sync with OpenBSD -current

distrib/sets/lists/base/mi

@@ -764,7 +764,7 @@
 ./usr/lib/libtls.so.30.0
 ./usr/lib/libusbhid.so.7.1
 ./usr/lib/libutil.so.18.0
-./usr/lib/libz.so.7.0
+./usr/lib/libz.so.7.1
 ./usr/lib/locate
 ./usr/lib/locate/src.db
 ./usr/lib/pkgconfig

include/unistd.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: unistd.h,v 1.109 2024/05/18 05:20:22 guenther Exp $ */
+/*	$OpenBSD: unistd.h,v 1.110 2024/08/02 01:53:21 guenther Exp $ */
 /*	$NetBSD: unistd.h,v 1.26.4.1 1996/05/28 02:31:51 mrg Exp $	*/
 
 /*-
@@ -471,6 +471,10 @@ int	symlinkat(const char *, int, const char *);
 int	unlinkat(int, const char *, int);
 #endif
 
+#if __POSIX_VISIBLE >= 202405 || __BSD_VISIBLE
+int	getentropy(void *, size_t);
+#endif
+
 #if __BSD_VISIBLE
 int	dup3(int, int, int);
 int	pipe2(int [2], int);
@@ -525,7 +529,6 @@ int	 setthrname(pid_t, const char *);
 void	 setusershell(void);
 int	 strtofflags(char **, u_int32_t *, u_int32_t *);
 int	 swapctl(int cmd, const void *arg, int misc);
-int	 getentropy(void *, size_t);
 int	 pledge(const char *, const char *);
 int	 unveil(const char *, const char *);
 pid_t	 __tfork_thread(const struct __tfork *, size_t, void (*)(void *),

lib/libc/sys/getentropy.2

@@ -1,4 +1,4 @@
-.\"	$OpenBSD: getentropy.2,v 1.10 2022/02/06 00:29:02 jsg Exp $
+.\"	$OpenBSD: getentropy.2,v 1.11 2024/08/02 01:53:21 guenther Exp $
 .\"
 .\" Copyright (c) 2014 Theo de Raadt
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: February 6 2022 $
+.Dd $Mdocdate: August 2 2024 $
 .Dt GETENTROPY 2
 .Os
 .Sh NAME
@@ -30,7 +30,9 @@ fills a buffer with high-quality entropy, which can be used
 as input for process-context pseudorandom generators like
 .Xr arc4random 3 .
 .Pp
-The maximum buffer size permitted is 256 bytes.
+The maximum buffer size permitted is
+.Dv GETENTROPY_MAX
+(256) bytes.
 .Pp
 .Fn getentropy
 is not intended for regular code; use the
@@ -51,11 +53,16 @@ The
 .Fa buf
 parameter points to an
 invalid address.
-.It Bq Er EIO
-Too many bytes requested, or some other fatal error occurred.
+.It Bq Er EINVAL
+Too many bytes requested.
 .El
 .Sh SEE ALSO
 .Xr arc4random 3
+.Sh STANDARDS
+The
+.Fn getentropy
+function conforms to
+.St -p1003.1-2024 .
 .Sh HISTORY
 The
 .Fn getentropy

lib/libcrypto/Makefile

@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.200 2024/07/10 13:30:14 beck Exp $
+# $OpenBSD: Makefile,v 1.201 2024/08/02 10:48:54 jsing Exp $
 
 LIB=	crypto
 LIBREBUILD=y
@@ -61,10 +61,10 @@ SYMBOL_LIST+=	${.CURDIR}/arch/${MACHINE_CPU}/Symbols.list
 # crypto/
 SRCS+= cpt_err.c
 SRCS+= cryptlib.c
+SRCS+= crypto_ex_data.c
 SRCS+= crypto_init.c
 SRCS+= crypto_lock.c
 SRCS+= cversion.c
-SRCS+= ex_data.c
 SRCS+= malloc-wrapper.c
 SRCS+= mem_clr.c
 SRCS+= mem_dbg.c

