From a2dd1eda92fb06903361efcf6ba141ce14d71c51 Mon Sep 17 00:00:00 2001
From: purplerain <purplerain@secbsd.org>
Date: Tue, 20 Jun 2023 20:38:03 +0000
Subject: [PATCH] sync

---
 distrib/sets/lists/base/mi                    |   2 +-
 lib/libcrypto/crypto_init.c                   |   6 +-
 lib/libcrypto/ec/ec_lib.c                     | 100 ++++---
 lib/libcrypto/evp/pmeth_lib.c                 | 119 ++++-----
 lib/libcrypto/x509/x509_purp.c                |  15 +-
 lib/libutil/Symbols.map                       |  17 +-
 lib/libutil/imsg-buffer.c                     | 217 ++++++++++++---
 lib/libutil/imsg.c                            |  50 +++-
 lib/libutil/imsg.h                            |  24 +-
 lib/libutil/imsg_init.3                       | 191 ++++++++++---
 lib/libutil/shlib_version                     |   2 +-
 regress/lib/libcrypto/bn/bn_unit.c            |  36 ++-
 regress/lib/libcrypto/engine/enginetest.c     |  11 +-
 regress/lib/libcrypto/gost/gost2814789t.c     |   6 +-
 regress/lib/libutil/imsg/ibuf_test.c          |  46 +---
 regress/usr.sbin/rpki-client/Makefile.inc     |  14 +-
 regress/usr.sbin/rpki-client/dummy.c          |  19 --
 regress/usr.sbin/rpki-client/test-mft.c       |   3 +-
 regress/usr.sbin/rpki-client/test-rrdp.c      |   3 +-
 regress/usr.sbin/rpki-client/test-tal.c       |   3 +-
 sbin/fdisk/gpt.c                              |   9 +-
 sbin/fdisk/part.c                             |   5 +-
 sbin/iked/iked.h                              |   3 +-
 sbin/iked/imsg_util.c                         |   8 +-
 share/man/man9/rt_timer_add.9                 |  91 ++++---
 share/man/man9/uvm_init.9                     |   8 +-
 sys/dev/fdt/dwmshc.c                          |   4 +-
 sys/dev/ic/aacreg.h                           |  20 +-
 sys/dev/ic/aacvar.h                           |   8 +-
 sys/dev/ic/acx.c                              |   4 +-
 sys/dev/ic/advlib.h                           |   4 +-
 sys/dev/ic/aic6360.c                          |  16 +-
 sys/dev/ic/aic7xxx.c                          |   2 +-
 sys/dev/ic/aic7xxxvar.h                       |   2 +-
 sys/dev/pci/drm/amd/amdgpu/amdgpu_object.c    |  10 +-
 sys/dev/pci/drm/amd/amdgpu/amdgpu_vm_pt.c     |   1 -
 sys/dev/pci/drm/amd/amdgpu/amdgpu_vram_mgr.c  |   7 +-
 sys/dev/pci/drm/amd/amdgpu/vi.c               |  11 +-
 .../drm/amd/display/dc/dml/dcn32/dcn32_fpu.c  |   2 +-
 .../amd/pm/swsmu/smu11/sienna_cichlid_ppt.c   |  94 +++++--
 .../pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c    |   4 +-
 sys/dev/pci/drm/i915/display/intel_dp_aux.c   |  32 ++-
 .../drm/i915/gem/selftests/i915_gem_context.c | 130 +++++----
 sys/dev/pci/drm/i915/gt/selftest_execlists.c  |  60 +++--
 sys/dev/pci/drm/i915/gt/selftest_hangcheck.c  |  51 ++--
 sys/dev/pci/drm/i915/selftests/i915_request.c | 252 +++++++++++-------
 sys/kern/sched_bsd.c                          |   4 +-
 sys/lib/libkern/arch/arm/bcopy.S              |   6 +-
 sys/lib/libkern/arch/arm/divsi3.S             |  16 +-
 sys/lib/libkern/arch/arm/htons.S              |   2 +-
 sys/lib/libkern/arch/arm/memcpy.S             |  72 ++---
 sys/lib/libkern/arch/arm64/ffs.S              |   2 +-
 sys/lib/libkern/memset.c                      |   2 +-
 sys/lib/libkern/muldi3.c                      |   2 +-
 sys/lib/libkern/qdivrem.c                     |   2 +-
 sys/lib/libkern/strncasecmp.c                 |   4 +-
 sys/lib/libsa/arc4.c                          |   2 +-
 sys/lib/libsa/bcrypt_pbkdf.c                  |   2 +-
 sys/lib/libsa/bootp.h                         |   2 +-
 sys/lib/libsa/loadfile.h                      |   2 +-
 sys/lib/libsa/printf.c                        |   6 +-
 sys/lib/libsa/sha1.c                          |   2 +-
 sys/lib/libsa/sha2.c                          |  10 +-
 sys/lib/libsa/sha2.h                          |   4 +-
 sys/miscfs/fuse/fuse_lookup.c                 |   2 +-
 sys/miscfs/fuse/fuse_vnops.c                  |   8 +-
 sys/net/if.c                                  |   4 +-
 sys/net/if_etherip.c                          |   2 +-
 sys/uvm/uvm_extern.h                          |   4 +-
 sys/uvm/uvm_meter.c                           |  15 +-
 usr.bin/ssh/ssh-keygen.c                      |   3 +-
 usr.sbin/ospfd/auth.c                         |  41 +--
 usr.sbin/ospfd/database.c                     |   9 +-
 usr.sbin/ospfd/lsupdate.c                     |  15 +-
 usr.sbin/ospfd/ospfe.c                        |  37 +--
 usr.sbin/pkg_add/OpenBSD/PkgCreate.pm         |   8 +-
 usr.sbin/pkg_add/OpenBSD/Subst.pm             |   9 +-
 usr.sbin/relayd/check_tcp.c                   |  12 +-
 usr.sbin/rpki-client/cert.c                   |  12 +-
 usr.sbin/rpki-client/cms.c                    |   4 +-
 usr.sbin/rpki-client/crl.c                    |   7 +-
 usr.sbin/rpki-client/gbr.c                    |   7 +-
 usr.sbin/rpki-client/http.c                   |   4 +-
 usr.sbin/rpki-client/io.c                     |   8 +-
 usr.sbin/rpki-client/main.c                   |   6 +-
 usr.sbin/rpki-client/mft.c                    |   7 +-
 usr.sbin/rpki-client/rrdp.c                   |  16 +-
 usr.sbin/rpki-client/tak.c                    |   7 +-
 usr.sbin/rpki-client/x509.c                   |   7 +-
 89 files changed, 1343 insertions(+), 775 deletions(-)
 delete mode 100644 regress/usr.sbin/rpki-client/dummy.c

diff --git a/distrib/sets/lists/base/mi b/distrib/sets/lists/base/mi
index 19f866052..4a5652c6a 100644
--- a/distrib/sets/lists/base/mi
+++ b/distrib/sets/lists/base/mi
@@ -770,7 +770,7 @@
 ./usr/lib/libtermlib.so.14.0
 ./usr/lib/libtls.so.27.0
 ./usr/lib/libusbhid.so.7.1
-./usr/lib/libutil.so.16.0
+./usr/lib/libutil.so.17.0
 ./usr/lib/libz.so.7.0
 ./usr/lib/locate
 ./usr/lib/locate/src.db
diff --git a/lib/libcrypto/crypto_init.c b/lib/libcrypto/crypto_init.c
index ccf60223b..347f9542f 100644
--- a/lib/libcrypto/crypto_init.c
+++ b/lib/libcrypto/crypto_init.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: crypto_init.c,v 1.8 2023/05/08 13:53:26 tb Exp $ */
+/*	$OpenBSD: crypto_init.c,v 1.9 2023/06/19 18:32:05 tb Exp $ */
 /*
  * Copyright (c) 2018 Bob Beck <beck@openbsd.org>
  *
@@ -21,7 +21,9 @@
 #include <stdio.h>
 
 #include <openssl/conf.h>
+#ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
+#endif
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/objects.h>
@@ -79,7 +81,9 @@ OPENSSL_cleanup(void)
 	ERR_free_strings();
 
 	CRYPTO_cleanup_all_ex_data();
+#ifndef OPENSSL_NO_ENGINE
 	ENGINE_cleanup();
+#endif
 	EVP_cleanup();
 	x509_issuer_cache_free();
 
diff --git a/lib/libcrypto/ec/ec_lib.c b/lib/libcrypto/ec/ec_lib.c
index 308a0f006..817b0239b 100644
--- a/lib/libcrypto/ec/ec_lib.c
+++ b/lib/libcrypto/ec/ec_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_lib.c,v 1.57 2023/05/04 13:51:59 tb Exp $ */
+/* $OpenBSD: ec_lib.c,v 1.58 2023/06/20 14:37:15 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -236,7 +236,8 @@ EC_METHOD_get_field_type(const EC_METHOD *meth)
 }
 
 /*
- * Try computing the cofactor from generator order n and field cardinality q.
+ * If there is a user-provided cofactor, sanity check and use it. Otherwise
+ * try computing the cofactor from generator order n and field cardinality q.
  * This works for all curves of cryptographic interest.
  *
  * Hasse's theorem: | h * n - (q + 1) | <= 2 * sqrt(q)
@@ -250,38 +251,43 @@ EC_METHOD_get_field_type(const EC_METHOD *meth)
  * Otherwise, zero cofactor and return success.
  */
 static int
-ec_guess_cofactor(EC_GROUP *group)
+ec_set_cofactor(EC_GROUP *group, const BIGNUM *in_cofactor)
 {
 	BN_CTX *ctx = NULL;
-	BIGNUM *q = NULL;
+	BIGNUM *cofactor;
 	int ret = 0;
 
+	BN_zero(&group->cofactor);
+
+	if ((ctx = BN_CTX_new()) == NULL)
+		goto err;
+
+	BN_CTX_start(ctx);
+	if ((cofactor = BN_CTX_get(ctx)) == NULL)
+		goto err;
+
+	/*
+	 * Unfortunately, the cofactor is an optional field in many standards.
+	 * Internally, the library uses a 0 cofactor as a marker for "unknown
+	 * cofactor".  So accept in_cofactor == NULL or in_cofactor >= 0.
+	 */
+	if (in_cofactor != NULL && !BN_is_zero(in_cofactor)) {
+		if (BN_is_negative(in_cofactor)) {
+			ECerror(EC_R_UNKNOWN_COFACTOR);
+			goto err;
+		}
+		if (!bn_copy(cofactor, in_cofactor))
+			goto err;
+		goto done;
+	}
+
 	/*
 	 * If the cofactor is too large, we cannot guess it and default to zero.
 	 * The RHS of below is a strict overestimate of log(4 * sqrt(q)).
 	 */
 	if (BN_num_bits(&group->order) <=
-	    (BN_num_bits(&group->field) + 1) / 2 + 3) {
-		BN_zero(&group->cofactor);
-		return 1;
-	}
-
-	if ((ctx = BN_CTX_new()) == NULL)
-		goto err;
-
-	BN_CTX_start(ctx);
-	if ((q = BN_CTX_get(ctx)) == NULL)
-		goto err;
-
-	/* Set q = 2**m for binary fields; q = p otherwise. */
-	if (group->meth->field_type == NID_X9_62_characteristic_two_field) {
-		BN_zero(q);
-		if (!BN_set_bit(q, BN_num_bits(&group->field) - 1))
-			goto err;
-	} else {
-		if (!bn_copy(q, &group->field))
-			goto err;
-	}
+	    (BN_num_bits(&group->field) + 1) / 2 + 3)
+		goto done;
 
 	/*
 	 * Compute
@@ -289,17 +295,26 @@ ec_guess_cofactor(EC_GROUP *group)
 	 */
 
 	/* h = n/2 */
-	if (!BN_rshift1(&group->cofactor, &group->order))
+	if (!BN_rshift1(cofactor, &group->order))
 		goto err;
 	/* h = 1 + n/2 */
-	if (!BN_add(&group->cofactor, &group->cofactor, BN_value_one()))
+	if (!BN_add_word(cofactor, 1))
 		goto err;
 	/* h = q + 1 + n/2 */
-	if (!BN_add(&group->cofactor, &group->cofactor, q))
+	if (!BN_add(cofactor, cofactor, &group->field))
 		goto err;
 	/* h = (q + 1 + n/2) / n */
-	if (!BN_div_ct(&group->cofactor, NULL, &group->cofactor, &group->order,
-	    ctx))
+	if (!BN_div_ct(cofactor, NULL, cofactor, &group->order, ctx))
+		goto err;
+
+ done:
+	/* Use Hasse's theorem to bound the cofactor. */
+	if (BN_num_bits(cofactor) > BN_num_bits(&group->field) + 1) {
+		ECerror(EC_R_INVALID_GROUP_ORDER);
+		goto err;
+	}
+
+	if (!bn_copy(&group->cofactor, cofactor))
 		goto err;
 
 	ret = 1;
@@ -308,9 +323,6 @@ ec_guess_cofactor(EC_GROUP *group)
 	BN_CTX_end(ctx);
 	BN_CTX_free(ctx);
 
-	if (ret != 1)
-		BN_zero(&group->cofactor);
-
 	return ret;
 }
 
@@ -339,16 +351,6 @@ EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
 		return 0;
 	}
 
-	/*
-	 * Unfortunately, the cofactor is an optional field in many standards.
-	 * Internally, the library uses a 0 cofactor as a marker for "unknown
-	 * cofactor".  So accept cofactor == NULL or cofactor >= 0.
-	 */
-	if (cofactor != NULL && BN_is_negative(cofactor)) {
-		ECerror(EC_R_UNKNOWN_COFACTOR);
-		return 0;
-	}
-
 	if (group->generator == NULL) {
 		group->generator = EC_POINT_new(group);
 		if (group->generator == NULL)
@@ -360,19 +362,9 @@ EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
 	if (!bn_copy(&group->order, order))
 		return 0;
 
-	/* Either take the provided positive cofactor, or try to compute it. */
-	if (cofactor != NULL && !BN_is_zero(cofactor)) {
-		if (!bn_copy(&group->cofactor, cofactor))
-			return 0;
-	} else if (!ec_guess_cofactor(group))
+	if (!ec_set_cofactor(group, cofactor))
 		return 0;
 
-	/* Use Hasse's theorem to bound the cofactor. */
-	if (BN_num_bits(&group->cofactor) > BN_num_bits(&group->field) + 1) {
-		ECerror(EC_R_INVALID_GROUP_ORDER);
-		return 0;
-	}
-
 	return 1;
 }
 
diff --git a/lib/libcrypto/evp/pmeth_lib.c b/lib/libcrypto/evp/pmeth_lib.c
index bec899cef..3341ba1e0 100644
--- a/lib/libcrypto/evp/pmeth_lib.c
+++ b/lib/libcrypto/evp/pmeth_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pmeth_lib.c,v 1.27 2022/12/26 07:18:52 jmc Exp $ */
+/* $OpenBSD: pmeth_lib.c,v 1.31 2023/06/20 14:14:00 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -151,69 +151,65 @@ EVP_PKEY_meth_find(int type)
 }
 
 static EVP_PKEY_CTX *
-int_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id)
+evp_pkey_ctx_new(EVP_PKEY *pkey, ENGINE *engine, int id)
 {
-	EVP_PKEY_CTX *ret;
+	EVP_PKEY_CTX *pkey_ctx = NULL;
 	const EVP_PKEY_METHOD *pmeth;
 
 	if (id == -1) {
-		if (!pkey || !pkey->ameth)
+		if (pkey == NULL || pkey->ameth == NULL)
 			return NULL;
 		id = pkey->ameth->pkey_id;
 	}
 #ifndef OPENSSL_NO_ENGINE
-	if (pkey && pkey->engine)
-		e = pkey->engine;
-	/* Try to find an ENGINE which implements this method */
-	if (e) {
-		if (!ENGINE_init(e)) {
+	if (pkey != NULL && pkey->engine != NULL)
+		engine = pkey->engine;
+	/* Try to find an ENGINE which implements this method. */
+	if (engine != NULL) {
+		if (!ENGINE_init(engine)) {
 			EVPerror(ERR_R_ENGINE_LIB);
 			return NULL;
 		}
 	} else
-		e = ENGINE_get_pkey_meth_engine(id);
+		engine = ENGINE_get_pkey_meth_engine(id);
 
-	/* If an ENGINE handled this method look it up. Otherwise
-	 * use internal tables.
-	 */
-
-	if (e)
-		pmeth = ENGINE_get_pkey_meth(e, id);
+	/* Look up method handler in ENGINE or use internal tables. */
+	if (engine != NULL)
+		pmeth = ENGINE_get_pkey_meth(engine, id);
 	else
 #endif
 		pmeth = EVP_PKEY_meth_find(id);
 
 	if (pmeth == NULL) {
 		EVPerror(EVP_R_UNSUPPORTED_ALGORITHM);
-		return NULL;
+		goto err;
 	}
 
-	ret = malloc(sizeof(EVP_PKEY_CTX));
-	if (ret == NULL) {
-#ifndef OPENSSL_NO_ENGINE
-		ENGINE_finish(e);
-#endif
+	if ((pkey_ctx = calloc(1, sizeof(*pkey_ctx))) == NULL) {
 		EVPerror(ERR_R_MALLOC_FAILURE);
-		return NULL;
+		goto err;
 	}
-	ret->engine = e;
-	ret->pmeth = pmeth;
-	ret->operation = EVP_PKEY_OP_UNDEFINED;
-	ret->pkey = pkey;
-	ret->peerkey = NULL;
-	ret->pkey_gencb = 0;
-	if (pkey)
-		CRYPTO_add(&pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);
-	ret->data = NULL;
+	pkey_ctx->engine = engine;
+	engine = NULL;
+	pkey_ctx->pmeth = pmeth;
+	pkey_ctx->operation = EVP_PKEY_OP_UNDEFINED;
+	if ((pkey_ctx->pkey = pkey) != NULL)
+		EVP_PKEY_up_ref(pkey_ctx->pkey);
 
-	if (pmeth->init) {
-		if (pmeth->init(ret) <= 0) {
-			EVP_PKEY_CTX_free(ret);
-			return NULL;
-		}
+	if (pmeth->init != NULL) {
+		if (pmeth->init(pkey_ctx) <= 0)
+			goto err;
 	}
 
-	return ret;
+	return pkey_ctx;
+
+ err:
+	EVP_PKEY_CTX_free(pkey_ctx);
+#ifndef OPENSSL_NO_ENGINE
+	ENGINE_finish(engine);
+#endif
+
+	return NULL;
 }
 
 EVP_PKEY_METHOD*
@@ -261,57 +257,54 @@ EVP_PKEY_meth_free(EVP_PKEY_METHOD *pmeth)
 }
 
 EVP_PKEY_CTX *
-EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e)
+EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *engine)
 {
-	return int_ctx_new(pkey, e, -1);
+	return evp_pkey_ctx_new(pkey, engine, -1);
 }
 
 EVP_PKEY_CTX *
-EVP_PKEY_CTX_new_id(int id, ENGINE *e)
+EVP_PKEY_CTX_new_id(int id, ENGINE *engine)
 {
-	return int_ctx_new(NULL, e, id);
+	return evp_pkey_ctx_new(NULL, engine, id);
 }
 
 EVP_PKEY_CTX *
 EVP_PKEY_CTX_dup(EVP_PKEY_CTX *pctx)
 {
-	EVP_PKEY_CTX *rctx;
+	EVP_PKEY_CTX *rctx = NULL;
 
-	if (!pctx->pmeth || !pctx->pmeth->copy)
-		return NULL;
+	if (pctx->pmeth == NULL || pctx->pmeth->copy == NULL)
+		goto err;
 #ifndef OPENSSL_NO_ENGINE
 	/* Make sure it's safe to copy a pkey context using an ENGINE */
-	if (pctx->engine && !ENGINE_init(pctx->engine)) {
+	if (pctx->engine != NULL && !ENGINE_init(pctx->engine)) {
 		EVPerror(ERR_R_ENGINE_LIB);
-		return 0;
+		goto err;
 	}
 #endif
-	rctx = malloc(sizeof(EVP_PKEY_CTX));
-	if (!rctx)
-		return NULL;
+	if ((rctx = calloc(1, sizeof(*rctx))) == NULL) {
+		EVPerror(ERR_R_MALLOC_FAILURE);
+		goto err;
+	}
 
 	rctx->pmeth = pctx->pmeth;
 #ifndef OPENSSL_NO_ENGINE
 	rctx->engine = pctx->engine;
 #endif
 
-	if (pctx->pkey)
-		CRYPTO_add(&pctx->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);
+	if ((rctx->pkey = pctx->pkey) != NULL)
+		EVP_PKEY_up_ref(rctx->pkey);
+	if ((rctx->peerkey = pctx->peerkey) != NULL)
+		EVP_PKEY_up_ref(rctx->peerkey);
 
-	rctx->pkey = pctx->pkey;
-
-	if (pctx->peerkey)
-		CRYPTO_add(&pctx->peerkey->references, 1, CRYPTO_LOCK_EVP_PKEY);
-
-	rctx->peerkey = pctx->peerkey;
-
-	rctx->data = NULL;
-	rctx->app_data = NULL;
 	rctx->operation = pctx->operation;
 
-	if (pctx->pmeth->copy(rctx, pctx) > 0)
-		return rctx;
+	if (pctx->pmeth->copy(rctx, pctx) <= 0)
+		goto err;
 
+	return rctx;
+
+ err:
 	EVP_PKEY_CTX_free(rctx);
 	return NULL;
 }
diff --git a/lib/libcrypto/x509/x509_purp.c b/lib/libcrypto/x509/x509_purp.c
index 85d9b77f6..75d229b03 100644
--- a/lib/libcrypto/x509/x509_purp.c
+++ b/lib/libcrypto/x509/x509_purp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_purp.c,v 1.25 2023/04/23 21:49:15 job Exp $ */
+/* $OpenBSD: x509_purp.c,v 1.26 2023/06/20 14:21:19 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2001.
  */
@@ -449,6 +449,7 @@ x509v3_cache_extensions_internal(X509 *x)
 	ASN1_BIT_STRING *ns;
 	EXTENDED_KEY_USAGE *extusage;
 	X509_EXTENSION *ex;
+	long version;
 	int i;
 
 	if (x->ex_flags & EXFLAG_SET)
@@ -456,12 +457,18 @@ x509v3_cache_extensions_internal(X509 *x)
 
 	X509_digest(x, X509_CERT_HASH_EVP, x->hash, NULL);
 
-	/* V1 should mean no extensions ... */
-	if (X509_get_version(x) == 0) {
+	version = X509_get_version(x);
+	if (version < 0 || version > 2)
+		x->ex_flags |= EXFLAG_INVALID;
+	if (version == 0) {
 		x->ex_flags |= EXFLAG_V1;
-		if (X509_get_ext_count(x) != 0)
+		/* UIDs may only appear in v2 or v3 certs */
+		if (x->cert_info->issuerUID != NULL ||
+		    x->cert_info->subjectUID != NULL)
 			x->ex_flags |= EXFLAG_INVALID;
 	}
+	if (version != 2 && X509_get_ext_count(x) != 0)
+		x->ex_flags |= EXFLAG_INVALID;
 
 	/* Handle basic constraints */
 	if ((bs = X509_get_ext_d2i(x, NID_basic_constraints, &i, NULL))) {
diff --git a/lib/libutil/Symbols.map b/lib/libutil/Symbols.map
index 4aa7d1462..00472fbb3 100644
--- a/lib/libutil/Symbols.map
+++ b/lib/libutil/Symbols.map
@@ -18,13 +18,28 @@
 		getptmfd;
 		getrawpartition;
 		ibuf_add;
+		ibuf_add_buf;
+		ibuf_add_n8;
+		ibuf_add_n16;
+		ibuf_add_n32;
+		ibuf_add_n64;
+		ibuf_add_zero;
 		ibuf_close;
+		ibuf_data;
 		ibuf_dynamic;
+		ibuf_fd_avail;
+		ibuf_fd_get;
+		ibuf_fd_set;
 		ibuf_free;
 		ibuf_left;
 		ibuf_open;
 		ibuf_reserve;
 		ibuf_seek;
+		ibuf_set;
+		ibuf_set_n8;
+		ibuf_set_n16;
+		ibuf_set_n32;
+		ibuf_set_n64;
 		ibuf_size;
 		ibuf_write;
 		imsg_add;
@@ -32,6 +47,7 @@
 		imsg_close;
 		imsg_compose;
 		imsg_composev;
+		imsg_compose_ibuf;
 		imsg_create;
 		imsg_fd_overhead;
 		imsg_flush;
@@ -47,7 +63,6 @@
 		logout;
 		logwtmp;
 		msgbuf_clear;
-		msgbuf_drain;
 		msgbuf_init;
 		msgbuf_write;
 		ober_add_bitstring;
diff --git a/lib/libutil/imsg-buffer.c b/lib/libutil/imsg-buffer.c
index ef0a1151f..750d7c077 100644
--- a/lib/libutil/imsg-buffer.c
+++ b/lib/libutil/imsg-buffer.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: imsg-buffer.c,v 1.15 2023/05/23 12:41:28 claudio Exp $	*/
+/*	$OpenBSD: imsg-buffer.c,v 1.16 2023/06/19 17:19:50 claudio Exp $	*/
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -23,6 +23,7 @@
 
