
  * Copyright (c) 2022 Marcus Glocker <mglocker@openbsd.org>
@@ -44,14 +44,17 @@ struct ufshci_dmamem {
 struct ufshci_softc;
 
 /* SCSI */
+enum ccb_status {
+	CCB_STATUS_FREE,
+	CCB_STATUS_INPROGRESS,
+	CCB_STATUS_READY2FREE,
+	CCB_STATUS_COUNT
+};
 struct ufshci_ccb {
 	SIMPLEQ_ENTRY(ufshci_ccb)	 ccb_entry;
 	bus_dmamap_t			 ccb_dmamap;
 	void				*ccb_cookie;
 	int				 ccb_slot;
-#define CCB_STATUS_FREE		0
-#define CCB_STATUS_INPROGRESS	1
-#define CCB_STATUS_READY2FREE	2
 	int				 ccb_status;
 	void				 (*ccb_done)(struct ufshci_softc *,
 					     struct ufshci_ccb *);
@@ -89,11 +92,12 @@ struct ufshci_softc {
 	struct ufshci_ccb_list	 sc_ccb_list;
 	struct ufshci_ccb	*sc_ccbs;
 
-#ifdef UFSHCI_DEBUG
+	/* kstat */
-	/* Debugging statistics */
+	uint64_t		*sc_stats_slots;
-	struct timeout		 sc_stats_timo;
+	struct mutex		 sc_kstat_mtx_ccb;
-	int			*sc_stats_slots;
+	struct mutex		 sc_kstat_mtx_slot;
-#endif
+	struct kstat		*sc_kstat_ccb;
+	struct kstat		*sc_kstat_slot;
 };
 
 int	ufshci_intr(void *);

sys/dev/kstat.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: kstat.c,v 1.4 2024/09/04 07:54:52 mglocker Exp $ */
+/* $OpenBSD: kstat.c,v 1.5 2025/01/18 12:31:49 mglocker Exp $ */
 
 /*
  * Copyright (c) 2020 David Gwynne <dlg@openbsd.org>
@@ -685,10 +685,13 @@ kstat_kv_unit_init(struct kstat_kv *kv, const char *name,
 	switch (type) {
 	case KSTAT_KV_T_COUNTER64:
 	case KSTAT_KV_T_COUNTER32:
+	case KSTAT_KV_T_COUNTER16:
 	case KSTAT_KV_T_UINT64:
 	case KSTAT_KV_T_INT64:
 	case KSTAT_KV_T_UINT32:
 	case KSTAT_KV_T_INT32:
+	case KSTAT_KV_T_UINT16:
+	case KSTAT_KV_T_INT16:
 		break;
 	default:
 		panic("kv unit init %s: unit for non-integer type", name);

sys/dev/pci/drm/i915/i915_active.c

@@ -27,7 +27,7 @@ struct active_node {
 	struct rb_node node;
 	struct i915_active_fence base;
 	struct i915_active *ref;
-	u64 timeline;
+	u64 timeline __aligned(8);
 };
 
 #define fetch_node(x) rb_entry(READ_ONCE(x), typeof(struct active_node), node)

sys/dev/pci/drm/include/linux/atomic.h

@@ -1,4 +1,4 @@
-/* $OpenBSD: atomic.h,v 1.23 2024/01/16 23:38:13 jsg Exp $ */
+/* $OpenBSD: atomic.h,v 1.24 2025/01/19 11:15:52 jsg Exp $ */
 /**
  * \file drm_atomic.h
  * Atomic operations used in the DRM which may or may not be provided by the OS.
@@ -125,7 +125,7 @@ atomic_dec_if_positive(volatile int *v)
 /* 32 bit powerpc lacks 64 bit atomics */
 #if !defined(__powerpc__) || defined(__powerpc64__)
 
-typedef int64_t atomic64_t;
+typedef int64_t atomic64_t __aligned(8);
 
 #define ATOMIC64_INIT(x)	(x)
 
@@ -133,14 +133,14 @@ typedef int64_t atomic64_t;
 #define atomic64_read(p)	READ_ONCE(*(p))
 
 static inline int64_t
-atomic64_xchg(volatile int64_t *v, int64_t n)
+atomic64_xchg(atomic64_t *v, int64_t n)
 {
 	__sync_synchronize();
 	return __sync_lock_test_and_set(v, n);
 }
 
 static inline int64_t
-atomic64_cmpxchg(volatile int64_t *v, int64_t o, int64_t n)
+atomic64_cmpxchg(atomic64_t *v, int64_t o, int64_t n)
 {
 	return __sync_val_compare_and_swap(v, o, n);
 }

sys/kern/init_sysent.c

@@ -1,10 +1,10 @@
-/*	$OpenBSD: init_sysent.c,v 1.283 2025/01/06 08:57:49 mpi Exp $	*/
+/*	$OpenBSD: init_sysent.c,v 1.284 2025/01/20 09:03:24 mpi Exp $	*/
 
 /*
  * System call switch table.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.266 2025/01/06 08:57:23 mpi Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.267 2025/01/20 09:02:17 mpi Exp 
  */
 
 #include <sys/param.h>
@@ -98,15 +98,15 @@ const struct sysent sysent[] = {
 	    sys_sync },				/* 36 = sync */
 	{ 0, 0, 0,
 	    sys_nosys },			/* 37 = obsolete msyscall */
-	{ 2, s(struct sys_stat_args), 0,
+	{ 2, s(struct sys_stat_args), SY_NOLOCK | 0,
 	    sys_stat },				/* 38 = stat */
 	{ 0, 0, SY_NOLOCK | 0,
 	    sys_getppid },			/* 39 = getppid */
-	{ 2, s(struct sys_lstat_args), 0,
+	{ 2, s(struct sys_lstat_args), SY_NOLOCK | 0,
 	    sys_lstat },			/* 40 = lstat */
 	{ 1, s(struct sys_dup_args), SY_NOLOCK | 0,
 	    sys_dup },				/* 41 = dup */
-	{ 4, s(struct sys_fstatat_args), 0,
+	{ 4, s(struct sys_fstatat_args), SY_NOLOCK | 0,
 	    sys_fstatat },			/* 42 = fstatat */
 	{ 0, 0, SY_NOLOCK | 0,
 	    sys_getegid },			/* 43 = getegid */

sys/kern/syscalls.c

@@ -1,10 +1,10 @@
-/*	$OpenBSD: syscalls.c,v 1.281 2025/01/06 08:57:49 mpi Exp $	*/
+/*	$OpenBSD: syscalls.c,v 1.282 2025/01/20 09:03:24 mpi Exp $	*/
 