lib/libcrypto/crypto_ex_data.c

@@ -0,0 +1,418 @@
+/* $OpenBSD: crypto_ex_data.c,v 1.2 2024/08/02 14:02:33 tb Exp $ */
+/*
+ * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <stdlib.h>
+
+#include <openssl/crypto.h>
+
+#define CRYPTO_EX_DATA_MAX_INDEX 16
+
+struct crypto_ex_data {
+	int class_index;
+	void **slots;
+	size_t slots_len;
+};
+
+struct crypto_ex_data_index {
+	CRYPTO_EX_new *new_func;
+	CRYPTO_EX_dup *dup_func;
+	CRYPTO_EX_free *free_func;
+	long argl;
+	void *argp;
+};
+
+struct crypto_ex_data_class {
+	struct crypto_ex_data_index **indexes;
+	size_t indexes_len;
+	size_t next_index;
+};
+
+static struct crypto_ex_data_class **classes;
+
+static int
+crypto_ex_data_classes_init(void)
+{
+	struct crypto_ex_data_class **classes_new = NULL;
+
+	if (classes != NULL)
+		return 1;
+
+	if ((classes_new = calloc(CRYPTO_EX_INDEX__COUNT,
+	    sizeof(struct crypto_ex_data_index))) == NULL)
+		return 0;
+
+	CRYPTO_w_lock(CRYPTO_LOCK_EX_DATA);
+	if (classes == NULL) {
+		classes = classes_new;
+		classes_new = NULL;
+	}
+	CRYPTO_w_unlock(CRYPTO_LOCK_EX_DATA);
+
+	free(classes_new);
+
+	return 1;
+}
+
+static struct crypto_ex_data_class *
+crypto_ex_data_class_lookup(int class_index)
+{
+	struct crypto_ex_data_class *class;
+
+	if (classes == NULL)
+		return NULL;
+	if (class_index < 0 || class_index >= CRYPTO_EX_INDEX__COUNT)
+		return NULL;
+
+	CRYPTO_r_lock(CRYPTO_LOCK_EX_DATA);
+	class = classes[class_index];
+	CRYPTO_r_unlock(CRYPTO_LOCK_EX_DATA);
+
+	return class;
+}
+
+int
+CRYPTO_get_ex_new_index(int class_index, long argl, void *argp,
+    CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+{
+	struct crypto_ex_data_class *new_class = NULL;
+	struct crypto_ex_data_index *index = NULL;
+	struct crypto_ex_data_class *class;
+	int idx = -1;
+
+	if (!crypto_ex_data_classes_init())
+		goto err;
+
+	if (class_index < 0 || class_index >= CRYPTO_EX_INDEX__COUNT)
+		goto err;
+
+	if ((class = classes[class_index]) == NULL) {
+		if ((new_class = calloc(1,
+		    sizeof(struct crypto_ex_data_class))) == NULL)
+			goto err;
+		if ((new_class->indexes = calloc(CRYPTO_EX_DATA_MAX_INDEX,
+                    sizeof(struct crypto_ex_data_index))) == NULL)
+			goto err;
+		new_class->indexes_len = CRYPTO_EX_DATA_MAX_INDEX;
+		new_class->next_index = 1;
+
+		CRYPTO_w_lock(CRYPTO_LOCK_EX_DATA);
+		if (classes[class_index] == NULL) {
+			classes[class_index] = new_class;
+			new_class = NULL;
+		}
+		CRYPTO_w_unlock(CRYPTO_LOCK_EX_DATA);
+
+		class = classes[class_index];
+	}
+
+	if ((index = calloc(1, sizeof(struct crypto_ex_data_index))) == NULL)
+		goto err;
+
+	index->new_func = new_func;
+	index->dup_func = dup_func;
+	index->free_func = free_func;
+
+	index->argl = argl;
+	index->argp = argp;
+
+	CRYPTO_w_lock(CRYPTO_LOCK_EX_DATA);
+	if (class->next_index < class->indexes_len) {
+		idx = class->next_index++;
+		class->indexes[idx] = index;
+		index = NULL;
+	}
+	CRYPTO_w_unlock(CRYPTO_LOCK_EX_DATA);
+
+
+ err:
+	if (new_class != NULL) {
+		free(new_class->indexes);
