sync

sbin/disklabel/editor.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: editor.c,v 1.411 2023/06/21 12:50:09 krw Exp $	*/
+/*	$OpenBSD: editor.c,v 1.412 2023/06/28 12:12:48 krw Exp $	*/
 
 /*
  * Copyright (c) 1997-2000 Todd C. Miller <millert@openbsd.org>
@@ -175,6 +175,11 @@ int	parse_sizespec(const char *, double *, char **);
 int	parse_sizerange(char *, u_int64_t *, u_int64_t *);
 int	parse_pct(char *, int *);
 int	alignpartition(struct disklabel *, int, u_int64_t, u_int64_t, int);
+int	allocate_space(struct disklabel *, const struct alloc_table *);
+void	allocate_physmemincr(struct space_allocation *);
+int	allocate_partition(struct disklabel *, struct space_allocation *);
+const struct diskchunk *allocate_diskchunk(const struct disklabel *,
+    const struct space_allocation *);
 
 static u_int64_t starting_sector;
 static u_int64_t ending_sector;
@@ -514,170 +519,175 @@ done:
 int
 editor_allocspace(struct disklabel *lp_org)
 {
-	struct disklabel *lp, label;
+	struct disklabel label;
-	struct space_allocation *alloc;
+	u_int64_t pstart, pend;
-	struct space_allocation *ap;
+	int i;
-	struct partition *pp;
-	const struct diskchunk *chunk;
-	u_int64_t chunkstart, chunksize, start, stop;
-	u_int64_t secs, xtrasecs;
-	u_int64_t pstart, pend, psz;
-	char **partmp;
-	int i, lastalloc, index, partno, freeparts;
-	extern int64_t physmem;
 
 	/* How big is the OpenBSD portion of the disk?  */
 	find_bounds(lp_org);
 
 	resizeok = 1;
-	freeparts = 0;
 	for (i = 0;  i < MAXPARTITIONS; i++) {
 		if (i == RAW_PART)
 			continue;
-		pp = &lp_org->d_partitions[i];
+		pstart = DL_GETPOFFSET(&lp_org->d_partitions[i]);
-		psz = DL_GETPSIZE(pp);
+		pend = pstart + DL_GETPSIZE(&lp_org->d_partitions[i]);
-		if (psz == 0 || pp->p_fstype == FS_UNUSED) {
-			freeparts++;
-			continue;
-		}
-		pstart = DL_GETPOFFSET(pp);
-		pend = pstart + psz;
 		if (((pstart >= starting_sector && pstart < ending_sector) ||
 		    (pend > starting_sector && pend <= ending_sector)))
 			resizeok = 0; /* Part of OBSD area is in use! */
 	}
 
-	alloc = NULL;
+	for (i = 0; i < alloc_table_nitems; i++) {
-	index = -1;
+		memcpy(&label, lp_org, sizeof(label));
-again:
+		if (allocate_space(&label, &alloc_table[i]) == 0) {
-	free(alloc);
+			memcpy(lp_org, &label, sizeof(struct disklabel));
-	alloc = NULL;
+			return 0;
-	index++;
+		}
-	if (index >= alloc_table_nitems)
+	}
+
 	return 1;
-	lp = &label;
+}
-	mpfree(mountpoints, KEEP);
-	memcpy(lp, lp_org, sizeof(struct disklabel));
-	lp->d_npartitions = MAXPARTITIONS;
-	lastalloc = alloc_table[index].sz;
-	if (lastalloc > freeparts)
-		goto again;
-	alloc = reallocarray(NULL, lastalloc, sizeof(struct space_allocation));
-	if (alloc == NULL)
-		err(1, NULL);
-	memcpy(alloc, alloc_table[index].table,
-	    lastalloc * sizeof(struct space_allocation));
 
-	/* bump max swap based on phys mem, little physmem gets 2x swap */
+const struct diskchunk *
-	if (index == 0 && alloc_table == alloc_table_default) {
+allocate_diskchunk(const struct disklabel *lp,
-		if (physmem && physmem / DEV_BSIZE < MEG(256))
+    const struct space_allocation *sa)
-			alloc[1].minsz = alloc[1].maxsz = 2 * (physmem /
+{
-			    DEV_BSIZE);
+	const struct diskchunk *chunk;
-		else
+	static struct diskchunk largest;
-			alloc[1].maxsz += (physmem / DEV_BSIZE);
+	uint64_t maxstop;
-		/* bump max /var to make room for 2 crash dumps */
-		alloc[3].maxsz += 2 * (physmem / DEV_BSIZE);
-	}
 
-	xtrasecs = editor_countfree(lp);
+	largest.start = largest.stop = 0;
 
-	for (i = 0; i < lastalloc; i++) {
-		alloc[i].minsz = DL_BLKTOSEC(lp, alloc[i].minsz);
-		alloc[i].maxsz = DL_BLKTOSEC(lp, alloc[i].maxsz);
-		if (xtrasecs >= alloc[i].minsz)
-			xtrasecs -= alloc[i].minsz;
-		else {
-			/* It did not work out, try next strategy */
-			goto again;
-		}
-	}
-
-	for (i = 0; i < lastalloc; i++) {
-		/* Find next available partition. */
-		for (partno = 0;  partno < MAXPARTITIONS; partno++)
-			if (DL_GETPSIZE(&lp->d_partitions[partno]) == 0)
-				break;
-		if (partno == MAXPARTITIONS) {
-			/* It did not work out, try next strategy */
-			goto again;
-		}
-		pp = &lp->d_partitions[partno];
-		partmp = &mountpoints[partno];
-		ap = &alloc[i];
-
-		/* Find largest chunk of free space. */
 	chunk = free_chunks(lp, -1);
-		chunkstart = chunksize = 0;
 	for (; chunk->start != 0 || chunk->stop != 0; chunk++) {
-			start = chunk->start;
+		if (CHUNKSZ(chunk) > CHUNKSZ(&largest))
-			stop = chunk->stop;
+			largest = *chunk;
+	}
+	maxstop = largest.start + DL_BLKTOSEC(lp, sa->maxsz);
+	if (maxstop > largest.stop)
+		maxstop = largest.stop;
 #ifdef SUN_CYLCHECK
 	if (lp->d_flags & D_VENDOR) {
-				/* Align to cylinder boundaries. */
+		largest.start = ROUNDUP(largest.start, lp->d_secpercyl);
-				start = ROUNDUP(start, lp_org->d_secpercyl);
+		maxstop = ROUNDUP(maxstop, lp->d_secpercyl);
-				stop = ROUNDDOWN(stop, lp_org->d_secpercyl);
+		if (maxstop > largest.stop)
-				if (start > stop)
+			maxstop -= lp->d_secpercyl;
-					start = stop;
+		if (largest.start >= maxstop)
+			largest.start = largest.stop = maxstop = 0;
 	}
 #endif
-			if (stop - start > chunksize) {
+	if (maxstop < largest.stop)
-				chunkstart = start;
+		largest.stop = maxstop;
-				chunksize = stop - start;
+	if (CHUNKSZ(&largest) < DL_BLKTOSEC(lp, sa->minsz))
-			}
+		return NULL;
-		}
 
-		/* Figure out the size of the partition. */
+	return &largest;
-		if (i == lastalloc - 1) {
+}
-			if (chunksize > ap->maxsz)
-				secs = ap->maxsz;
-			else
-				secs = chunksize;
-		} else {
-			secs = ap->minsz;
-			if (xtrasecs > 0)
-				secs += (xtrasecs / 100) * ap->rate;
-			if (secs > ap->maxsz)
-				secs = ap->maxsz;
-		}
-#ifdef SUN_CYLCHECK
-		if (lp->d_flags & D_VENDOR) {
-			secs = ROUNDUP(secs, lp_org->d_secpercyl);
-			while (secs > chunksize)
-				secs -= lp_org->d_secpercyl;
-		}
-#endif
 
-		/* See if partition can fit into chunk. */
+int
-		if (secs > chunksize)
+allocate_partition(struct disklabel *lp, struct space_allocation *sa)
-			secs = chunksize;
+{
-		if (secs < ap->minsz) {
+	const struct diskchunk *chunk;
-			/* It did not work out, try next strategy */
+	struct partition *pp;
-			goto again;
+	unsigned int partno;
-		}
 