 /*
  * System call names.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.266 2025/01/06 08:57:23 mpi Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.267 2025/01/20 09:02:17 mpi Exp 
  */
 
 const char *const syscallnames[] = {

sys/kern/syscalls.master

@@ -1,4 +1,4 @@
-;	$OpenBSD: syscalls.master,v 1.266 2025/01/06 08:57:23 mpi Exp $
+;	$OpenBSD: syscalls.master,v 1.267 2025/01/20 09:02:17 mpi Exp $
 ;	$NetBSD: syscalls.master,v 1.32 1996/04/23 10:24:21 mycroft Exp $
 
 ;	@(#)syscalls.master	8.2 (Berkeley) 1/13/94
@@ -104,11 +104,11 @@
 35	STD		{ int sys_fchflags(int fd, u_int flags); }
 36	STD		{ void sys_sync(void); }
 37	OBSOL		msyscall
-38	STD		{ int sys_stat(const char *path, struct stat *ub); }
+38	STD NOLOCK	{ int sys_stat(const char *path, struct stat *ub); }
 39	STD NOLOCK	{ pid_t sys_getppid(void); }
-40	STD		{ int sys_lstat(const char *path, struct stat *ub); }
+40	STD NOLOCK	{ int sys_lstat(const char *path, struct stat *ub); }
 41	STD NOLOCK	{ int sys_dup(int fd); }
-42	STD		{ int sys_fstatat(int fd, const char *path, \
+42	STD NOLOCK	{ int sys_fstatat(int fd, const char *path, \
 			    struct stat *buf, int flag); }
 43	STD NOLOCK	{ gid_t sys_getegid(void); }
 44	STD		{ int sys_profil(caddr_t samples, size_t size, \

sys/kern/uipc_socket.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_socket.c,v 1.360 2025/01/13 18:10:20 mvs Exp $	*/
+/*	$OpenBSD: uipc_socket.c,v 1.361 2025/01/20 16:34:48 bluhm Exp $	*/
 /*	$NetBSD: uipc_socket.c,v 1.21 1996/02/04 02:17:52 christos Exp $	*/
 
 /*
@@ -400,22 +400,24 @@ drop:
 		int persocket = solock_persocket(so);
 
 		while ((so2 = TAILQ_FIRST(&so->so_q0)) != NULL) {
-			if (persocket)
+			soref(so2);
-				solock(so2);
+			solock(so2);
 			(void) soqremque(so2, 0);
-			if (persocket)
+			sounlock(so);
-				sounlock(so);
 			soabort(so2);
-			if (persocket)
+			sounlock(so2);
-				solock(so);
+			sorele(so2);
+			solock(so);
 		}
 		while ((so2 = TAILQ_FIRST(&so->so_q)) != NULL) {
-			if (persocket)
+			soref(so2);
-				solock(so2);
+			solock_nonet(so2);
 			(void) soqremque(so2, 1);
 			if (persocket)
 				sounlock(so);
 			soabort(so2);
+			sounlock_nonet(so2);
+			sorele(so2);
 			if (persocket)
 				solock(so);
 		}

sys/kern/uipc_socket2.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_socket2.c,v 1.165 2025/01/16 16:35:01 bluhm Exp $	*/
+/*	$OpenBSD: uipc_socket2.c,v 1.167 2025/01/20 16:34:48 bluhm Exp $	*/
 /*	$NetBSD: uipc_socket2.c,v 1.11 1996/02/04 02:17:55 christos Exp $	*/
 
 /*
@@ -100,21 +100,15 @@ soisconnected(struct socket *so)
 	so->so_state |= SS_ISCONNECTED;
 
 	if (head != NULL && so->so_onq == &head->so_q0) {
-		int persocket = solock_persocket(so);
+		soref(head);
-
+		sounlock(so);
-		if (persocket) {
+		solock(head);
-			soref(head);
+		solock(so);
-
-			sounlock(so);
-			solock(head);
-			solock(so);
-
-			if (so->so_onq != &head->so_q0) {
-				sounlock(head);
-				sorele(head);
-				return;
-			}
 
+		if (so->so_onq != &head->so_q0) {
+			sounlock(head);
+			sorele(head);
+			return;
 		}
 
 		soqremque(so, 0);
@@ -122,10 +116,8 @@ soisconnected(struct socket *so)
 		sorwakeup(head);
 		wakeup_one(&head->so_timeo);
 
-		if (persocket) {
+		sounlock(head);
-			sounlock(head);
+		sorele(head);
-			sorele(head);
-		}
 	} else {
 		wakeup(&so->so_timeo);
 		sorwakeup(so);

sys/kern/uipc_usrreq.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_usrreq.c,v 1.212 2025/01/01 13:44:22 bluhm Exp $	*/
+/*	$OpenBSD: uipc_usrreq.c,v 1.213 2025/01/20 16:34:48 bluhm Exp $	*/
 /*	$NetBSD: uipc_usrreq.c,v 1.18 1996/02/09 19:00:50 christos Exp $	*/
 
 /*
@@ -656,7 +656,7 @@ uipc_abort(struct socket *so)
 	struct unpcb *unp = sotounpcb(so);
 
 	unp_detach(unp);
-	sofree(so, 0);
+	sofree(so, 1);
 }
 
 int

sys/kern/vfs_syscalls.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: vfs_syscalls.c,v 1.370 2024/11/05 06:03:19 jsg Exp $	*/
+/*	$OpenBSD: vfs_syscalls.c,v 1.371 2025/01/20 09:02:17 mpi Exp $	*/
 /*	$NetBSD: vfs_syscalls.c,v 1.71 1996/04/23 10:29:02 mycroft Exp $	*/
 
 /*
@@ -2066,10 +2066,14 @@ dofstatat(struct proc *p, int fd, const char *path, struct stat *buf, int flag)
 	NDINITAT(&nd, LOOKUP, follow | LOCKLEAF, UIO_USERSPACE, fd, path, p);
 	nd.ni_pledge = PLEDGE_RPATH;
 	nd.ni_unveil = UNVEIL_READ;
-	if ((error = namei(&nd)) != 0)
+	KERNEL_LOCK();
+	if ((error = namei(&nd)) != 0) {
+		KERNEL_UNLOCK();
 		return (error);
+	}
 	error = vn_stat(nd.ni_vp, &sb, p);
 	vput(nd.ni_vp);
+	KERNEL_UNLOCK();
 	if (error)
 		return (error);
 	/* Don't let non-root see generation numbers (for NFS security) */

sys/net/bpf.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: bpf.c,v 1.229 2024/12/30 02:46:00 guenther Exp $	*/
+/*	$OpenBSD: bpf.c,v 1.230 2025/01/19 03:27:27 dlg Exp $	*/
 /*	$NetBSD: bpf.c,v 1.33 1997/02/21 23:59:35 thorpej Exp $	*/
 