+		free(new_class);
+	}
+	free(index);
+
+	return idx;
+}
+LCRYPTO_ALIAS(CRYPTO_get_ex_new_index);
+
+void
+CRYPTO_cleanup_all_ex_data(void)
+{
+	struct crypto_ex_data_class *class;
+	int i, j;
+
+	if (classes == NULL)
+		return;
+
+	for (i = 0; i < CRYPTO_EX_INDEX__COUNT; i++) {
+		if ((class = classes[i]) == NULL)
+			continue;
+
+		if (class->indexes != NULL) {
+			for (j = 0; j < CRYPTO_EX_DATA_MAX_INDEX; j++)
+				free(class->indexes[j]);
+			free(class->indexes);
+		}
+
+		free(class);
+	}
+
+	free(classes);
+	classes = NULL;
+}
+LCRYPTO_ALIAS(CRYPTO_cleanup_all_ex_data);
+
+static void
+crypto_ex_data_clear(CRYPTO_EX_DATA *exdata)
+{
+	struct crypto_ex_data *ced;
+
+	if (exdata == NULL)
+		return;
+
+	if ((ced = exdata->sk) != NULL) {
+		freezero(ced->slots, ced->slots_len * sizeof(void *));
+		freezero(ced, sizeof(*ced));
+	}
+
+	exdata->sk = NULL;
+}
+
+static int
+crypto_ex_data_init(CRYPTO_EX_DATA *exdata)
+{
+	struct crypto_ex_data *ced = NULL;
+
+	if (exdata->sk != NULL)
+		goto err;
+
+	if ((ced = calloc(1, sizeof(struct crypto_ex_data))) == NULL)
+		goto err;
+
+	ced->class_index = -1;
+
+	if ((ced->slots = calloc(CRYPTO_EX_DATA_MAX_INDEX, sizeof(void *))) == NULL)
+		goto err;
+	ced->slots_len = CRYPTO_EX_DATA_MAX_INDEX;
+
+	exdata->sk = ced;
+
+	return 1;
+
+ err:
+	if (ced != NULL) {
+		free(ced->slots);
+		free(ced);
+	}
+	crypto_ex_data_clear(exdata);
+
+	return 0;
+}
+
+int
+CRYPTO_new_ex_data(int class_index, void *parent, CRYPTO_EX_DATA *exdata)
+{
+	struct crypto_ex_data_class *class;
+	struct crypto_ex_data_index *index;
+	struct crypto_ex_data *ced;
+	size_t i, last_index;
+
+	if (!crypto_ex_data_init(exdata))
+		goto err;
+	if ((ced = exdata->sk) == NULL)
+		goto err;
+
+	if (!crypto_ex_data_classes_init())
+		goto err;
+	if ((class = crypto_ex_data_class_lookup(class_index)) == NULL)
+		goto done;
+
+	ced->class_index = class_index;
+
+	/* Existing indexes are immutable, we just have to know when to stop. */
+	CRYPTO_r_lock(CRYPTO_LOCK_EX_DATA);
+	last_index = class->next_index;
+	CRYPTO_r_unlock(CRYPTO_LOCK_EX_DATA);
+
+	for (i = 0; i < last_index; i++) {
+		if ((index = class->indexes[i]) == NULL)
+			continue;
+		if (index->new_func == NULL)
+			continue;
+		if (!index->new_func(parent, NULL, exdata, i, index->argl,
+		    index->argp))
+			goto err;
+	}
+
+ done:
+	return 1;
+
+ err:
+	CRYPTO_free_ex_data(class_index, parent, exdata);
+
+	return 0;
+}
+LCRYPTO_ALIAS(CRYPTO_new_ex_data);
+
+int
+CRYPTO_dup_ex_data(int class_index, CRYPTO_EX_DATA *dst, CRYPTO_EX_DATA *src)
+{
+	struct crypto_ex_data *dst_ced, *src_ced;
+	struct crypto_ex_data_class *class;
+	struct crypto_ex_data_index *index;
+	size_t i, last_index;
+	void *val;
+
+	if (dst == NULL || src == NULL)
+		goto err;
+
+	/*
+	 * Some code calls CRYPTO_new_ex_data() before dup, others never call
+	 * CRYPTO_new_ex_data()... so we get to handle both.
+	 */
+	/* XXX - parent == NULL? */
+	CRYPTO_free_ex_data(class_index, NULL, dst);
+
+	if (!crypto_ex_data_init(dst))