-		/* Everything seems ok so configure the partition. */
+	for (partno = 0; partno < nitems(lp->d_partitions); partno++) {
-		DL_SETPSIZE(pp, secs);
+		if (partno == RAW_PART)
-		DL_SETPOFFSET(pp, chunkstart);
+			continue;
-		if (ap->mp[0] != '/') {
+		pp = &lp->d_partitions[partno];
-			if (strcasecmp(ap->mp, "raid") == 0)
+		if (DL_GETPSIZE(pp) == 0 || pp->p_fstype == FS_UNUSED)
+			break;
+	}
+	if (partno >= nitems(lp->d_partitions))
+		return 1;		/* No free partition. */
+
+	/* Find appropriate chunk of free space. */
+	chunk = allocate_diskchunk(lp, sa);
+	if (chunk == NULL)
+		return 1;
+
+	if (strcasecmp(sa->mp, "raid") == 0)
 		pp->p_fstype = FS_RAID;
-			else
+	else if (strcasecmp(sa->mp, "swap") == 0)
 		pp->p_fstype = FS_SWAP;
-		} else {
+	else if (sa->mp[0] == '/')
 		pp->p_fstype = FS_BSDFFS;
-			pp->p_fragblock = 0;
+	else
-			if (set_fragblock(lp, partno) == 1) {
+		return 1;
-				free(alloc);
+
+	DL_SETPSIZE(pp, chunk->stop - chunk->start);
+	DL_SETPOFFSET(pp, chunk->start);
+
+	if (pp->p_fstype == FS_BSDFFS && DL_GETPSIZE(pp) > 0) {
+		mountpoints[partno] = strdup(sa->mp);
+		if (mountpoints[partno] == NULL)
+			err(1, NULL);
+		if (set_fragblock(lp, partno))
 			return 1;
 	}
-			free(*partmp);
+
-			if ((*partmp = strdup(ap->mp)) == NULL)
+	return 0;
-				err(1, NULL);
+}
+
+void
+allocate_physmemincr(struct space_allocation *sa)
+{
+	u_int64_t memblks;
+	extern int64_t physmem;
+
+	if (physmem == 0)
+		return;
+
+	memblks = physmem / DEV_BSIZE;
+	if (strcasecmp(sa->mp, "swap") == 0) {
+		if (memblks < MEG(256))
+			sa->minsz = sa->maxsz = 2 * memblks;
+		else
+			sa->maxsz += memblks;
+	} else if (strcasecmp(sa->mp, "/var") == 0) {
+		sa->maxsz += 2 * memblks;
+	}
+}
+
+int
+allocate_space(struct disklabel *lp, const struct alloc_table *alloc_table)
+{
+	struct space_allocation sa[MAXPARTITIONS];
+	u_int64_t maxsz, xtrablks;
+	int i;
+
+	xtrablks = DL_SECTOBLK(lp, editor_countfree(lp));
+	memset(sa, 0, sizeof(sa));
+	for (i = 0; i < alloc_table->sz; i++) {
+		sa[i] = alloc_table->table[i];
+		if (alloc_table->table == alloc_big)
+			allocate_physmemincr(&sa[i]);
+		if (xtrablks < sa[i].minsz)
+			return 1;	/* Too few free blocks. */
+		xtrablks -= sa[i].minsz;
+	}
+	sa[alloc_table->sz - 1].rate = 100; /* Last allocation is greedy. */
+
+	for (i = lp->d_npartitions; i < MAXPARTITIONS; i++) {
+		if (i == RAW_PART)
+			continue;
+		memset(&lp->d_partitions[i], 0, sizeof(lp->d_partitions[i]));
+	}
+	lp->d_npartitions = MAXPARTITIONS;
+
+	mpfree(mountpoints, KEEP);
+	for (i = 0; i < alloc_table->sz; i++) {
+		if (sa[i].rate < 100) {
+			maxsz = sa[i].minsz + (xtrablks / 100) * sa[i].rate;
+			if (maxsz < sa[i].maxsz)
+				sa[i].maxsz = maxsz;
+		}
+		if (allocate_partition(lp, &sa[i])) {
+			mpfree(mountpoints, KEEP);
+			return 1;
 		}
 	}
 
-	free(alloc);
-	memcpy(lp_org, lp, sizeof(struct disklabel));
 	return 0;
 }
 

sbin/iked/ca.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: ca.c,v 1.94 2023/06/25 08:07:04 op Exp $	*/
+/*	$OpenBSD: ca.c,v 1.95 2023/06/28 14:10:24 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
@@ -62,7 +62,7 @@ int	 ca_x509_subject_cmp(X509 *, struct iked_static_id *);
 int	 ca_validate_pubkey(struct iked *, struct iked_static_id *,
 	    void *, size_t, struct iked_id *);
 int	 ca_validate_cert(struct iked *, struct iked_static_id *,
-	    void *, size_t, X509 **);
+	    void *, size_t, STACK_OF(X509) *, X509 **);
 EVP_PKEY *
 	 ca_bytes_to_pkey(uint8_t *, size_t);
 int	 ca_privkey_to_method(struct iked_id *);
@@ -203,6 +203,130 @@ ca_reset(struct privsep *ps)
 		fatal("ca_reset: reload");
 }
 
+int
+ca_certbundle_add(struct ibuf *buf, struct iked_id *id)
+{
+	uint8_t		 type = id->id_type;
+	size_t		 len = ibuf_length(id->id_buf);
+	void		*val = ibuf_data(id->id_buf);
+
+	if (id == NULL ||
+	    buf == NULL ||
+	    ibuf_add(buf, &type, sizeof(type)) != 0 ||
+	    ibuf_add(buf, &len, sizeof(len)) != 0 ||
+	    ibuf_add(buf, val, len) != 0)
+		return -1;
+	return 0;
+}
+
+/*
+ * decode cert bundle to cert and untrusted intermediate CAs.
+ * datap/lenp point to bundle on input and to decoded cert output
+ */
+static int
+ca_decode_cert_bundle(struct iked *env, struct iked_sahdr *sh,
+  uint8_t **datap, size_t *lenp, STACK_OF(X509)	**untrustedp)
+{
+	STACK_OF(X509)		*untrusted = NULL;
+	X509			*cert;
+	BIO			*rawcert = NULL;
+	uint8_t			*certdata = NULL;
+	size_t			 certlen = 0;
+	uint8_t			 datatype;
+	size_t			 datalen = 0;
+	uint8_t			*ptr;
+	size_t			 len;
+	int			 ret = -1;
+
+	log_debug("%s: decoding cert bundle", SPI_SH(sh, __func__));
+
+	ptr = *datap;
+	len = *lenp;
+	*untrustedp = NULL;
+
+	/* allocate stack for intermediate CAs */
+	if ((untrusted = sk_X509_new_null()) == NULL)
+		goto done;
+
+	/* parse TLV, see ca_certbundle_add() */
+	while (len > 0) {
+		/* Type */
+		if (len < sizeof(datatype)) {
+			log_debug("%s: short data (type)",
+			    SPI_SH(sh, __func__));
+			goto done;
+		}
+		memcpy(&datatype, ptr, sizeof(datatype));
+		ptr += sizeof(datatype);
+		len -= sizeof(datatype);
+
+		/* Only X509 certs/CAs are supported */
+		if (datatype != IKEV2_CERT_X509_CERT) {
+			log_info("%s: unsupported data type: %s",
+			    SPI_SH(sh, __func__),
+			    print_map(datatype, ikev2_cert_map));
+			goto done;
+		}
+
+		/* Length */
+		if (len < sizeof(datalen)) {
+			log_info("%s: short data (len)",
+			    SPI_SH(sh, __func__));
+			goto done;
+		}
+		memcpy(&datalen, ptr, sizeof(datalen));
+		ptr += sizeof(datalen);
+		len -= sizeof(datalen);
+
+		/* Value */
+		if (len < datalen) {
+			log_info("%s: short len %zu < datalen %zu",
+			    SPI_SH(sh, __func__), len, datalen);
+			goto done;
+		}
+
+		if (certdata == NULL) {
+			/* First entry is cert */
+			certdata = ptr;
+			certlen = datalen;
+		} else {
+			/* All other entries are intermediate CAs */
+			rawcert = BIO_new_mem_buf(ptr, datalen);
+			if (rawcert == NULL)
+				goto done;
+			cert = d2i_X509_bio(rawcert, NULL);
+			BIO_free(rawcert);
+			if (cert == NULL) {
+				log_warnx("%s: cannot parse CA",
+				    SPI_SH(sh, __func__));
+				ca_sslerror(__func__);
+				goto done;
+			}
+			if (!sk_X509_push(untrusted, cert)) {
+				log_warnx("%s: cannot store CA",
+				    SPI_SH(sh, __func__));
+				X509_free(cert);
+				goto done;
+			}
+		}
+		ptr += datalen;
+		len -= datalen;
+	}
+	log_debug("%s: decoded cert bundle", SPI_SH(sh, __func__));
+	*datap = certdata;
+	*lenp = certlen;
+	*untrustedp = untrusted;
+	untrusted = NULL;
+	ret = 0;
+
+ done:
+	if (ret != 0)
+		log_info("%s: failed to decode cert bundle",
+		    SPI_SH(sh, __func__));
+	sk_X509_free(untrusted);
+	return ret;
+}
+
 int
 ca_dispatch_parent(int fd, struct privsep_proc *p, struct imsg *imsg)
 {
@@ -470,6 +594,7 @@ ca_getcert(struct iked *env, struct imsg *imsg)
 {
 	struct ca_store		*store = env->sc_priv;
 	X509			*issuer = NULL, *cert;
+	STACK_OF(X509)		*untrusted = NULL;
 	EVP_PKEY		*certkey;
 	struct iked_sahdr	 sh;
 	uint8_t			 type;
@@ -498,6 +623,10 @@ ca_getcert(struct iked *env, struct imsg *imsg)
 
 	bzero(&key, sizeof(key));
 