 #include <limits.h>
 #include <errno.h>
+#include <endian.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
@@ -32,6 +33,7 @@
 static int	ibuf_realloc(struct ibuf *, size_t);
 static void	ibuf_enqueue(struct msgbuf *, struct ibuf *);
 static void	ibuf_dequeue(struct msgbuf *, struct ibuf *);
+static void	msgbuf_drain(struct msgbuf *, size_t);
 
 struct ibuf *
 ibuf_open(size_t len)
@@ -99,23 +101,6 @@ ibuf_realloc(struct ibuf *buf, size_t len)
 	return (0);
 }
 
-int
-ibuf_add(struct ibuf *buf, const void *data, size_t len)
-{
-	if (len > SIZE_MAX - buf->wpos) {
-		errno = ERANGE;
-		return (-1);
-	}
-
-	if (buf->wpos + len > buf->size)
-		if (ibuf_realloc(buf, len) == -1)
-			return (-1);
-
-	memcpy(buf->buf + buf->wpos, data, len);
-	buf->wpos += len;
-	return (0);
-}
-
 void *
 ibuf_reserve(struct ibuf *buf, size_t len)
 {
@@ -136,16 +121,156 @@ ibuf_reserve(struct ibuf *buf, size_t len)
 	return (b);
 }
 
+int
+ibuf_add(struct ibuf *buf, const void *data, size_t len)
+{
+	void *b;
+
+	if ((b = ibuf_reserve(buf, len)) == NULL)
+		return (-1);
+
+	memcpy(b, data, len);
+	return (0);
+}
+
+int
+ibuf_add_buf(struct ibuf *buf, const struct ibuf *from)
+{
+	return ibuf_add(buf, from->buf, from->wpos);
+}
+
+int
+ibuf_add_n8(struct ibuf *buf, uint64_t value)
+{
+	uint8_t v;
+
+	if (value > UINT8_MAX) {
+		errno = EINVAL;
+		return (-1);
+	}
+	v = value;
+	return ibuf_add(buf, &v, sizeof(v));
+}
+
+int
+ibuf_add_n16(struct ibuf *buf, uint64_t value)
+{
+	uint16_t v;
+
+	if (value > UINT16_MAX) {
+		errno = EINVAL;
+		return (-1);
+	}
+	v = htobe16(value);
+	return ibuf_add(buf, &v, sizeof(v));
+}
+
+int
+ibuf_add_n32(struct ibuf *buf, uint64_t value)
+{
+	uint32_t v;
+
+	if (value > UINT32_MAX) {
+		errno = EINVAL;
+		return (-1);
+	}
+	v = htobe32(value);
+	return ibuf_add(buf, &v, sizeof(v));
+}
+
+int
+ibuf_add_n64(struct ibuf *buf, uint64_t value)
+{
+	value = htobe64(value);
+	return ibuf_add(buf, &value, sizeof(value));
+}
+
+int
+ibuf_add_zero(struct ibuf *buf, size_t len)
+{
+	void *b;
+
+	if ((b = ibuf_reserve(buf, len)) == NULL)
+		return (-1);
+	return (0);
+}
+
 void *
 ibuf_seek(struct ibuf *buf, size_t pos, size_t len)
 {
 	/* only allowed to seek in already written parts */
-	if (len > SIZE_MAX - pos || pos + len > buf->wpos)
+	if (len > SIZE_MAX - pos || pos + len > buf->wpos) {
+		errno = ERANGE;
 		return (NULL);
+	}
 
 	return (buf->buf + pos);
 }
 
+int
+ibuf_set(struct ibuf *buf, size_t pos, const void *data, size_t len)
+{
+	void *b;
+
+	if ((b = ibuf_seek(buf, pos, len)) == NULL)
+		return (-1);
+
+	memcpy(b, data, len);
+	return (0);
+}
+
+int
+ibuf_set_n8(struct ibuf *buf, size_t pos, uint64_t value)
+{
+	uint8_t v;
+
+	if (value > UINT8_MAX) {
+		errno = EINVAL;
+		return (-1);
+	}
+	v = value;
+	return (ibuf_set(buf, pos, &v, sizeof(v)));
+}
+
+int
+ibuf_set_n16(struct ibuf *buf, size_t pos, uint64_t value)
+{
+	uint16_t v;
+
+	if (value > UINT16_MAX) {
+		errno = EINVAL;
+		return (-1);
+	}
+	v = htobe16(value);
+	return (ibuf_set(buf, pos, &v, sizeof(v)));
+}
+
+int
+ibuf_set_n32(struct ibuf *buf, size_t pos, uint64_t value)
+{
+	uint32_t v;
+
+	if (value > UINT32_MAX) {
+		errno = EINVAL;
+		return (-1);
+	}
+	v = htobe32(value);
+	return (ibuf_set(buf, pos, &v, sizeof(v)));
+}
+
+int
+ibuf_set_n64(struct ibuf *buf, size_t pos, uint64_t value)
+{
+	value = htobe64(value);
+	return (ibuf_set(buf, pos, &value, sizeof(value)));
+}
+
+void *
+ibuf_data(struct ibuf *buf)
+{
+	return (buf->buf);
+}
+
 size_t
 ibuf_size(struct ibuf *buf)
 {
@@ -164,6 +289,45 @@ ibuf_close(struct msgbuf *msgbuf, struct ibuf *buf)
 	ibuf_enqueue(msgbuf, buf);
 }
 
+void
+ibuf_free(struct ibuf *buf)
+{
+	if (buf == NULL)
+		return;
+#ifdef NOTYET
+	if (buf->fd != -1)
+		close(buf->fd);
+#endif
+	freezero(buf->buf, buf->size);
+	free(buf);
+}
+
+int
+ibuf_fd_avail(struct ibuf *buf)
+{
+	return (buf->fd != -1);
+}
+
+int
+ibuf_fd_get(struct ibuf *buf)
+{
+	int fd;
+
+	fd = buf->fd;
+#ifdef NOTYET
+	buf->fd = -1;
+#endif
+	return (fd);
+}
+
+void
+ibuf_fd_set(struct ibuf *buf, int fd)
+{
+	if (buf->fd != -1)
+		close(buf->fd);
+	buf->fd = fd;
+}
+
 int
 ibuf_write(struct msgbuf *msgbuf)
 {
@@ -200,15 +364,6 @@ again:
 	return (1);
 }
 
-void
-ibuf_free(struct ibuf *buf)
-{
-	if (buf == NULL)
-		return;
-	freezero(buf->buf, buf->size);
-	free(buf);
-}
-
 void
 msgbuf_init(struct msgbuf *msgbuf)
 {
@@ -217,7 +372,7 @@ msgbuf_init(struct msgbuf *msgbuf)
 	TAILQ_INIT(&msgbuf->bufs);
 }
 
-void
+static void
 msgbuf_drain(struct msgbuf *msgbuf, size_t n)
 {
 	struct ibuf	*buf, *next;
@@ -326,8 +481,10 @@ ibuf_dequeue(struct msgbuf *msgbuf, struct ibuf *buf)
 {
 	TAILQ_REMOVE(&msgbuf->bufs, buf, entry);
 
-	if (buf->fd != -1)
+	if (buf->fd != -1) {
 		close(buf->fd);
+		buf->fd = -1;
+	}
 
 	msgbuf->queued--;
 	ibuf_free(buf);
diff --git a/lib/libutil/imsg.c b/lib/libutil/imsg.c
index 8ca55d731..73a0cc27e 100644
--- a/lib/libutil/imsg.c
+++ b/lib/libutil/imsg.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: imsg.c,v 1.18 2023/03/08 04:43:05 guenther Exp $	*/
+/*	$OpenBSD: imsg.c,v 1.19 2023/06/19 17:19:50 claudio Exp $	*/
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -175,8 +175,7 @@ imsg_compose(struct imsgbuf *ibuf, uint32_t type, uint32_t peerid, pid_t pid,
 	if (imsg_add(wbuf, data, datalen) == -1)
 		return (-1);
 
-	wbuf->fd = fd;
-
+	ibuf_fd_set(wbuf, fd);
 	imsg_close(ibuf, wbuf);
 
 	return (1);
@@ -199,13 +198,49 @@ imsg_composev(struct imsgbuf *ibuf, uint32_t type, uint32_t peerid, pid_t pid,
 		if (imsg_add(wbuf, iov[i].iov_base, iov[i].iov_len) == -1)
 			return (-1);
 
-	wbuf->fd = fd;
-
+	ibuf_fd_set(wbuf, fd);
 	imsg_close(ibuf, wbuf);
 
 	return (1);
 }
 
+int
+imsg_compose_ibuf(struct imsgbuf *ibuf, uint32_t type, uint32_t peerid,
+    pid_t pid, struct ibuf *buf)
+{
+	struct ibuf	*wbuf = NULL;
+	struct imsg_hdr	 hdr;
+	int save_errno;
+
+	if (ibuf_size(buf) + IMSG_HEADER_SIZE > MAX_IMSGSIZE) {
+		errno = ERANGE;
+		goto fail;
+	}
+
+	hdr.type = type;
+	hdr.len = ibuf_size(buf) + IMSG_HEADER_SIZE;
+	hdr.flags = 0;
+	hdr.peerid = peerid;
+	if ((hdr.pid = pid) == 0)
+		hdr.pid = ibuf->pid;
+
+	if ((wbuf = ibuf_open(IMSG_HEADER_SIZE)) == NULL)
+		goto fail;
+	if (imsg_add(wbuf, &hdr, sizeof(hdr)) == -1)
+		goto fail;
+
+	ibuf_close(&ibuf->w, wbuf);
+	ibuf_close(&ibuf->w, buf);
+	return (1);
+
+ fail:
+	save_errno = errno;
+	ibuf_free(buf);
+	ibuf_free(wbuf);
+	errno = save_errno;
+	return (-1);
+}
+
 struct ibuf *
 imsg_create(struct imsgbuf *ibuf, uint32_t type, uint32_t peerid, pid_t pid,
     uint16_t datalen)
@@ -252,10 +287,9 @@ imsg_close(struct imsgbuf *ibuf, struct ibuf *msg)
 	hdr = (struct imsg_hdr *)msg->buf;
 
 	hdr->flags &= ~IMSGF_HASFD;
-	if (msg->fd != -1)
+	if (ibuf_fd_avail(msg))
 		hdr->flags |= IMSGF_HASFD;
-
-	hdr->len = (uint16_t)msg->wpos;
+	hdr->len = ibuf_size(msg);
 
 	ibuf_close(&ibuf->w, msg);
 }
diff --git a/lib/libutil/imsg.h b/lib/libutil/imsg.h
index 9e19bedb8..fb516e302 100644
--- a/lib/libutil/imsg.h
+++ b/lib/libutil/imsg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: imsg.h,v 1.6 2021/01/13 09:56:28 claudio Exp $	*/
+/*	$OpenBSD: imsg.h,v 1.7 2023/06/19 17:19:50 claudio Exp $	*/
 
 /*
  * Copyright (c) 2006, 2007 Pierre-Yves Ritschard <pyr@openbsd.org>
@@ -80,21 +80,35 @@ struct imsg {
 
 struct iovec;
 
-/* buffer.c */
+/* imsg-buffer.c */
 struct ibuf	*ibuf_open(size_t);
 struct ibuf	*ibuf_dynamic(size_t, size_t);
 int		 ibuf_add(struct ibuf *, const void *, size_t);
+int		 ibuf_add_buf(struct ibuf *, const struct ibuf *);
+int		 ibuf_add_zero(struct ibuf *, size_t);
+int		 ibuf_add_n8(struct ibuf *, uint64_t);
+int		 ibuf_add_n16(struct ibuf *, uint64_t);
+int		 ibuf_add_n32(struct ibuf *, uint64_t);
+int		 ibuf_add_n64(struct ibuf *, uint64_t);
 void		*ibuf_reserve(struct ibuf *, size_t);
 void		*ibuf_seek(struct ibuf *, size_t, size_t);
+int		 ibuf_set(struct ibuf *, size_t, const void *, size_t);
+int		 ibuf_set_n8(struct ibuf *, size_t, uint64_t);
+int		 ibuf_set_n16(struct ibuf *, size_t, uint64_t);
+int		 ibuf_set_n32(struct ibuf *, size_t, uint64_t);
+int		 ibuf_set_n64(struct ibuf *, size_t, uint64_t);
+void		*ibuf_data(struct ibuf *);
 size_t		 ibuf_size(struct ibuf *);
 size_t		 ibuf_left(struct ibuf *);
 void		 ibuf_close(struct msgbuf *, struct ibuf *);
-int		 ibuf_write(struct msgbuf *);
 void		 ibuf_free(struct ibuf *);
+int		 ibuf_fd_avail(struct ibuf *);
+int		 ibuf_fd_get(struct ibuf *);
+void		 ibuf_fd_set(struct ibuf *, int);
+int		 ibuf_write(struct msgbuf *);
 void		 msgbuf_init(struct msgbuf *);
 void		 msgbuf_clear(struct msgbuf *);
 int		 msgbuf_write(struct msgbuf *);
-void		 msgbuf_drain(struct msgbuf *, size_t);
 
 /* imsg.c */
 void	 imsg_init(struct imsgbuf *, int);
@@ -104,6 +118,8 @@ int	 imsg_compose(struct imsgbuf *, uint32_t, uint32_t, pid_t, int,
 	    const void *, uint16_t);
 int	 imsg_composev(struct imsgbuf *, uint32_t, uint32_t,  pid_t, int,
 	    const struct iovec *, int);
+int	 imsg_compose_ibuf(struct imsgbuf *, uint32_t, uint32_t, pid_t,
+	    struct ibuf *);
 struct ibuf *imsg_create(struct imsgbuf *, uint32_t, uint32_t, pid_t, uint16_t);
 int	 imsg_add(struct ibuf *, const void *, uint16_t);
 void	 imsg_close(struct imsgbuf *, struct ibuf *);
diff --git a/lib/libutil/imsg_init.3 b/lib/libutil/imsg_init.3
index 2319aa65d..11915f377 100644
--- a/lib/libutil/imsg_init.3
+++ b/lib/libutil/imsg_init.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: imsg_init.3,v 1.25 2022/05/19 08:05:23 stsp Exp $
+.\" $OpenBSD: imsg_init.3,v 1.28 2023/06/20 06:53:29 jsg Exp $
 .\"
 .\" Copyright (c) 2010 Nicholas Marriott <nicm@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
 .\" OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: May 19 2022 $
+.Dd $Mdocdate: June 20 2023 $
 .Dt IMSG_INIT 3
 .Os
 .Sh NAME
@@ -23,6 +23,7 @@
 .Nm imsg_get ,
 .Nm imsg_compose ,
 .Nm imsg_composev ,
+.Nm imsg_compose_ibuf ,
 .Nm imsg_create ,
 .Nm imsg_add ,
 .Nm imsg_close ,
@@ -32,17 +33,31 @@
 .Nm ibuf_open ,
 .Nm ibuf_dynamic ,
 .Nm ibuf_add ,
+.Nm ibuf_add_buf ,
+.Nm ibuf_add_n8 ,
+.Nm ibuf_add_n16 ,
+.Nm ibuf_add_n32 ,
+.Nm ibuf_add_n64 ,
+.Nm ibuf_add_zero ,
 .Nm ibuf_reserve ,
 .Nm ibuf_seek ,
+.Nm ibuf_set ,
+.Nm ibuf_set_n8 ,
+.Nm ibuf_set_n16 ,
+.Nm ibuf_set_n32 ,
+.Nm ibuf_set_n64 ,
+.Nm ibuf_data ,
 .Nm ibuf_size ,
 .Nm ibuf_left ,
 .Nm ibuf_close ,
-.Nm ibuf_write ,
 .Nm ibuf_free ,
+.Nm ibuf_fd_avail ,
+.Nm ibuf_fd_get ,
+.Nm ibuf_fd_set ,
+.Nm ibuf_write ,
 .Nm msgbuf_init ,
 .Nm msgbuf_clear ,
-.Nm msgbuf_write ,
-.Nm msgbuf_drain
+.Nm msgbuf_write
 .Nd IPC messaging functions
 .Sh SYNOPSIS
 .In sys/types.h
@@ -62,6 +77,9 @@
 .Ft int
 .Fn imsg_composev "struct imsgbuf *ibuf" "uint32_t type" "uint32_t peerid" \
     "pid_t pid" "int fd" "const struct iovec *iov" "int iovcnt"
+.Ft int
+.Fn imsg_compose_ibuf "struct imsgbuf *ibuf" "uint32_t type" "uint32_t peerid" \
+    "pid_t pid" "struct ibuf *buf"
 .Ft "struct ibuf *"
 .Fn imsg_create "struct imsgbuf *ibuf" "uint32_t type" "uint32_t peerid" \
     "pid_t pid" "uint16_t datalen"
@@ -81,28 +99,57 @@
 .Fn ibuf_dynamic "size_t len" "size_t max"
 .Ft int
 .Fn ibuf_add "struct ibuf *buf" "const void *data" "size_t len"
+.Ft int
+.Fn ibuf_add_buf "struct ibuf *buf" "const struct ibuf *from"
+.Ft int
+.Fn ibuf_add_n8 "struct ibuf *buf" "uint64_t value"
+.Ft int
+.Fn ibuf_add_n16 "struct ibuf *buf" "uint64_t value"
+.Ft int
+.Fn ibuf_add_n32 "struct ibuf *buf" "uint64_t value"
+.Ft int
+.Fn ibuf_add_n64 "struct ibuf *buf" "uint64_t value"
+.Ft int
+.Fn ibuf_add_zero "struct ibuf *buf" "size_t len"
 .Ft "void *"
 .Fn ibuf_reserve "struct ibuf *buf" "size_t len"
 .Ft "void *"
 .Fn ibuf_seek "struct ibuf *buf" "size_t pos" "size_t len"
+.Ft int
+.Fn ibuf_set "struct ibuf *buf" "size_t pos" "const void *data" \
+    "size_t len"
+.Ft int
+.Fn ibuf_set_n8 "struct ibuf *buf" "size_t pos" "uint64_t value"
+.Ft int
+.Fn ibuf_set_n16 "struct ibuf *buf" "size_t pos" "uint64_t value"
+.Ft int
+.Fn ibuf_set_n32 "struct ibuf *buf" "size_t pos" "uint64_t value"
+.Ft int
+.Fn ibuf_set_n64 "struct ibuf *buf" "size_t pos" "uint64_t value"
+.Ft "void *"
+.Fn ibuf_data "struct ibuf *buf"
 .Ft size_t
 .Fn ibuf_size "struct ibuf *buf"
 .Ft size_t
 .Fn ibuf_left "struct ibuf *buf"
 .Ft void
 .Fn ibuf_close "struct msgbuf *msgbuf" "struct ibuf *buf"
-.Ft int
-.Fn ibuf_write "struct msgbuf *msgbuf"
 .Ft void
 .Fn ibuf_free "struct ibuf *buf"
+.Ft int
+.Fn ibuf_fd_avail "struct ibuf *buf"
+.Ft int
+.Fn ibuf_fd_get "struct ibuf *buf"
+.Ft void
+.Fn ibuf_fd_set "struct ibuf *buf" "int fd"
+.Ft int
+.Fn ibuf_write "struct msgbuf *msgbuf"
 .Ft void
 .Fn msgbuf_init "struct msgbuf *msgbuf"
 .Ft void
 .Fn msgbuf_clear "struct msgbuf *msgbuf"
 .Ft int
 .Fn msgbuf_write "struct msgbuf *msgbuf"
-.Ft void
-.Fn msgbuf_drain "struct msgbuf *msgbuf" "size_t n"
 .Sh DESCRIPTION
 The
 .Nm imsg
@@ -133,7 +180,7 @@ struct imsgbuf {
 .Ed
 .Pp
 .Fn imsg_init
-is a routine which initializes
+initializes
 .Fa ibuf
 as one side of a channel associated with
 .Fa fd .
@@ -199,7 +246,7 @@ by adding it to
 output buffer.
 .Pp
 .Fn imsg_compose
-is a routine which is used to quickly create and queue an imsg.
+is used to quickly create and queue an imsg.
 It takes the same parameters as the
 .Fn imsg_create ,
 .Fn imsg_add
@@ -223,8 +270,19 @@ It takes the same parameters, except that the ancillary data buffer is specified
 by
 .Fa iovec .
 .Pp
+.Fn imsg_compose_ibuf
+is similar to
+.Fn imsg_compose .
+It takes the same parameters, except that the ancillary data buffer is specified
+by an ibuf
+.Fa buf .
+This routine returns 1 if it succeeds, \-1 otherwise.
+In either case the buffer
+.Fa buf
+is consumed by the function.
+.Pp
 .Fn imsg_flush
-is a function which calls
+calls
 .Fn msgbuf_write
 in a loop until all imsgs in the output buffer are sent.
 It returns 0 if it succeeds, \-1 otherwise.
@@ -357,7 +415,34 @@ Buffers allocated with
 are automatically grown if necessary when data is added.
 .Pp
 .Fn ibuf_add
-is a routine which appends a block of data to
+appends a block of data to
+.Fa buf .
+0 is returned on success and \-1 on failure.
+.Pp
+.Fn ibuf_add_buf
+appends the buffer
+.Fa from
+to
+.Fa buf .
+0 is returned on success and \-1 on failure.
+.Pp
+.Fn ibuf_add_n8 ,
+.Fn ibuf_add_n16 ,
+.Fn ibuf_add_n32 ,
+and
+.Fn ibuf_add_n64
+add a 1-byte, 2-byte, 4-byte, and 8-byte
+.Fa value
+to
+.Fa buf
+in network byte order.
+This function checks
+.Fa value
+to not overflow.
+0 is returned on success and \-1 on failure.
+.Pp
+.Fn ibuf_add_zero
+appends a block of zeros to
 .Fa buf .
 0 is returned on success and \-1 on failure.
 .Pp
@@ -369,13 +454,45 @@ bytes in
 A pointer to the start of the reserved space is returned, or NULL on error.
 .Pp
 .Fn ibuf_seek
-is a function which returns a pointer to the part of the buffer at offset
+returns a pointer to the part of the buffer at offset
 .Fa pos
 and of extent
 .Fa len .
 NULL is returned if the requested range is outside the part of the buffer
 in use.
 .Pp
+.Fn ibuf_set
+replaces a part of
+.Fa buf
+at offset
+.Fa pos
+with the data of extent
+.Fa len .
+0 is returned on success and \-1 on failure.
+.Pp
+.Fn ibuf_set_n8 ,
+.Fn ibuf_set_n16 ,
+.Fn ibuf_seek_set_n32
+and
+.Fn ibuf_seek_set_n64
+replace a 1-byte, 2-byte, 4-byte or 8-byte
+.Fa value
+at offset
+.Fa pos
+in the buffer
+.Fa buf
+in network byte order.
+This function checks
+.Fa value
+to not overflow.
+0 is returned on success and \-1 on failure.
+.Pp
+.Fn ibuf_data
+returns the pointer to the internal buffer.
+This function should only be used together with
+.Fn ibuf_size
+to process a previously generated buffer.
+.Pp
 .Fn ibuf_size
 and
 .Fn ibuf_left
@@ -390,6 +507,35 @@ to
 .Fa msgbuf
 ready to be sent.
 .Pp
+.Fn ibuf_fd_avail ,
+.Fn ibuf_fd_get
+and
+.Fn ibuf_fd_set
+are functions to check, get and set the file descriptor assigned to
+.Fa buf .
+After calling
+.Fn ibuf_fd_set
+the file descriptor is part of the
+.Fa buf
+and will be transmitted or closed by the ibuf API.
+Any previously set file descriptor will be closed before assigning a
+new descriptor.
+.Fn ibuf_fd_get
+returns the file descriptor and passes the responsibility to track the
+descriptor back to the program.
+.Fn ibuf_fd_avail
+returns true if there is a file descriptor set on
+.Fa buf .
+.Pp
+.Fn ibuf_free
+frees
+.Fa buf
+and any associated storage, and closes any file descriptor set with
+.Fn ibuf_fd_set .
+If
+.Fa buf
+is a NULL pointer, no action occurs.
+.Pp
 The
 .Fn ibuf_write
 routine transmits as many pending buffers as possible from
@@ -402,14 +548,6 @@ Temporary resource shortages are returned with errno
 .Er EAGAIN
 and require the application to retry again in the future.
 .Pp
-.Fn ibuf_free
-frees
-.Fa buf
-and any associated storage.
-If
-.Fa buf
-is a NULL pointer, no action occurs.
-.Pp
 The
 .Fn msgbuf_init
 function initializes
@@ -435,15 +573,6 @@ or an EOF condition on the socket is detected.
 Temporary resource shortages are returned with errno
 .Er EAGAIN
 and require the application to retry again in the future.
-.Pp
-.Fn msgbuf_drain
-discards data from buffers queued in
-.Fa msgbuf
-until
-.Fa n
-bytes have been removed or
-.Fa msgbuf
-is empty.
 .Sh EXAMPLES
 In a typical program, a channel between two processes is created with
 .Xr socketpair 2 ,
diff --git a/lib/libutil/shlib_version b/lib/libutil/shlib_version
index 84e2c2920..ffdd3d2d5 100644
--- a/lib/libutil/shlib_version
+++ b/lib/libutil/shlib_version
@@ -1,2 +1,2 @@
-major=16
+major=17
 minor=0
diff --git a/regress/lib/libcrypto/bn/bn_unit.c b/regress/lib/libcrypto/bn/bn_unit.c
index 95764dfce..bc49192b8 100644
--- a/regress/lib/libcrypto/bn/bn_unit.c
+++ b/regress/lib/libcrypto/bn/bn_unit.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bn_unit.c,v 1.4 2023/03/31 19:40:08 tb Exp $ */
+/*	$OpenBSD: bn_unit.c,v 1.6 2023/06/20 06:46:07 tb Exp $ */
 