+		goto err;
+
+	if ((dst_ced = dst->sk) == NULL)
+		goto err;
+	if ((src_ced = src->sk) == NULL)
+		goto err;
+
+	if ((class = crypto_ex_data_class_lookup(class_index)) == NULL) {
+		for (i = 0; i < CRYPTO_EX_DATA_MAX_INDEX; i++)
+			dst_ced->slots[i] = src_ced->slots[i];
+		goto done;
+	}
+
+	OPENSSL_assert(src_ced->class_index == class_index);
+
+	dst_ced->class_index = class_index;
+
+	/* Existing indexes are immutable, we just have to know when to stop. */
+	CRYPTO_r_lock(CRYPTO_LOCK_EX_DATA);
+	last_index = class->next_index;
+	CRYPTO_r_unlock(CRYPTO_LOCK_EX_DATA);
+
+	for (i = 0; i < last_index; i++) {
+		if ((index = class->indexes[i]) == NULL)
+			continue;
+
+		/* If there is no dup function, we copy the pointer. */
+		val = src_ced->slots[i];
+		if (index->dup_func != NULL) {
+			if (!index->dup_func(dst, src, &val, i, index->argl,
+			    index->argp))
+				goto err;
+		}
+		/* If the dup function set data, we will potentially leak. */
+		if (dst_ced->slots[i] != NULL)
+			goto err;
+		dst_ced->slots[i] = val;
+	}
+
+ done:
+	return 1;
+
+ err:
+	/* XXX - parent == NULL? */
+	CRYPTO_free_ex_data(class_index, NULL, dst);
+
+	return 0;
+}
+LCRYPTO_ALIAS(CRYPTO_dup_ex_data);
+
+void
+CRYPTO_free_ex_data(int class_index, void *parent, CRYPTO_EX_DATA *exdata)
+{
+	struct crypto_ex_data_class *class;
+	struct crypto_ex_data_index *index;
+	struct crypto_ex_data *ced;
+	size_t i, last_index;
+
+	if (exdata == NULL)
+		return;
+	if ((ced = exdata->sk) == NULL)
+		goto done;
+	if (ced->class_index == -1)
+		goto done;
+
+	if ((class = crypto_ex_data_class_lookup(class_index)) == NULL)
+		goto done;
+
+	OPENSSL_assert(ced->class_index == class_index);
+
+	/* Existing indexes are immutable, we just have to know when to stop. */
+	CRYPTO_r_lock(CRYPTO_LOCK_EX_DATA);
+	last_index = class->next_index;
+	CRYPTO_r_unlock(CRYPTO_LOCK_EX_DATA);
+
+	for (i = 0; i < last_index; i++) {
+		if ((index = class->indexes[i]) == NULL)
+			continue;
+		if (index->free_func == NULL)
+			continue;
+		index->free_func(parent, ced->slots[i], exdata, i, index->argl,
+		    index->argp);
+	}
+
+ done:
+	crypto_ex_data_clear(exdata);
+}
+LCRYPTO_ALIAS(CRYPTO_free_ex_data);
+
+int
+CRYPTO_set_ex_data(CRYPTO_EX_DATA *exdata, int idx, void *val)
+{
+	struct crypto_ex_data *ced;
+
+	/*
+	 * Preserve horrible historical behaviour - allow set to work even if
+	 * new has not been called first.
+	 */
+	if ((ced = exdata->sk) == NULL) {
+		if (!crypto_ex_data_init(exdata))
+			return 0;
+		ced = exdata->sk;
+	}
+
+	/* XXX - consider preventing set for an unallocated index. */
+
+	if (idx < 0 || idx >= ced->slots_len)
+		return 0;
+
+	ced->slots[idx] = val;
+
+	return 1;
+}
+LCRYPTO_ALIAS(CRYPTO_set_ex_data);
+
+void *
+CRYPTO_get_ex_data(const CRYPTO_EX_DATA *exdata, int idx)
+{
+	struct crypto_ex_data *ced;
+
+	if ((ced = exdata->sk) == NULL)
+		return NULL;
+	if (idx < 0 || idx >= ced->slots_len)
+		return NULL;
+
+	return ced->slots[idx];
+}
+LCRYPTO_ALIAS(CRYPTO_get_ex_data);