 /*
@@ -1277,7 +1277,7 @@ filt_bpfread(struct knote *kn, long hint)
 	MUTEX_ASSERT_LOCKED(&d->bd_mtx);
 
 	kn->kn_data = d->bd_hlen;
-	if (d->bd_wtout == 0)
+	if (d->bd_state == BPF_S_DONE)
 		kn->kn_data += d->bd_slen;
 
 	return (kn->kn_data > 0);

sys/sys/syscall.h

@@ -1,10 +1,10 @@
-/*	$OpenBSD: syscall.h,v 1.279 2024/08/02 14:35:56 mvs Exp $	*/
+/*	$OpenBSD: syscall.h,v 1.280 2025/01/20 09:03:24 mpi Exp $	*/
 
 /*
  * System call numbers.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.265 2024/08/02 14:34:45 mvs Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.267 2025/01/20 09:02:17 mpi Exp 
  */
 
 /* syscall: "exit" ret: "void" args: "int" */

sys/sys/syscallargs.h

@@ -1,10 +1,10 @@
-/*	$OpenBSD: syscallargs.h,v 1.282 2024/08/02 14:35:56 mvs Exp $	*/
+/*	$OpenBSD: syscallargs.h,v 1.283 2025/01/20 09:03:24 mpi Exp $	*/
 
 /*
  * System call argument lists.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.265 2024/08/02 14:34:45 mvs Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.267 2025/01/20 09:02:17 mpi Exp 
  */
 
 #ifdef	syscallarg

sys/sys/videoio.h

@@ -1,6 +1,4 @@
-/*	$OpenBSD: videoio.h,v 1.20 2025/01/15 20:34:50 kirill Exp $	*/
+/*	$OpenBSD: videoio.h,v 1.21 2025/01/18 19:50:55 kirill Exp $	*/
-
-/* Based on Linux-v6.13-rc7 */
 
 /*
  *  Video for Linux Two header file

sys/uvm/uvm_fault.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_fault.c,v 1.159 2025/01/03 15:31:48 mpi Exp $	*/
+/*	$OpenBSD: uvm_fault.c,v 1.160 2025/01/18 16:35:30 kettenis Exp $	*/
 /*	$NetBSD: uvm_fault.c,v 1.51 2000/08/06 00:22:53 thorpej Exp $	*/
 
 /*
@@ -1105,8 +1105,12 @@ uvm_fault_upper(struct uvm_faultinfo *ufi, struct uvm_faultctx *flt,
 			/* XXX instrumentation */
 			return ENOMEM;
 		}
+#ifdef __HAVE_PMAP_POPULATE
+		pmap_populate(ufi->orig_map->pmap, ufi->orig_rvaddr);
+#else
 		/* XXX instrumentation */
 		uvm_wait("flt_pmfail1");
+#endif
 		return ERESTART;
 	}
 
@@ -1457,8 +1461,12 @@ uvm_fault_lower(struct uvm_faultinfo *ufi, struct uvm_faultctx *flt,
 			/* XXX instrumentation */
 			return (ENOMEM);
 		}
+#ifdef __HAVE_PMAP_POPULATE
+		pmap_populate(ufi->orig_map->pmap, ufi->orig_rvaddr);
+#else
 		/* XXX instrumentation */
 		uvm_wait("flt_pmfail2");
+#endif
 		return ERESTART;
 	}
 

sys/uvm/uvm_pmap.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_pmap.h,v 1.34 2024/04/03 18:43:32 miod Exp $	*/
+/*	$OpenBSD: uvm_pmap.h,v 1.35 2025/01/18 16:35:31 kettenis Exp $	*/
 /*	$NetBSD: uvm_pmap.h,v 1.1 2000/06/27 09:00:14 mrg Exp $	*/
 
 /*
@@ -179,6 +179,10 @@ vaddr_t		 pmap_steal_memory(vsize_t, vaddr_t *, vaddr_t *);
 void		 pmap_virtual_space(vaddr_t *, vaddr_t *);
 #endif
 
+#if defined(__HAVE_PMAP_POPULATE)
+void		pmap_populate(pmap_t, vaddr_t);
+#endif
+
 /* nested pmaps are used in i386/amd64 vmm */
 #ifndef pmap_nested
 #define pmap_nested(pm) 0

usr.bin/mandoc/mdoc_html.c

@@ -1,6 +1,6 @@
-/* $OpenBSD: mdoc_html.c,v 1.225 2022/07/06 16:02:52 schwarze Exp $ */
+/* $OpenBSD: mdoc_html.c,v 1.226 2025/01/19 16:36:24 schwarze Exp $ */
 /*
- * Copyright (c) 2014-2022 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2014-2022, 2025 Ingo Schwarze <schwarze@openbsd.org>
  * Copyright (c) 2008-2011, 2014 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2022 Anna Vyalkova <cyber@sysrq.in>
  *
@@ -1492,10 +1492,13 @@ static int
 mdoc__x_pre(MDOC_ARGS)
 {
 	struct roff_node	*nn;
-	const char		*cattr;
+	const unsigned char	*cp;
+	const char		*cattr, *arg;
+	char			*url;
 	enum htmltag		 t;
 
 	t = TAG_SPAN;
+	arg = n->child->string;
 
 	switch (n->tok) {
 	case MDOC__A:
@@ -1535,13 +1538,25 @@ mdoc__x_pre(MDOC_ARGS)
 		cattr = "RsQ";
 		break;
 	case MDOC__R:
+		if (strncmp(arg, "RFC ", 4) == 0) {
+			cp = arg += 4;
+			while (isdigit(*cp))
+				cp++;
+			if (*cp == '\0') {
+				mandoc_asprintf(&url, "https://www.rfc-"
+				    "editor.org/rfc/rfc%s.html", arg);
+				print_otag(h, TAG_A, "ch", "RsR", url);
+				free(url);
+				return 1;
+			}
+		}
 		cattr = "RsR";
 		break;
 	case MDOC__T:
 		cattr = "RsT";
 		break;
 	case MDOC__U:
-		print_otag(h, TAG_A, "ch", "RsU", n->child->string);
+		print_otag(h, TAG_A, "ch", "RsU", arg);
 		return 1;
 	case MDOC__V:
 		cattr = "RsV";