 /*
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
@@ -69,6 +69,39 @@ test_bn_print_null_derefs(void)
 	return failed;
 }
 
+static int
+test_bn_num_bits(void)
+{
+	BIGNUM *bn;
+	int i, num_bits;
+	int failed = 0;
+
+	if ((bn = BN_new()) == NULL)
+		errx(1, "BN_new");
+
+	if ((num_bits = BN_num_bits(bn)) != 0) {
+		warnx("BN_num_bits(0): want 0, got %d", num_bits);
+		failed |= 1;
+	}
+
+	if (!BN_set_word(bn, 1))
+		errx(1, "BN_set_word");
+
+	for (i = 0; i <= 5 * BN_BITS2; i++) {
+		if ((num_bits = BN_num_bits(bn)) != i + 1) {
+			warnx("BN_num_bits(1 << %d): want %d, got %d",
+			    i, i + 1, num_bits);
+			failed |= 1;
+		}
+		if (!BN_lshift1(bn, bn))
+			errx(1, "BN_lshift1");
+	}
+
+	BN_free(bn);
+
+	return failed;
+}
+
 static int
 test_bn_num_bits_word(void)
 {
@@ -255,6 +288,7 @@ main(void)
 	int failed = 0;
 
 	failed |= test_bn_print_null_derefs();
+	failed |= test_bn_num_bits();
 	failed |= test_bn_num_bits_word();
 	failed |= test_bn_copy_copies_flags();
 	failed |= test_bn_copy_consttime_is_sticky();
diff --git a/regress/lib/libcrypto/engine/enginetest.c b/regress/lib/libcrypto/engine/enginetest.c
index 40e598ab7..9afae3919 100644
--- a/regress/lib/libcrypto/engine/enginetest.c
+++ b/regress/lib/libcrypto/engine/enginetest.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: enginetest.c,v 1.9 2022/09/05 21:06:31 tb Exp $	*/
+/*	$OpenBSD: enginetest.c,v 1.10 2023/06/19 18:52:29 tb Exp $	*/
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -61,6 +61,7 @@
 
 #include <openssl/buffer.h>
 #include <openssl/crypto.h>
+#ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #include <openssl/err.h>
 
@@ -242,3 +243,11 @@ end:
 	CRYPTO_mem_leaks_fp(stderr);
 	return to_return;
 }
+#else
+int
+main(void)
+{
+	printf("ENGINE support is disabled\n");
+	return 0;
+}
+#endif
diff --git a/regress/lib/libcrypto/gost/gost2814789t.c b/regress/lib/libcrypto/gost/gost2814789t.c
index e531229f6..5e439a7e3 100644
--- a/regress/lib/libcrypto/gost/gost2814789t.c
+++ b/regress/lib/libcrypto/gost/gost2814789t.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: gost2814789t.c,v 1.8 2022/09/12 04:20:59 tb Exp $	*/
+/*	$OpenBSD: gost2814789t.c,v 1.9 2023/06/19 18:51:47 tb Exp $	*/
 /* vim: set fileencoding=ascii : Charset: ASCII */
 /* test/gostr2814789t.c */
 /* ====================================================================
@@ -24,7 +24,9 @@ int main(int argc, char *argv[])
 #include <inttypes.h>
 #include <openssl/conf.h>
 #include <openssl/crypto.h>
+#ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
+#endif
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
@@ -1287,7 +1289,9 @@ int main(int argc, char *argv[])
     }
 
     ERR_load_crypto_strings();
+#ifndef OPENSSL_NO_ENGINE
     ENGINE_load_builtin_engines();
+#endif
     OPENSSL_load_builtin_modules();
     OpenSSL_add_all_algorithms();
 
diff --git a/regress/lib/libutil/imsg/ibuf_test.c b/regress/lib/libutil/imsg/ibuf_test.c
index 819bacb5c..c8c481d5b 100644
--- a/regress/lib/libutil/imsg/ibuf_test.c
+++ b/regress/lib/libutil/imsg/ibuf_test.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ibuf_test.c,v 1.3 2023/06/13 10:39:46 tb Exp $ */
+/* $OpenBSD: ibuf_test.c,v 1.4 2023/06/19 17:22:46 claudio Exp $ */
 /*
  * Copyright (c) Tobias Stoeckmann <tobias@openbsd.org>
  *
@@ -92,44 +92,6 @@ test_ibuf_seek(void)
 	return ret;
 }
 
-int
-test_msgbuf_drain(void)
-{
-	struct msgbuf msgbuf;
-	struct ibuf *buf;
-
-	msgbuf_init(&msgbuf);
-
-	if ((buf = ibuf_open(4)) == NULL)
-		return 1;
-	if (ibuf_add(buf, "test", 4) != 0) {
-		ibuf_free(buf);
-		return 1;
-	}
-	ibuf_close(&msgbuf, buf);
-
-	if (msgbuf.queued != 1) {
-		ibuf_free(buf);
-		return 1;
-	}
-
-	msgbuf_drain(&msgbuf, 1);
-
-	if (msgbuf.queued != 1) {
-		ibuf_free(buf);
-		return 1;
-	}
-
-	msgbuf_drain(&msgbuf, SIZE_MAX);
-
-	if (msgbuf.queued != 0) {
-		ibuf_free(buf);
-		return 1;
-	}
-
-	return 0;
-}
-
 int
 main(void)
 {
@@ -161,12 +123,6 @@ main(void)
 	} else
 		printf("SUCCESS: test_ibuf_seek\n");
 
-	if (test_msgbuf_drain() != 0) {
-		printf("FAILED: test_msgbuf_drain\n");
-		ret = 1;
-	} else
-		printf("SUCCESS: test_msgbuf_drain\n");
-
 	if (ret != 0) {
 		printf("FAILED: %s\n", __progname);
 		return 1;
diff --git a/regress/usr.sbin/rpki-client/Makefile.inc b/regress/usr.sbin/rpki-client/Makefile.inc
index 1c25ca052..be503b590 100644
--- a/regress/usr.sbin/rpki-client/Makefile.inc
+++ b/regress/usr.sbin/rpki-client/Makefile.inc
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile.inc,v 1.32 2023/05/30 15:56:47 job Exp $
+# $OpenBSD: Makefile.inc,v 1.33 2023/06/20 12:52:32 job Exp $
 
 .PATH:		${.CURDIR}/../../../../usr.sbin/rpki-client
 
@@ -40,7 +40,7 @@ run-regress-test-cert: test-cert
 	./test-cert -vt ${TALARGS:S,,${.CURDIR}/../&,}
 
 SRCS_test-mft+=	test-mft.c mft.c crl.c cms.c x509.c ip.c io.c log.c validate.c \
-		encoding.c print.c dummy.c json.c
+		encoding.c print.c json.c cert.c as.c
 run-regress-test-mft: test-mft
 	./test-mft -v ${.CURDIR}/../mft/*.mft
 
@@ -64,8 +64,8 @@ SRCS_test-geofeed+=	test-geofeed.c geofeed.c cms.c x509.c ip.c io.c log.c \
 run-regress-test-geofeed: test-geofeed
 	./test-geofeed -v ${.CURDIR}/../geofeed/*.csv
 
-SRCS_test-tal+=	test-tal.c tal.c ip.c io.c log.c validate.c \
-		encoding.c print.c crl.c dummy.c x509.c json.c
+SRCS_test-tal+=	test-tal.c tal.c ip.c io.c log.c validate.c cms.c \
+		encoding.c print.c crl.c x509.c json.c cert.c as.c mft.c
 run-regress-test-tal: test-tal
 	./test-tal -v ${.CURDIR}/../tal/*.tal
 
@@ -80,9 +80,9 @@ SRCS_test-tak+=	test-tak.c tak.c cms.c x509.c ip.c as.c io.c log.c \
 run-regress-test-tak: test-tak
 	./test-tak -v ${.CURDIR}/../tak/*.tak
 
-SRCS_test-rrdp+=	test-rrdp.c rrdp_delta.c rrdp_notification.c \
-			rrdp_snapshot.c rrdp_util.c \
-			log.c encoding.c ip.c validate.c dummy.c crl.c x509.c
+SRCS_test-rrdp+=	test-rrdp.c rrdp_delta.c rrdp_notification.c cms.c \
+			rrdp_snapshot.c rrdp_util.c cert.c as.c mft.c io.c \
+			log.c encoding.c ip.c validate.c crl.c x509.c
 LDADD_test-rrdp+=	-lexpat ${LDADD}
 DPADD_test-rrdp+=	${LIBEXPAT} ${DPADD}
 run-regress-test-rrdp: test-rrdp
diff --git a/regress/usr.sbin/rpki-client/dummy.c b/regress/usr.sbin/rpki-client/dummy.c
deleted file mode 100644
index 5caf1ebd9..000000000
--- a/regress/usr.sbin/rpki-client/dummy.c
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Public domain
- * dummy shim for some tests.
- */
-
-#include "extern.h"
-
-struct auth *
-auth_find(struct auth_tree *auths, const char *aki)
-{
-	return NULL;
-}
-
-int
-as_check_covered(uint32_t min, uint32_t max,
-    const struct cert_as *as, size_t asz)
-{
-	return -1;
-}
diff --git a/regress/usr.sbin/rpki-client/test-mft.c b/regress/usr.sbin/rpki-client/test-mft.c
index f975c8496..a2737b266 100644
--- a/regress/usr.sbin/rpki-client/test-mft.c
+++ b/regress/usr.sbin/rpki-client/test-mft.c
@@ -1,4 +1,4 @@
-/*	$Id: test-mft.c,v 1.25 2023/05/30 12:14:48 claudio Exp $ */
+/*	$Id: test-mft.c,v 1.26 2023/06/20 12:52:32 job Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -35,6 +35,7 @@
 
 int outformats;
 int verbose;
+int filemode;
 
 int
 main(int argc, char *argv[])
diff --git a/regress/usr.sbin/rpki-client/test-rrdp.c b/regress/usr.sbin/rpki-client/test-rrdp.c
index abcd843d5..b6da63c67 100644
--- a/regress/usr.sbin/rpki-client/test-rrdp.c
+++ b/regress/usr.sbin/rpki-client/test-rrdp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: test-rrdp.c,v 1.6 2023/05/30 12:14:48 claudio Exp $ */
+/*	$OpenBSD: test-rrdp.c,v 1.7 2023/06/20 12:52:32 job Exp $ */
 /*
  * Copyright (c) 2020 Nils Fisher <nils_fisher@hotmail.com>
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
@@ -36,6 +36,7 @@
 #include "rrdp.h"
 
 int verbose;
+int filemode;
 
 #define REGRESS_NOTIFY_URI	"https://rpki.example.com/notify.xml"
 
diff --git a/regress/usr.sbin/rpki-client/test-tal.c b/regress/usr.sbin/rpki-client/test-tal.c
index 3d9eb351f..aa3026954 100644
--- a/regress/usr.sbin/rpki-client/test-tal.c
+++ b/regress/usr.sbin/rpki-client/test-tal.c
@@ -1,4 +1,4 @@
-/*	$Id: test-tal.c,v 1.12 2023/05/30 12:14:48 claudio Exp $ */
+/*	$Id: test-tal.c,v 1.13 2023/06/20 12:52:32 job Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -31,6 +31,7 @@
 
 int outformats;
 int verbose;
+int filemode;
 
 int
 main(int argc, char *argv[])
diff --git a/sbin/fdisk/gpt.c b/sbin/fdisk/gpt.c
index ad7f44e49..8e8badfe0 100644
--- a/sbin/fdisk/gpt.c
+++ b/sbin/fdisk/gpt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: gpt.c,v 1.91 2023/05/17 12:59:37 krw Exp $	*/
+/*	$OpenBSD: gpt.c,v 1.93 2023/06/20 11:52:08 krw Exp $	*/
 /*
  * Copyright (c) 2015 Markus Muller <mmu@grummel.net>
  * Copyright (c) 2015 Kenneth R Westerback <krw@openbsd.org>
@@ -77,10 +77,9 @@ name_to_string(const unsigned int pn)
 	static char		name[GPTPARTNAMESIZE + 1];
 	unsigned int		i;
 
-	memset(name, 0, sizeof(name));
-
-	for (i = 0; i < sizeof(name) && gp[pn].gp_name[i] != 0; i++)
+	for (i = 0; i < GPTPARTNAMESIZE && gp[pn].gp_name[i] != 0; i++)
 		name[i] = letoh16(gp[pn].gp_name[i]) & 0x7F;
+	name[i] = '\0';
 
 	return name;
 }
@@ -455,7 +454,7 @@ GPT_print_part(const unsigned int pn, const char *units, const int verbosity)
 			printf("      <invalid partition guid>             ");
 		else
 			printf("      %-36s ", guidstr);
-		printf("%-36s\n", name_to_string(pn));
+		printf("%s\n", name_to_string(pn));
 		free(guidstr);
 		attrs = gp[pn].gp_attrs;
 		if (attrs) {
diff --git a/sbin/fdisk/part.c b/sbin/fdisk/part.c
index d925b703a..1e0a17143 100644
--- a/sbin/fdisk/part.c
+++ b/sbin/fdisk/part.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: part.c,v 1.163 2023/05/21 17:29:33 krw Exp $	*/
+/*	$OpenBSD: part.c,v 1.164 2023/06/19 23:11:57 krw Exp $	*/
 
 /*
  * Copyright (c) 1997 Tobias Weingartner
@@ -1047,14 +1047,13 @@ PRT_print_part(const int num, const struct prt *prt, const char *units)
 	const char		*desc;
 	struct chs		 start, end;
 	double			 size;
-	unsigned int		 i;
 
 	size = units_size(units, prt->prt_ns, &ut);
 	PRT_lba_to_chs(prt, &start, &end);
 	desc = find_mbr_desc(find_mbr_type(prt->prt_id));
 
 	printf("%c%1d: %.2X %6llu %3u %3u - %6llu %3u %3u [%12llu:%12.0f%s] "
-	    "%-15s\n", (prt->prt_flag == DOSACTIVE) ? '*' : ' ', num,
+	    "%s\n", (prt->prt_flag == DOSACTIVE) ? '*' : ' ', num,
 	    prt->prt_id, start.chs_cyl, start.chs_head, start.chs_sect,
 	    end.chs_cyl, end.chs_head, end.chs_sect,
 	    prt->prt_bs, size, ut->ut_abbr, desc ? desc : "<Unknown ID>");
diff --git a/sbin/iked/iked.h b/sbin/iked/iked.h
index 84999630d..85958e1c2 100644
--- a/sbin/iked/iked.h
+++ b/sbin/iked/iked.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: iked.h,v 1.217 2023/06/16 10:28:43 tb Exp $	*/
+/*	$OpenBSD: iked.h,v 1.218 2023/06/19 17:19:50 claudio Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -1270,7 +1270,6 @@ struct ibuf *
 int	 ibuf_cat(struct ibuf *, struct ibuf *);
 size_t	 ibuf_length(struct ibuf *);
 int	 ibuf_setsize(struct ibuf *, size_t);
-void	*ibuf_data(struct ibuf *);
 void	*ibuf_getdata(struct ibuf *, size_t);
 struct ibuf *
 	 ibuf_get(struct ibuf *, size_t);
diff --git a/sbin/iked/imsg_util.c b/sbin/iked/imsg_util.c
index cf83b5c98..eab8eea72 100644
--- a/sbin/iked/imsg_util.c
+++ b/sbin/iked/imsg_util.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: imsg_util.c,v 1.18 2023/06/12 09:02:32 claudio Exp $	*/
+/*	$OpenBSD: imsg_util.c,v 1.19 2023/06/19 17:19:50 claudio Exp $	*/
 
 /*
  * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
@@ -83,12 +83,6 @@ ibuf_length(struct ibuf *buf)
 	return (ibuf_size(buf));
 }
 
-void *
-ibuf_data(struct ibuf *buf)
-{
-	return (ibuf_seek(buf, 0, 0));
-}
-
 void *
 ibuf_getdata(struct ibuf *buf, size_t len)
 {
diff --git a/share/man/man9/rt_timer_add.9 b/share/man/man9/rt_timer_add.9
index b20dd9499..319591c2b 100644
--- a/share/man/man9/rt_timer_add.9
+++ b/share/man/man9/rt_timer_add.9
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: rt_timer_add.9,v 1.4 2014/03/26 14:50:30 mpi Exp $
+.\"     $OpenBSD: rt_timer_add.9,v 1.5 2023/06/20 10:59:47 kn Exp $
 .\"
 .\" Copyright (c) 2011 Bret S. Lambert <blambert@openbsd.org>
 .\" All rights reserved.
@@ -15,83 +15,90 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: March 26 2014 $
+.Dd $Mdocdate: June 20 2023 $
 .Dt RT_TIMER_ADD 9
 .Os
 .Sh NAME
 .Nm rt_timer_add ,
 .Nm rt_timer_remove_all ,
-.Nm rt_timer_queue_create ,
-.Nm rt_timer_queue_count ,
+.Nm rt_timer_get_expire ,
+.Nm rt_timer_queue_init ,
 .Nm rt_timer_queue_change ,
-.Nm rt_timer_queue_destroy
+.Nm rt_timer_queue_flush ,
+.Nm rt_timer_queue_count
 .Nd route timer queues interface
 .Sh SYNOPSIS
 .In net/route.h
 .Ft int
 .Fn rt_timer_add "struct rtentry *rt" \
-"void (*func)(struct rtentry *, struct rttimer *)" \
 "struct rttimer_queue *queue" "u_int rtableid"
 .Ft void
 .Fn rt_timer_remove_all "struct rtentry *rt"
-.Ft struct rttimer_queue *
-.Fn rt_timer_queue_create "u_int timeout"
+.Ft time_t
+.Fn rt_timer_get_expire "const struct rtentry *rt"
+.Ft void
+.Fn rt_timer_queue_init "struct rttimer_queue *rtq" "int timeout" \
+"void (*func)(struct rtentry *, u_int)"
+.Ft void
+.Fn rt_timer_queue_change "struct rttimer_queue *rtq" "int timeout"
+.Ft void
+.Fn rt_timer_queue_flush "struct rttimer_queue *rtq"
 .Ft unsigned long
 .Fn rt_timer_queue_count "struct rttimer_queue *rtq"
-.Ft void
-.Fn rt_timer_queue_change "struct rttimer_queue *rtq" "long timeout"
-.Ft void
-.Fn rt_timer_queue_destroy "struct rttimer_queue *rtq"
 .Sh DESCRIPTION
-Route timer queues provide a method of queueing routing-related actions to be
-triggered once per second.
-.Bl -tag -width Ds
-.It Fn rt_timer_add "struct rtentry *rt" \
-"void (*func)(struct rtentry *, struct rttimer *)" \
-"struct rttimer_queue *queue" "u_int rtableid"
-Schedule
-.Fa func
+The
+.Nm rt_timer
+subsystem queues routing-related functions for asynchronous execution
+in the future.
+.Pp
+.Fn rt_timer_add
+allocates an rttimer_queue
+.Fa rtq
 to be called on
 .Fa rt
 using the timeout of
 .Fa queue .
-If
-.Fa rt
-already has a call to
-.Fa func
-scheduled on any timer queue, it will be replaced with the new invocation.
-.It Fn rt_timer_remove_all "struct rtentry *rt"
-Remove all timeouts associated with
+If an action already exists, it will be replaced with the new one.
+.Pp
+.Fn rt_timer_remove_all
+removes all timeouts associated with
 .Fa rt
 from all routing timer queues.
-.It Fn rt_timer_queue_create "u_int timeout"
-Create a timer queue with a timeout of
+.Pp
+.Fn rt_timer_get_expire
+returns the current expiry time in seconds.
+.Pp
+.Fn rt_timer_queue_init
+creates a timer queue with a timeout of
 .Fa timeout
 seconds.
-.It Fn rt_timer_queue_count "struct rtentry *rt"
-Return the number of timers present in the queue
-.Fa rtq .
-.It Fn rt_timer_queue_change "struct rttimer_queue *rtq" "long timeout"
-Set timeout for
+.Pp
+.Fn rt_timer_queue_change
+sets the timeout for
 .Fa rtq
 to
 .Fa timeout
 seconds.
-.It Fn rt_timer_queue_destroy "struct rttimer_queue *rtq"
-Remove all timeouts from the routing timer queue
+.Pp
+.Fn rt_timer_queue_flush
+removes all timeouts from the routing timer queue
 .Fa rtq ,
-execute their associated callback and destroy it.
-.El
+executes their associated callback and destroys it.
+.Pp
+.Fn rt_timer_queue_count
+returns the number of timers present in the queue
+.Fa rtq .
 .Sh CONTEXT
 .Fn rt_timer_add ,
 .Fn rt_timer_remove_all ,
-.Fn rt_timer_queue_create ,
-.Fn rt_timer_queue_count ,
+.Fn rt_timer_get_expire ,
+.Fn rt_timer_queue_init ,
 .Fn rt_timer_queue_change ,
+.Fn rt_timer_queue_flush
 and
-.Fn rt_timer_queue_destroy
+.Fn rt_timer_queue_count
 can be called during autoconf, from process context, or from interrupt context.
-.Sh RETURN VALUES
+.Sh ERRORS
 .Fn rt_timer_add
 may fail with
 .Er ENOBUFS
diff --git a/share/man/man9/uvm_init.9 b/share/man/man9/uvm_init.9
index 2ef1769b0..636a16a13 100644
--- a/share/man/man9/uvm_init.9
+++ b/share/man/man9/uvm_init.9
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: uvm_init.9,v 1.5 2023/05/21 05:11:38 jmc Exp $
+.\"	$OpenBSD: uvm_init.9,v 1.6 2023/06/20 16:30:30 cheloha Exp $
 .\"	$NetBSD: uvm.9,v 1.14 2000/06/29 06:08:44 mrg Exp $
 .\"
 .\" Copyright (c) 1998 Matthew R. Green
@@ -28,7 +28,7 @@
 .\" XXX this manual sets nS to 1 or 0 in the description, to obtain
 .\" synopsis-like function prototypes.  any better way?
 .\"
-.Dd $Mdocdate: May 21 2023 $
+.Dd $Mdocdate: June 20 2023 $
 .Dt UVM_INIT 9
 .Os
 .Sh NAME
@@ -168,7 +168,7 @@ argument is ignored.
 .Ft void
 .Fn uvm_kernacc "caddr_t addr" "size_t len" "int rw"
 .Ft void
-.Fn uvm_meter
+.Fn uvm_meter "void *"
 .Ft int
 .Fn uvm_sysctl "int *name" "u_int namelen" "void *oldp" "size_t *oldlenp" "void *newp " "size_t newlen" "struct proc *p"
 .Ft int
@@ -212,7 +212,7 @@ access, in the kernel address space.
 .Pp
 The
 .Fn uvm_meter
-function calculates the load average and wakes up the swapper if necessary.
+function periodically recomputes the load average.
 .Pp
 The
 .Fn uvm_sysctl
diff --git a/sys/dev/fdt/dwmshc.c b/sys/dev/fdt/dwmshc.c
index d5de236ab..34df2ed9c 100644
--- a/sys/dev/fdt/dwmshc.c
+++ b/sys/dev/fdt/dwmshc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dwmshc.c,v 1.4 2023/04/19 02:01:02 dlg Exp $ */
+/*	$OpenBSD: dwmshc.c,v 1.5 2023/06/20 09:26:36 kettenis Exp $ */
 