+	if (type == IKEV2_CERT_BUNDLE &&
+	    ca_decode_cert_bundle(env, &sh, &ptr, &len, &untrusted) == 0)
+		type = IKEV2_CERT_X509_CERT;
+
 	switch (type) {
 	case IKEV2_CERT_X509_CERT:
 		/* Look in local cert storage first */
@@ -515,15 +644,17 @@ ca_getcert(struct iked *env, struct imsg *imsg)
 			}
 		}
 		if (env->sc_ocsp_url == NULL)
-			ret = ca_validate_cert(env, &id, ptr, len, NULL);
+			ret = ca_validate_cert(env, &id, ptr, len, untrusted, NULL);
 		else {
-			ret = ca_validate_cert(env, &id, ptr, len, &issuer);
+			ret = ca_validate_cert(env, &id, ptr, len, untrusted, &issuer);
 			if (ret == 0) {
 				ret = ocsp_validate_cert(env, ptr, len, sh,
 				    type, issuer);
 				X509_free(issuer);
-				if (ret == 0)
+				if (ret == 0) {
+					sk_X509_free(untrusted);
 					return (0);
+				}
 			} else
 				X509_free(issuer);
 		}
@@ -561,6 +692,8 @@ ca_getcert(struct iked *env, struct imsg *imsg)
 
 	ret = proc_composev(&env->sc_ps, PROC_IKEV2, cmd, iov, iovcnt);
 	ibuf_free(key.id_buf);
+	sk_X509_free(untrusted);
+
 	return (ret);
 }
 
@@ -979,7 +1112,7 @@ ca_reload(struct iked *env)
 
 		x509 = X509_OBJECT_get0_X509(xo);
 
-		(void)ca_validate_cert(env, NULL, x509, 0, NULL);
+		(void)ca_validate_cert(env, NULL, x509, 0, NULL, NULL);
 	}
 
 	if (!env->sc_certreqtype)
@@ -1690,7 +1823,7 @@ ca_validate_pubkey(struct iked *env, struct iked_static_id *id,
 
 int
 ca_validate_cert(struct iked *env, struct iked_static_id *id,
-    void *data, size_t len, X509 **issuerp)
+    void *data, size_t len, STACK_OF(X509) *untrusted, X509 **issuerp)
 {
 	struct ca_store		*store = env->sc_priv;
 	X509_STORE_CTX		*csc = NULL;
@@ -1754,7 +1887,7 @@ ca_validate_cert(struct iked *env, struct iked_static_id *id,
 		errstr = "failed to alloc csc";
 		goto done;
 	}
-	X509_STORE_CTX_init(csc, store->ca_cas, cert, NULL);
+	X509_STORE_CTX_init(csc, store->ca_cas, cert, untrusted);
 	param = X509_STORE_get0_param(store->ca_cas);
 	if (X509_VERIFY_PARAM_get_flags(param) & X509_V_FLAG_CRL_CHECK) {
 		X509_STORE_CTX_set_flags(csc, X509_V_FLAG_CRL_CHECK);

sbin/iked/iked.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: iked.c,v 1.65 2023/06/25 08:07:04 op Exp $	*/
+/*	$OpenBSD: iked.c,v 1.66 2023/06/28 12:31:19 gerhard Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -203,8 +203,6 @@ main(int argc, char *argv[])
 
 	setproctitle("parent");
 	log_procinit("parent");
-	if (!debug && daemon(0, 0) == -1)
-		err(1, "failed to daemonize");
 
 	event_init();
 

sbin/iked/iked.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: iked.h,v 1.219 2023/06/25 08:07:04 op Exp $	*/
+/*	$OpenBSD: iked.h,v 1.220 2023/06/28 14:10:24 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -642,6 +642,7 @@ struct iked_message {
 	struct iked_id		 msg_peerid;
 	struct iked_id		 msg_localid;
 	struct iked_id		 msg_cert;
+	struct iked_id		 msg_scert[IKED_SCERT_MAX]; /* supplemental certs */
 	struct ibuf		*msg_cookie;
 	uint16_t		 msg_group;
 	uint16_t		 msg_cpi;
@@ -1176,6 +1177,7 @@ int	 ca_setcert(struct iked *, struct iked_sahdr *, struct iked_id *,
 int	 ca_setauth(struct iked *, struct iked_sa *,
 	    struct ibuf *, enum privsep_procid);
 void	 ca_getkey(struct privsep *, struct iked_id *, enum imsg_type);
+int	 ca_certbundle_add(struct ibuf *, struct iked_id *);
 int	 ca_privkey_serialize(EVP_PKEY *, struct iked_id *);
 int	 ca_pubkey_serialize(EVP_PKEY *, struct iked_id *);
 void	 ca_sslerror(const char *);

sbin/iked/ikev2.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: ikev2.c,v 1.371 2023/06/14 14:09:29 claudio Exp $	*/
+/*	$OpenBSD: ikev2.c,v 1.372 2023/06/28 14:10:24 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -940,11 +940,12 @@ ikev2_ike_auth_recv(struct iked *env, struct iked_sa *sa,
     struct iked_message *msg)
 {
 	struct iked_id		*id;
-	struct ibuf		*authmsg;
+	struct ibuf		*authmsg, *buf;
 	struct iked_policy	*old;
 	uint8_t			*cert = NULL;
 	size_t			 certlen = 0;
 	int			 certtype = IKEV2_CERT_NONE;
+	int			 i;
 
 	/* The AUTH payload indicates if the responder wants EAP or not */
 	if (msg->msg_auth.id_type != IKEV2_AUTH_NONE &&
@@ -1047,6 +1048,30 @@ ikev2_ike_auth_recv(struct iked *env, struct iked_sa *sa,
 		}
 	}
 
+	/* Encode all received certs as single blob */
+	if (msg->msg_cert.id_type != IKEV2_CERT_BUNDLE &&
+	    msg->msg_scert[0].id_type != IKEV2_CERT_NONE) {
+		if ((buf = ibuf_new(NULL, 0)) == NULL)
+			return (-1);
+		/* begin with certificate */
+		if (ca_certbundle_add(buf, &msg->msg_cert) != 0) {
+			ibuf_free(buf);
+			return (-1);
+		}
+		/* add intermediate CAs */
+		for (i = 0; i < IKED_SCERT_MAX; i++) {
+			if (msg->msg_scert[i].id_type == IKEV2_CERT_NONE)
+				break;
+			if (ca_certbundle_add(buf, &msg->msg_scert[i]) != 0) {
+				ibuf_free(buf);
+				return (-1);
+			}
+		}
+		ibuf_free(msg->msg_cert.id_buf);
+		msg->msg_cert.id_buf = buf;
+		msg->msg_cert.id_type = IKEV2_CERT_BUNDLE;
+	}
+
 	if (!TAILQ_EMPTY(&msg->msg_proposals)) {
 		if (proposals_negotiate(&sa->sa_proposals,
 		    &sa->sa_policy->pol_proposals, &msg->msg_proposals,

sbin/iked/ikev2.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: ikev2.h,v 1.34 2021/05/28 18:01:39 tobhe Exp $	*/
+/*	$OpenBSD: ikev2.h,v 1.35 2023/06/28 14:10:24 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -433,6 +433,7 @@ struct ikev2_cert {
  * use range (201-255, same RFC) for ECDSA.
  */
 #define IKEV2_CERT_ECDSA		201	/* Private */
+#define IKEV2_CERT_BUNDLE		254	/* Private */
 