usr.bin/mandoc/mdoc_markdown.c

@@ -1,6 +1,6 @@
-/* $OpenBSD: mdoc_markdown.c,v 1.37 2024/08/13 12:43:55 schwarze Exp $ */
+/* $OpenBSD: mdoc_markdown.c,v 1.38 2025/01/20 00:52:00 schwarze Exp $ */
 /*
- * Copyright (c) 2017, 2018, 2020 Ingo Schwarze <schwarze@openbsd.org>
+ * Copyright (c) 2017, 2018, 2020, 2025 Ingo Schwarze <schwarze@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -83,6 +83,7 @@ static	int	 md_pre_Sh(struct roff_node *);
 static	int	 md_pre_Sm(struct roff_node *);
 static	int	 md_pre_Vt(struct roff_node *);
 static	int	 md_pre_Xr(struct roff_node *);
+static	int	 md_pre__R(struct roff_node *);
 static	int	 md_pre__T(struct roff_node *);
 static	int	 md_pre_br(struct roff_node *);
 
@@ -157,7 +158,7 @@ static	const struct md_act md_acts[MDOC_MAX - MDOC_Dd] = {
 	{ NULL, NULL, md_post_pc, NULL, NULL }, /* %N */
 	{ NULL, NULL, md_post_pc, NULL, NULL }, /* %O */
 	{ NULL, NULL, md_post_pc, NULL, NULL }, /* %P */
-	{ NULL, NULL, md_post_pc, NULL, NULL }, /* %R */
+	{ NULL, md_pre__R, md_post_pc, NULL, NULL }, /* %R */
 	{ NULL, md_pre__T, md_post__T, NULL, NULL }, /* %T */
 	{ NULL, NULL, md_post_pc, NULL, NULL }, /* %V */
 	{ NULL, NULL, NULL, NULL, NULL }, /* Ac */
@@ -1578,6 +1579,34 @@ md_pre_Xr(struct roff_node *n)
 	return 0;
 }
 
+static int
+md_pre__R(struct roff_node *n)
+{
+	const unsigned char	*cp;
+	const char		*arg;
+
+	arg = n->child->string;
+
+	if (strncmp(arg, "RFC ", 4) != 0)
+		return 1;
+	cp = arg += 4;
+	while (isdigit(*cp))
+		cp++;
+	if (*cp != '\0')
+		return 1;
+
+	md_rawword("[RFC ");
+	outflags &= ~MD_spc;
+	md_rawword(arg);
+	outflags &= ~MD_spc;
+	md_rawword("](http://www.rfc-editor.org/rfc/rfc");
+	outflags &= ~MD_spc;
+	md_rawword(arg);
+	outflags &= ~MD_spc;
+	md_rawword(".html)");
+	return 0;
+}
+
 static int
 md_pre__T(struct roff_node *n)
 {

usr.bin/openssl/dh.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: dh.c,v 1.15 2023/03/06 14:32:05 tb Exp $ */
+/* $OpenBSD: dh.c,v 1.16 2025/01/19 10:24:17 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -75,7 +75,6 @@
 #include <openssl/x509.h>
 
 static struct {
-	int C;
 	int check;
 	char *infile;
 	int informat;
@@ -86,12 +85,6 @@ static struct {
 } cfg;
 
 static const struct option dh_options[] = {
-	{
-		.name = "C",
-		.desc = "Convert DH parameters into C code",
-		.type = OPTION_FLAG,
-		.opt.flag = &cfg.C,
-	},
 	{
 		.name = "check",
 		.desc = "Check the DH parameters",
@@ -145,7 +138,7 @@ static void
 dh_usage(void)
 {
 	fprintf(stderr,
-	    "usage: dh [-C] [-check] [-in file] [-inform format]\n"
+	    "usage: dh [-check] [-in file] [-inform format]\n"
 	    "    [-noout] [-out file] [-outform format] [-text]\n\n");
 	options_usage(dh_options);
 }
@@ -228,49 +221,6 @@ dh_main(int argc, char **argv)
 		if (i == 0)
 			printf("DH parameters appear to be ok.\n");
 	}
-	if (cfg.C) {
-		unsigned char *data;
-		int len, l, bits;
-
-		len = BN_num_bytes(DH_get0_p(dh));
-		bits = BN_num_bits(DH_get0_p(dh));
-		data = malloc(len);
-		if (data == NULL) {
-			perror("malloc");
-			goto end;
-		}
-		l = BN_bn2bin(DH_get0_p(dh), data);
-		printf("static unsigned char dh%d_p[] = {", bits);
-		for (i = 0; i < l; i++) {
-			if ((i % 12) == 0)
-				printf("\n\t");
-			printf("0x%02X, ", data[i]);
-		}
-		printf("\n\t};\n");
-
-		l = BN_bn2bin(DH_get0_g(dh), data);
-		printf("static unsigned char dh%d_g[] = {", bits);
-		for (i = 0; i < l; i++) {
-			if ((i % 12) == 0)
-				printf("\n\t");
-			printf("0x%02X, ", data[i]);
-		}
-		printf("\n\t};\n\n");
-
-		printf("DH *get_dh%d()\n\t{\n", bits);
-		printf("\tDH *dh;\n");
-		printf("\tBIGNUM *p = NULL, *g = NULL;\n\n");
-		printf("\tif ((dh = DH_new()) == NULL) return(NULL);\n");
-		printf("\tp = BN_bin2bn(dh%d_p, sizeof(dh%d_p), NULL);\n",
-		    bits, bits);
-		printf("\tg = BN_bin2bn(dh%d_g, sizeof(dh%d_g), NULL);\n",
-		    bits, bits);
-		printf("\tif (p == NULL || g == NULL)\n");
-		printf("\t\t{ BN_free(p); BN_free(q); DH_free(dh); return(NULL); }\n");
-		printf("\tDH_set0_pqg(dh, p, NULL, g);\n");
-		printf("\treturn(dh);\n\t}\n");
-		free(data);
-	}
 	if (!cfg.noout) {
 		if (cfg.outformat == FORMAT_ASN1)
 			i = i2d_DHparams_bio(out, dh);

usr.bin/openssl/dhparam.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: dhparam.c,v 1.18 2023/07/23 11:39:29 tb Exp $ */
+/* $OpenBSD: dhparam.c,v 1.19 2025/01/19 10:24:17 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -132,7 +132,6 @@
 #define DEFBITS	2048
 