 /*
  * Copyright (c) 2023 David Gwynne <dlg@openbsd.org>
@@ -98,7 +98,7 @@
 #define  EMMC_DLL_RXCLK_RX_CLK_OUT_SEL		(1U << 27)
 #define  EMMC_DLL_RXCLK_RX_CLK_CHANGE_WINDOW	(1U << 28)
 #define  EMMC_DLL_RXCLK_RX_CLK_SRC_SEL		(1U << 29)
-#define EMMC_DLL_TXCLK			0x804
+#define EMMC_DLL_TXCLK			0x808
 #define  EMMC_DLL_TXCLK_TX_TAP_NUM_SHIFT	0
 #define  EMMC_DLL_TXCLK_TX_TAP_NUM_MASK		0x1f
 #define  EMMC_DLL_TXCLK_TX_TAP_VALUE_SHIFT	8
diff --git a/sys/dev/ic/aacreg.h b/sys/dev/ic/aacreg.h
index 37350443f..d987d42c5 100644
--- a/sys/dev/ic/aacreg.h
+++ b/sys/dev/ic/aacreg.h
@@ -267,7 +267,7 @@ typedef enum {
 #define AAC_ERROR_FIB_DEALLOCATION_FAILED	0x08
 
 /*
- * Adapter Init Structure: this is passed to the adapter with the 
+ * Adapter Init Structure: this is passed to the adapter with the
  * AAC_MONKER_INITSTRUCT command to point it at our control structures.
  */
 struct aac_adapter_init {
@@ -423,7 +423,7 @@ typedef enum {
 	CPU_MIPS,
 	CPU_XSCALE,
 	CPU__last
-} AAC_CpuType;  
+} AAC_CpuType;
 
 typedef enum {
 	CPUI960_JX = 1,
@@ -481,7 +481,7 @@ typedef enum {
  * XXX the aac-2622 with no battery present reports PLATFORM_BAT_OPT_PRESENT
  */
 typedef enum
-{ 
+{
 	PLATFORM_BAT_REQ_PRESENT = 1,	/* BATTERY REQUIRED AND PRESENT */
 	PLATFORM_BAT_REQ_NOTPRESENT,	/* BATTERY REQUIRED AND NOT PRESENT */
 	PLATFORM_BAT_OPT_PRESENT,	/* BATTERY OPTIONAL AND PRESENT */
@@ -489,9 +489,9 @@ typedef enum
 	PLATFORM_BAT_NOT_SUPPORTED	/* BATTERY NOT SUPPORTED */
 } AAC_BatteryPlatform;
 
-/* 
+/*
  * options supported by this board
- * there has to be a one to one mapping of these defines and the ones in 
+ * there has to be a one to one mapping of these defines and the ones in
  * fsaapi.h, search for FSA_SUPPORT_SNAPSHOT
  */
 #define AAC_SUPPORTED_SNAPSHOT		0x01
@@ -508,7 +508,7 @@ typedef enum
 #define AAC_SUPPORTED_ALARM		0x800
 #define AAC_SUPPORTED_NONDASD		0x1000
 
-/* 
+/*
  * Structure used to respond to a RequestAdapterInfo fib.
  */
 struct aac_adapter_info {
@@ -564,7 +564,7 @@ struct aac_adapter_info {
 #define AAC_KERNEL_PANIC	0x00000100
 
 /*
- * Data types relating to control and monitoring of the NVRAM/WriteCache 
+ * Data types relating to control and monitoring of the NVRAM/WriteCache
  * subsystem.
  */
 
@@ -732,7 +732,7 @@ typedef enum {
 	AifEnGeneric = 1,		/* Generic notification */
 	AifEnTaskComplete,		/* Task has completed */
 	AifEnConfigChange,		/* Adapter config change occurred */
-	AifEnContainerChange,		/* Adapter specific container 
+	AifEnContainerChange,		/* Adapter specific container
 					 * configuration change */
 	AifEnDeviceFailure,		/* SCSI device failed */
 	AifEnMirrorFailover,		/* Mirror failover started */
@@ -832,7 +832,7 @@ struct aac_AifEventNotify {
 /*
  * Adapter Initiated FIB command structures. Start with the adapter
  * initiated FIBs that really come from the adapter, and get responded
- * to by the host. 
+ * to by the host.
  */
 #define AAC_AIF_REPORT_MAX_SIZE 64
 
@@ -1378,7 +1378,7 @@ enum {
 /*
  * The adapter can request the host print a message by setting the
  * DB_PRINTF flag in DOORBELL0.  The driver responds by collecting the
- * message from the printf buffer, clearing the DB_PRINTF flag in 
+ * message from the printf buffer, clearing the DB_PRINTF flag in
  * DOORBELL0 and setting it in DOORBELL1.
  * (ODBR and IDBR respectively for the i960Rx adapters)
  */
diff --git a/sys/dev/ic/aacvar.h b/sys/dev/ic/aacvar.h
index d2104d31d..cf6beab0f 100644
--- a/sys/dev/ic/aacvar.h
+++ b/sys/dev/ic/aacvar.h
@@ -127,10 +127,10 @@ struct aac_softc;
 #define AAC_SYNC_DELAY 20000
 
 /*
- * The firmware interface allows for a 16-bit s/g list length.  We limit 
+ * The firmware interface allows for a 16-bit s/g list length.  We limit
  * ourselves to a reasonable maximum and ensure alignment.
  */
-#define AAC_MAXSGENTRIES	64	/* max S/G entries, limit 65535 */		
+#define AAC_MAXSGENTRIES	64	/* max S/G entries, limit 65535 */
 
 /*
  * We gather a number of adapter-visible items into a single structure.
@@ -157,7 +157,7 @@ struct aac_common {
 
 	/* buffer for text messages from the controller */
 	char	ac_printf[AAC_PRINTF_BUFSIZE];
-    
+
 	/* fib for synchronous commands */
 	struct aac_fib ac_sync_fib;
 };
@@ -348,7 +348,7 @@ struct aac_softc
 
 	/* command management */
 	struct mutex		 aac_free_mtx;
-	TAILQ_HEAD(,aac_command) aac_free;	/* command structures 
+	TAILQ_HEAD(,aac_command) aac_free;	/* command structures
 						 * available for reuse */
 	TAILQ_HEAD(,aac_command) aac_ready;	/* commands on hold for
 						 * controller resources */
diff --git a/sys/dev/ic/acx.c b/sys/dev/ic/acx.c
index 6025fa4bc..b1099f11e 100644
--- a/sys/dev/ic/acx.c
+++ b/sys/dev/ic/acx.c
@@ -989,7 +989,7 @@ encapped:
 			} else
 				rate = ni->ni_rates.rs_rates[ni->ni_txrate];
 			rate &= IEEE80211_RATE_VAL;
-		} 
+		}
 
 #if NBPFILTER > 0
 		if (ic->ic_rawbpf != NULL)
@@ -2375,7 +2375,7 @@ acx_set_probe_resp_tmplt(struct acx_softc *sc, struct ieee80211_node *ni)
 
 	m_copydata(m, 0, m->m_pkthdr.len, &resp.data);
 	len = m->m_pkthdr.len + sizeof(resp.size);
-	m_freem(m); 
+	m_freem(m);
 
 	return (acx_set_tmplt(sc, ACXCMD_TMPLT_PROBE_RESP, &resp, len));
 }
diff --git a/sys/dev/ic/advlib.h b/sys/dev/ic/advlib.h
index 90bdd4e08..937738b86 100644
--- a/sys/dev/ic/advlib.h
+++ b/sys/dev/ic/advlib.h
@@ -36,10 +36,10 @@
  */
 /*
  * advansys.c - Linux Host Driver for AdvanSys SCSI Adapters
- *     
+ *
  * Copyright (c) 1995-1996 Advanced System Products, Inc.
  * All Rights Reserved.
- *   
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that redistributions of source
  * code retain the above copyright notice and this comment without
diff --git a/sys/dev/ic/aic6360.c b/sys/dev/ic/aic6360.c
index f1b294333..b6477552a 100644
--- a/sys/dev/ic/aic6360.c
+++ b/sys/dev/ic/aic6360.c
@@ -553,7 +553,7 @@ aic_poll(struct aic_softc *sc, struct scsi_xfer *xs, int count)
 	}
 	return 1;
 }
-
+
 /*
  * LOW LEVEL SCSI UTILITIES
  */
@@ -684,7 +684,7 @@ abort:
 	aic_sched_msgout(sc, SEND_ABORT);
 	return (1);
 }
-
+
 /*
  * Schedule a SCSI operation.  This has now been pulled out of the interrupt
  * handler so that we may call it from aic_scsi_cmd and aic_done.  This may
@@ -726,7 +726,7 @@ aic_sched(struct aic_softc *sc)
 	bus_space_write_1(iot, ioh, SIMODE1, ENSCSIRST);
 	bus_space_write_1(iot, ioh, SCSISEQ, ENRESELI);
 }
-
+
 void
 aic_sense(struct aic_softc *sc, struct aic_acb *acb)
 {
@@ -831,7 +831,7 @@ aic_dequeue(struct aic_softc *sc, struct aic_acb *acb)
 		TAILQ_REMOVE(&sc->ready_list, acb, chain);
 	}
 }
-
+
 /*
  * INTERRUPT/PROTOCOL ENGINE
  */
@@ -1305,7 +1305,7 @@ out:
 	/* Disable REQ/ACK protocol. */
 	bus_space_write_1(iot, ioh, SXFRCTL0, CHEN);
 }
-
+
 /* aic_dataout_pio: perform a data transfer using the FIFO datapath in the aic6360
  * Precondition: The SCSI bus should be in the DOUT phase, with REQ asserted
  * and ACK deasserted (i.e. waiting for a data byte).
@@ -1446,7 +1446,7 @@ phasechange:
 
 	return out;
 }
-
+
 /* aic_datain_pio: perform data transfers using the FIFO datapath in the aic6360
  * Precondition: The SCSI bus should be in the DIN phase, with REQ asserted
  * and ACK deasserted (i.e. at least one byte is ready).
@@ -1569,7 +1569,7 @@ phasechange:
 
 	return in;
 }
-
+
 /*
  * This is the workhorse routine of the driver.
  * Deficiencies (for now):
@@ -1992,7 +1992,7 @@ aic_timeout(void *arg)
 
 	splx(s);
 }
-
+
 #ifdef AIC_DEBUG
 /*
  * The following functions are mostly used for debugging purposes, either
diff --git a/sys/dev/ic/aic7xxx.c b/sys/dev/ic/aic7xxx.c
index 128902d1a..b442a19e1 100644
--- a/sys/dev/ic/aic7xxx.c
+++ b/sys/dev/ic/aic7xxx.c
@@ -825,7 +825,7 @@ ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat)
 					if (scb != NULL)
 						ahc_set_transaction_status(scb,
 						    CAM_UNCOR_PARITY);
-					ahc_reset_channel(ahc, devinfo.channel, 
+					ahc_reset_channel(ahc, devinfo.channel,
 							  /*init reset*/TRUE);
 				}
 			} else {
diff --git a/sys/dev/ic/aic7xxxvar.h b/sys/dev/ic/aic7xxxvar.h
index 0c4668fad..7e71fd984 100644
--- a/sys/dev/ic/aic7xxxvar.h
+++ b/sys/dev/ic/aic7xxxvar.h
@@ -823,7 +823,7 @@ struct seeprom_config {
 #define		CFBIOS_BUSSCAN	0x0008	/* Have the BIOS Scan the Bus */
 #define		CFSM2DRV	0x0010	/* support more than two drives */
 #define		CFSTPWLEVEL	0x0010	/* Termination level control */
-#define		CF284XEXTEND	0x0020	/* extended translation (284x cards) */	
+#define		CF284XEXTEND	0x0020	/* extended translation (284x cards) */
 #define		CFCTRL_A	0x0020	/* BIOS displays Ctrl-A message */
 #define		CFTERM_MENU	0x0040	/* BIOS displays termination menu */
 #define		CFEXTEND	0x0080	/* extended translation enabled */
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_object.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_object.c
index 2c1285b26..5c44cb7e1 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_object.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_object.c
@@ -80,9 +80,10 @@ static void amdgpu_bo_user_destroy(struct ttm_buffer_object *tbo)
 static void amdgpu_bo_vm_destroy(struct ttm_buffer_object *tbo)
 {
 	struct amdgpu_device *adev = amdgpu_ttm_adev(tbo->bdev);
-	struct amdgpu_bo *bo = ttm_to_amdgpu_bo(tbo);
+	struct amdgpu_bo *shadow_bo = ttm_to_amdgpu_bo(tbo), *bo;
 	struct amdgpu_bo_vm *vmbo;
 
+	bo = shadow_bo->parent;
 	vmbo = to_amdgpu_bo_vm(bo);
 	/* in case amdgpu_device_recover_vram got NULL of bo->parent */
 	if (!list_empty(&vmbo->shadow_list)) {
@@ -693,11 +694,6 @@ int amdgpu_bo_create_vm(struct amdgpu_device *adev,
 		return r;
 
 	*vmbo_ptr = to_amdgpu_bo_vm(bo_ptr);
-	INIT_LIST_HEAD(&(*vmbo_ptr)->shadow_list);
-	/* Set destroy callback to amdgpu_bo_vm_destroy after vmbo->shadow_list
-	 * is initialized.
-	 */
-	bo_ptr->tbo.destroy = &amdgpu_bo_vm_destroy;
 	return r;
 }
 
@@ -714,6 +710,8 @@ void amdgpu_bo_add_to_shadow_list(struct amdgpu_bo_vm *vmbo)
 
 	mutex_lock(&adev->shadow_list_lock);
 	list_add_tail(&vmbo->shadow_list, &adev->shadow_list);
+	vmbo->shadow->parent = amdgpu_bo_ref(&vmbo->bo);
+	vmbo->shadow->tbo.destroy = &amdgpu_bo_vm_destroy;
 	mutex_unlock(&adev->shadow_list_lock);
 }
 
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm_pt.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm_pt.c
index 432bf2662..7faa4182c 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm_pt.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm_pt.c
@@ -564,7 +564,6 @@ int amdgpu_vm_pt_create(struct amdgpu_device *adev, struct amdgpu_vm *vm,
 		return r;
 	}
 
-	(*vmbo)->shadow->parent = amdgpu_bo_ref(bo);
 	amdgpu_bo_add_to_shadow_list(*vmbo);
 
 	return 0;
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vram_mgr.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vram_mgr.c
index c8607247e..e351ec986 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vram_mgr.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vram_mgr.c
@@ -806,7 +806,7 @@ static void amdgpu_vram_mgr_debug(struct ttm_resource_manager *man,
 {
 	struct amdgpu_vram_mgr *mgr = to_vram_mgr(man);
 	struct drm_buddy *mm = &mgr->mm;
-	struct drm_buddy_block *block;
+	struct amdgpu_vram_reservation *rsv;
 
 	drm_printf(printer, "  vis usage:%llu\n",
 		   amdgpu_vram_mgr_vis_usage(mgr));
@@ -818,8 +818,9 @@ static void amdgpu_vram_mgr_debug(struct ttm_resource_manager *man,
 	drm_buddy_print(mm, printer);
 
 	drm_printf(printer, "reserved:\n");
-	list_for_each_entry(block, &mgr->reserved_pages, link)
-		drm_buddy_block_print(mm, block, printer);
+	list_for_each_entry(rsv, &mgr->reserved_pages, blocks)
+		drm_printf(printer, "%#018llx-%#018llx: %llu\n",
+			rsv->start, rsv->start + rsv->size, rsv->size);
 	mutex_unlock(&mgr->lock);
 }
 
diff --git a/sys/dev/pci/drm/amd/amdgpu/vi.c b/sys/dev/pci/drm/amd/amdgpu/vi.c
index 1e52c5f58..2a3fbba76 100644
--- a/sys/dev/pci/drm/amd/amdgpu/vi.c
+++ b/sys/dev/pci/drm/amd/amdgpu/vi.c
@@ -542,8 +542,15 @@ static u32 vi_get_xclk(struct amdgpu_device *adev)
 	u32 reference_clock = adev->clock.spll.reference_freq;
 	u32 tmp;
 
-	if (adev->flags & AMD_IS_APU)
-		return reference_clock;
+	if (adev->flags & AMD_IS_APU) {
+		switch (adev->asic_type) {
+		case CHIP_STONEY:
+			/* vbios says 48Mhz, but the actual freq is 100Mhz */
+			return 10000;
+		default:
+			return reference_clock;
+		}
+	}
 
 	tmp = RREG32_SMC(ixCG_CLKPIN_CNTL_2);
 	if (REG_GET_FIELD(tmp, CG_CLKPIN_CNTL_2, MUX_TCLK_TO_XCLK))
diff --git a/sys/dev/pci/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/sys/dev/pci/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
index d2b184fdd..f28caece5 100644
--- a/sys/dev/pci/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+++ b/sys/dev/pci/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
@@ -137,7 +137,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn3_2_soc = {
 	.urgent_out_of_order_return_per_channel_pixel_only_bytes = 4096,
 	.urgent_out_of_order_return_per_channel_pixel_and_vm_bytes = 4096,
 	.urgent_out_of_order_return_per_channel_vm_only_bytes = 4096,
-	.pct_ideal_sdp_bw_after_urgent = 100.0,
+	.pct_ideal_sdp_bw_after_urgent = 90.0,
 	.pct_ideal_fabric_bw_after_urgent = 67.0,
 	.pct_ideal_dram_sdp_bw_after_urgent_pixel_only = 20.0,
 	.pct_ideal_dram_sdp_bw_after_urgent_pixel_and_vm = 60.0, // N/A, for now keep as is until DML implemented
diff --git a/sys/dev/pci/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/sys/dev/pci/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index 033e75b2d..f10676395 100644
--- a/sys/dev/pci/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/sys/dev/pci/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -2067,33 +2067,96 @@ static int sienna_cichlid_display_disable_memory_clock_switch(struct smu_context
 	return ret;
 }
 
+static void sienna_cichlid_get_override_pcie_settings(struct smu_context *smu,
+						      uint32_t *gen_speed_override,
+						      uint32_t *lane_width_override)
+{
+	struct amdgpu_device *adev = smu->adev;
+
+	*gen_speed_override = 0xff;
+	*lane_width_override = 0xff;
+
+	switch (adev->pdev->device) {
+	case 0x73A0:
+	case 0x73A1:
+	case 0x73A2:
+	case 0x73A3:
+	case 0x73AB:
+	case 0x73AE:
+		/* Bit 7:0: PCIE lane width, 1 to 7 corresponds is x1 to x32 */
+		*lane_width_override = 6;
+		break;
+	case 0x73E0:
+	case 0x73E1:
+	case 0x73E3:
+		*lane_width_override = 4;
+		break;
+	case 0x7420:
+	case 0x7421:
+	case 0x7422:
+	case 0x7423:
+	case 0x7424:
+		*lane_width_override = 3;
+		break;
+	default:
+		break;
+	}
+}
+
+#ifndef MAX
+#define MAX(a, b)	((a) > (b) ? (a) : (b))
+#endif
+
 static int sienna_cichlid_update_pcie_parameters(struct smu_context *smu,
 					 uint32_t pcie_gen_cap,
 					 uint32_t pcie_width_cap)
 {
 	struct smu_11_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;
-
-	uint32_t smu_pcie_arg;
+	struct smu_11_0_pcie_table *pcie_table = &dpm_context->dpm_tables.pcie_table;
+	uint32_t gen_speed_override, lane_width_override;
 	uint8_t *table_member1, *table_member2;
+	uint32_t min_gen_speed, max_gen_speed;
+	uint32_t min_lane_width, max_lane_width;
+	uint32_t smu_pcie_arg;
 	int ret, i;
 
 	GET_PPTABLE_MEMBER(PcieGenSpeed, &table_member1);
 	GET_PPTABLE_MEMBER(PcieLaneCount, &table_member2);
 
-	/* lclk dpm table setup */
-	for (i = 0; i < MAX_PCIE_CONF; i++) {
-		dpm_context->dpm_tables.pcie_table.pcie_gen[i] = table_member1[i];
-		dpm_context->dpm_tables.pcie_table.pcie_lane[i] = table_member2[i];
+	sienna_cichlid_get_override_pcie_settings(smu,
+						  &gen_speed_override,
+						  &lane_width_override);
+
+	/* PCIE gen speed override */
+	if (gen_speed_override != 0xff) {
+		min_gen_speed = MIN(pcie_gen_cap, gen_speed_override);
+		max_gen_speed = MIN(pcie_gen_cap, gen_speed_override);
+	} else {
+		min_gen_speed = MAX(0, table_member1[0]);
+		max_gen_speed = MIN(pcie_gen_cap, table_member1[1]);
+		min_gen_speed = min_gen_speed > max_gen_speed ?
+				max_gen_speed : min_gen_speed;
 	}
+	pcie_table->pcie_gen[0] = min_gen_speed;
+	pcie_table->pcie_gen[1] = max_gen_speed;
+
+	/* PCIE lane width override */
+	if (lane_width_override != 0xff) {
+		min_lane_width = MIN(pcie_width_cap, lane_width_override);
+		max_lane_width = MIN(pcie_width_cap, lane_width_override);
+	} else {
+		min_lane_width = MAX(1, table_member2[0]);
+		max_lane_width = MIN(pcie_width_cap, table_member2[1]);
+		min_lane_width = min_lane_width > max_lane_width ?
+				 max_lane_width : min_lane_width;
+	}
+	pcie_table->pcie_lane[0] = min_lane_width;
+	pcie_table->pcie_lane[1] = max_lane_width;
 
 	for (i = 0; i < NUM_LINK_LEVELS; i++) {
-		smu_pcie_arg = (i << 16) |
-			((table_member1[i] <= pcie_gen_cap) ?
-			 (table_member1[i] << 8) :
-			 (pcie_gen_cap << 8)) |
-			((table_member2[i] <= pcie_width_cap) ?
-			 table_member2[i] :
-			 pcie_width_cap);
+		smu_pcie_arg = (i << 16 |
+				pcie_table->pcie_gen[i] << 8 |
+				pcie_table->pcie_lane[i]);
 
 		ret = smu_cmn_send_smc_msg_with_param(smu,
 				SMU_MSG_OverridePcieParameters,
@@ -2101,11 +2164,6 @@ static int sienna_cichlid_update_pcie_parameters(struct smu_context *smu,
 				NULL);
 		if (ret)
 			return ret;
-
-		if (table_member1[i] > pcie_gen_cap)
-			dpm_context->dpm_tables.pcie_table.pcie_gen[i] = pcie_gen_cap;
-		if (table_member2[i] > pcie_width_cap)
-			dpm_context->dpm_tables.pcie_table.pcie_lane[i] = pcie_width_cap;
 	}
 
 	return 0;
diff --git a/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index 700c88448..d829f9525 100644
--- a/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -582,11 +582,11 @@ int smu_v13_0_init_power(struct smu_context *smu)
 	if (smu_power->power_context || smu_power->power_context_size != 0)
 		return -EINVAL;
 
-	smu_power->power_context = kzalloc(sizeof(struct smu_13_0_dpm_context),
+	smu_power->power_context = kzalloc(sizeof(struct smu_13_0_power_context),
 					   GFP_KERNEL);
 	if (!smu_power->power_context)
 		return -ENOMEM;
-	smu_power->power_context_size = sizeof(struct smu_13_0_dpm_context);
+	smu_power->power_context_size = sizeof(struct smu_13_0_power_context);
 
 	return 0;
 }
diff --git a/sys/dev/pci/drm/i915/display/intel_dp_aux.c b/sys/dev/pci/drm/i915/display/intel_dp_aux.c
index d9e3e7a34..222e92aca 100644
--- a/sys/dev/pci/drm/i915/display/intel_dp_aux.c
+++ b/sys/dev/pci/drm/i915/display/intel_dp_aux.c
@@ -119,6 +119,32 @@ static u32 skl_get_aux_clock_divider(struct intel_dp *intel_dp, int index)
 	return index ? 0 : 1;
 }
 
+static int intel_dp_aux_sync_len(void)
+{
+	int precharge = 16; /* 10-16 */
+	int preamble = 16;
+
+	return precharge + preamble;
+}
+
+static int intel_dp_aux_fw_sync_len(void)
+{
+	int precharge = 10; /* 10-16 */
+	int preamble = 8;
+
+	return precharge + preamble;
+}
+
+static int g4x_dp_aux_precharge_len(void)
+{
+	int precharge_min = 10;
+	int preamble = 16;
+
+	/* HW wants the length of the extra precharge in 2us units */
+	return (intel_dp_aux_sync_len() -
+		precharge_min - preamble) / 2;
+}
+
 static u32 g4x_get_aux_send_ctl(struct intel_dp *intel_dp,
 				int send_bytes,
 				u32 aux_clock_divider)
@@ -141,7 +167,7 @@ static u32 g4x_get_aux_send_ctl(struct intel_dp *intel_dp,
 	       timeout |
 	       DP_AUX_CH_CTL_RECEIVE_ERROR |
 	       (send_bytes << DP_AUX_CH_CTL_MESSAGE_SIZE_SHIFT) |
-	       (3 << DP_AUX_CH_CTL_PRECHARGE_2US_SHIFT) |
+	       (g4x_dp_aux_precharge_len() << DP_AUX_CH_CTL_PRECHARGE_2US_SHIFT) |
 	       (aux_clock_divider << DP_AUX_CH_CTL_BIT_CLOCK_2X_SHIFT);
 }
 