 extern struct iked_constmap ikev2_cert_map[];
 

sbin/iked/ikev2_msg.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: ikev2_msg.c,v 1.95 2023/06/13 12:34:12 tb Exp $	*/
+/*	$OpenBSD: ikev2_msg.c,v 1.96 2023/06/28 14:10:24 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -189,6 +189,7 @@ void
 ikev2_msg_cleanup(struct iked *env, struct iked_message *msg)
 {
 	struct iked_certreq	*cr;
+	int			 i;
 
 	if (msg == msg->msg_parent) {
 		ibuf_free(msg->msg_nonce);
@@ -197,6 +198,8 @@ ikev2_msg_cleanup(struct iked *env, struct iked_message *msg)
 		ibuf_free(msg->msg_peerid.id_buf);
 		ibuf_free(msg->msg_localid.id_buf);
 		ibuf_free(msg->msg_cert.id_buf);
+		for (i = 0; i < IKED_SCERT_MAX; i++)
+			ibuf_free(msg->msg_scert[i].id_buf);
 		ibuf_free(msg->msg_cookie);
 		ibuf_free(msg->msg_cookie2);
 		ibuf_free(msg->msg_del_buf);
@@ -211,6 +214,8 @@ ikev2_msg_cleanup(struct iked *env, struct iked_message *msg)
 		msg->msg_peerid.id_buf = NULL;
 		msg->msg_localid.id_buf = NULL;
 		msg->msg_cert.id_buf = NULL;
+		for (i = 0; i < IKED_SCERT_MAX; i++)
+			msg->msg_scert[i].id_buf = NULL;
 		msg->msg_cookie = NULL;
 		msg->msg_cookie2 = NULL;
 		msg->msg_del_buf = NULL;

sbin/iked/ikev2_pld.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: ikev2_pld.c,v 1.130 2023/06/14 14:09:29 claudio Exp $	*/
+/*	$OpenBSD: ikev2_pld.c,v 1.131 2023/06/28 14:10:24 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -810,6 +810,7 @@ ikev2_pld_cert(struct iked *env, struct ikev2_payload *pld,
 	struct iked_id			*certid;
 	uint8_t				*msgbuf = ibuf_data(msg->msg_data);
 	const struct iked_sa		*sa = msg->msg_sa;
+	int				 i;
 
 	if (ikev2_validate_cert(msg, offset, left, &cert))
 		return (-1);
@@ -826,13 +827,28 @@ ikev2_pld_cert(struct iked *env, struct ikev2_payload *pld,
 	if (!ikev2_msg_frompeer(msg))
 		return (0);
 
-	certid = &msg->msg_parent->msg_cert;
+	/* do not accept internal encoding in the wire */
-	if (certid->id_type) {
+	if (cert.cert_type == IKEV2_CERT_BUNDLE) {
-		log_debug("%s: multiple cert payloads, ignoring",
+		log_debug("%s: ignoring IKEV2_CERT_BUNDLE",
 		   SPI_SA(sa, __func__));
 		return (0);
 	}
 
+	certid = &msg->msg_parent->msg_cert;
+	if (certid->id_type) {
+		/* try to set supplemental certs */
+		for (i = 0; i < IKED_SCERT_MAX; i++) {
+			certid = &msg->msg_parent->msg_scert[i];
+			if (!certid->id_type)
+				break;
+		}
+		if (certid->id_type) {
+			log_debug("%s: too many cert payloads, ignoring",
+			   SPI_SA(sa, __func__));
+			return (0);
+		}
+	}
+
 	if ((certid->id_buf = ibuf_new(buf, len)) == NULL) {
 		log_debug("%s: failed to save cert", __func__);
 		return (-1);

sbin/iked/proc.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: proc.c,v 1.38 2023/03/05 22:17:22 tobhe Exp $	*/
+/*	$OpenBSD: proc.c,v 1.39 2023/06/28 12:31:19 gerhard Exp $	*/
 
 /*
  * Copyright (c) 2010 - 2016 Reyk Floeter <reyk@openbsd.org>
@@ -205,6 +205,8 @@ proc_init(struct privsep *ps, struct privsep_proc *procs, unsigned int nproc,
 
 	if (proc_id == PROC_PARENT) {
 		privsep_process = PROC_PARENT;
+		if (!debug && daemon(0, 0) == -1)
+			fatal("failed to daemonize");
 		proc_setup(ps, procs, nproc);
 
 		/*

sys/arch/arm64/conf/GENERIC

@@ -1,4 +1,4 @@
-# $OpenBSD: GENERIC,v 1.273 2023/06/10 18:31:38 patrick Exp $
+# $OpenBSD: GENERIC,v 1.274 2023/06/27 22:38:46 patrick Exp $
 #
 # GENERIC machine description file
 #
@@ -338,6 +338,7 @@ qcscm*		at fdt?
 qcsmem*		at fdt?
 qcsmptp*	at fdt?
 qcspmi*		at fdt?
+qctsens*	at fdt?
 qcpmic*		at qcspmi?
 qcpmicgpio*	at qcpmic?
 qcpon*		at qcpmic?

sys/arch/arm64/conf/RAMDISK

@@ -1,4 +1,4 @@
-# $OpenBSD: RAMDISK,v 1.206 2023/06/10 18:31:38 patrick Exp $
+# $OpenBSD: RAMDISK,v 1.207 2023/06/27 22:38:46 patrick Exp $
 
 machine		arm64
 maxusers	4
@@ -262,6 +262,7 @@ qcscm*		at fdt?
 qcsmem*		at fdt?
 qcsmptp*	at fdt?
 qcspmi*		at fdt?
+qctsens*	at fdt?
 qcpmic*		at qcspmi?
 qcpmicgpio*	at qcpmic?
 qcpon*		at qcpmic?

sys/dev/dt/dt_dev.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: dt_dev.c,v 1.26 2023/04/26 16:53:59 claudio Exp $ */
+/*	$OpenBSD: dt_dev.c,v 1.27 2023/06/28 08:23:25 claudio Exp $ */
 
 /*
  * Copyright (c) 2019 Martin Pieuchot <mpi@openbsd.org>
@@ -240,8 +240,8 @@ dtread(dev_t dev, struct uio *uio, int flags)
 		return (EMSGSIZE);
 
 	while (!sc->ds_evtcnt) {
-		sleep_setup(&sls, sc, PWAIT | PCATCH, "dtread", 0);
+		sleep_setup(&sls, sc, PWAIT | PCATCH, "dtread");
-		error = sleep_finish(&sls, !sc->ds_evtcnt);
+		error = sleep_finish(&sls, PWAIT | PCATCH, 0, !sc->ds_evtcnt);
 		if (error == EINTR || error == ERESTART)
 			break;
 	}

sys/dev/dt/dt_prov_static.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: dt_prov_static.c,v 1.18 2023/04/28 20:03:13 mvs Exp $ */
+/*	$OpenBSD: dt_prov_static.c,v 1.19 2023/06/28 11:49:49 kn Exp $ */
 
 /*
  * Copyright (c) 2019 Martin Pieuchot <mpi@openbsd.org>
@@ -93,6 +93,7 @@ DT_STATIC_PROBE2(smr, thread, "uint64_t", "uint64_t");
  */
 DT_STATIC_PROBE0(refcnt, none);
 DT_STATIC_PROBE3(refcnt, ifaddr, "void *", "int", "int");
+DT_STATIC_PROBE3(refcnt, ifmaddr, "void *", "int", "int");
 DT_STATIC_PROBE3(refcnt, inpcb, "void *", "int", "int");
 DT_STATIC_PROBE3(refcnt, rtentry, "void *", "int", "int");
 DT_STATIC_PROBE3(refcnt, tdb, "void *", "int", "int");
@@ -140,6 +141,7 @@ struct dt_probe *const dtps_static[] = {
 	/* refcnt */
 	&_DT_STATIC_P(refcnt, none),
 	&_DT_STATIC_P(refcnt, ifaddr),
+	&_DT_STATIC_P(refcnt, ifmaddr),
 	&_DT_STATIC_P(refcnt, inpcb),
 	&_DT_STATIC_P(refcnt, rtentry),
 	&_DT_STATIC_P(refcnt, tdb),

sys/dev/fdt/files.fdt

@@ -1,4 +1,4 @@
-#	$OpenBSD: files.fdt,v 1.193 2023/06/10 18:31:38 patrick Exp $
+#	$OpenBSD: files.fdt,v 1.194 2023/06/27 22:38:46 patrick Exp $
 #
 # Config file and device description for machine-independent FDT code.
 # Included by ports that need it.
@@ -721,6 +721,11 @@ device	qcpdc
 attach	qcpdc at fdt
 file	dev/fdt/qcpdc.c			qcpdc
 