 static struct {
-	int C;
 	int check;
 	int dsaparam;
 	int g;
@@ -160,12 +159,6 @@ static const struct option dhparam_options[] = {
 		.opt.value = &cfg.g,
 		.value = 5,
 	},
-	{
-		.name = "C",
-		.desc = "Convert DH parameters into C code",
-		.type = OPTION_FLAG,
-		.opt.flag = &cfg.C,
-	},
 	{
 		.name = "check",
 		.desc = "Check the DH parameters",
@@ -225,7 +218,7 @@ static void
 dhparam_usage(void)
 {
 	fprintf(stderr,
-	    "usage: dhparam [-2 | -5] [-C] [-check] [-dsaparam]\n"
+	    "usage: dhparam [-2 | -5] [-check] [-dsaparam]\n"
 	    "    [-in file] [-inform DER | PEM] [-noout] [-out file]\n"
 	    "    [-outform DER | PEM] [-text] [numbits]\n\n");
 	options_usage(dhparam_options);
@@ -405,55 +398,6 @@ dhparam_main(int argc, char **argv)
 		if (i == 0)
 			printf("DH parameters appear to be ok.\n");
 	}
-	if (cfg.C) {
-		unsigned char *data;
-		int len, l, bits;
-
-		len = BN_num_bytes(DH_get0_p(dh));
-		bits = BN_num_bits(DH_get0_p(dh));
-		data = malloc(len);
-		if (data == NULL) {
-			perror("malloc");
-			goto end;
-		}
-		printf("#ifndef HEADER_DH_H\n"
-		    "#include <openssl/dh.h>\n"
-		    "#endif\n");
-		printf("DH *get_dh%d()\n\t{\n", bits);
-
-		l = BN_bn2bin(DH_get0_p(dh), data);
-		printf("\tstatic unsigned char dh%d_p[] = {", bits);
-		for (i = 0; i < l; i++) {
-			if ((i % 12) == 0)
-				printf("\n\t\t");
-			printf("0x%02X, ", data[i]);
-		}
-		printf("\n\t\t};\n");
-
-		l = BN_bn2bin(DH_get0_g(dh), data);
-		printf("\tstatic unsigned char dh%d_g[] = {", bits);
-		for (i = 0; i < l; i++) {
-			if ((i % 12) == 0)
-				printf("\n\t\t");
-			printf("0x%02X, ", data[i]);
-		}
-		printf("\n\t\t};\n");
-
-		printf("\tDH *dh;\n");
-		printf("\tBIGNUM *p = NULL, *g = NULL;\n\n");
-		printf("\tif ((dh = DH_new()) == NULL) return(NULL);\n");
-		printf("\tp = BN_bin2bn(dh%d_p, sizeof(dh%d_p), NULL);\n",
-		    bits, bits);
-		printf("\tg = BN_bin2bn(dh%d_g, sizeof(dh%d_g), NULL);\n",
-		    bits, bits);
-		printf("\tif (p == NULL || g == NULL)\n");
-		printf("\t\t{ BN_free(p); BN_free(g); DH_free(dh); return(NULL); }\n");
-		printf("\tDH_set0_pqg(dh, p, NULL, g);\n");
-		if (DH_get_length(dh) > 0)
-			printf("\tDH_set_length(dh, %ld);\n", DH_get_length(dh));
-		printf("\treturn(dh);\n\t}\n");
-		free(data);
-	}
 	if (!cfg.noout) {
 		if (cfg.outformat == FORMAT_ASN1)
 			i = i2d_DHparams_bio(out, dh);

usr.bin/openssl/dsaparam.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: dsaparam.c,v 1.15 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: dsaparam.c,v 1.16 2025/01/19 10:24:17 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -80,7 +80,6 @@
 #include <openssl/x509.h>
 
 static struct {
-	int C;
 	int genkey;
 	char *infile;
 	int informat;
@@ -91,12 +90,6 @@ static struct {
 } cfg;
 
 static const struct option dsaparam_options[] = {
-	{
-		.name = "C",
-		.desc = "Convert DSA parameters into C code",
-		.type = OPTION_FLAG,
-		.opt.flag = &cfg.C,
-	},
 	{
 		.name = "genkey",
 		.desc = "Generate a DSA key",
@@ -150,7 +143,7 @@ static void
 dsaparam_usage(void)
 {
 	fprintf(stderr,
-	    "usage: dsaparam [-C] [-genkey] [-in file]\n"
+	    "usage: dsaparam [-genkey] [-in file]\n"
 	    "    [-inform format] [-noout] [-out file] [-outform format]\n"
 	    "    [-text] [numbits]\n\n");
 	options_usage(dsaparam_options);
@@ -253,60 +246,6 @@ dsaparam_main(int argc, char **argv)
 	if (cfg.text) {
 		DSAparams_print(out, dsa);
 	}
-	if (cfg.C) {
-		unsigned char *data;
-		int l, len, bits_p;
-
-		len = BN_num_bytes(DSA_get0_p(dsa));
-		bits_p = BN_num_bits(DSA_get0_p(dsa));
-		data = malloc(len + 20);
-		if (data == NULL) {
-			perror("malloc");
-			goto end;
-		}
-		l = BN_bn2bin(DSA_get0_p(dsa), data);
-		printf("static unsigned char dsa%d_p[] = {", bits_p);
-		for (i = 0; i < l; i++) {
-			if ((i % 12) == 0)
-				printf("\n\t");
-			printf("0x%02X, ", data[i]);
-		}
-		printf("\n\t};\n");
-
-		l = BN_bn2bin(DSA_get0_q(dsa), data);
-		printf("static unsigned char dsa%d_q[] = {", bits_p);
-		for (i = 0; i < l; i++) {
-			if ((i % 12) == 0)
-				printf("\n\t");
-			printf("0x%02X, ", data[i]);
-		}
-		printf("\n\t};\n");
-
-		l = BN_bn2bin(DSA_get0_g(dsa), data);
-		printf("static unsigned char dsa%d_g[] = {", bits_p);
-		for (i = 0; i < l; i++) {
-			if ((i % 12) == 0)
-				printf("\n\t");
-			printf("0x%02X, ", data[i]);
-		}
-		free(data);
-		printf("\n\t};\n\n");
-
-		printf("DSA *get_dsa%d()\n\t{\n", bits_p);
-		printf("\tBIGNUM *p = NULL, *q = NULL, *g = NULL;\n");
-		printf("\tDSA *dsa;\n\n");
-		printf("\tif ((dsa = DSA_new()) == NULL) return(NULL);\n");
-		printf("\tp = BN_bin2bn(dsa%d_p, sizeof(dsa%d_p), NULL);\n",
-		    bits_p, bits_p);
-		printf("\tq = BN_bin2bn(dsa%d_q, sizeof(dsa%d_q), NULL);\n",
-		    bits_p, bits_p);
-		printf("\tg = BN_bin2bn(dsa%d_g, sizeof(dsa%d_g), NULL);\n",
-		    bits_p, bits_p);
-		printf("\tif (p == NULL || q == NULL || g == NULL)\n");
-		printf("\t\t{ BN_free(p); BN_free(q); BN_free(g); DSA_free(dsa); return(NULL); }\n");
-		printf("\tDSA_set0_pqg(dsa, p, q, g);\n");
-		printf("\treturn(dsa);\n\t}\n");
-	}
 	if (!cfg.noout) {
 		if (cfg.outformat == FORMAT_ASN1)
 			i = i2d_DSAparams_bio(out, dsa);