@@ -165,8 +191,8 @@ static u32 skl_get_aux_send_ctl(struct intel_dp *intel_dp,
 	      DP_AUX_CH_CTL_TIME_OUT_MAX |
 	      DP_AUX_CH_CTL_RECEIVE_ERROR |
 	      (send_bytes << DP_AUX_CH_CTL_MESSAGE_SIZE_SHIFT) |
-	      DP_AUX_CH_CTL_FW_SYNC_PULSE_SKL(24) |
-	      DP_AUX_CH_CTL_SYNC_PULSE_SKL(32);
+	      DP_AUX_CH_CTL_FW_SYNC_PULSE_SKL(intel_dp_aux_fw_sync_len()) |
+	      DP_AUX_CH_CTL_SYNC_PULSE_SKL(intel_dp_aux_sync_len());
 
 	if (intel_tc_port_in_tbt_alt_mode(dig_port))
 		ret |= DP_AUX_CH_CTL_TBT_IO;
diff --git a/sys/dev/pci/drm/i915/gem/selftests/i915_gem_context.c b/sys/dev/pci/drm/i915/gem/selftests/i915_gem_context.c
index 6b8fff7fd..958d465c8 100644
--- a/sys/dev/pci/drm/i915/gem/selftests/i915_gem_context.c
+++ b/sys/dev/pci/drm/i915/gem/selftests/i915_gem_context.c
@@ -179,97 +179,108 @@ out_file:
 }
 
 struct parallel_switch {
-	struct task_struct *tsk;
+	struct kthread_worker *worker;
+	struct kthread_work work;
 	struct intel_context *ce[2];
+	int result;
 };
 
-static int __live_parallel_switch1(void *data)
+static void __live_parallel_switch1(struct kthread_work *work)
 {
-	struct parallel_switch *arg = data;
+	struct parallel_switch *arg =
+		container_of(work, typeof(*arg), work);
 	IGT_TIMEOUT(end_time);
 	unsigned long count;
 
 	count = 0;
+	arg->result = 0;
 	do {
 		struct i915_request *rq = NULL;
-		int err, n;
+		int n;
 
-		err = 0;
-		for (n = 0; !err && n < ARRAY_SIZE(arg->ce); n++) {
+		for (n = 0; !arg->result && n < ARRAY_SIZE(arg->ce); n++) {
 			struct i915_request *prev = rq;
 
 			rq = i915_request_create(arg->ce[n]);
 			if (IS_ERR(rq)) {
 				i915_request_put(prev);
-				return PTR_ERR(rq);
+				arg->result = PTR_ERR(rq);
+				break;
 			}
 
 			i915_request_get(rq);
 			if (prev) {
-				err = i915_request_await_dma_fence(rq, &prev->fence);
+				arg->result =
+					i915_request_await_dma_fence(rq,
+								     &prev->fence);
 				i915_request_put(prev);
 			}
 
 			i915_request_add(rq);
 		}
+
+		if (IS_ERR_OR_NULL(rq))
+			break;
+
 		if (i915_request_wait(rq, 0, HZ) < 0)
-			err = -ETIME;
+			arg->result = -ETIME;
+
 		i915_request_put(rq);
-		if (err)
-			return err;
 
 		count++;
-	} while (!__igt_timeout(end_time, NULL));
+	} while (!arg->result && !__igt_timeout(end_time, NULL));
 
-	pr_info("%s: %lu switches (sync)\n", arg->ce[0]->engine->name, count);
-	return 0;
+	pr_info("%s: %lu switches (sync) <%d>\n",
+		arg->ce[0]->engine->name, count, arg->result);
 }
 
-static int __live_parallel_switchN(void *data)
+static void __live_parallel_switchN(struct kthread_work *work)
 {
-	struct parallel_switch *arg = data;
+	struct parallel_switch *arg =
+		container_of(work, typeof(*arg), work);
 	struct i915_request *rq = NULL;
 	IGT_TIMEOUT(end_time);
 	unsigned long count;
 	int n;
 
 	count = 0;
+	arg->result = 0;
 	do {
-		for (n = 0; n < ARRAY_SIZE(arg->ce); n++) {
+		for (n = 0; !arg->result && n < ARRAY_SIZE(arg->ce); n++) {
 			struct i915_request *prev = rq;
-			int err = 0;
 
 			rq = i915_request_create(arg->ce[n]);
 			if (IS_ERR(rq)) {
 				i915_request_put(prev);
-				return PTR_ERR(rq);
+				arg->result = PTR_ERR(rq);
+				break;
 			}
 
 			i915_request_get(rq);
 			if (prev) {
-				err = i915_request_await_dma_fence(rq, &prev->fence);
+				arg->result =
+					i915_request_await_dma_fence(rq,
+								     &prev->fence);
 				i915_request_put(prev);
 			}
 
 			i915_request_add(rq);
-			if (err) {
-				i915_request_put(rq);
-				return err;
-			}
 		}
 
 		count++;
-	} while (!__igt_timeout(end_time, NULL));
-	i915_request_put(rq);
+	} while (!arg->result && !__igt_timeout(end_time, NULL));
 
-	pr_info("%s: %lu switches (many)\n", arg->ce[0]->engine->name, count);
-	return 0;
+	if (!IS_ERR_OR_NULL(rq))
+		i915_request_put(rq);
+
+	pr_info("%s: %lu switches (many) <%d>\n",
+		arg->ce[0]->engine->name, count, arg->result);
 }
 
 static int live_parallel_switch(void *arg)
 {
 	struct drm_i915_private *i915 = arg;
-	static int (* const func[])(void *arg) = {
+	static void (* const func[])(struct kthread_work *) = {
 		__live_parallel_switch1,
 		__live_parallel_switchN,
 		NULL,
@@ -277,7 +288,7 @@ static int live_parallel_switch(void *arg)
 	struct parallel_switch *data = NULL;
 	struct i915_gem_engines *engines;
 	struct i915_gem_engines_iter it;
-	int (* const *fn)(void *arg);
+	void (* const *fn)(struct kthread_work *);
 	struct i915_gem_context *ctx;
 	struct intel_context *ce;
 	struct file *file;
@@ -335,8 +346,10 @@ static int live_parallel_switch(void *arg)
 				continue;
 
 			ce = intel_context_create(data[m].ce[0]->engine);
-			if (IS_ERR(ce))
+			if (IS_ERR(ce)) {
+				err = PTR_ERR(ce);
 				goto out;
+			}
 
 			err = intel_context_pin(ce);
 			if (err) {
@@ -348,9 +361,24 @@ static int live_parallel_switch(void *arg)
 		}
 	}
 
+	for (n = 0; n < count; n++) {
+		struct kthread_worker *worker;
+
+		if (!data[n].ce[0])
+			continue;
+
+		worker = kthread_create_worker(0, "igt/parallel:%s",
+					       data[n].ce[0]->engine->name);
+		if (IS_ERR(worker)) {
+			err = PTR_ERR(worker);
+			goto out;
+		}
+
+		data[n].worker = worker;
+	}
+
 	for (fn = func; !err && *fn; fn++) {
 		struct igt_live_test t;
-		int n;
 
 		err = igt_live_test_begin(&t, i915, __func__, "");
 		if (err)
@@ -360,34 +388,23 @@ static int live_parallel_switch(void *arg)
 			if (!data[n].ce[0])
 				continue;
 
-			data[n].tsk = kthread_run(*fn, &data[n],
-						  "igt/parallel:%s",
-						  data[n].ce[0]->engine->name);
-			if (IS_ERR(data[n].tsk)) {
-				err = PTR_ERR(data[n].tsk);
-				break;
-			}
-			get_task_struct(data[n].tsk);
+			data[n].result = 0;
+			kthread_init_work(&data[n].work, *fn);
+			kthread_queue_work(data[n].worker, &data[n].work);
 		}
 
-		yield(); /* start all threads before we kthread_stop() */
-
 		for (n = 0; n < count; n++) {
-			int status;
-
-			if (IS_ERR_OR_NULL(data[n].tsk))
-				continue;
-
-			status = kthread_stop(data[n].tsk);
-			if (status && !err)
-				err = status;
-
-			put_task_struct(data[n].tsk);
-			data[n].tsk = NULL;
+			if (data[n].ce[0]) {
+				kthread_flush_work(&data[n].work);
+				if (data[n].result && !err)
+					err = data[n].result;
+			}
 		}
 
-		if (igt_live_test_end(&t))
-			err = -EIO;
+		if (igt_live_test_end(&t)) {
+			err = err ?: -EIO;
+			break;
+		}
 	}
 
 out:
@@ -399,6 +416,9 @@ out:
 			intel_context_unpin(data[n].ce[m]);
 			intel_context_put(data[n].ce[m]);
 		}
+
+		if (data[n].worker)
+			kthread_destroy_worker(data[n].worker);
 	}
 	kfree(data);
 out_file:
diff --git a/sys/dev/pci/drm/i915/gt/selftest_execlists.c b/sys/dev/pci/drm/i915/gt/selftest_execlists.c
index 1e08b2473..b370411d4 100644
--- a/sys/dev/pci/drm/i915/gt/selftest_execlists.c
+++ b/sys/dev/pci/drm/i915/gt/selftest_execlists.c
@@ -1532,8 +1532,8 @@ static int live_busywait_preempt(void *arg)
 	struct drm_i915_gem_object *obj;
 	struct i915_vma *vma;
 	enum intel_engine_id id;
-	int err = -ENOMEM;
 	u32 *map;
+	int err;
 
 	/*
 	 * Verify that even without HAS_LOGICAL_RING_PREEMPTION, we can
@@ -1541,13 +1541,17 @@ static int live_busywait_preempt(void *arg)
 	 */
 
 	ctx_hi = kernel_context(gt->i915, NULL);
-	if (!ctx_hi)
-		return -ENOMEM;
+	if (IS_ERR(ctx_hi))
+		return PTR_ERR(ctx_hi);
+
 	ctx_hi->sched.priority = I915_CONTEXT_MAX_USER_PRIORITY;
 
 	ctx_lo = kernel_context(gt->i915, NULL);
-	if (!ctx_lo)
+	if (IS_ERR(ctx_lo)) {
+		err = PTR_ERR(ctx_lo);
 		goto err_ctx_hi;
+	}
+
 	ctx_lo->sched.priority = I915_CONTEXT_MIN_USER_PRIORITY;
 
 	obj = i915_gem_object_create_internal(gt->i915, PAGE_SIZE);
@@ -3475,12 +3479,14 @@ static int random_priority(struct rnd_state *rnd)
 
 struct preempt_smoke {
 	struct intel_gt *gt;
+	struct kthread_work work;
 	struct i915_gem_context **contexts;
 	struct intel_engine_cs *engine;
 	struct drm_i915_gem_object *batch;
 	unsigned int ncontext;
 	struct rnd_state prng;
 	unsigned long count;
+	int result;
 };
 
 static struct i915_gem_context *smoke_context(struct preempt_smoke *smoke)
@@ -3540,34 +3546,31 @@ unpin:
 	return err;
 }
 
-static int smoke_crescendo_thread(void *arg)
+static void smoke_crescendo_work(struct kthread_work *work)
 {
-	struct preempt_smoke *smoke = arg;
+	struct preempt_smoke *smoke = container_of(work, typeof(*smoke), work);
 	IGT_TIMEOUT(end_time);
 	unsigned long count;
 
 	count = 0;
 	do {
 		struct i915_gem_context *ctx = smoke_context(smoke);
-		int err;
 
-		err = smoke_submit(smoke,
-				   ctx, count % I915_PRIORITY_MAX,
-				   smoke->batch);
-		if (err)
-			return err;
+		smoke->result = smoke_submit(smoke, ctx,
+					     count % I915_PRIORITY_MAX,
+					     smoke->batch);
 
 		count++;
-	} while (count < smoke->ncontext && !__igt_timeout(end_time, NULL));
+	} while (!smoke->result && count < smoke->ncontext &&
+		 !__igt_timeout(end_time, NULL));
 
 	smoke->count = count;
-	return 0;
 }
 
 static int smoke_crescendo(struct preempt_smoke *smoke, unsigned int flags)
 #define BATCH BIT(0)
 {
-	struct task_struct *tsk[I915_NUM_ENGINES] = {};
+	struct kthread_worker *worker[I915_NUM_ENGINES] = {};
 	struct preempt_smoke *arg;
 	struct intel_engine_cs *engine;
 	enum intel_engine_id id;
@@ -3578,6 +3581,8 @@ static int smoke_crescendo(struct preempt_smoke *smoke, unsigned int flags)
 	if (!arg)
 		return -ENOMEM;
 
+	memset(arg, 0, I915_NUM_ENGINES * sizeof(*arg));
+
 	for_each_engine(engine, smoke->gt, id) {
 		arg[id] = *smoke;
 		arg[id].engine = engine;
@@ -3585,31 +3590,28 @@ static int smoke_crescendo(struct preempt_smoke *smoke, unsigned int flags)
 			arg[id].batch = NULL;
 		arg[id].count = 0;
 
-		tsk[id] = kthread_run(smoke_crescendo_thread, arg,
-				      "igt/smoke:%d", id);
-		if (IS_ERR(tsk[id])) {
-			err = PTR_ERR(tsk[id]);
+		worker[id] = kthread_create_worker(0, "igt/smoke:%d", id);
+		if (IS_ERR(worker[id])) {
+			err = PTR_ERR(worker[id]);
 			break;
 		}
-		get_task_struct(tsk[id]);
-	}
 
-	yield(); /* start all threads before we kthread_stop() */
+		kthread_init_work(&arg[id].work, smoke_crescendo_work);
+		kthread_queue_work(worker[id], &arg[id].work);
+	}
 
 	count = 0;
 	for_each_engine(engine, smoke->gt, id) {
-		int status;
-
-		if (IS_ERR_OR_NULL(tsk[id]))
+		if (IS_ERR_OR_NULL(worker[id]))
 			continue;
 
-		status = kthread_stop(tsk[id]);
-		if (status && !err)
-			err = status;
+		kthread_flush_work(&arg[id].work);
+		if (arg[id].result && !err)
+			err = arg[id].result;
 
 		count += arg[id].count;
 
-		put_task_struct(tsk[id]);
+		kthread_destroy_worker(worker[id]);
 	}
 
 	pr_info("Submitted %lu crescendo:%x requests across %d engines and %d contexts\n",
diff --git a/sys/dev/pci/drm/i915/gt/selftest_hangcheck.c b/sys/dev/pci/drm/i915/gt/selftest_hangcheck.c
index 7f3bb1d34..71263058a 100644
--- a/sys/dev/pci/drm/i915/gt/selftest_hangcheck.c
+++ b/sys/dev/pci/drm/i915/gt/selftest_hangcheck.c
@@ -866,10 +866,13 @@ static int igt_reset_active_engine(void *arg)
 }
 
 struct active_engine {
-	struct task_struct *task;
+	struct kthread_worker *worker;
+	struct kthread_work work;
 	struct intel_engine_cs *engine;
 	unsigned long resets;
 	unsigned int flags;
+	bool stop;
+	int result;
 };
 
 #define TEST_ACTIVE	BIT(0)
@@ -900,10 +903,10 @@ static int active_request_put(struct i915_request *rq)
 	return err;
 }
 
-static int active_engine(void *data)
+static void active_engine(struct kthread_work *work)
 {
 	I915_RND_STATE(prng);
-	struct active_engine *arg = data;
+	struct active_engine *arg = container_of(work, typeof(*arg), work);
 	struct intel_engine_cs *engine = arg->engine;
 	struct i915_request *rq[8] = {};
 	struct intel_context *ce[ARRAY_SIZE(rq)];
@@ -913,16 +916,17 @@ static int active_engine(void *data)
 	for (count = 0; count < ARRAY_SIZE(ce); count++) {
 		ce[count] = intel_context_create(engine);
 		if (IS_ERR(ce[count])) {
-			err = PTR_ERR(ce[count]);
-			pr_err("[%s] Create context #%ld failed: %d!\n", engine->name, count, err);
+			arg->result = PTR_ERR(ce[count]);
+			pr_err("[%s] Create context #%ld failed: %d!\n",
+			       engine->name, count, arg->result);
 			while (--count)
 				intel_context_put(ce[count]);
-			return err;
+			return;
 		}
 	}
 
 	count = 0;
-	while (!kthread_should_stop()) {
+	while (!READ_ONCE(arg->stop)) {
 		unsigned int idx = count++ & (ARRAY_SIZE(rq) - 1);
 		struct i915_request *old = rq[idx];
 		struct i915_request *new;
@@ -967,7 +971,7 @@ static int active_engine(void *data)
 		intel_context_put(ce[count]);
 	}
 
-	return err;
+	arg->result = err;
 }
 
 static int __igt_reset_engines(struct intel_gt *gt,
@@ -1022,7 +1026,7 @@ static int __igt_reset_engines(struct intel_gt *gt,
 
 		memset(threads, 0, sizeof(*threads) * I915_NUM_ENGINES);
 		for_each_engine(other, gt, tmp) {
-			struct task_struct *tsk;
+			struct kthread_worker *worker;
 
 			threads[tmp].resets =
 				i915_reset_engine_count(global, other);
@@ -1036,19 +1040,21 @@ static int __igt_reset_engines(struct intel_gt *gt,
 			threads[tmp].engine = other;
 			threads[tmp].flags = flags;
 
-			tsk = kthread_run(active_engine, &threads[tmp],
-					  "igt/%s", other->name);
-			if (IS_ERR(tsk)) {
-				err = PTR_ERR(tsk);
-				pr_err("[%s] Thread spawn failed: %d!\n", engine->name, err);
+			worker = kthread_create_worker(0, "igt/%s",
+						       other->name);
+			if (IS_ERR(worker)) {
+				err = PTR_ERR(worker);
+				pr_err("[%s] Worker create failed: %d!\n",
+				       engine->name, err);
 				goto unwind;
 			}
 
-			threads[tmp].task = tsk;
-			get_task_struct(tsk);
-		}
+			threads[tmp].worker = worker;
 
-		yield(); /* start all threads before we begin */
+			kthread_init_work(&threads[tmp].work, active_engine);
+			kthread_queue_work(threads[tmp].worker,
+					   &threads[tmp].work);
+		}
 
 		st_engine_heartbeat_disable_no_pm(engine);
 		GEM_BUG_ON(test_and_set_bit(I915_RESET_ENGINE + id,
@@ -1197,17 +1203,20 @@ unwind:
 		for_each_engine(other, gt, tmp) {
 			int ret;
 
-			if (!threads[tmp].task)
+			if (!threads[tmp].worker)
 				continue;
 
-			ret = kthread_stop(threads[tmp].task);
+			WRITE_ONCE(threads[tmp].stop, true);
+			kthread_flush_work(&threads[tmp].work);
+			ret = READ_ONCE(threads[tmp].result);
 			if (ret) {
 				pr_err("kthread for other engine %s failed, err=%d\n",
 				       other->name, ret);
 				if (!err)
 					err = ret;
 			}
-			put_task_struct(threads[tmp].task);
+
+			kthread_destroy_worker(threads[tmp].worker);
 
 			/* GuC based resets are not logged per engine */
 			if (!using_guc) {
diff --git a/sys/dev/pci/drm/i915/selftests/i915_request.c b/sys/dev/pci/drm/i915/selftests/i915_request.c
index bc2622803..3257d41fe 100644
--- a/sys/dev/pci/drm/i915/selftests/i915_request.c
+++ b/sys/dev/pci/drm/i915/selftests/i915_request.c
@@ -299,9 +299,18 @@ __live_request_alloc(struct intel_context *ce)
 	return intel_context_create_request(ce);
 }
 
-static int __igt_breadcrumbs_smoketest(void *arg)
+struct smoke_thread {
+	struct kthread_worker *worker;
+	struct kthread_work work;
+	struct smoketest *t;
+	bool stop;
+	int result;
+};
+
+static void __igt_breadcrumbs_smoketest(struct kthread_work *work)
 {
-	struct smoketest *t = arg;
+	struct smoke_thread *thread = container_of(work, typeof(*thread), work);
+	struct smoketest *t = thread->t;
 	const unsigned int max_batch = min(t->ncontexts, t->max_batch) - 1;
 	const unsigned int total = 4 * t->ncontexts + 1;
 	unsigned int num_waits = 0, num_fences = 0;
@@ -320,8 +329,10 @@ static int __igt_breadcrumbs_smoketest(void *arg)
 	 */
 
 	requests = kcalloc(total, sizeof(*requests), GFP_KERNEL);
-	if (!requests)
-		return -ENOMEM;
+	if (!requests) {
+		thread->result = -ENOMEM;
+		return;
+	}
 
 	order = i915_random_order(total, &prng);
 	if (!order) {
@@ -329,7 +340,7 @@ static int __igt_breadcrumbs_smoketest(void *arg)
 		goto out_requests;
 	}
 
-	while (!kthread_should_stop()) {
+	while (!READ_ONCE(thread->stop)) {
 		struct i915_sw_fence *submit, *wait;
 		unsigned int n, count;
 
@@ -437,7 +448,7 @@ static int __igt_breadcrumbs_smoketest(void *arg)
 	kfree(order);
 out_requests:
 	kfree(requests);
-	return err;
+	thread->result = err;
 }
 
 static int mock_breadcrumbs_smoketest(void *arg)
@@ -450,7 +461,7 @@ static int mock_breadcrumbs_smoketest(void *arg)
 		.request_alloc = __mock_request_alloc
 	};
 	unsigned int ncpus = num_online_cpus();
-	struct task_struct **threads;
+	struct smoke_thread *threads;
 	unsigned int n;
 	int ret = 0;
 
@@ -479,28 +490,37 @@ static int mock_breadcrumbs_smoketest(void *arg)
 	}
 
 	for (n = 0; n < ncpus; n++) {
-		threads[n] = kthread_run(__igt_breadcrumbs_smoketest,
-					 &t, "igt/%d", n);
-		if (IS_ERR(threads[n])) {
-			ret = PTR_ERR(threads[n]);
+		struct kthread_worker *worker;
+
+		worker = kthread_create_worker(0, "igt/%d", n);
+		if (IS_ERR(worker)) {
+			ret = PTR_ERR(worker);
 			ncpus = n;
 			break;
 		}
 
-		get_task_struct(threads[n]);
+		threads[n].worker = worker;
+		threads[n].t = &t;
+		threads[n].stop = false;
+		threads[n].result = 0;
+
+		kthread_init_work(&threads[n].work,
+				  __igt_breadcrumbs_smoketest);
+		kthread_queue_work(worker, &threads[n].work);
 	}
 
-	yield(); /* start all threads before we begin */
 	drm_msleep(jiffies_to_msecs(i915_selftest.timeout_jiffies));
 
 	for (n = 0; n < ncpus; n++) {
 		int err;
 
-		err = kthread_stop(threads[n]);
+		WRITE_ONCE(threads[n].stop, true);
+		kthread_flush_work(&threads[n].work);
+		err = READ_ONCE(threads[n].result);
 		if (err < 0 && !ret)
 			ret = err;
 
-		put_task_struct(threads[n]);
+		kthread_destroy_worker(threads[n].worker);
 	}
 	pr_info("Completed %lu waits for %lu fence across %d cpus\n",
 		atomic_long_read(&t.num_waits),
@@ -1419,9 +1439,18 @@ out_free:
 	return err;
 }
 
-static int __live_parallel_engine1(void *arg)
+struct parallel_thread {
+	struct kthread_worker *worker;
+	struct kthread_work work;
+	struct intel_engine_cs *engine;
+	int result;
+};
+
+static void __live_parallel_engine1(struct kthread_work *work)
 {
-	struct intel_engine_cs *engine = arg;
+	struct parallel_thread *thread =
+		container_of(work, typeof(*thread), work);
+	struct intel_engine_cs *engine = thread->engine;
 	IGT_TIMEOUT(end_time);
 	unsigned long count;
 	int err = 0;
@@ -1452,12 +1481,14 @@ static int __live_parallel_engine1(void *arg)
 	intel_engine_pm_put(engine);
 
 	pr_info("%s: %lu request + sync\n", engine->name, count);
-	return err;
+	thread->result = err;
 }
 
-static int __live_parallel_engineN(void *arg)
+static void __live_parallel_engineN(struct kthread_work *work)
 {
-	struct intel_engine_cs *engine = arg;
+	struct parallel_thread *thread =
+		container_of(work, typeof(*thread), work);
+	struct intel_engine_cs *engine = thread->engine;
 	IGT_TIMEOUT(end_time);
 	unsigned long count;
 	int err = 0;
@@ -1479,7 +1510,7 @@ static int __live_parallel_engineN(void *arg)
 	intel_engine_pm_put(engine);
 
 	pr_info("%s: %lu requests\n", engine->name, count);
-	return err;
+	thread->result = err;
 }
 
 static bool wake_all(struct drm_i915_private *i915)
@@ -1505,9 +1536,11 @@ static int wait_for_all(struct drm_i915_private *i915)
 	return -ETIME;
 }
 