+# Qualcomm Temperature Sensor
+device	qctsens
+attach	qctsens at fdt
+file	dev/fdt/qctsens.c		qctsens
+
 # Qualcomm PMIC
 device	qcpmic: spmi
 attach	qcpmic at spmi

sys/dev/fdt/qctsens.c

@@ -0,0 +1,206 @@
+/*	$OpenBSD: qctsens.c,v 1.1 2023/06/27 22:38:46 patrick Exp $	*/
+/*
+ * Copyright (c) 2023 Patrick Wildt <patrick@blueri.se>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/malloc.h>
+#include <sys/device.h>
+#include <sys/sensors.h>
+
+#include <machine/intr.h>
+#include <machine/bus.h>
+#include <machine/fdt.h>
+
+#include <dev/ofw/openfirm.h>
+#include <dev/ofw/ofw_clock.h>
+#include <dev/ofw/ofw_misc.h>
+#include <dev/ofw/ofw_thermal.h>
+#include <dev/ofw/fdt.h>
+
+/* Registers (sensor block) */
+#define TSENS_Sn_STATUS(n)	(0xa0 + (4 * (n)))
+#define  TSENS_Sn_VALID			(1 << 21)
+#define  TSENS_Sn_TEMP(x)		((x) & 0xfff)
+
+/* Registers (config block) */
+#define TSENS_HW_VER		0x00
+#define TSENS_CTRL		0x04
+#define  TSENS_CTRL_EN			(1 << 0)
+#define  TSENS_CTRL_Sn_EN(x)		(1 << ((x) + 3))
+
+#define TSENS_NUM_SENSORS	16
+
+struct qctsens_softc {
+	struct device		sc_dev;
+	bus_space_tag_t		sc_iot;
+	bus_space_handle_t	sc_ioh;
+	bus_space_handle_t	sc_ioh_conf;
+
+	int			sc_node;
+
+	struct ksensordev	sc_sensordev;
+	struct ksensor		sc_sensor[TSENS_NUM_SENSORS];
+
+	struct thermal_sensor	sc_ts;
+};
+
+int	qctsens_match(struct device *, void *, void *);
+void	qctsens_attach(struct device *, struct device *, void *);
+
+const struct cfattach	qctsens_ca = {
+	sizeof (struct qctsens_softc), qctsens_match, qctsens_attach
+};
+
+struct cfdriver qctsens_cd = {
+	NULL, "qctsens", DV_DULL
+};
+
+void	qctsens_refresh_sensors(void *);
+int32_t	qctsens_get_temperature(void *, uint32_t *);
+void qctsens_attach_sensors(struct qctsens_softc *);
+
+int
+qctsens_match(struct device *parent, void *match, void *aux)
+{
+	struct fdt_attach_args *faa = aux;
+
+	return OF_is_compatible(faa->fa_node, "qcom,tsens-v2");
+}
+
+void
+qctsens_attach(struct device *parent, struct device *self, void *aux)
+{
+	struct qctsens_softc *sc = (struct qctsens_softc *)self;
+	struct fdt_attach_args *faa = aux;
+	uint32_t reg;
+
+	if (faa->fa_nreg < 1) {
+		printf(": no registers\n");
+		return;
+	}
+
+	sc->sc_node = faa->fa_node;
+	sc->sc_iot = faa->fa_iot;
+	if (bus_space_map(sc->sc_iot, faa->fa_reg[0].addr,
+	    faa->fa_reg[0].size, 0, &sc->sc_ioh)) {
+		printf(": can't map registers (sensors)\n");
+		return;
+	}
+	if (bus_space_map(sc->sc_iot, faa->fa_reg[1].addr,
+	    faa->fa_reg[1].size, 0, &sc->sc_ioh_conf)) {
+		printf(": can't map registers (config)\n");
+		return;
+	}
+
+	printf("\n");
+
+	reg = bus_space_read_4(sc->sc_iot, sc->sc_ioh_conf, TSENS_CTRL);
+	if ((reg & TSENS_CTRL_EN) == 0)
+		return;
+
+	qctsens_attach_sensors(sc);
+
+	sc->sc_ts.ts_node = sc->sc_node;
+	sc->sc_ts.ts_cookie = sc;
+	sc->sc_ts.ts_get_temperature = qctsens_get_temperature;
+	thermal_sensor_register(&sc->sc_ts);
+}
+
+void
+qctsens_attach_sensors(struct qctsens_softc *sc)
+{
+	char nodename[32];
+	uint32_t propdata[4];
+	uint32_t phandle, reg;
+	int node, len, sidx;
+
+	phandle = OF_getpropint(sc->sc_node, "phandle", 0);
+	if (phandle == 0) {
+		printf("%s: missing phandle on node\n", sc->sc_dev.dv_xname);
+		return;
+	}
+
+	reg = bus_space_read_4(sc->sc_iot, sc->sc_ioh_conf, TSENS_CTRL);
+	node = OF_getnodebyname(0, "thermal-zones");
+	for (node = OF_child(node); node != 0; node = OF_peer(node)) {
+		len = OF_getpropintarray(node, "thermal-sensors", propdata,
+		    sizeof(propdata));
+
+		if (len != 8 || propdata[0] != phandle || propdata[1] >= 16)
+			continue;
+
+		len = OF_getprop(node, "name", nodename, sizeof(nodename));
+		len = strlen(nodename);
+		if (strcmp("-thermal", &nodename[len - 8]) != 0)
+			continue;
+
+		nodename[len - 8] = '\0';
+		sidx = propdata[1];
+
+		if ((reg & TSENS_CTRL_Sn_EN(sidx)) == 0)
+			continue;
+
+		strlcpy(sc->sc_sensor[sidx].desc, nodename,
+		    sizeof(sc->sc_sensor[sidx].desc));
+		sc->sc_sensor[sidx].type = SENSOR_TEMP;
+		sc->sc_sensor[sidx].flags = SENSOR_FINVALID;
+		sensor_attach(&sc->sc_sensordev, &sc->sc_sensor[sidx]);
+	}
+
+	strlcpy(sc->sc_sensordev.xname, sc->sc_dev.dv_xname,
+	    sizeof(sc->sc_sensordev.xname));
+	sensordev_install(&sc->sc_sensordev);
+	sensor_task_register(sc, qctsens_refresh_sensors, 1);
+}
+
+void
+qctsens_refresh_sensors(void *arg)
+{
+	struct qctsens_softc *sc = arg;
+	int32_t reg, temp;
+	int id;
+
+	for (id = 0; id < TSENS_NUM_SENSORS; id++) {
+		if (sc->sc_sensor[id].type != SENSOR_TEMP)
+			continue;
+		reg = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
+		    TSENS_Sn_STATUS(id));
+		temp = TSENS_Sn_TEMP(reg);
+		if (reg & TSENS_Sn_VALID) {
+			sc->sc_sensor[id].value = 273150000 + 100000 * temp;
+			sc->sc_sensor[id].flags &= ~SENSOR_FINVALID;
+		} else {
+			sc->sc_sensor[id].flags = SENSOR_FINVALID;
+		}
+	}
+}
+
+int32_t
+qctsens_get_temperature(void *cookie, uint32_t *cells)
+{
+	struct qctsens_softc *sc = cookie;
+	uint32_t id = cells[0];
+	int32_t reg, temp;
+
+	reg = bus_space_read_4(sc->sc_iot, sc->sc_ioh, TSENS_Sn_STATUS(id));
+	temp = 273150000 + 100000 * TSENS_Sn_TEMP(reg);
+
+	if (reg & TSENS_Sn_VALID)
+		return temp;
+
+	return THERMAL_SENSOR_MAX;
+}

sys/dev/pci/drm/drm_linux.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: drm_linux.c,v 1.98 2023/06/01 10:21:26 claudio Exp $	*/
+/*	$OpenBSD: drm_linux.c,v 1.99 2023/06/28 08:23:25 claudio Exp $	*/
 /*
  * Copyright (c) 2013 Jonathan Gray <jsg@openbsd.org>
  * Copyright (c) 2015, 2016 Mark Kettenis <kettenis@openbsd.org>
@@ -135,14 +135,15 @@ schedule_timeout(long timeout)
 {
 	struct sleep_state sls;
 	unsigned long deadline;
-	int wait, spl, timo = 0;
+	int wait, spl, prio, timo = 0;
 