usr.bin/openssl/ecparam.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: ecparam.c,v 1.23 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: ecparam.c,v 1.25 2025/01/19 10:24:17 tb Exp $ */
 /*
  * Written by Nils Larsch for the OpenSSL project.
  */
@@ -87,11 +87,7 @@
 #include <openssl/pem.h>
 #include <openssl/x509.h>
 
-static int ecparam_print_var(BIO *, BIGNUM *, const char *, int,
-    unsigned char *);
-
 static struct {
-	int C;
 	int asn1_flag;
 	int check;
 	char *curve_name;
@@ -140,12 +136,6 @@ ecparam_opt_enctype(char *arg)
 }
 
 static const struct option ecparam_options[] = {
-	{
-		.name = "C",
-		.desc = "Convert the EC parameters into C code",
-		.type = OPTION_FLAG,
-		.opt.flag = &cfg.C,
-	},
 	{
 		.name = "check",
 		.desc = "Validate the elliptic curve parameters",
@@ -241,7 +231,7 @@ static const struct option ecparam_options[] = {
 static void
 ecparam_usage(void)
 {
-	fprintf(stderr, "usage: ecparam [-C] [-check] [-conv_form arg] "
+	fprintf(stderr, "usage: ecparam [-check] [-conv_form arg] "
 	    " [-genkey]\n"
 	    "    [-in file] [-inform DER | PEM] [-list_curves] [-name arg]\n"
 	    "    [-no_seed] [-noout] [-out file] [-outform DER | PEM]\n"
@@ -252,10 +242,7 @@ ecparam_usage(void)
 int
 ecparam_main(int argc, char **argv)
 {
-	BIGNUM *ec_p = NULL, *ec_a = NULL, *ec_b = NULL, *ec_gen = NULL;
-	BIGNUM *ec_order = NULL, *ec_cofactor = NULL;
 	EC_GROUP *group = NULL;
-	unsigned char *buffer = NULL;
 	BIO *in = NULL, *out = NULL;
 	int i, ret = 1;
 
@@ -403,119 +390,6 @@ ecparam_main(int argc, char **argv)
 			BIO_printf(bio_err, "ok\n");
 