-static int __live_parallel_spin(void *arg)
+static void __live_parallel_spin(struct kthread_work *work)
 {
-	struct intel_engine_cs *engine = arg;
+	struct parallel_thread *thread =
+		container_of(work, typeof(*thread), work);
+	struct intel_engine_cs *engine = thread->engine;
 	struct igt_spinner spin;
 	struct i915_request *rq;
 	int err = 0;
@@ -1520,7 +1553,8 @@ static int __live_parallel_spin(void *arg)
 
 	if (igt_spinner_init(&spin, engine->gt)) {
 		wake_all(engine->i915);
-		return -ENOMEM;
+		thread->result = -ENOMEM;
+		return;
 	}
 
 	intel_engine_pm_get(engine);
@@ -1553,22 +1587,22 @@ static int __live_parallel_spin(void *arg)
 
 out_spin:
 	igt_spinner_fini(&spin);
-	return err;
+	thread->result = err;
 }
 
 static int live_parallel_engines(void *arg)
 {
 	struct drm_i915_private *i915 = arg;
-	static int (* const func[])(void *arg) = {
+	static void (* const func[])(struct kthread_work *) = {
 		__live_parallel_engine1,
 		__live_parallel_engineN,
 		__live_parallel_spin,
 		NULL,
 	};
 	const unsigned int nengines = num_uabi_engines(i915);
+	struct parallel_thread *threads;
 	struct intel_engine_cs *engine;
-	int (* const *fn)(void *arg);
-	struct task_struct **tsk;
+	void (* const *fn)(struct kthread_work *);
 	int err = 0;
 
 	/*
@@ -1576,8 +1610,8 @@ static int live_parallel_engines(void *arg)
 	 * tests that we load up the system maximally.
 	 */
 
-	tsk = kcalloc(nengines, sizeof(*tsk), GFP_KERNEL);
-	if (!tsk)
+	threads = kcalloc(nengines, sizeof(*threads), GFP_KERNEL);
+	if (!threads)
 		return -ENOMEM;
 
 	for (fn = func; !err && *fn; fn++) {
@@ -1594,37 +1628,44 @@ static int live_parallel_engines(void *arg)
 
 		idx = 0;
 		for_each_uabi_engine(engine, i915) {
-			tsk[idx] = kthread_run(*fn, engine,
-					       "igt/parallel:%s",
-					       engine->name);
-			if (IS_ERR(tsk[idx])) {
-				err = PTR_ERR(tsk[idx]);
+			struct kthread_worker *worker;
+
+			worker = kthread_create_worker(0, "igt/parallel:%s",
+						       engine->name);
+			if (IS_ERR(worker)) {
+				err = PTR_ERR(worker);
 				break;
 			}
-			get_task_struct(tsk[idx++]);
-		}
 
-		yield(); /* start all threads before we kthread_stop() */
+			threads[idx].worker = worker;
+			threads[idx].result = 0;
+			threads[idx].engine = engine;
+
+			kthread_init_work(&threads[idx].work, *fn);
+			kthread_queue_work(worker, &threads[idx].work);
+			idx++;
+		}
 
 		idx = 0;
 		for_each_uabi_engine(engine, i915) {
 			int status;
 
-			if (IS_ERR(tsk[idx]))
+			if (!threads[idx].worker)
 				break;
 
-			status = kthread_stop(tsk[idx]);
+			kthread_flush_work(&threads[idx].work);
+			status = READ_ONCE(threads[idx].result);
 			if (status && !err)
 				err = status;
 
-			put_task_struct(tsk[idx++]);
+			kthread_destroy_worker(threads[idx++].worker);
 		}
 
 		if (igt_live_test_end(&t))
 			err = -EIO;
 	}
 
-	kfree(tsk);
+	kfree(threads);
 	return err;
 }
 
@@ -1672,7 +1713,7 @@ static int live_breadcrumbs_smoketest(void *arg)
 	const unsigned int ncpus = num_online_cpus();
 	unsigned long num_waits, num_fences;
 	struct intel_engine_cs *engine;
-	struct task_struct **threads;
+	struct smoke_thread *threads;
 	struct igt_live_test live;
 	intel_wakeref_t wakeref;
 	struct smoketest *smoke;
@@ -1746,23 +1787,26 @@ static int live_breadcrumbs_smoketest(void *arg)
 			 smoke[idx].max_batch, engine->name);
 
 		for (n = 0; n < ncpus; n++) {
-			struct task_struct *tsk;
+			unsigned int i = idx * ncpus + n;
+			struct kthread_worker *worker;
 
-			tsk = kthread_run(__igt_breadcrumbs_smoketest,
-					  &smoke[idx], "igt/%d.%d", idx, n);
-			if (IS_ERR(tsk)) {
-				ret = PTR_ERR(tsk);
+			worker = kthread_create_worker(0, "igt/%d.%d", idx, n);
+			if (IS_ERR(worker)) {
+				ret = PTR_ERR(worker);
 				goto out_flush;
 			}
 
-			get_task_struct(tsk);
-			threads[idx * ncpus + n] = tsk;
+			threads[i].worker = worker;
+			threads[i].t = &smoke[idx];
+
+			kthread_init_work(&threads[i].work,
+					  __igt_breadcrumbs_smoketest);
+			kthread_queue_work(worker, &threads[i].work);
 		}
 
 		idx++;
 	}
 
-	yield(); /* start all threads before we begin */
 	drm_msleep(jiffies_to_msecs(i915_selftest.timeout_jiffies));
 
 out_flush:
@@ -1771,17 +1815,19 @@ out_flush:
 	num_fences = 0;
 	for_each_uabi_engine(engine, i915) {
 		for (n = 0; n < ncpus; n++) {
-			struct task_struct *tsk = threads[idx * ncpus + n];
+			unsigned int i = idx * ncpus + n;
 			int err;
 
-			if (!tsk)
+			if (!threads[i].worker)
 				continue;
 
-			err = kthread_stop(tsk);
+			WRITE_ONCE(threads[i].stop, true);
+			kthread_flush_work(&threads[i].work);
+			err = READ_ONCE(threads[i].result);
 			if (err < 0 && !ret)
 				ret = err;
 
-			put_task_struct(tsk);
+			kthread_destroy_worker(threads[i].worker);
 		}
 
 		num_waits += atomic_long_read(&smoke[idx].num_waits);
@@ -2891,9 +2937,18 @@ out:
 	return err;
 }
 
-static int p_sync0(void *arg)
+struct p_thread {
+	struct perf_stats p;
+	struct kthread_worker *worker;
+	struct kthread_work work;
+	struct intel_engine_cs *engine;
+	int result;
+};
+
+static void p_sync0(struct kthread_work *work)
 {
-	struct perf_stats *p = arg;
+	struct p_thread *thread = container_of(work, typeof(*thread), work);
+	struct perf_stats *p = &thread->p;
 	struct intel_engine_cs *engine = p->engine;
 	struct intel_context *ce;
 	IGT_TIMEOUT(end_time);
@@ -2902,13 +2957,16 @@ static int p_sync0(void *arg)
 	int err = 0;
 
 	ce = intel_context_create(engine);
-	if (IS_ERR(ce))
-		return PTR_ERR(ce);
+	if (IS_ERR(ce)) {
+		thread->result = PTR_ERR(ce);
+		return;
+	}
 
 	err = intel_context_pin(ce);
 	if (err) {
 		intel_context_put(ce);
-		return err;
+		thread->result = err;
+		return;
 	}
 
 	if (intel_engine_supports_stats(engine)) {
@@ -2958,12 +3016,13 @@ static int p_sync0(void *arg)
 
 	intel_context_unpin(ce);
 	intel_context_put(ce);
-	return err;
+	thread->result = err;
 }
 
-static int p_sync1(void *arg)
+static void p_sync1(struct kthread_work *work)
 {
-	struct perf_stats *p = arg;
+	struct p_thread *thread = container_of(work, typeof(*thread), work);
+	struct perf_stats *p = &thread->p;
 	struct intel_engine_cs *engine = p->engine;
 	struct i915_request *prev = NULL;
 	struct intel_context *ce;
@@ -2973,13 +3032,16 @@ static int p_sync1(void *arg)
 	int err = 0;
 
 	ce = intel_context_create(engine);
-	if (IS_ERR(ce))
-		return PTR_ERR(ce);
+	if (IS_ERR(ce)) {
+		thread->result = PTR_ERR(ce);
+		return;
+	}
 
 	err = intel_context_pin(ce);
 	if (err) {
 		intel_context_put(ce);
-		return err;
+		thread->result = err;
+		return;
 	}
 
 	if (intel_engine_supports_stats(engine)) {
@@ -3031,12 +3093,13 @@ static int p_sync1(void *arg)
 
 	intel_context_unpin(ce);
 	intel_context_put(ce);
-	return err;
+	thread->result = err;
 }
 
-static int p_many(void *arg)
+static void p_many(struct kthread_work *work)
 {
-	struct perf_stats *p = arg;
+	struct p_thread *thread = container_of(work, typeof(*thread), work);
+	struct perf_stats *p = &thread->p;
 	struct intel_engine_cs *engine = p->engine;
 	struct intel_context *ce;
 	IGT_TIMEOUT(end_time);
@@ -3045,13 +3108,16 @@ static int p_many(void *arg)
 	bool busy;
 
 	ce = intel_context_create(engine);
-	if (IS_ERR(ce))
-		return PTR_ERR(ce);
+	if (IS_ERR(ce)) {
+		thread->result = PTR_ERR(ce);
+		return;
+	}
 
 	err = intel_context_pin(ce);
 	if (err) {
 		intel_context_put(ce);
-		return err;
+		thread->result = err;
+		return;
 	}
 
 	if (intel_engine_supports_stats(engine)) {
@@ -3092,26 +3158,23 @@ static int p_many(void *arg)
 
 	intel_context_unpin(ce);
 	intel_context_put(ce);
-	return err;
+	thread->result = err;
 }
 
 static int perf_parallel_engines(void *arg)
 {
 	struct drm_i915_private *i915 = arg;
-	static int (* const func[])(void *arg) = {
+	static void (* const func[])(struct kthread_work *) = {
 		p_sync0,
 		p_sync1,
 		p_many,
 		NULL,
 	};
 	const unsigned int nengines = num_uabi_engines(i915);
+	void (* const *fn)(struct kthread_work *);
 	struct intel_engine_cs *engine;
-	int (* const *fn)(void *arg);
 	struct pm_qos_request qos;
-	struct {
-		struct perf_stats p;
-		struct task_struct *tsk;
-	} *engines;
+	struct p_thread *engines;
 	int err = 0;
 
 	engines = kcalloc(nengines, sizeof(*engines), GFP_KERNEL);
@@ -3134,36 +3197,45 @@ static int perf_parallel_engines(void *arg)
 
 		idx = 0;
 		for_each_uabi_engine(engine, i915) {
+			struct kthread_worker *worker;
+
 			intel_engine_pm_get(engine);
 
 			memset(&engines[idx].p, 0, sizeof(engines[idx].p));
-			engines[idx].p.engine = engine;
 
-			engines[idx].tsk = kthread_run(*fn, &engines[idx].p,
-						       "igt:%s", engine->name);
-			if (IS_ERR(engines[idx].tsk)) {
-				err = PTR_ERR(engines[idx].tsk);
+			worker = kthread_create_worker(0, "igt:%s",
+						       engine->name);
+			if (IS_ERR(worker)) {
+				err = PTR_ERR(worker);
 				intel_engine_pm_put(engine);
 				break;
 			}
-			get_task_struct(engines[idx++].tsk);
-		}
+			engines[idx].worker = worker;
+			engines[idx].result = 0;
+			engines[idx].p.engine = engine;
+			engines[idx].engine = engine;
 
-		yield(); /* start all threads before we kthread_stop() */
+			kthread_init_work(&engines[idx].work, *fn);
+			kthread_queue_work(worker, &engines[idx].work);
+			idx++;
+		}
 
 		idx = 0;
 		for_each_uabi_engine(engine, i915) {
 			int status;
 
-			if (IS_ERR(engines[idx].tsk))
+			if (!engines[idx].worker)
 				break;
 
-			status = kthread_stop(engines[idx].tsk);
+			kthread_flush_work(&engines[idx].work);
+			status = READ_ONCE(engines[idx].result);
 			if (status && !err)
 				err = status;
 
 			intel_engine_pm_put(engine);
-			put_task_struct(engines[idx++].tsk);
+
+			kthread_destroy_worker(engines[idx].worker);
+			idx++;
 		}
 
 		if (igt_live_test_end(&t))
diff --git a/sys/kern/sched_bsd.c b/sys/kern/sched_bsd.c
index 94d0950b5..3a82cca9b 100644
--- a/sys/kern/sched_bsd.c
+++ b/sys/kern/sched_bsd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sched_bsd.c,v 1.74 2023/02/04 19:33:03 cheloha Exp $	*/
+/*	$OpenBSD: sched_bsd.c,v 1.75 2023/06/20 16:30:30 cheloha Exp $	*/
 /*	$NetBSD: kern_synch.c,v 1.37 1996/04/22 01:38:37 christos Exp $	*/
 
 /*-
@@ -234,7 +234,6 @@ schedcpu(void *arg)
 		}
 		SCHED_UNLOCK(s);
 	}
-	uvm_meter();
 	wakeup(&lbolt);
 	timeout_add_sec(to, 1);
 }
@@ -669,6 +668,7 @@ scheduler_start(void)
 
 	rrticks_init = hz / 10;
 	schedcpu(&schedcpu_to);
+	uvm_meter(NULL);
 
 #ifndef SMALL_KERNEL
 	if (perfpolicy == PERFPOL_AUTO)
diff --git a/sys/lib/libkern/arch/arm/bcopy.S b/sys/lib/libkern/arch/arm/bcopy.S
index aa2279937..57d03734d 100644
--- a/sys/lib/libkern/arch/arm/bcopy.S
+++ b/sys/lib/libkern/arch/arm/bcopy.S
@@ -36,7 +36,7 @@
 
 ENTRY(bcopy)
 	/* switch the source and destination registers */
-	eor     r0, r1, r0 
-	eor     r1, r0, r1 
-	eor     r0, r1, r0 
+	eor     r0, r1, r0
+	eor     r1, r0, r1
+	eor     r0, r1, r0
 	b	PIC_SYM(memmove, PLT)
diff --git a/sys/lib/libkern/arch/arm/divsi3.S b/sys/lib/libkern/arch/arm/divsi3.S
index f655cc8a8..b7c1eb1b6 100644
--- a/sys/lib/libkern/arch/arm/divsi3.S
+++ b/sys/lib/libkern/arch/arm/divsi3.S
@@ -17,7 +17,7 @@
 
 #include <machine/asm.h>
 
-/* 
+/*
  * stack is aligned as there's a possibility of branching to L_overflow
  * which makes a C call
  */
@@ -51,9 +51,9 @@ L_overflow:
 
 ENTRY(__udivsi3)
 L_udivide:				/* r0 = r0 / r1; r1 = r0 % r1 */
-	eor     r0, r1, r0 
-	eor     r1, r0, r1 
-	eor     r0, r1, r0 
+	eor     r0, r1, r0
+	eor     r1, r0, r1
+	eor     r0, r1, r0
 					/* r0 = r1 / r0; r1 = r1 % r0 */
 	cmp	r0, #1
 	bcc	L_overflow
@@ -73,9 +73,9 @@ L_divide_l0:				/* r0 == 1 */
 
 ENTRY(__divsi3)
 L_divide:				/* r0 = r0 / r1; r1 = r0 % r1 */
-	eor     r0, r1, r0 
-	eor     r1, r0, r1 
-	eor     r0, r1, r0 
+	eor     r0, r1, r0
+	eor     r1, r0, r1
+	eor     r0, r1, r0
 					/* r0 = r1 / r0; r1 = r1 % r0 */
 	cmp	r0, #1
 	bcc	L_overflow
@@ -94,7 +94,7 @@ L_divide_l1:
 
 	/*
 	 * If the highest bit of the dividend is set, we have to be
-	 * careful when shifting the divisor. Test this. 
+	 * careful when shifting the divisor. Test this.
 	 */
 	movs	r1,r1
 	bpl	L_old_code
diff --git a/sys/lib/libkern/arch/arm/htons.S b/sys/lib/libkern/arch/arm/htons.S
index 0593286c5..5323197f8 100644
--- a/sys/lib/libkern/arch/arm/htons.S
+++ b/sys/lib/libkern/arch/arm/htons.S
@@ -39,4 +39,4 @@ _PROF_PROLOGUE
 	and		r1, r0, #0xff
 	mov		r0, r0, lsr #8
 	orr		r0, r0, r1, lsl #8
-	mov		pc, lr  
+	mov		pc, lr
diff --git a/sys/lib/libkern/arch/arm/memcpy.S b/sys/lib/libkern/arch/arm/memcpy.S
index fade0f032..a1ab0b64d 100644
--- a/sys/lib/libkern/arch/arm/memcpy.S
+++ b/sys/lib/libkern/arch/arm/memcpy.S
@@ -77,7 +77,7 @@ ENTRY_NP(memmove)
 
 	bcc	Lmemcpy_backwards
 
-	/* start of forwards copy */	
+	/* start of forwards copy */
 	subs	r2, r2, #4
 	blt	Lmemcpy_fl4		/* less than 4 bytes */
 	ands	r12, r0, #3
@@ -89,28 +89,28 @@ Lmemcpy_ft8:
 	/* We have aligned source and destination */
 	subs	r2, r2, #8
 	blt	Lmemcpy_fl12		/* less than 12 bytes (4 from above) */
-	subs	r2, r2, #0x14         
+	subs	r2, r2, #0x14
 	blt	Lmemcpy_fl32		/* less than 32 bytes (12 from above) */
 	stmdb	sp!, {r4}		/* borrow r4 */
 
 	/* blat 32 bytes at a time */
 	/* XXX for really big copies perhaps we should use more registers */
-Lmemcpy_floop32:	
+Lmemcpy_floop32:
 	ldmia	r1!, {r3, r4, r12, lr}
 	stmia	r0!, {r3, r4, r12, lr}
 	ldmia	r1!, {r3, r4, r12, lr}
 	stmia	r0!, {r3, r4, r12, lr}
-	subs	r2, r2, #0x20         
+	subs	r2, r2, #0x20
 	bge	Lmemcpy_floop32
 
 	cmn	r2, #0x10
 	ldmiage	r1!, {r3, r4, r12, lr}	/* blat a remaining 16 bytes */
 	stmiage	r0!, {r3, r4, r12, lr}
-	subge	r2, r2, #0x10         
+	subge	r2, r2, #0x10
 	ldmia	sp!, {r4}		/* return r4 */
 
 Lmemcpy_fl32:
-	adds	r2, r2, #0x14         
+	adds	r2, r2, #0x14
 
 	/* blat 12 bytes at a time */
 Lmemcpy_floop12:
@@ -174,9 +174,9 @@ Lmemcpy_fsrcul:
 	cmp	r12, #2
 	bgt	Lmemcpy_fsrcul3
 	beq	Lmemcpy_fsrcul2
-	cmp	r2, #0x0c            
+	cmp	r2, #0x0c
 	blt	Lmemcpy_fsrcul1loop4
-	sub	r2, r2, #0x0c         
+	sub	r2, r2, #0x0c
 	stmdb	sp!, {r4, r5}
 
 Lmemcpy_fsrcul1loop16:
@@ -190,10 +190,10 @@ Lmemcpy_fsrcul1loop16:
 	mov	r12, r12, lsr #8
 	orr	r12, r12, lr, lsl #24
 	stmia	r0!, {r3-r5, r12}
-	subs	r2, r2, #0x10         
+	subs	r2, r2, #0x10
 	bge	Lmemcpy_fsrcul1loop16
 	ldmia	sp!, {r4, r5}
-	adds	r2, r2, #0x0c         
+	adds	r2, r2, #0x0c
 	blt	Lmemcpy_fsrcul1l4
 
 Lmemcpy_fsrcul1loop4:
@@ -209,9 +209,9 @@ Lmemcpy_fsrcul1l4:
 	b	Lmemcpy_fl4
 
 Lmemcpy_fsrcul2:
-	cmp	r2, #0x0c            
+	cmp	r2, #0x0c
 	blt	Lmemcpy_fsrcul2loop4
-	sub	r2, r2, #0x0c         
+	sub	r2, r2, #0x0c
 	stmdb	sp!, {r4, r5}
 
 Lmemcpy_fsrcul2loop16:
@@ -225,10 +225,10 @@ Lmemcpy_fsrcul2loop16:
 	mov	r12, r12, lsr #16
 	orr	r12, r12, lr, lsl #16
 	stmia	r0!, {r3-r5, r12}
-	subs	r2, r2, #0x10         
+	subs	r2, r2, #0x10
 	bge	Lmemcpy_fsrcul2loop16
 	ldmia	sp!, {r4, r5}
-	adds	r2, r2, #0x0c         
+	adds	r2, r2, #0x0c
 	blt	Lmemcpy_fsrcul2l4
 
 Lmemcpy_fsrcul2loop4:
@@ -244,9 +244,9 @@ Lmemcpy_fsrcul2l4:
 	b	Lmemcpy_fl4
 
 Lmemcpy_fsrcul3:
-	cmp	r2, #0x0c            
+	cmp	r2, #0x0c
 	blt	Lmemcpy_fsrcul3loop4
-	sub	r2, r2, #0x0c         
+	sub	r2, r2, #0x0c
 	stmdb	sp!, {r4, r5}
 
 Lmemcpy_fsrcul3loop16:
@@ -260,10 +260,10 @@ Lmemcpy_fsrcul3loop16:
 	mov	r12, r12, lsr #24
 	orr	r12, r12, lr, lsl #8
 	stmia	r0!, {r3-r5, r12}
-	subs	r2, r2, #0x10         
+	subs	r2, r2, #0x10
 	bge	Lmemcpy_fsrcul3loop16
 	ldmia	sp!, {r4, r5}
-	adds	r2, r2, #0x0c         
+	adds	r2, r2, #0x0c
 	blt	Lmemcpy_fsrcul3l4
 
 Lmemcpy_fsrcul3loop4:
@@ -303,18 +303,18 @@ Lmemcpy_bloop32:
 	stmdb	r0!, {r3, r4, r12, lr}
 	ldmdb	r1!, {r3, r4, r12, lr}
 	stmdb	r0!, {r3, r4, r12, lr}
-	subs	r2, r2, #0x20         
+	subs	r2, r2, #0x20
 	bge	Lmemcpy_bloop32
 
 Lmemcpy_bl32:
-	cmn	r2, #0x10            
+	cmn	r2, #0x10
 	ldmdbge	r1!, {r3, r4, r12, lr}	/* blat a remaining 16 bytes */
 	stmdbge	r0!, {r3, r4, r12, lr}
-	subge	r2, r2, #0x10         
-	adds	r2, r2, #0x14         
+	subge	r2, r2, #0x10
+	adds	r2, r2, #0x14
 	ldmdbge	r1!, {r3, r12, lr}	/* blat a remaining 12 bytes */
 	stmdbge	r0!, {r3, r12, lr}
-	subge	r2, r2, #0x0c         
+	subge	r2, r2, #0x0c
 	ldmia	sp!, {r4}
 
 Lmemcpy_bl12:
@@ -366,9 +366,9 @@ Lmemcpy_bsrcul:
 	cmp	r12, #2
 	blt	Lmemcpy_bsrcul1
 	beq	Lmemcpy_bsrcul2
-	cmp	r2, #0x0c            
+	cmp	r2, #0x0c
 	blt	Lmemcpy_bsrcul3loop4
-	sub	r2, r2, #0x0c         
+	sub	r2, r2, #0x0c
 	stmdb	sp!, {r4, r5}
 
 Lmemcpy_bsrcul3loop16:
@@ -382,10 +382,10 @@ Lmemcpy_bsrcul3loop16:
 	mov	r4, r4, lsl #8
 	orr	r4, r4, r3, lsr #24
 	stmdb	r0!, {r4, r5, r12, lr}
-	subs	r2, r2, #0x10         
+	subs	r2, r2, #0x10
 	bge	Lmemcpy_bsrcul3loop16
 	ldmia	sp!, {r4, r5}
-	adds	r2, r2, #0x0c         
+	adds	r2, r2, #0x0c
 	blt	Lmemcpy_bsrcul3l4
 
 Lmemcpy_bsrcul3loop4:
@@ -401,9 +401,9 @@ Lmemcpy_bsrcul3l4:
 	b	Lmemcpy_bl4
 
 Lmemcpy_bsrcul2:
-	cmp	r2, #0x0c            
+	cmp	r2, #0x0c
 	blt	Lmemcpy_bsrcul2loop4
-	sub	r2, r2, #0x0c         
+	sub	r2, r2, #0x0c
 	stmdb	sp!, {r4, r5}
 
 Lmemcpy_bsrcul2loop16:
@@ -417,10 +417,10 @@ Lmemcpy_bsrcul2loop16:
 	mov	r4, r4, lsl #16
 	orr	r4, r4, r3, lsr #16
 	stmdb	r0!, {r4, r5, r12, lr}
-	subs	r2, r2, #0x10         
+	subs	r2, r2, #0x10
 	bge	Lmemcpy_bsrcul2loop16
 	ldmia	sp!, {r4, r5}
-	adds	r2, r2, #0x0c         
+	adds	r2, r2, #0x0c
 	blt	Lmemcpy_bsrcul2l4
 