 	MUTEX_ASSERT_LOCKED(&sch_mtx);
 	KASSERT(!cold);
 
 	if (timeout != MAX_SCHEDULE_TIMEOUT)
 		timo = timeout;
-	sleep_setup(&sls, sch_ident, sch_priority, "schto", timo);
+	prio = sch_priority;
+	sleep_setup(&sls, sch_ident, prio, "schto");
 
 	wait = (sch_proc == curproc && timeout > 0);
 
@@ -152,7 +153,7 @@ schedule_timeout(long timeout)
 
 	if (timeout != MAX_SCHEDULE_TIMEOUT)
 		deadline = jiffies + timeout;
-	sleep_finish(&sls, wait);
+	sleep_finish(&sls, prio, timo, wait);
 	if (timeout != MAX_SCHEDULE_TIMEOUT)
 		timeout = deadline - jiffies;
 

sys/dev/pci/if_myx.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_myx.c,v 1.116 2022/03/11 18:00:48 mpi Exp $	*/
+/*	$OpenBSD: if_myx.c,v 1.117 2023/06/28 08:23:25 claudio Exp $	*/
 
 /*
  * Copyright (c) 2007 Reyk Floeter <reyk@openbsd.org>
@@ -1397,9 +1397,9 @@ myx_down(struct myx_softc *sc)
 	(void)myx_cmd(sc, MYXCMD_SET_IFDOWN, &mc, NULL);
 
 	while (sc->sc_state != MYX_S_OFF) {
-		sleep_setup(&sls, sts, PWAIT, "myxdown", 0);
+		sleep_setup(&sls, sts, PWAIT, "myxdown");
 		membar_consumer();
-		sleep_finish(&sls, sc->sc_state != MYX_S_OFF);
+		sleep_finish(&sls, PWAIT, 0, sc->sc_state != MYX_S_OFF);
 	}
 
 	s = splnet();

sys/kern/kern_rwlock.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_rwlock.c,v 1.48 2022/05/10 16:56:16 bluhm Exp $	*/
+/*	$OpenBSD: kern_rwlock.c,v 1.49 2023/06/28 08:23:25 claudio Exp $	*/
 
 /*
  * Copyright (c) 2002, 2003 Artur Grabowski <art@openbsd.org>
@@ -279,11 +279,11 @@ retry:
 		prio = op->wait_prio;
 		if (flags & RW_INTR)
 			prio |= PCATCH;
-		sleep_setup(&sls, rwl, prio, rwl->rwl_name, 0);
+		sleep_setup(&sls, rwl, prio, rwl->rwl_name);
 
 		do_sleep = !rw_cas(&rwl->rwl_owner, o, set);
 
-		error = sleep_finish(&sls, do_sleep);
+		error = sleep_finish(&sls, prio, 0, do_sleep);
 		if ((flags & RW_INTR) &&
 		    (error != 0))
 			return (error);

sys/kern/kern_sched.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sched.c,v 1.76 2022/12/05 23:18:37 deraadt Exp $	*/
+/*	$OpenBSD: kern_sched.c,v 1.77 2023/06/28 08:23:25 claudio Exp $	*/
 /*
  * Copyright (c) 2007, 2008 Artur Grabowski <art@openbsd.org>
  *
@@ -673,8 +673,8 @@ sched_stop_secondary_cpus(void)
 		if (CPU_IS_PRIMARY(ci) || !CPU_IS_RUNNING(ci))
 			continue;
 		while ((spc->spc_schedflags & SPCF_HALTED) == 0) {
-			sleep_setup(&sls, spc, PZERO, "schedstate", 0);
+			sleep_setup(&sls, spc, PZERO, "schedstate");
-			sleep_finish(&sls,
+			sleep_finish(&sls, PZERO, 0,
 			    (spc->spc_schedflags & SPCF_HALTED) == 0);
 		}
 	}

sys/kern/kern_sig.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sig.c,v 1.306 2023/04/03 11:57:50 claudio Exp $	*/
+/*	$OpenBSD: kern_sig.c,v 1.307 2023/06/28 08:23:25 claudio Exp $	*/
 /*	$NetBSD: kern_sig.c,v 1.54 1996/04/22 01:38:32 christos Exp $	*/
 
 /*
@@ -2170,9 +2170,9 @@ single_thread_wait(struct process *pr, int recheck)
 	/* wait until they're all suspended */
 	wait = pr->ps_singlecount > 0;
 	while (wait) {
-		sleep_setup(&sls, &pr->ps_singlecount, PWAIT, "suspend", 0);
+		sleep_setup(&sls, &pr->ps_singlecount, PWAIT, "suspend");
 		wait = pr->ps_singlecount > 0;
-		sleep_finish(&sls, wait);
+		sleep_finish(&sls, PWAIT, 0, wait);
 		if (!recheck)
 			break;
 	}

sys/kern/kern_synch.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_synch.c,v 1.192 2023/06/01 10:21:26 claudio Exp $	*/
+/*	$OpenBSD: kern_synch.c,v 1.193 2023/06/28 08:23:25 claudio Exp $	*/
 /*	$NetBSD: kern_synch.c,v 1.37 1996/04/22 01:38:37 christos Exp $	*/
 
 /*
@@ -151,8 +151,8 @@ tsleep(const volatile void *ident, int priority, const char *wmesg, int timo)
 		return (0);
 	}
 
-	sleep_setup(&sls, ident, priority, wmesg, timo);
+	sleep_setup(&sls, ident, priority, wmesg);
-	return sleep_finish(&sls, 1);
+	return sleep_finish(&sls, priority, timo, 1);
 }
 
 int
@@ -244,7 +244,7 @@ msleep(const volatile void *ident, struct mutex *mtx, int priority,
 		return (0);
 	}
 
-	sleep_setup(&sls, ident, priority, wmesg, timo);
+	sleep_setup(&sls, ident, priority, wmesg);
 
 	/* XXX - We need to make sure that the mutex doesn't
 	 * unblock splsched. This can be made a bit more
@@ -254,7 +254,7 @@ msleep(const volatile void *ident, struct mutex *mtx, int priority,
 	MUTEX_OLDIPL(mtx) = splsched();
 	mtx_leave(mtx);
 	/* signal may stop the process, release mutex before that */
-	error = sleep_finish(&sls, 1);
+	error = sleep_finish(&sls, priority, timo, 1);
 
 	if ((priority & PNORELOCK) == 0) {
 		mtx_enter(mtx);
@@ -304,11 +304,11 @@ rwsleep(const volatile void *ident, struct rwlock *rwl, int priority,
 	rw_assert_anylock(rwl);
 	status = rw_status(rwl);
 
-	sleep_setup(&sls, ident, priority, wmesg, timo);
+	sleep_setup(&sls, ident, priority, wmesg);
 
 	rw_exit(rwl);
 	/* signal may stop the process, release rwlock before that */
-	error = sleep_finish(&sls, 1);
+	error = sleep_finish(&sls, priority, timo, 1);
 
 	if ((priority & PNORELOCK) == 0)
 		rw_enter(rwl, status);
@@ -341,7 +341,7 @@ rwsleep_nsec(const volatile void *ident, struct rwlock *rwl, int priority,
 
 void
 sleep_setup(struct sleep_state *sls, const volatile void *ident, int prio,
-    const char *wmesg, int timo)
+    const char *wmesg)
 {
 	struct proc *p = curproc;
 
@@ -354,9 +354,6 @@ sleep_setup(struct sleep_state *sls, const volatile void *ident, int prio,
 		panic("tsleep: not SONPROC");
 #endif
 
-	sls->sls_catch = prio & PCATCH;
-	sls->sls_timeout = 0;
-
 	SCHED_LOCK(sls->sls_s);
 
 	TRACEPOINT(sched, sleep, NULL);
@@ -367,20 +364,22 @@ sleep_setup(struct sleep_state *sls, const volatile void *ident, int prio,
 	p->p_slppri = prio & PRIMASK;
 	TAILQ_INSERT_TAIL(&slpque[LOOKUP(ident)], p, p_runq);
 
-	if (timo) {
-		KASSERT((p->p_flag & P_TIMEOUT) == 0);
-		sls->sls_timeout = 1;
-		timeout_add(&p->p_sleep_to, timo);
-	}
 }
 
 int
-sleep_finish(struct sleep_state *sls, int do_sleep)
+sleep_finish(struct sleep_state *sls, int prio, int timo, int do_sleep)
 {
 	struct proc *p = curproc;
-	int error = 0, error1 = 0;
+	int catch, error = 0, error1 = 0;
 