 	}
-	if (cfg.C) {
-		size_t buf_len = 0, tmp_len = 0;
-		const EC_POINT *point;
-		int is_prime, len = 0;
-		const EC_METHOD *meth = EC_GROUP_method_of(group);
-
-		if ((ec_p = BN_new()) == NULL || (ec_a = BN_new()) == NULL ||
-		    (ec_b = BN_new()) == NULL || (ec_gen = BN_new()) == NULL ||
-		    (ec_order = BN_new()) == NULL ||
-		    (ec_cofactor = BN_new()) == NULL) {
-			perror("malloc");
-			goto end;
-		}
-		is_prime = (EC_METHOD_get_field_type(meth) ==
-		    NID_X9_62_prime_field);
-
-		if (!EC_GROUP_get_curve(group, ec_p, ec_a, ec_b, NULL))
-			goto end;
-
-		if ((point = EC_GROUP_get0_generator(group)) == NULL)
-			goto end;
-		if (!EC_POINT_point2bn(group, point,
-			EC_GROUP_get_point_conversion_form(group), ec_gen,
-			NULL))
-			goto end;
-		if (!EC_GROUP_get_order(group, ec_order, NULL))
-			goto end;
-		if (!EC_GROUP_get_cofactor(group, ec_cofactor, NULL))
-			goto end;
-
-		len = BN_num_bits(ec_order);
-
-		if ((tmp_len = (size_t) BN_num_bytes(ec_p)) > buf_len)
-			buf_len = tmp_len;
-		if ((tmp_len = (size_t) BN_num_bytes(ec_a)) > buf_len)
-			buf_len = tmp_len;
-		if ((tmp_len = (size_t) BN_num_bytes(ec_b)) > buf_len)
-			buf_len = tmp_len;
-		if ((tmp_len = (size_t) BN_num_bytes(ec_gen)) > buf_len)
-			buf_len = tmp_len;
-		if ((tmp_len = (size_t) BN_num_bytes(ec_order)) > buf_len)
-			buf_len = tmp_len;
-		if ((tmp_len = (size_t) BN_num_bytes(ec_cofactor)) > buf_len)
-			buf_len = tmp_len;
-
-		buffer = malloc(buf_len);
-
-		if (buffer == NULL) {
-			perror("malloc");
-			goto end;
-		}
-		ecparam_print_var(out, ec_p, "ec_p", len, buffer);
-		ecparam_print_var(out, ec_a, "ec_a", len, buffer);
-		ecparam_print_var(out, ec_b, "ec_b", len, buffer);
-		ecparam_print_var(out, ec_gen, "ec_gen", len, buffer);
-		ecparam_print_var(out, ec_order, "ec_order", len, buffer);
-		ecparam_print_var(out, ec_cofactor, "ec_cofactor", len,
-		    buffer);
-
-		BIO_printf(out, "\n\n");
-
-		BIO_printf(out, "EC_GROUP *get_ec_group_%d(void)\n\t{\n", len);
-		BIO_printf(out, "\tint ok=0;\n");
-		BIO_printf(out, "\tEC_GROUP *group = NULL;\n");
-		BIO_printf(out, "\tEC_POINT *point = NULL;\n");
-		BIO_printf(out, "\tBIGNUM   *tmp_1 = NULL, *tmp_2 = NULL, "
-		    "*tmp_3 = NULL;\n\n");
-		BIO_printf(out, "\tif ((tmp_1 = BN_bin2bn(ec_p_%d, "
-		    "sizeof(ec_p_%d), NULL)) == NULL)\n\t\t"
-		    "goto err;\n", len, len);
-		BIO_printf(out, "\tif ((tmp_2 = BN_bin2bn(ec_a_%d, "
-		    "sizeof(ec_a_%d), NULL)) == NULL)\n\t\t"
-		    "goto err;\n", len, len);
-		BIO_printf(out, "\tif ((tmp_3 = BN_bin2bn(ec_b_%d, "
-		    "sizeof(ec_b_%d), NULL)) == NULL)\n\t\t"
-		    "goto err;\n", len, len);
-		if (is_prime) {
-			BIO_printf(out, "\tif ((group = EC_GROUP_new_curve_"
-			    "GFp(tmp_1, tmp_2, tmp_3, NULL)) == NULL)"
-			    "\n\t\tgoto err;\n\n");
-		} else {
-			BIO_printf(out, "\tif ((group = EC_GROUP_new_curve_"
-			    "GF2m(tmp_1, tmp_2, tmp_3, NULL)) == NULL)"
-			    "\n\t\tgoto err;\n\n");
-		}
-		BIO_printf(out, "\t/* build generator */\n");
-		BIO_printf(out, "\tif ((tmp_1 = BN_bin2bn(ec_gen_%d, "
-		    "sizeof(ec_gen_%d), tmp_1)) == NULL)"
-		    "\n\t\tgoto err;\n", len, len);
-		BIO_printf(out, "\tpoint = EC_POINT_bn2point(group, tmp_1, "
-		    "NULL, NULL);\n");
-		BIO_printf(out, "\tif (point == NULL)\n\t\tgoto err;\n");
-		BIO_printf(out, "\tif ((tmp_2 = BN_bin2bn(ec_order_%d, "
-		    "sizeof(ec_order_%d), tmp_2)) == NULL)"
-		    "\n\t\tgoto err;\n", len, len);
-		BIO_printf(out, "\tif ((tmp_3 = BN_bin2bn(ec_cofactor_%d, "
-		    "sizeof(ec_cofactor_%d), tmp_3)) == NULL)"
-		    "\n\t\tgoto err;\n", len, len);
-		BIO_printf(out, "\tif (!EC_GROUP_set_generator(group, point,"
-		    " tmp_2, tmp_3))\n\t\tgoto err;\n");
-		BIO_printf(out, "\n\tok=1;\n");
-		BIO_printf(out, "err:\n");
-		BIO_printf(out, "\tif (tmp_1)\n\t\tBN_free(tmp_1);\n");
-		BIO_printf(out, "\tif (tmp_2)\n\t\tBN_free(tmp_2);\n");
-		BIO_printf(out, "\tif (tmp_3)\n\t\tBN_free(tmp_3);\n");
-		BIO_printf(out, "\tif (point)\n\t\tEC_POINT_free(point);\n");
-		BIO_printf(out, "\tif (!ok)\n");
-		BIO_printf(out, "\t\t{\n");
-		BIO_printf(out, "\t\tEC_GROUP_free(group);\n");
-		BIO_printf(out, "\t\tgroup = NULL;\n");
-		BIO_printf(out, "\t\t}\n");
-		BIO_printf(out, "\treturn(group);\n\t}\n");
-	}
 	if (!cfg.noout) {
 		if (cfg.outformat == FORMAT_ASN1)
 			i = i2d_ECPKParameters_bio(out, group);
@@ -564,15 +438,6 @@ ecparam_main(int argc, char **argv)
 	ret = 0;
 
  end:
-	BN_free(ec_p);
-	BN_free(ec_a);
-	BN_free(ec_b);
-	BN_free(ec_gen);
-	BN_free(ec_order);
-	BN_free(ec_cofactor);
-
-	free(buffer);
-
 	BIO_free(in);
 	BIO_free_all(out);
 	EC_GROUP_free(group);
@@ -580,27 +445,4 @@ ecparam_main(int argc, char **argv)
 	return (ret);
 }
 
-static int
-ecparam_print_var(BIO * out, BIGNUM * in, const char *var,
-    int len, unsigned char *buffer)
-{
-	BIO_printf(out, "static unsigned char %s_%d[] = {", var, len);
-	if (BN_is_zero(in))
-		BIO_printf(out, "\n\t0x00");
-	else {
-		int i, l;
-
-		l = BN_bn2bin(in, buffer);
-		for (i = 0; i < l - 1; i++) {
-			if ((i % 12) == 0)
-				BIO_printf(out, "\n\t");
-			BIO_printf(out, "0x%02X,", buffer[i]);
-		}
-		if ((i % 12) == 0)
-			BIO_printf(out, "\n\t");
-		BIO_printf(out, "0x%02X", buffer[i]);
-	}
-	BIO_printf(out, "\n\t};\n\n");
-	return 1;
-}
 #endif