 Lmemcpy_bsrcul2loop4:
@@ -436,9 +436,9 @@ Lmemcpy_bsrcul2l4:
 	b	Lmemcpy_bl4
 
 Lmemcpy_bsrcul1:
-	cmp	r2, #0x0c            
+	cmp	r2, #0x0c
 	blt	Lmemcpy_bsrcul1loop4
-	sub	r2, r2, #0x0c         
+	sub	r2, r2, #0x0c
 	stmdb	sp!, {r4, r5}
 
 Lmemcpy_bsrcul1loop32:
@@ -452,10 +452,10 @@ Lmemcpy_bsrcul1loop32:
 	mov	r4, r4, lsl #24
 	orr	r4, r4, r3, lsr #8
 	stmdb	r0!, {r4, r5, r12, lr}
-	subs	r2, r2, #0x10         
+	subs	r2, r2, #0x10
 	bge	Lmemcpy_bsrcul1loop32
 	ldmia	sp!, {r4, r5}
-	adds	r2, r2, #0x0c         
+	adds	r2, r2, #0x0c
 	blt	Lmemcpy_bsrcul1l4
 
 Lmemcpy_bsrcul1loop4:
@@ -469,4 +469,4 @@ Lmemcpy_bsrcul1loop4:
 Lmemcpy_bsrcul1l4:
 	add	r1, r1, #1
 	b	Lmemcpy_bl4
-	
+
diff --git a/sys/lib/libkern/arch/arm64/ffs.S b/sys/lib/libkern/arch/arm64/ffs.S
index 03101cb2c..c8ac028e1 100644
--- a/sys/lib/libkern/arch/arm64/ffs.S
+++ b/sys/lib/libkern/arch/arm64/ffs.S
@@ -3,7 +3,7 @@
  * Written by Christian Weisgerber <naddy@openbsd.org>.
  * Public domain.
  */
- 
+
 #include <machine/asm.h>
 
 ENTRY(ffs)
diff --git a/sys/lib/libkern/memset.c b/sys/lib/libkern/memset.c
index 7388f41e9..cc4228f76 100644
--- a/sys/lib/libkern/memset.c
+++ b/sys/lib/libkern/memset.c
@@ -80,7 +80,7 @@ memset(void *dst0, int c0, size_t length)
 	 *
 	 * but we use a minimum of 3 here since the overhead of the code
 	 * to do word writes is substantial.
-	 */ 
+	 */
 	if (length < 3 * wsize) {
 		while (length != 0) {
 			*dst++ = VAL;
diff --git a/sys/lib/libkern/muldi3.c b/sys/lib/libkern/muldi3.c
index d9d64e3a4..b7738e077 100644
--- a/sys/lib/libkern/muldi3.c
+++ b/sys/lib/libkern/muldi3.c
@@ -41,7 +41,7 @@
  *
  *	u = 2^n u1  *  u0	(n = number of bits in `u_int', usu. 32)
  *
- * and 
+ * and
  *
  *	v = 2^n v1  *  v0
  *
diff --git a/sys/lib/libkern/qdivrem.c b/sys/lib/libkern/qdivrem.c
index 1cf2e8f62..f28b39758 100644
--- a/sys/lib/libkern/qdivrem.c
+++ b/sys/lib/libkern/qdivrem.c
@@ -176,7 +176,7 @@ __qdivrem(u_quad_t uq, u_quad_t vq, u_quad_t *arq)
 	v2 = v[2];	/* for D3 */
 	do {
 		digit uj0, uj1, uj2;
-		
+
 		/*
 		 * D3: Calculate qhat (\^q, in TeX notation).
 		 * Let qhat = min((u[j]*B + u[j+1])/v[1], B-1), and
diff --git a/sys/lib/libkern/strncasecmp.c b/sys/lib/libkern/strncasecmp.c
index 905808fb8..28b976be8 100644
--- a/sys/lib/libkern/strncasecmp.c
+++ b/sys/lib/libkern/strncasecmp.c
@@ -43,10 +43,10 @@ strncasecmp(const char *s1, const char *s2, size_t n)
 		unsigned char c2 = (unsigned char) *s2++;
 
 		if (c1 != c2) {
-			if (c1 >= 'A' && c1 <= 'Z' && 
+			if (c1 >= 'A' && c1 <= 'Z' &&
 			    c2 >= 'a' && c2 <= 'z')
 				c1 += 'a' - 'A';
-			else if (c1 >= 'a' && c1 <= 'z' && 
+			else if (c1 >= 'a' && c1 <= 'z' &&
 				 c2 >= 'A' && c2 <= 'Z')
 				c2 += 'a' - 'A';
 			if (c1 != c2)
diff --git a/sys/lib/libsa/arc4.c b/sys/lib/libsa/arc4.c
index c51e63a91..7c1794a44 100644
--- a/sys/lib/libsa/arc4.c
+++ b/sys/lib/libsa/arc4.c
@@ -15,7 +15,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <sys/types.h>                                                         
+#include <sys/types.h>
 
 #include <lib/libsa/arc4.h>
 
diff --git a/sys/lib/libsa/bcrypt_pbkdf.c b/sys/lib/libsa/bcrypt_pbkdf.c
index 07c1461e7..f7d1040c8 100644
--- a/sys/lib/libsa/bcrypt_pbkdf.c
+++ b/sys/lib/libsa/bcrypt_pbkdf.c
@@ -17,7 +17,7 @@
 
 #include <lib/libsa/stand.h>
 #include <sys/param.h>
- 
+
 #include "bcrypt_pbkdf.h"
 #include "blowfish.h"
 #include "sha2.h"
diff --git a/sys/lib/libsa/bootp.h b/sys/lib/libsa/bootp.h
index 5405a0a02..49a9bb214 100644
--- a/sys/lib/libsa/bootp.h
+++ b/sys/lib/libsa/bootp.h
@@ -76,7 +76,7 @@ struct bootp {
  */
 #define VM_RFC1048	{ 99, 130, 83, 99 }
 
-
+
 
 /*
  * RFC1048 tag values used to specify what information is being supplied in
diff --git a/sys/lib/libsa/loadfile.h b/sys/lib/libsa/loadfile.h
index c7d836f5d..45e849ef3 100644
--- a/sys/lib/libsa/loadfile.h
+++ b/sys/lib/libsa/loadfile.h
@@ -40,7 +40,7 @@
 #define	MARK_END	4
 #define	MARK_RANDOM	5
 #define	MARK_ERANDOM	6
-#define	MARK_VENTRY	7 
+#define	MARK_VENTRY	7
 #define	MARK_MAX	8
 
 /*
diff --git a/sys/lib/libsa/printf.c b/sys/lib/libsa/printf.c
index 6a049f2e2..9c2e54a21 100644
--- a/sys/lib/libsa/printf.c
+++ b/sys/lib/libsa/printf.c
@@ -176,7 +176,7 @@ reswitch:	switch (ch) {
 				}
 				kprintn64(put, ull, 10, width, padchar);
 				break;
-			} 
+			}
 #endif
 			ul = lflag ?
 			    va_arg(ap, long) : va_arg(ap, int);
@@ -192,7 +192,7 @@ reswitch:	switch (ch) {
 				ull = va_arg(ap, u_int64_t);
 				kprintn64(put, ull, 8, width, padchar);
 				break;
-			} 
+			}
 #endif
 			ul = lflag ?
 			    va_arg(ap, u_long) : va_arg(ap, u_int);
@@ -204,7 +204,7 @@ reswitch:	switch (ch) {
 				ull = va_arg(ap, u_int64_t);
 				kprintn64(put, ull, 10, width, padchar);
 				break;
-			} 
+			}
 #endif
 			ul = lflag ?
 			    va_arg(ap, u_long) : va_arg(ap, u_int);
diff --git a/sys/lib/libsa/sha1.c b/sys/lib/libsa/sha1.c
index e466481ed..5b188745b 100644
--- a/sys/lib/libsa/sha1.c
+++ b/sys/lib/libsa/sha1.c
@@ -4,7 +4,7 @@
  * SHA-1 in C
  * By Steve Reid <steve@edmweb.com>
  * 100% Public Domain
- * 
+ *
  * Test Vectors (from FIPS PUB 180-1)
  * "abc"
  *   A9993E36 4706816A BA3E2571 7850C26C 9CD0D89D
diff --git a/sys/lib/libsa/sha2.c b/sys/lib/libsa/sha2.c
index eacbc49d2..fe032eee0 100644
--- a/sys/lib/libsa/sha2.c
+++ b/sys/lib/libsa/sha2.c
@@ -3,7 +3,7 @@
 /*
  * FILE:	sha2.c
  * AUTHOR:	Aaron D. Gifford <me@aarongifford.com>
- * 
+ *
  * Copyright (c) 2000-2001, Aaron D. Gifford
  * All rights reserved.
  *
@@ -18,7 +18,7 @@
  * 3. Neither the name of the copyright holder nor the names of contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTOR(S) ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -76,7 +76,7 @@
  *
  * And for little-endian machines, add:
  *
- *   #define BYTE_ORDER LITTLE_ENDIAN 
+ *   #define BYTE_ORDER LITTLE_ENDIAN
  *
  * Or for big-endian machines:
  *
@@ -466,11 +466,11 @@ SHA256Transform(u_int32_t state[8], const u_int8_t data[SHA256_BLOCK_LENGTH])
 		/* Part of the message block expansion: */
 		s0 = W256[(j+1)&0x0f];
 		s0 = sigma0_256(s0);
-		s1 = W256[(j+14)&0x0f];	
+		s1 = W256[(j+14)&0x0f];
 		s1 = sigma1_256(s1);
 
 		/* Apply the SHA-256 compression function to update a..h */
-		T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + 
+		T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] +
 		     (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0);
 		T2 = Sigma0_256(a) + Maj(a, b, c);
 		h = g;
diff --git a/sys/lib/libsa/sha2.h b/sys/lib/libsa/sha2.h
index 294569090..9dcd7d4a0 100644
--- a/sys/lib/libsa/sha2.h
+++ b/sys/lib/libsa/sha2.h
@@ -3,7 +3,7 @@
 /*
  * FILE:	sha2.h
  * AUTHOR:	Aaron D. Gifford <me@aarongifford.com>
- * 
+ *
  * Copyright (c) 2000-2001, Aaron D. Gifford
  * All rights reserved.
  *
@@ -18,7 +18,7 @@
  * 3. Neither the name of the copyright holder nor the names of contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTOR(S) ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
diff --git a/sys/miscfs/fuse/fuse_lookup.c b/sys/miscfs/fuse/fuse_lookup.c
index 7e19d2449..ab9b271e2 100644
--- a/sys/miscfs/fuse/fuse_lookup.c
+++ b/sys/miscfs/fuse/fuse_lookup.c
@@ -96,7 +96,7 @@ fusefs_lookup(void *v)
 				 */
 				if ((error = VOP_ACCESS(vdp, VWRITE, cred,
 				    cnp->cn_proc)) != 0)
-					return (error); 
+					return (error);
 
 				cnp->cn_flags |= SAVENAME;
 
diff --git a/sys/miscfs/fuse/fuse_vnops.c b/sys/miscfs/fuse/fuse_vnops.c
index 8f9a66f2c..c68b7b38e 100644
--- a/sys/miscfs/fuse/fuse_vnops.c
+++ b/sys/miscfs/fuse/fuse_vnops.c
@@ -224,7 +224,7 @@ filt_fusefsvnode(struct knote *kn, long int hint)
 
 /*
  * FUSE file systems can maintain a file handle for each VFS file descriptor
- * that is opened. The OpenBSD VFS does not make file descriptors visible to 
+ * that is opened. The OpenBSD VFS does not make file descriptors visible to
  * us so we fake it by mapping open flags to file handles.
  * There is no way for FUSE to know which file descriptor is being used
  * by an application for a file operation. We only maintain 3 descriptors,
@@ -360,7 +360,7 @@ fusefs_access(void *v)
 	ip = VTOI(ap->a_vp);
 	fmp = (struct fusefs_mnt *)ip->ufs_ino.i_ump;
 
-	/* 
+	/*
 	 * Only user that mounted the file system can access it unless
 	 * allow_other mount option was specified.
 	 */
@@ -411,7 +411,7 @@ fusefs_getattr(void *v)
 	ip = VTOI(vp);
 	fmp = (struct fusefs_mnt *)ip->ufs_ino.i_ump;
 
-	/* 
+	/*
 	 * Only user that mounted the file system can access it unless
 	 * allow_other mount option was specified. Return dummy values
 	 * for the root inode in this situation.
@@ -853,7 +853,7 @@ fusefs_inactive(void *v)
 
 			/*
 			 * FUSE file systems expect the same flags to be sent
-			 * on release that were sent on open. We don't have a 
+			 * on release that were sent on open. We don't have a
 			 * record of them so make a best guess.
 			 */
 			switch (type) {
diff --git a/sys/net/if.c b/sys/net/if.c
index a4755f6b9..494b1b2d7 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -356,7 +356,7 @@ if_idxmap_alloc(struct ifnet *ifp)
 		if_map = mallocarray(limit, sizeof(*if_map), M_IFADDR,
 		    M_WAITOK | M_ZERO);
 		if_map[0] = (struct ifnet *)(uintptr_t)limit;
-		
+
 		for (i = 1; i < olimit; i++) {
 			struct ifnet *oifp = SMR_PTR_GET_LOCKED(&oif_map[i]);
 			if (oifp == NULL)
@@ -3506,6 +3506,6 @@ net_tq_barriers(const char *wmesg)
 		refcnt_take(&r);
 		task_add(softnets[i].sn_taskq, &barriers[i]);
 	}
- 
+
 	refcnt_finalize(&r, wmesg);
 }
diff --git a/sys/net/if_etherip.c b/sys/net/if_etherip.c
index 3abc9d4b5..50411c7bf 100644
--- a/sys/net/if_etherip.c
+++ b/sys/net/if_etherip.c
@@ -219,7 +219,7 @@ etherip_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
 			return (EIO);
 		}
 	}
- 
+
 	return (ether_output(ifp, m, dst, rt));
 }
 
diff --git a/sys/uvm/uvm_extern.h b/sys/uvm/uvm_extern.h
index 702d9b9d0..85124bd81 100644
--- a/sys/uvm/uvm_extern.h
+++ b/sys/uvm/uvm_extern.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_extern.h,v 1.168 2023/05/30 08:30:01 jsg Exp $	*/
+/*	$OpenBSD: uvm_extern.h,v 1.169 2023/06/20 16:30:30 cheloha Exp $	*/
 /*	$NetBSD: uvm_extern.h,v 1.57 2001/03/09 01:02:12 chs Exp $	*/
 
 /*
@@ -414,7 +414,7 @@ void			uvmspace_free(struct vmspace *);
 struct vmspace		*uvmspace_share(struct process *);
 int			uvm_share(vm_map_t, vaddr_t, vm_prot_t,
 			    vm_map_t, vaddr_t, vsize_t);
-void			uvm_meter(void);
+void			uvm_meter(void *);
 int			uvm_sysctl(int *, u_int, void *, size_t *, 
 			    void *, size_t, struct proc *);
 struct vm_page		*uvm_pagealloc(struct uvm_object *,
diff --git a/sys/uvm/uvm_meter.c b/sys/uvm/uvm_meter.c
index f86fb0369..8fc7c1030 100644
--- a/sys/uvm/uvm_meter.c
+++ b/sys/uvm/uvm_meter.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_meter.c,v 1.42 2020/12/28 14:01:23 mpi Exp $	*/
+/*	$OpenBSD: uvm_meter.c,v 1.43 2023/06/20 16:30:30 cheloha Exp $	*/
 /*	$NetBSD: uvm_meter.c,v 1.21 2001/07/14 06:36:03 matt Exp $	*/
 
 /*
@@ -65,6 +65,9 @@
 int maxslp = MAXSLP;	/* patchable ... */
 struct loadavg averunnable;
 
+#define UVM_METER_INTVL	5
+struct timeout uvm_meter_to = TIMEOUT_INITIALIZER(uvm_meter, NULL);
+
 /*
  * constants for averages over 1, 5, and 15 minutes when sampling at
  * 5 second intervals.
@@ -82,15 +85,13 @@ void uvm_total(struct vmtotal *);
 void uvmexp_read(struct uvmexp *);
 
 /*
- * uvm_meter: calculate load average and wake up the swapper (if needed)
+ * uvm_meter: recompute load averages
  */
 void
-uvm_meter(void)
+uvm_meter(void *unused)
 {
-	if ((gettime() % 5) == 0)
-		uvm_loadav(&averunnable);
-	if (proc0.p_slptime > (maxslp / 2))
-		wakeup(&proc0);
+	timeout_add_sec(&uvm_meter_to, UVM_METER_INTVL);
+	uvm_loadav(&averunnable);
 }
 
 /*
diff --git a/usr.bin/ssh/ssh-keygen.c b/usr.bin/ssh/ssh-keygen.c
index 39d3519c6..7979930aa 100644
--- a/usr.bin/ssh/ssh-keygen.c
+++ b/usr.bin/ssh/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.467 2023/04/12 08:53:54 jsg Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.468 2023/06/20 00:05:09 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -976,6 +976,7 @@ do_fingerprint(struct passwd *pw)
 		 * accept a public key prefixed with a hostname or options.
 		 * Try a bare key first, otherwise skip the leading stuff.
 		 */
+		comment = NULL;
 		if ((public = try_read_key(&cp)) == NULL) {
 			i = strtol(cp, &ep, 10);
 			if (i == 0 || ep == NULL ||
diff --git a/usr.sbin/ospfd/auth.c b/usr.sbin/ospfd/auth.c
index a50c3f0b9..204d4b33e 100644
--- a/usr.sbin/ospfd/auth.c
+++ b/usr.sbin/ospfd/auth.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: auth.c,v 1.20 2015/05/05 01:26:37 jsg Exp $ */
+/*	$OpenBSD: auth.c,v 1.21 2023/06/20 15:19:55 claudio Exp $ */
 
 /*
  * Copyright (c) 2004, 2005 Esben Norby <norby@openbsd.org>
@@ -141,36 +141,45 @@ auth_gen(struct ibuf *buf, struct iface *iface)
 {
 	MD5_CTX		 hash;
 	u_int8_t	 digest[MD5_DIGEST_LENGTH];
-	struct ospf_hdr	*ospf_hdr;
+	struct crypt	 crypt;
 	struct auth_md	*md;
-
-	if ((ospf_hdr = ibuf_seek(buf, 0, sizeof(*ospf_hdr))) == NULL)
-		fatalx("auth_gen: buf_seek failed");
+	u_int16_t	 chksum;
 
 	/* update length */
 	if (ibuf_size(buf) > USHRT_MAX)
 		fatalx("auth_gen: resulting ospf packet too big");
-	ospf_hdr->len = htons(ibuf_size(buf));
-	/* clear auth_key field */
-	bzero(ospf_hdr->auth_key.simple, sizeof(ospf_hdr->auth_key.simple));
+	if (ibuf_set_n16(buf, offsetof(struct ospf_hdr, len),
+	    ibuf_size(buf)) == -1)
+		fatalx("auth_gen: ibuf_set_n16 failed");
 
 	switch (iface->auth_type) {
 	case AUTH_NONE:
-		ospf_hdr->chksum = in_cksum(buf->buf, ibuf_size(buf));
+		chksum = in_cksum(buf->buf, ibuf_size(buf));
+		if (ibuf_set(buf, offsetof(struct ospf_hdr, chksum),
+		    &chksum, sizeof(chksum)) == -1)
+			fatalx("auth_gen: ibuf_set failed");
 		break;
 	case AUTH_SIMPLE:
-		ospf_hdr->chksum = in_cksum(buf->buf, ibuf_size(buf));
+		chksum = in_cksum(buf->buf, ibuf_size(buf));
+		if (ibuf_set(buf, offsetof(struct ospf_hdr, chksum),
+		    &chksum, sizeof(chksum)) == -1)
+			fatalx("auth_gen: ibuf_set failed");
 
-		strncpy(ospf_hdr->auth_key.simple, iface->auth_key,
-		    sizeof(ospf_hdr->auth_key.simple));
+		if (ibuf_set(buf, offsetof(struct ospf_hdr, auth_key),
+		    iface->auth_key, strlen(iface->auth_key)) == -1)
+			fatalx("auth_gen: ibuf_set failed");
 		break;
 	case AUTH_CRYPT:
-		ospf_hdr->chksum = 0;
-		ospf_hdr->auth_key.crypt.keyid = iface->auth_keyid;
-		ospf_hdr->auth_key.crypt.seq_num = htonl(iface->crypt_seq_num);
-		ospf_hdr->auth_key.crypt.len = MD5_DIGEST_LENGTH;
+		bzero(&crypt, sizeof(crypt));
+		crypt.keyid = iface->auth_keyid;
+		crypt.seq_num = htonl(iface->crypt_seq_num);
+		crypt.len = MD5_DIGEST_LENGTH;
 		iface->crypt_seq_num++;
 
+		if (ibuf_set(buf, offsetof(struct ospf_hdr, auth_key),
+		    &crypt, sizeof(crypt)) == -1)
+			fatalx("auth_gen: ibuf_set failed");
+
 		/* insert plaintext key */
 		if ((md = md_list_find(&iface->auth_md_list,
 		    iface->auth_keyid)) == NULL) {
diff --git a/usr.sbin/ospfd/database.c b/usr.sbin/ospfd/database.c
index 17f855c26..5fec976e8 100644
--- a/usr.sbin/ospfd/database.c
+++ b/usr.sbin/ospfd/database.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: database.c,v 1.36 2023/03/08 04:43:14 guenther Exp $ */
+/*	$OpenBSD: database.c,v 1.37 2023/06/20 15:19:55 claudio Exp $ */
 
 /*
  * Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org>
@@ -53,7 +53,7 @@ send_db_description(struct nbr *nbr)
 		goto fail;
 
 	/* reserve space for database description header */
-	if (ibuf_reserve(buf, sizeof(dd_hdr)) == NULL)
+	if (ibuf_add_zero(buf, sizeof(dd_hdr)) == -1)
 		goto fail;
 
 	switch (nbr->state) {
@@ -140,8 +140,9 @@ send_db_description(struct nbr *nbr)
 	dd_hdr.bits = bits;
 	dd_hdr.dd_seq_num = htonl(nbr->dd_seq_num);
 
-	memcpy(ibuf_seek(buf, sizeof(struct ospf_hdr), sizeof(dd_hdr)),
-	    &dd_hdr, sizeof(dd_hdr));
+	if (ibuf_set(buf, sizeof(struct ospf_hdr), &dd_hdr,
+	    sizeof(dd_hdr)) == -1)
+		goto fail;
 
 	/* update authentication and calculate checksum */
 	if (auth_gen(buf, nbr->iface))
diff --git a/usr.sbin/ospfd/lsupdate.c b/usr.sbin/ospfd/lsupdate.c
index 774e002b7..25c6b3ad3 100644
--- a/usr.sbin/ospfd/lsupdate.c
+++ b/usr.sbin/ospfd/lsupdate.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lsupdate.c,v 1.51 2023/03/08 04:43:14 guenther Exp $ */
+/*	$OpenBSD: lsupdate.c,v 1.52 2023/06/20 15:19:55 claudio Exp $ */
 
 /*
  * Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org>
@@ -158,7 +158,7 @@ prepare_ls_update(struct iface *iface)
 		goto fail;
 
 	/* reserve space for number of lsa field */
-	if (ibuf_reserve(buf, sizeof(u_int32_t)) == NULL)
+	if (ibuf_add_zero(buf, sizeof(u_int32_t)) == -1)
 		goto fail;
 
 	return (buf);
@@ -194,8 +194,10 @@ add_ls_update(struct ibuf *buf, struct iface *iface, void *data, u_int16_t len,
 	age = ntohs(age);
 	if ((age += older + iface->transmit_delay) >= MAX_AGE)
 		age = MAX_AGE;
-	age = htons(age);
-	memcpy(ibuf_seek(buf, ageoff, sizeof(age)), &age, sizeof(age));
+	if (ibuf_set_n16(buf, ageoff, age) == -1) {
+		log_warn("add_ls_update");
+		return (0);
+	}
 
 	return (1);
 }
@@ -208,9 +210,8 @@ send_ls_update(struct ibuf *buf, struct iface *iface, struct in_addr addr,
 {
 	struct sockaddr_in	 dst;
 
-	nlsa = htonl(nlsa);
-	memcpy(ibuf_seek(buf, sizeof(struct ospf_hdr), sizeof(nlsa)),
-	    &nlsa, sizeof(nlsa));
+	if (ibuf_set_n32(buf, sizeof(struct ospf_hdr), nlsa) == -1)
+		goto fail;
 	/* update authentication and calculate checksum */
 	if (auth_gen(buf, iface))
 		goto fail;
diff --git a/usr.sbin/ospfd/ospfe.c b/usr.sbin/ospfd/ospfe.c
index ffc6faaa3..dda1090db 100644
--- a/usr.sbin/ospfd/ospfe.c
+++ b/usr.sbin/ospfd/ospfe.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ospfe.c,v 1.111 2023/03/08 04:43:14 guenther Exp $ */
+/*	$OpenBSD: ospfe.c,v 1.112 2023/06/20 15:19:55 claudio Exp $ */
 