-	if (sls->sls_catch != 0) {
+	catch = prio & PCATCH;
+
+	if (timo != 0) {
+		KASSERT((p->p_flag & P_TIMEOUT) == 0);
+		timeout_add(&p->p_sleep_to, timo);
+	}
+
+	if (catch != 0) {
 		/*
 		 * We put ourselves on the sleep queue and start our
 		 * timeout before calling sleep_signal_check(), as we could
@@ -396,10 +395,10 @@ sleep_finish(struct sleep_state *sls, int do_sleep)
 		atomic_setbits_int(&p->p_flag, P_SINTR);
 		if ((error = sleep_signal_check()) != 0) {
 			p->p_stat = SONPROC;
-			sls->sls_catch = 0;
+			catch = 0;
 			do_sleep = 0;
 		} else if (p->p_wchan == NULL) {
-			sls->sls_catch = 0;
+			catch = 0;
 			do_sleep = 0;
 		}
 	}
@@ -427,7 +426,7 @@ sleep_finish(struct sleep_state *sls, int do_sleep)
 	 */
 	atomic_clearbits_int(&p->p_flag, P_SINTR);
 
-	if (sls->sls_timeout) {
+	if (timo != 0) {
 		if (p->p_flag & P_TIMEOUT) {
 			error1 = EWOULDBLOCK;
 		} else {
@@ -438,7 +437,7 @@ sleep_finish(struct sleep_state *sls, int do_sleep)
 	}
 
 	/* Check if thread was woken up because of a unwind or signal */
-	if (sls->sls_catch != 0)
+	if (catch != 0)
 		error = sleep_signal_check();
 
 	/* Signal errors are higher priority than timeouts. */
@@ -837,9 +836,9 @@ refcnt_finalize(struct refcnt *r, const char *wmesg)
 	KASSERT(refs != ~0);
 	TRACEINDEX(refcnt, r->r_traceidx, r, refs + 1, -1);
 	while (refs) {
-		sleep_setup(&sls, r, PWAIT, wmesg, 0);
+		sleep_setup(&sls, r, PWAIT, wmesg);
 		refs = atomic_load_int(&r->r_refs);
-		sleep_finish(&sls, refs);
+		sleep_finish(&sls, PWAIT, 0, refs);
 	}
 	TRACEINDEX(refcnt, r->r_traceidx, r, refs, 0);
 	/* Order subsequent loads and stores after refs == 0 load. */
@@ -888,8 +887,8 @@ cond_wait(struct cond *c, const char *wmesg)
 
 	wait = atomic_load_int(&c->c_wait);
 	while (wait) {
-		sleep_setup(&sls, c, PWAIT, wmesg, 0);
+		sleep_setup(&sls, c, PWAIT, wmesg);
 		wait = atomic_load_int(&c->c_wait);
-		sleep_finish(&sls, wait);
+		sleep_finish(&sls, PWAIT, 0, wait);
 	}
 }

sys/kern/kern_timeout.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_timeout.c,v 1.91 2023/06/26 16:26:20 cheloha Exp $	*/
+/*	$OpenBSD: kern_timeout.c,v 1.92 2023/06/28 08:23:25 claudio Exp $	*/
 /*
  * Copyright (c) 2001 Thomas Nordin <nordin@openbsd.org>
  * Copyright (c) 2000-2001 Artur Grabowski <art@openbsd.org>
@@ -752,8 +752,8 @@ softclock_thread(void *arg)
 
 	s = splsoftclock();
 	for (;;) {
-		sleep_setup(&sls, &timeout_proc, PSWP, "bored", 0);
+		sleep_setup(&sls, &timeout_proc, PSWP, "bored");
-		sleep_finish(&sls, CIRCQ_EMPTY(&timeout_proc));
+		sleep_finish(&sls, PSWP, 0, CIRCQ_EMPTY(&timeout_proc));
 
 		mtx_enter(&timeout_mutex);
 		while (!CIRCQ_EMPTY(&timeout_proc)) {

sys/kern/subr_log.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: subr_log.c,v 1.75 2022/07/02 08:50:42 visa Exp $	*/
+/*	$OpenBSD: subr_log.c,v 1.76 2023/06/28 08:23:25 claudio Exp $	*/
 /*	$NetBSD: subr_log.c,v 1.11 1996/03/30 22:24:44 christos Exp $	*/
 
 /*
@@ -250,8 +250,9 @@ logread(dev_t dev, struct uio *uio, int flag)
 		 * Set up and enter sleep manually instead of using msleep()
 		 * to keep log_mtx as a leaf lock.
 		 */
-		sleep_setup(&sls, mbp, LOG_RDPRI | PCATCH, "klog", 0);
+		sleep_setup(&sls, mbp, LOG_RDPRI | PCATCH, "klog");
-		error = sleep_finish(&sls, logsoftc.sc_state & LOG_RDWAIT);
+		error = sleep_finish(&sls, LOG_RDPRI | PCATCH, 0,
+		    logsoftc.sc_state & LOG_RDWAIT);
 		mtx_enter(&log_mtx);
 		if (error)
 			goto out;

sys/net/if_var.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_var.h,v 1.127 2023/05/30 08:30:01 jsg Exp $	*/
+/*	$OpenBSD: if_var.h,v 1.128 2023/06/28 11:49:49 kn Exp $	*/
 /*	$NetBSD: if.h,v 1.23 1996/05/07 02:40:27 thorpej Exp $	*/
 
 /*
@@ -255,7 +255,7 @@ struct ifaddr {
 struct ifmaddr {
 	struct sockaddr		*ifma_addr;	/* Protocol address */
 	unsigned int		 ifma_ifidx;	/* Index of the interface */
-	unsigned int		 ifma_refcnt;	/* Count of references */
+	struct refcnt		 ifma_refcnt;	/* Count of references */
 	TAILQ_ENTRY(ifmaddr)	 ifma_list;	/* Per-interface list */
 };
 

sys/net/pf_ioctl.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf_ioctl.c,v 1.408 2023/06/27 17:36:56 kn Exp $ */
+/*	$OpenBSD: pf_ioctl.c,v 1.409 2023/06/28 15:36:08 kn Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -118,7 +118,6 @@ int			 pf_states_clr(struct pfioc_state_kill *);
 int			 pf_states_get(struct pfioc_states *);
 
 struct pf_trans		*pf_open_trans(uint32_t);
-void			 pf_close_all_trans(uint32_t);
 struct pf_trans		*pf_find_trans(uint32_t, uint64_t);
 void			 pf_free_trans(struct pf_trans *);
 void			 pf_rollback_trans(struct pf_trans *);
@@ -1492,7 +1491,6 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 		PF_UNLOCK();
 		NET_UNLOCK();
 
-		pf_close_all_trans(minor(dev));
 		t = pf_open_trans(minor(dev));
 		pf_init_tgetrule(t, ruleset->anchor, ruleset_version, rule);
 		pr->ticket = t->pft_ticket;
@@ -3271,19 +3269,6 @@ pf_open_trans(uint32_t unit)
 	return (t);
 }
 
-void
-pf_close_all_trans(uint32_t unit)
-{
-	struct pf_trans	*t, *nt;
-
-	rw_assert_wrlock(&pfioctl_rw);
-
-	LIST_FOREACH_SAFE(t, &pf_ioctl_trans, pft_entry, nt) {
-		if (t->pft_unit == unit)
-			pf_rollback_trans(t);
-	}
-}
-
 struct pf_trans *
 pf_find_trans(uint32_t unit, uint64_t ticket)
 {

sys/netinet/in.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: in.c,v 1.184 2023/04/24 12:11:56 kn Exp $	*/
+/*	$OpenBSD: in.c,v 1.185 2023/06/28 11:49:49 kn Exp $	*/
 /*	$NetBSD: in.c,v 1.26 1996/02/13 23:41:39 christos Exp $	*/
 
 /*
@@ -839,7 +839,7 @@ in_addmulti(struct in_addr *ap, struct ifnet *ifp)
 		/*
 		 * Found it; just increment the reference count.
 		 */
-		++inm->inm_refcnt;
+		refcnt_take(&inm->inm_refcnt);
 	} else {
 		/*
 		 * New address; allocate a new multicast record
@@ -849,7 +849,7 @@ in_addmulti(struct in_addr *ap, struct ifnet *ifp)
 		inm->inm_sin.sin_len = sizeof(struct sockaddr_in);
 		inm->inm_sin.sin_family = AF_INET;
 		inm->inm_sin.sin_addr = *ap;
-		inm->inm_refcnt = 1;
+		refcnt_init_trace(&inm->inm_refcnt, DT_REFCNT_IDX_IFMADDR);
 		inm->inm_ifidx = ifp->if_index;
 		inm->inm_ifma.ifma_addr = sintosa(&inm->inm_sin);
 