usr.bin/openssl/openssl.1

@@ -1,4 +1,4 @@
-.\" $OpenBSD: openssl.1,v 1.161 2024/08/30 06:05:10 jmc Exp $
+.\" $OpenBSD: openssl.1,v 1.162 2025/01/19 10:24:17 tb Exp $
 .\" ====================================================================
 .\" Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
 .\"
@@ -110,7 +110,7 @@
 .\" copied and put under another distribution licence
 .\" [including the GNU Public Licence.]
 .\"
-.Dd $Mdocdate: August 30 2024 $
+.Dd $Mdocdate: January 19 2025 $
 .Dt OPENSSL 1
 .Os
 .Sh NAME
@@ -1697,7 +1697,6 @@ If no files are specified then standard input is used.
 .It Nm openssl dhparam
 .Bk -words
 .Op Fl 2 | 5
-.Op Fl C
 .Op Fl check
 .Op Fl dsaparam
 .Op Fl in Ar file
@@ -1722,11 +1721,6 @@ The options are as follows:
 The generator to use;
 2 is the default.
 If present, the input file is ignored and parameters are generated instead.
-.It Fl C
-Convert the parameters into C code.
-The parameters can then be loaded by calling the
-.No get_dh Ns Ar numbits
-function.
 .It Fl check
 Check the DH parameters.
 .It Fl dsaparam
@@ -1862,7 +1856,6 @@ Print the public/private key in plain text.
 .Bl -hang -width "openssl dsaparam"
 .It Nm openssl dsaparam
 .Bk -words
-.Op Fl C
 .Op Fl genkey
 .Op Fl in Ar file
 .Op Fl inform Cm der | pem
@@ -1880,11 +1873,6 @@ command is used to manipulate or generate DSA parameter files.
 .Pp
 The options are as follows:
 .Bl -tag -width Ds
-.It Fl C
-Convert the parameters into C code.
-The parameters can then be loaded by calling the
-.No get_dsa Ns Ar XXX
-function.
 .It Fl genkey
 Generate a DSA key either using the specified or generated
 parameters.
@@ -2028,7 +2016,6 @@ Print the public/private key in plain text.
 .Bl -hang -width "openssl ecparam"
 .It Nm openssl ecparam
 .Bk -words
-.Op Fl C
 .Op Fl check
 .Op Fl conv_form Ar arg
 .Op Fl genkey
@@ -2055,11 +2042,6 @@ can only create EC parameters from known (named) curves.
 .Pp
 The options are as follows:
 .Bl -tag -width Ds
-.It Fl C
-Convert the EC parameters into C code.
-The parameters can then be loaded by calling the
-.No get_ec_group_ Ns Ar XXX
-function.
 .It Fl check
 Validate the elliptic curve parameters.
 .It Fl conv_form Ar arg
@@ -5984,7 +5966,6 @@ version.
 .Bl -hang -width "openssl x509"
 .It Nm openssl x509
 .Bk -words
-.Op Fl C
 .Op Fl addreject Ar arg
 .Op Fl addtrust Ar arg
 .Op Fl alias
@@ -6091,8 +6072,6 @@ The key password source.
 .Pp
 The following are x509 display options:
 .Bl -tag -width "XXXX"
-.It Fl C
-Output the certificate in the form of a C source file.
 .It Fl certopt Ar option
 Customise the output format used with
 .Fl text ,

usr.bin/openssl/x509.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: x509.c,v 1.40 2024/12/04 08:14:34 tb Exp $ */
+/* $OpenBSD: x509.c,v 1.42 2025/01/19 13:14:22 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -93,7 +93,6 @@ static struct {
 	char *alias;
 	int aliasout;
 	int badops;
-	int C;
 	int CA_createserial;
 	int CA_flag;
 	char *CAfile;
@@ -327,13 +326,6 @@ x509_opt_utf8(void)
 }
 
 static const struct option x509_options[] = {
-	{
-		.name = "C",
-		.desc = "Convert the certificate into C code",
-		.type = OPTION_ORDER,
-		.opt.order = &cfg.C,
-		.order = &cfg.num,
-	},
 	{
 		.name = "addreject",
 		.argname = "arg",
@@ -763,7 +755,7 @@ static void
 x509_usage(void)
 {
 	fprintf(stderr, "usage: x509 "
-	    "[-C] [-addreject arg] [-addtrust arg] [-alias] [-CA file]\n"
+	    "[-addreject arg] [-addtrust arg] [-alias] [-CA file]\n"
 	    "    [-CAcreateserial] [-CAform der | pem] [-CAkey file]\n"
 	    "    [-CAkeyform der | pem] [-CAserial file] [-certopt option]\n"
 	    "    [-checkend arg] [-clrext] [-clrreject] [-clrtrust] [-dates]\n"
@@ -798,7 +790,6 @@ x509_main(int argc, char **argv)
 	BIO *STDout = NULL;
 	X509_STORE *ctx = NULL;
 	X509_REQ *rq = NULL;
-	char buf[256];
 	CONF *extconf = NULL;
 	char *passin = NULL;
 
@@ -1178,85 +1169,6 @@ x509_main(int argc, char **argv)
 					goto end;
 				}
 				PEM_write_bio_PUBKEY(STDout, pubkey);
-			} else if (cfg.C == i) {
-				unsigned char *d;
-				char *m;
-				int y, z;
-
-				m = X509_NAME_oneline(X509_get_subject_name(x),
-				    buf, sizeof buf);
-				if (m == NULL)
-					goto end;
-				BIO_printf(STDout, "/* subject:%s */\n", buf);
-				m = X509_NAME_oneline(X509_get_issuer_name(x),
-				    buf, sizeof buf);
-				if (m == NULL)
-					goto end;
-				BIO_printf(STDout, "/* issuer :%s */\n", buf);
-
-				z = i2d_X509(x, NULL);
-				if (z < 0)
-					goto end;
-
-				m = malloc(z);
-				if (m == NULL) {
-					BIO_printf(bio_err, "out of mem\n");
-					goto end;
-				}
-
-				d = (unsigned char *) m;
-				z = i2d_X509_NAME(X509_get_subject_name(x), &d);
-				if (z < 0) {
-					free(m);
-					goto end;
-				}
-				BIO_printf(STDout,
-				    "unsigned char XXX_subject_name[%d]={\n", z);
-				d = (unsigned char *) m;
-				for (y = 0; y < z; y++) {
-					BIO_printf(STDout, "0x%02X,", d[y]);
-					if ((y & 0x0f) == 0x0f)
-						BIO_printf(STDout, "\n");
-				}
-				if (y % 16 != 0)
-					BIO_printf(STDout, "\n");
-				BIO_printf(STDout, "};\n");
-
-				z = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(x), &d);
-				if (z < 0) {
-					free(m);
-					goto end;
-				}
-				BIO_printf(STDout,
-				    "unsigned char XXX_public_key[%d]={\n", z);
-				d = (unsigned char *) m;
-				for (y = 0; y < z; y++) {
-					BIO_printf(STDout, "0x%02X,", d[y]);
-					if ((y & 0x0f) == 0x0f)
-						BIO_printf(STDout, "\n");
-				}
-				if (y % 16 != 0)
-					BIO_printf(STDout, "\n");
-				BIO_printf(STDout, "};\n");
-
-				z = i2d_X509(x, &d);
-				if (z < 0) {
-					free(m);
-					goto end;
-				}
-				BIO_printf(STDout,
-				    "unsigned char XXX_certificate[%d]={\n", z);
-				d = (unsigned char *) m;
-				for (y = 0; y < z; y++) {
-					BIO_printf(STDout, "0x%02X,", d[y]);
-					if ((y & 0x0f) == 0x0f)
-						BIO_printf(STDout, "\n");
-				}
-				if (y % 16 != 0)
-					BIO_printf(STDout, "\n");
-				BIO_printf(STDout, "};\n");
-
-				free(m);
 			} else if (cfg.text == i) {
 				if(!X509_print_ex(STDout, x, cfg.nmflag,
 				    cfg.certflag))