 /*
  * Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org>
@@ -842,11 +842,11 @@ orig_rtr_lsa(struct area *area)
 		fatal("orig_rtr_lsa");
 
 	/* reserve space for LSA header and LSA Router header */
-	if (ibuf_reserve(buf, sizeof(lsa_hdr)) == NULL)
-		fatal("orig_rtr_lsa: ibuf_reserve failed");
+	if (ibuf_add_zero(buf, sizeof(lsa_hdr)) == -1)
+		fatal("orig_rtr_lsa: ibuf_add_zero failed");
 
-	if (ibuf_reserve(buf, sizeof(lsa_rtr)) == NULL)
-		fatal("orig_rtr_lsa: ibuf_reserve failed");
+	if (ibuf_add_zero(buf, sizeof(lsa_rtr)) == -1)
+		fatal("orig_rtr_lsa: ibuf_add_zero failed");
 
 	/* links */
 	LIST_FOREACH(iface, &area->iface_list, entry) {
@@ -1083,8 +1083,9 @@ orig_rtr_lsa(struct area *area)
 
 	lsa_rtr.dummy = 0;
 	lsa_rtr.nlinks = htons(num_links);
-	memcpy(ibuf_seek(buf, sizeof(lsa_hdr), sizeof(lsa_rtr)),
-	    &lsa_rtr, sizeof(lsa_rtr));
+	if (ibuf_set(buf, sizeof(lsa_hdr), &lsa_rtr, sizeof(lsa_rtr)) ==
+	    -1)
+		fatal("orig_rtr_lsa: ibuf_set failed");
 
 	/* LSA header */
 	lsa_hdr.age = htons(DEFAULT_AGE);
@@ -1095,11 +1096,12 @@ orig_rtr_lsa(struct area *area)
 	lsa_hdr.seq_num = htonl(INIT_SEQ_NUM);
 	lsa_hdr.len = htons(ibuf_size(buf));
 	lsa_hdr.ls_chksum = 0;		/* updated later */
-	memcpy(ibuf_seek(buf, 0, sizeof(lsa_hdr)), &lsa_hdr, sizeof(lsa_hdr));
+	if (ibuf_set(buf, 0, &lsa_hdr, sizeof(lsa_hdr)) == -1)
+		fatal("orig_rtr_lsa: ibuf_set failed");
 
-	chksum = htons(iso_cksum(buf->buf, ibuf_size(buf), LS_CKSUM_OFFSET));
-	memcpy(ibuf_seek(buf, LS_CKSUM_OFFSET, sizeof(chksum)),
-	    &chksum, sizeof(chksum));
+	chksum = iso_cksum(buf->buf, ibuf_size(buf), LS_CKSUM_OFFSET);
+	if (ibuf_set_n16(buf, LS_CKSUM_OFFSET, chksum) == -1)
+		fatal("orig_rtr_lsa: ibuf_set_n16 failed");
 
 	if (self && num_links)
 		imsg_compose_event(iev_rde, IMSG_LS_UPD, self->peerid, 0,
@@ -1126,8 +1128,8 @@ orig_net_lsa(struct iface *iface)
 		fatal("orig_net_lsa");
 
 	/* reserve space for LSA header and LSA Router header */
-	if (ibuf_reserve(buf, sizeof(lsa_hdr)) == NULL)
-		fatal("orig_net_lsa: ibuf_reserve failed");
+	if (ibuf_add_zero(buf, sizeof(lsa_hdr)) == -1)
+		fatal("orig_net_lsa: ibuf_add_zero failed");
 
 	/* LSA net mask and then all fully adjacent routers */
 	if (ibuf_add(buf, &iface->mask, sizeof(iface->mask)))
@@ -1160,11 +1162,12 @@ orig_net_lsa(struct iface *iface)
 	lsa_hdr.seq_num = htonl(INIT_SEQ_NUM);
 	lsa_hdr.len = htons(ibuf_size(buf));
 	lsa_hdr.ls_chksum = 0;		/* updated later */
-	memcpy(ibuf_seek(buf, 0, sizeof(lsa_hdr)), &lsa_hdr, sizeof(lsa_hdr));
+	if (ibuf_set(buf, 0, &lsa_hdr, sizeof(lsa_hdr)) == -1)
+		fatal("orig_net_lsa: ibuf_set failed");
 
-	chksum = htons(iso_cksum(buf->buf, ibuf_size(buf), LS_CKSUM_OFFSET));
-	memcpy(ibuf_seek(buf, LS_CKSUM_OFFSET, sizeof(chksum)),
-	    &chksum, sizeof(chksum));
+	chksum = iso_cksum(buf->buf, ibuf_size(buf), LS_CKSUM_OFFSET);
+	if (ibuf_set_n16(buf, LS_CKSUM_OFFSET, chksum) == -1)
+		fatal("orig_net_lsa: ibuf_set_n16 failed");
 
 	imsg_compose_event(iev_rde, IMSG_LS_UPD, iface->self->peerid, 0,
 	    -1, buf->buf, ibuf_size(buf));
diff --git a/usr.sbin/pkg_add/OpenBSD/PkgCreate.pm b/usr.sbin/pkg_add/OpenBSD/PkgCreate.pm
index ec85ea08e..033a13632 100644
--- a/usr.sbin/pkg_add/OpenBSD/PkgCreate.pm
+++ b/usr.sbin/pkg_add/OpenBSD/PkgCreate.pm
@@ -1,6 +1,6 @@
 #! /usr/bin/perl
 # ex:ts=8 sw=4:
-# $OpenBSD: PkgCreate.pm,v 1.191 2023/06/13 09:07:17 espie Exp $
+# $OpenBSD: PkgCreate.pm,v 1.192 2023/06/20 14:50:05 espie Exp $
 #
 # Copyright (c) 2003-2014 Marc Espie <espie@openbsd.org>
 #
@@ -1125,10 +1125,10 @@ sub print($self)
 package OpenBSD::PkgCreate;
 our @ISA = qw(OpenBSD::AddCreateDelete);
 
-sub handle_fragment($self, $state, $old, $not, $frag, $, $, $msg)
+sub handle_fragment($self, $state, $old, $not, $frag, $location)
 {
 	my $def = $frag;
-	if ($state->{subst}->has_fragment($def, $frag, $msg)) {
+	if ($state->{subst}->has_fragment($state, $def, $frag, $location)) {
 		return undef if defined $not;
 	} else {
 		return undef unless defined $not;
@@ -1185,7 +1185,7 @@ sub read_fragments($self, $state, $plist, $filename)
 				if ($l =~ m/^(\!)?\%\%(.*)\%\%$/) {
 					$self->record_fragment($plist, $1, $2,
 					    $file);
-					if (my $f2 = $self->handle_fragment($state, $file, $1, $2, $l, $cont, $filename)) {
+					if (my $f2 = $self->handle_fragment($state, $file, $1, $2, $filename)) {
 						push(@$stack, $file);
 						$file = $f2;
 					}
diff --git a/usr.sbin/pkg_add/OpenBSD/Subst.pm b/usr.sbin/pkg_add/OpenBSD/Subst.pm
index e8934115f..be0a9fe36 100644
--- a/usr.sbin/pkg_add/OpenBSD/Subst.pm
+++ b/usr.sbin/pkg_add/OpenBSD/Subst.pm
@@ -1,5 +1,5 @@
 # ex:ts=8 sw=4:
-# $OpenBSD: Subst.pm,v 1.20 2023/06/13 09:07:17 espie Exp $
+# $OpenBSD: Subst.pm,v 1.21 2023/06/20 14:50:06 espie Exp $
 #
 # Copyright (c) 2008 Marc Espie <espie@openbsd.org>
 #
@@ -91,18 +91,19 @@ sub copy($self, $srcname, $destname)
 	return $dest;
 }
 
-sub has_fragment($self, $def, $frag, $msg)
+sub has_fragment($self, $state, $def, $frag, $location)
 {
 	my $v = $self->value($def);
 
 	if (!defined $v) {
-		die "Error: unknown fragment $frag in $msg";
+		$state->fatal("Unknown fragment #1 in #2", 
+		    $frag, $location);
 	} elsif ($v == 1) {
 		return 1;
 	} elsif ($v == 0) {
 		return 0;
 	} else {
-		die "Incorrect define for $frag in $msg";
+		$state->fatal("Invalid fragment define #1=#2", $frag, $v);
 	}
 }
 
diff --git a/usr.sbin/relayd/check_tcp.c b/usr.sbin/relayd/check_tcp.c
index 6ab695265..096020336 100644
--- a/usr.sbin/relayd/check_tcp.c
+++ b/usr.sbin/relayd/check_tcp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: check_tcp.c,v 1.58 2021/09/18 19:44:46 claudio Exp $	*/
+/*	$OpenBSD: check_tcp.c,v 1.59 2023/06/20 09:54:57 claudio Exp $	*/
 
 /*
  * Copyright (c) 2006 Pierre-Yves Ritschard <pyr@openbsd.org>
@@ -344,17 +344,14 @@ check_http_code(struct ctl_tcp_event *cte)
 	char		*head;
 	char		 scode[4];
 	const char	*estr;
-	u_char		*b;
 	int		 code;
 	struct host	*host;
 
 	/*
 	 * ensure string is nul-terminated.
 	 */
-	b = ibuf_reserve(cte->buf, 1);
-	if (b == NULL)
+	if (ibuf_add_zero(cte->buf, 1) == -1)
 		fatal("out of memory");
-	*b = '\0';
 
 	head = cte->buf->buf;
 	host = cte->host;
@@ -398,17 +395,14 @@ int
 check_http_digest(struct ctl_tcp_event *cte)
 {
 	char		*head;
-	u_char		*b;
 	char		 digest[SHA1_DIGEST_STRING_LENGTH];
 	struct host	*host;
 
 	/*
 	 * ensure string is nul-terminated.
 	 */
-	b = ibuf_reserve(cte->buf, 1);
-	if (b == NULL)
+	if (ibuf_add_zero(cte->buf, 1) == -1)
 		fatal("out of memory");
-	*b = '\0';
 
 	head = cte->buf->buf;
 	host = cte->host;
diff --git a/usr.sbin/rpki-client/cert.c b/usr.sbin/rpki-client/cert.c
index f8f7c42b9..b166ed063 100644
--- a/usr.sbin/rpki-client/cert.c
+++ b/usr.sbin/rpki-client/cert.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cert.c,v 1.108 2023/05/09 10:34:32 tb Exp $ */
+/*	$OpenBSD: cert.c,v 1.109 2023/06/20 12:28:08 job Exp $ */
 /*
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
  * Copyright (c) 2021 Job Snijders <job@openbsd.org>
@@ -596,6 +596,11 @@ cert_parse_ee_cert(const char *fn, X509 *x)
 	if ((p.res = calloc(1, sizeof(struct cert))) == NULL)
 		err(1, NULL);
 
+	if (X509_get_version(x) != 2) {
+		warnx("%s: RFC 6487 4.1: X.509 version must be v3", fn);
+		goto out;
+	}
+
 	if (X509_get_key_usage(x) != KU_DIGITAL_SIGNATURE) {
 		warnx("%s: RFC 6487 section 4.8.4: KU must be digitalSignature",
 		    fn);
@@ -680,6 +685,11 @@ cert_parse_pre(const char *fn, const unsigned char *der, size_t len)
 		goto out;
 	}
 
+	if (X509_get_version(x) != 2) {
+		warnx("%s: RFC 6487 4.1: X.509 version must be v3", fn);
+		goto out;
+	}
+
 	X509_get0_signature(NULL, &palg, x);
 	if (palg == NULL) {
 		cryptowarnx("%s: X509_get0_signature", p.fn);
diff --git a/usr.sbin/rpki-client/cms.c b/usr.sbin/rpki-client/cms.c
index 3fa595926..1d31beb09 100644
--- a/usr.sbin/rpki-client/cms.c
+++ b/usr.sbin/rpki-client/cms.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cms.c,v 1.36 2023/06/17 04:46:11 job Exp $ */
+/*	$OpenBSD: cms.c,v 1.37 2023/06/20 02:46:18 job Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -276,7 +276,7 @@ cms_parse_validate_internal(X509 **xp, const char *fn, const unsigned char *der,
 	assert(octype != NULL);
 	if (OBJ_cmp(obj, octype) != 0) {
 		OBJ_obj2txt(buf, sizeof(buf), obj, 1);
-		OBJ_obj2txt(obuf, sizeof(obuf), oid, 1);
+		OBJ_obj2txt(obuf, sizeof(obuf), octype, 1);
 		warnx("%s: RFC 6488: eContentType does not match Content-Type "
 		    "OID: %s, want %s", fn, buf, obuf);
 		goto out;
diff --git a/usr.sbin/rpki-client/crl.c b/usr.sbin/rpki-client/crl.c
index ad43e18fb..bf9b19a62 100644
--- a/usr.sbin/rpki-client/crl.c
+++ b/usr.sbin/rpki-client/crl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: crl.c,v 1.25 2023/05/22 15:07:02 tb Exp $ */
+/*	$OpenBSD: crl.c,v 1.26 2023/06/20 12:48:32 job Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -51,6 +51,11 @@ crl_parse(const char *fn, const unsigned char *der, size_t len)
 		goto out;
 	}
 
+	if (X509_CRL_get_version(crl->x509_crl) != 1) {
+		warnx("%s: RFC 6487 section 5: version 2 expected", fn);
+		goto out;
+	}
+
 	X509_CRL_get0_signature(crl->x509_crl, NULL, &palg);
 	if (palg == NULL) {
 		cryptowarnx("%s: X509_CRL_get0_signature", fn);
diff --git a/usr.sbin/rpki-client/gbr.c b/usr.sbin/rpki-client/gbr.c
index 3d27224cb..214bf3231 100644
--- a/usr.sbin/rpki-client/gbr.c
+++ b/usr.sbin/rpki-client/gbr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: gbr.c,v 1.26 2023/03/12 11:46:35 tb Exp $ */
+/*	$OpenBSD: gbr.c,v 1.27 2023/06/20 12:39:50 job Exp $ */
 /*
  * Copyright (c) 2020 Claudio Jeker <claudio@openbsd.org>
  *
@@ -43,6 +43,7 @@ struct gbr *
 gbr_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
 {
 	struct parse	 p;
+	struct cert	*cert = NULL;
 	size_t		 cmsz;
 	unsigned char	*cms;
 	time_t		 signtime = 0;
@@ -86,12 +87,16 @@ gbr_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
 		goto out;
 	}
 
+	if ((cert = cert_parse_ee_cert(fn, *x509)) == NULL)
+		goto out;
+
 	return p.res;
 
  out:
 	gbr_free(p.res);
 	X509_free(*x509);
 	*x509 = NULL;
+	cert_free(cert);
 	return NULL;
 }
 
diff --git a/usr.sbin/rpki-client/http.c b/usr.sbin/rpki-client/http.c
index c1927529e..4544eac23 100644
--- a/usr.sbin/rpki-client/http.c
+++ b/usr.sbin/rpki-client/http.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: http.c,v 1.76 2023/06/12 15:27:52 claudio Exp $ */
+/*	$OpenBSD: http.c,v 1.77 2023/06/20 15:15:14 claudio Exp $ */
 /*
  * Copyright (c) 2020 Nils Fisher <nils_fisher@hotmail.com>
  * Copyright (c) 2020 Claudio Jeker <claudio@openbsd.org>
@@ -2150,7 +2150,7 @@ proc_http(char *bind_addr, int fd)
 				io_read_str(b, &mod);
 
 				/* queue up new requests */
-				http_req_new(id, uri, mod, 0, b->fd);
+				http_req_new(id, uri, mod, 0, ibuf_fd_get(b));
 				ibuf_free(b);
 			}
 		}
diff --git a/usr.sbin/rpki-client/io.c b/usr.sbin/rpki-client/io.c
index 043331e32..a3b988ef0 100644
--- a/usr.sbin/rpki-client/io.c
+++ b/usr.sbin/rpki-client/io.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: io.c,v 1.22 2022/12/14 15:19:16 claudio Exp $ */
+/*	$OpenBSD: io.c,v 1.23 2023/06/20 15:15:14 claudio Exp $ */
 /*
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -41,7 +41,7 @@ io_new_buffer(void)
 
 	if ((b = ibuf_dynamic(64, INT32_MAX)) == NULL)
 		err(1, NULL);
-	ibuf_reserve(b, sizeof(size_t));	/* can not fail */
+	ibuf_add_zero(b, sizeof(size_t));	/* can not fail */
 	return b;
 }
 
@@ -88,7 +88,7 @@ io_close_buffer(struct msgbuf *msgbuf, struct ibuf *b)
 	size_t len;
 
 	len = ibuf_size(b) - sizeof(len);
-	memcpy(ibuf_seek(b, 0, sizeof(len)), &len, sizeof(len));
+	ibuf_set(b, 0, &len, sizeof(len));
 	ibuf_close(msgbuf, b);
 }
 
@@ -280,7 +280,7 @@ io_buf_recvfd(int fd, struct ibuf **ib)
 			for (i = 0; i < j; i++) {
 				f = ((int *)CMSG_DATA(cmsg))[i];
 				if (i == 0)
-					b->fd = f;
+					ibuf_fd_set(b, f);
 				else
 					close(f);
 			}
diff --git a/usr.sbin/rpki-client/main.c b/usr.sbin/rpki-client/main.c
index 1982e2747..39fd2931c 100644
--- a/usr.sbin/rpki-client/main.c
+++ b/usr.sbin/rpki-client/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.241 2023/05/30 16:02:28 job Exp $ */
+/*	$OpenBSD: main.c,v 1.242 2023/06/20 15:15:14 claudio Exp $ */
 /*
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -341,7 +341,7 @@ http_fetch(unsigned int id, const char *uri, const char *last_mod, int fd)
 	io_str_buffer(b, uri);
 	io_str_buffer(b, last_mod);
 	/* pass file as fd */
-	b->fd = fd;
+	ibuf_fd_set(b, fd);
 	io_close_buffer(&httpq, b);
 }
 
@@ -362,7 +362,7 @@ rrdp_http_fetch(unsigned int id, const char *uri, const char *last_mod)
 	b = io_new_buffer();
 	io_simple_buffer(b, &type, sizeof(type));
 	io_simple_buffer(b, &id, sizeof(id));
-	b->fd = pi[0];
+	ibuf_fd_set(b, pi[0]);
 	io_close_buffer(&rrdpq, b);
 
 	http_fetch(id, uri, last_mod, pi[1]);
diff --git a/usr.sbin/rpki-client/mft.c b/usr.sbin/rpki-client/mft.c
index 75ad639d8..2f4761e02 100644
--- a/usr.sbin/rpki-client/mft.c
+++ b/usr.sbin/rpki-client/mft.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mft.c,v 1.94 2023/06/07 10:46:34 job Exp $ */
+/*	$OpenBSD: mft.c,v 1.95 2023/06/20 12:39:50 job Exp $ */
 /*
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -353,6 +353,7 @@ struct mft *
 mft_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
 {
 	struct parse	 p;
+	struct cert	*cert = NULL;
 	int		 rc = 0;
 	size_t		 cmsz;
 	unsigned char	*cms;
@@ -418,6 +419,9 @@ mft_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
 	if (mft_parse_econtent(cms, cmsz, &p) == 0)
 		goto out;
 
+	if ((cert = cert_parse_ee_cert(fn, *x509)) == NULL)
+		goto out;
+
 	if (p.res->signtime > p.res->nextupdate) {
 		warnx("%s: dating issue: CMS signing-time after MFT nextUpdate",
 		    fn);
@@ -433,6 +437,7 @@ out:
 		*x509 = NULL;
 	}
 	free(crldp);
+	cert_free(cert);
 	free(cms);
 	return p.res;
 }
diff --git a/usr.sbin/rpki-client/rrdp.c b/usr.sbin/rpki-client/rrdp.c
index d254beca5..08a861a4e 100644
--- a/usr.sbin/rpki-client/rrdp.c
+++ b/usr.sbin/rpki-client/rrdp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rrdp.c,v 1.30 2023/05/03 07:51:08 claudio Exp $ */
+/*	$OpenBSD: rrdp.c,v 1.31 2023/06/20 15:15:14 claudio Exp $ */
 /*
  * Copyright (c) 2020 Nils Fisher <nils_fisher@hotmail.com>
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
@@ -431,20 +431,20 @@ rrdp_input_handler(int fd)
 		io_read_str(b, &session_id);
 		io_read_buf(b, &serial, sizeof(serial));
 		io_read_str(b, &last_mod);
-		if (b->fd != -1)
+		if (ibuf_fd_avail(b))
 			errx(1, "received unexpected fd");
 
 		rrdp_new(id, local, notify, session_id, serial, last_mod);
 		break;
 	case RRDP_HTTP_INI:
-		if (b->fd == -1)
-			errx(1, "expected fd not received");
 		s = rrdp_get(id);
 		if (s == NULL)
 			errx(1, "http ini, rrdp session %u does not exist", id);
 		if (s->state != RRDP_STATE_WAIT)
 			errx(1, "%s: bad internal state", s->local);
-		s->infd = b->fd;
+		s->infd = ibuf_fd_get(b);
+		if (s->infd == -1)
+			errx(1, "expected fd not received");
 		s->state = RRDP_STATE_PARSE;
 		if (s->aborted) {
 			rrdp_abort_req(s);
@@ -454,7 +454,7 @@ rrdp_input_handler(int fd)
 	case RRDP_HTTP_FIN:
 		io_read_buf(b, &res, sizeof(res));
 		io_read_str(b, &last_mod);
-		if (b->fd != -1)
+		if (ibuf_fd_avail(b))
 			errx(1, "received unexpected fd");
 
 		s = rrdp_get(id);
@@ -472,7 +472,7 @@ rrdp_input_handler(int fd)
 		s = rrdp_get(id);
 		if (s == NULL)
 			errx(1, "file, rrdp session %u does not exist", id);;
-		if (b->fd != -1)
+		if (ibuf_fd_avail(b))
 			errx(1, "received unexpected fd");
 		io_read_buf(b, &ok, sizeof(ok));
 		if (ok != 1)
@@ -482,7 +482,7 @@ rrdp_input_handler(int fd)
 			rrdp_finished(s);
 		break;
 	case RRDP_ABORT:
-		if (b->fd != -1)
+		if (ibuf_fd_avail(b))
 			errx(1, "received unexpected fd");
 		s = rrdp_get(id);
 		if (s != NULL)
diff --git a/usr.sbin/rpki-client/tak.c b/usr.sbin/rpki-client/tak.c
index 4805fa0ed..b841e9abc 100644
--- a/usr.sbin/rpki-client/tak.c
+++ b/usr.sbin/rpki-client/tak.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tak.c,v 1.9 2023/06/07 10:46:34 job Exp $ */
+/*	$OpenBSD: tak.c,v 1.10 2023/06/20 12:39:50 job Exp $ */
 /*
  * Copyright (c) 2022 Job Snijders <job@fastly.com>
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
@@ -228,6 +228,7 @@ struct tak *
 tak_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
 {
 	struct parse		 p;
+	struct cert		*cert = NULL;
 	unsigned char		*cms;
 	size_t			 cmsz;
 	time_t			 signtime = 0;
@@ -272,6 +273,9 @@ tak_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
 	if (!tak_parse_econtent(cms, cmsz, &p))
 		goto out;
 
+	if ((cert = cert_parse_ee_cert(fn, *x509)) == NULL)
+		goto out;
+
 	if (strcmp(p.res->aki, p.res->current->ski) != 0) {
 		warnx("%s: current TAKey's SKI does not match EE AKI", fn);
 		goto out;
@@ -285,6 +289,7 @@ tak_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
 		X509_free(*x509);
 		*x509 = NULL;
 	}
+	cert_free(cert);
 	free(cms);
 	return p.res;
 }
diff --git a/usr.sbin/rpki-client/x509.c b/usr.sbin/rpki-client/x509.c
index 59f6d10a5..db1d21cde 100644
--- a/usr.sbin/rpki-client/x509.c
+++ b/usr.sbin/rpki-client/x509.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: x509.c,v 1.71 2023/05/22 15:07:02 tb Exp $ */
+/*	$OpenBSD: x509.c,v 1.72 2023/06/20 11:06:47 job Exp $ */
 /*
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
@@ -479,8 +479,11 @@ x509_get_sia(X509 *x, const char *fn, char **sia)
 		*sia = NULL;
 	}
 
-	if (!rsync_found)
+	if (!rsync_found) {
+		warnx("%s: RFC 6487 section 4.8.8.2: "
+		    "SIA without rsync accessLocation", fn);
 		goto out;
+	}
 
 	AUTHORITY_INFO_ACCESS_free(info);
 	return 1;