lib/libcrypto/ex_data.c

@@ -1,637 +0,0 @@
-/* $OpenBSD: ex_data.c,v 1.23 2023/07/28 10:19:20 tb Exp $ */
-
-/*
- * Overhaul notes;
- *
- * This code is now *mostly* thread-safe. It is now easier to understand in what
- * ways it is safe and in what ways it is not, which is an improvement. Firstly,
- * all per-class stacks and index-counters for ex_data are stored in the same
- * global LHASH table (keyed by class). This hash table uses locking for all
- * access with the exception of CRYPTO_cleanup_all_ex_data(), which must only be
- * called when no other threads can possibly race against it (even if it was
- * locked, the race would mean it's possible the hash table might have been
- * recreated after the cleanup). As classes can only be added to the hash table,
- * and within each class, the stack of methods can only be incremented, the
- * locking mechanics are simpler than they would otherwise be. For example, the
- * new/dup/free ex_data functions will lock the hash table, copy the method
- * pointers it needs from the relevant class, then unlock the hash table before
- * actually applying those method pointers to the task of the new/dup/free
- * operations. As they can't be removed from the method-stack, only
- * supplemented, there's no race conditions associated with using them outside
- * the lock. The get/set_ex_data functions are not locked because they do not
- * involve this global state at all - they operate directly with a previously
- * obtained per-class method index and a particular "ex_data" variable. These
- * variables are usually instantiated per-context (eg. each RSA structure has
- * one) so locking on read/write access to that variable can be locked locally
- * if required (eg. using the "RSA" lock to synchronise access to a
- * per-RSA-structure ex_data variable if required).
- * [Geoff]
- */
-
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-/* ====================================================================
- * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <openssl/err.h>
-#include <openssl/lhash.h>
-
-typedef struct crypto_ex_data_func_st {
-	long argl;	/* Arbitrary long */
-	void *argp;	/* Arbitrary void * */
-	CRYPTO_EX_new *new_func;
-	CRYPTO_EX_free *free_func;
-	CRYPTO_EX_dup *dup_func;
-} CRYPTO_EX_DATA_FUNCS;
-
-DECLARE_STACK_OF(CRYPTO_EX_DATA_FUNCS)
-
-#define sk_CRYPTO_EX_DATA_FUNCS_new_null() SKM_sk_new_null(CRYPTO_EX_DATA_FUNCS)
-#define sk_CRYPTO_EX_DATA_FUNCS_num(st) SKM_sk_num(CRYPTO_EX_DATA_FUNCS, (st))
-#define sk_CRYPTO_EX_DATA_FUNCS_value(st, i) SKM_sk_value(CRYPTO_EX_DATA_FUNCS, (st), (i))
-#define sk_CRYPTO_EX_DATA_FUNCS_set(st, i, val) SKM_sk_set(CRYPTO_EX_DATA_FUNCS, (st), (i), (val))
-#define sk_CRYPTO_EX_DATA_FUNCS_push(st, val) SKM_sk_push(CRYPTO_EX_DATA_FUNCS, (st), (val))
-#define sk_CRYPTO_EX_DATA_FUNCS_pop_free(st, free_func) SKM_sk_pop_free(CRYPTO_EX_DATA_FUNCS, (st), (free_func))
-
-/* An opaque type representing an implementation of "ex_data" support */
-typedef struct st_CRYPTO_EX_DATA_IMPL	CRYPTO_EX_DATA_IMPL;
-
-/* What an "implementation of ex_data functionality" looks like */
-struct st_CRYPTO_EX_DATA_IMPL {
-	/*********************/
-	/* GLOBAL OPERATIONS */
-	/* Return a new class index */
-	int (*cb_new_class)(void);
-	/* Cleanup all state used by the implementation */
-	void (*cb_cleanup)(void);
-	/************************/
-	/* PER-CLASS OPERATIONS */
-	/* Get a new method index within a class */
-	int (*cb_get_new_index)(int class_index, long argl, void *argp,
-	    CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func,