@@ -890,7 +890,7 @@ in_delmulti(struct in_multi *inm)
 
 	NET_ASSERT_LOCKED();
 
-	if (--inm->inm_refcnt != 0)
+	if (refcnt_rele(&inm->inm_refcnt) == 0)
 		return;
 
 	ifp = if_get(inm->inm_ifidx);

sys/netinet6/in6.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: in6.c,v 1.261 2023/04/21 00:41:13 kn Exp $	*/
+/*	$OpenBSD: in6.c,v 1.262 2023/06/28 11:49:49 kn Exp $	*/
 /*	$KAME: in6.c,v 1.372 2004/06/14 08:14:21 itojun Exp $	*/
 
 /*
@@ -1032,7 +1032,7 @@ in6_addmulti(struct in6_addr *maddr6, struct ifnet *ifp, int *errorp)
 		/*
 		 * Found it; just increment the reference count.
 		 */
-		in6m->in6m_refcnt++;
+		refcnt_take(&in6m->in6m_refcnt);
 	} else {
 		/*
 		 * New address; allocate a new multicast record
@@ -1047,7 +1047,7 @@ in6_addmulti(struct in6_addr *maddr6, struct ifnet *ifp, int *errorp)
 		in6m->in6m_sin.sin6_len = sizeof(struct sockaddr_in6);
 		in6m->in6m_sin.sin6_family = AF_INET6;
 		in6m->in6m_sin.sin6_addr = *maddr6;
-		in6m->in6m_refcnt = 1;
+		refcnt_init_trace(&in6m->in6m_refcnt, DT_REFCNT_IDX_IFMADDR);
 		in6m->in6m_ifidx = ifp->if_index;
 		in6m->in6m_ifma.ifma_addr = sin6tosa(&in6m->in6m_sin);
 
@@ -1088,7 +1088,7 @@ in6_delmulti(struct in6_multi *in6m)
 
 	NET_ASSERT_LOCKED();
 
-	if (--in6m->in6m_refcnt == 0) {
+	if (refcnt_rele(&in6m->in6m_refcnt) != 0) {
 		/*
 		 * No remaining claims to this record; let MLD6 know
 		 * that we are leaving the multicast group.

sys/sys/proc.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: proc.h,v 1.341 2023/06/01 10:21:26 claudio Exp $	*/
+/*	$OpenBSD: proc.h,v 1.342 2023/06/28 08:23:25 claudio Exp $	*/
 /*	$NetBSD: proc.h,v 1.44 1996/04/22 01:23:21 christos Exp $	*/
 
 /*-
@@ -587,8 +587,6 @@ int	proc_cansugid(struct proc *);
 
 struct sleep_state {
 	int sls_s;
-	int sls_catch;
-	int sls_timeout;
 };
 
 struct cond {

sys/sys/refcnt.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: refcnt.h,v 1.9 2023/04/28 20:03:14 mvs Exp $ */
+/*	$OpenBSD: refcnt.h,v 1.10 2023/06/28 11:49:49 kn Exp $ */
 
 /*
  * Copyright (c) 2015 David Gwynne <dlg@openbsd.org>
@@ -45,9 +45,10 @@ unsigned int	refcnt_read(struct refcnt *);
 
 /* sorted alphabetically, keep in sync with dev/dt/dt_prov_static.c */
 #define DT_REFCNT_IDX_IFADDR	1
-#define DT_REFCNT_IDX_INPCB	2
+#define DT_REFCNT_IDX_IFMADDR	2
-#define DT_REFCNT_IDX_RTENTRY	3
+#define DT_REFCNT_IDX_INPCB	3
-#define DT_REFCNT_IDX_TDB	4
+#define DT_REFCNT_IDX_RTENTRY	4
+#define DT_REFCNT_IDX_TDB	5
 
 #endif /* _KERNEL */
 

sys/sys/systm.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: systm.h,v 1.161 2023/01/31 15:18:56 deraadt Exp $	*/
+/*	$OpenBSD: systm.h,v 1.162 2023/06/28 08:23:25 claudio Exp $	*/
 /*	$NetBSD: systm.h,v 1.50 1996/06/09 04:55:09 briggs Exp $	*/
 
 /*-
@@ -251,8 +251,8 @@ void	stop_periodic_resettodr(void);
 
 struct sleep_state;
 void	sleep_setup(struct sleep_state *, const volatile void *, int,
-	    const char *, int);
+	    const char *);
-int	sleep_finish(struct sleep_state *, int);
+int	sleep_finish(struct sleep_state *, int, int, int);
 void	sleep_queue_init(void);
 
 struct cond;

usr.bin/ftp/fetch.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: fetch.c,v 1.214 2023/03/08 04:43:11 guenther Exp $	*/
+/*	$OpenBSD: fetch.c,v 1.215 2023/06/28 11:07:28 op Exp $	*/
 /*	$NetBSD: fetch.c,v 1.14 1997/08/18 10:20:20 lukem Exp $	*/
 
 /*-
@@ -984,6 +984,7 @@ noslash:
 		} else if (strncasecmp(cp, LAST_MODIFIED,
 			    sizeof(LAST_MODIFIED) - 1) == 0) {
 			cp += sizeof(LAST_MODIFIED) - 1;
+			cp += strspn(cp, " \t");
 			cp[strcspn(cp, "\t")] = '\0';
 			if (strptime(cp, "%a, %d %h %Y %T %Z", &lmt) == NULL)
 				server_timestamps = 0;

usr.bin/mg/mg.1

@@ -1,7 +1,7 @@
-.\"	$OpenBSD: mg.1,v 1.134 2023/04/28 10:02:03 op Exp $
+.\"	$OpenBSD: mg.1,v 1.135 2023/06/28 08:37:52 op Exp $
 .\" This file is in the public domain.
 .\"
-.Dd $Mdocdate: April 28 2023 $
+.Dd $Mdocdate: June 28 2023 $
 .Dt MG 1
 .Os
 .Sh NAME
@@ -770,6 +770,8 @@ lines.
 .It Ic no-tab-mode
 Toggle notab mode.
 In this mode, spaces are inserted rather than tabs.
+Can be set globally with
+.Ic set-default-mode .
 .It Ic not-modified
 Turn off the modified flag in the current buffer.
 .It Ic open-line
@@ -920,7 +922,7 @@ This is the default.
 .It Ic set-default-mode
 Append the supplied mode to the list of default modes
 used by subsequent buffer creation.
-Built in modes include: fill, indent and overwrite.
+Built in modes include: fill, indent, notab and overwrite.
 .It Ic set-fill-column
 Prompt the user for a fill column.
 Used by

usr.sbin/fw_update/patterns.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: patterns.c,v 1.8 2023/02/16 03:09:33 jsg Exp $	*/
+/*	$OpenBSD: patterns.c,v 1.9 2023/06/27 22:31:27 patrick Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996 Christopher G. Demetriou.  All rights reserved.
@@ -111,6 +111,7 @@ main(void)
 	printf("%s\n", "ogx");
 	printf("%s\n", "otus");
 	printf("%s\n", "pgt");
+	printf("%s\n", "qcpas");
 	printf("%s\n", "radeondrm");
 	print_devices("radeondrm", radeon_devices, nitems(radeon_devices));
 	printf("%s\n", "rsu");

usr.sbin/rpki-client/aspa.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: aspa.c,v 1.19 2023/06/26 18:39:53 job Exp $ */
+/*	$OpenBSD: aspa.c,v 1.20 2023/06/28 17:24:20 tb Exp $ */
 /*
  * Copyright (c) 2022 Job Snijders <job@fastly.com>
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
@@ -133,8 +133,7 @@ aspa_parse_econtent(const unsigned char *d, size_t dsz, struct parse *p)
 	int			 rc = 0;
 
 	if ((aspa = d2i_ASProviderAttestation(NULL, &d, dsz)) == NULL) {
-		cryptowarnx("%s: ASPA: failed to parse ASProviderAttestation",
+		warnx("%s: ASPA: failed to parse ASProviderAttestation", p->fn);
-		    p->fn);
 		goto out;
 	}