-	    CRYPTO_EX_free *free_func);
-	/* Initialise a new CRYPTO_EX_DATA of a given class */
-	int (*cb_new_ex_data)(int class_index, void *obj,
-	    CRYPTO_EX_DATA *ad);
-	/* Duplicate a CRYPTO_EX_DATA of a given class onto a copy */
-	int (*cb_dup_ex_data)(int class_index, CRYPTO_EX_DATA *to,
-	    CRYPTO_EX_DATA *from);
-	/* Cleanup a CRYPTO_EX_DATA of a given class */
-	void (*cb_free_ex_data)(int class_index, void *obj,
-	    CRYPTO_EX_DATA *ad);
-};
-
-/* The implementation we use at run-time */
-static const CRYPTO_EX_DATA_IMPL *impl = NULL;
-
-/* To call "impl" functions, use this macro rather than referring to 'impl' directly, eg.
- * EX_IMPL(get_new_index)(...);
-*/
-#define EX_IMPL(a) impl->cb_##a
-
-/* Predeclare the "default" ex_data implementation */
-static int int_new_class(void);
-static void int_cleanup(void);
-static int int_get_new_index(int class_index, long argl, void *argp,
-    CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func,
-    CRYPTO_EX_free *free_func);
-static int int_new_ex_data(int class_index, void *obj,
-    CRYPTO_EX_DATA *ad);
-static int int_dup_ex_data(int class_index, CRYPTO_EX_DATA *to,
-    CRYPTO_EX_DATA *from);
-static void int_free_ex_data(int class_index, void *obj,
-    CRYPTO_EX_DATA *ad);
-
-static CRYPTO_EX_DATA_IMPL impl_default = {
-	int_new_class,
-	int_cleanup,
-	int_get_new_index,
-	int_new_ex_data,
-	int_dup_ex_data,
-	int_free_ex_data
-};
-
-/* Internal function that checks whether "impl" is set and if not, sets it to
- * the default. */
-static void
-impl_check(void)
-{
-	CRYPTO_w_lock(CRYPTO_LOCK_EX_DATA);
-	if (!impl)
-		impl = &impl_default;
-	CRYPTO_w_unlock(CRYPTO_LOCK_EX_DATA);
-}
-/* A macro wrapper for impl_check that first uses a non-locked test before
- * invoking the function (which checks again inside a lock). */
-#define IMPL_CHECK if(!impl) impl_check();
-
-/****************************************************************************/
-/* Interal (default) implementation of "ex_data" support. API functions are
- * further down. */
-
-/* The type that represents what each "class" used to implement locally. A STACK
- * of CRYPTO_EX_DATA_FUNCS plus a index-counter. The 'class_index' is the global
- * value representing the class that is used to distinguish these items. */
-typedef struct st_ex_class_item {
-	int class_index;
-	STACK_OF(CRYPTO_EX_DATA_FUNCS) *meth;
-	int meth_num;
-} EX_CLASS_ITEM;
-
-/* When assigning new class indexes, this is our counter */
-#define CRYPTO_EX_INDEX_USER		100
-static int ex_class = CRYPTO_EX_INDEX_USER;
-
-/* The global hash table of EX_CLASS_ITEM items */
-DECLARE_LHASH_OF(EX_CLASS_ITEM);
-static LHASH_OF(EX_CLASS_ITEM) *ex_data = NULL;
-
-/* The callbacks required in the "ex_data" hash table */
-static unsigned long
-ex_class_item_hash(const EX_CLASS_ITEM *a)
-{
-	return a->class_index;
-}
-
-static IMPLEMENT_LHASH_HASH_FN(ex_class_item, EX_CLASS_ITEM)
-
-static int
-ex_class_item_cmp(const EX_CLASS_ITEM *a, const EX_CLASS_ITEM *b)
-{
-	return a->class_index - b->class_index;
-}
-
-static IMPLEMENT_LHASH_COMP_FN(ex_class_item, EX_CLASS_ITEM)
-
-/* Internal functions used by the "impl_default" implementation to access the
- * state */
-
-static int
-ex_data_check(void)
-{
-	int toret = 1;
-	CRYPTO_w_lock(CRYPTO_LOCK_EX_DATA);
-	if (!ex_data &&
-	    (ex_data = lh_EX_CLASS_ITEM_new()) == NULL)
-		toret = 0;
-	CRYPTO_w_unlock(CRYPTO_LOCK_EX_DATA);
-	return toret;
-}
-/* This macros helps reduce the locking from repeated checks because the
- * ex_data_check() function checks ex_data again inside a lock. */
-#define EX_DATA_CHECK(iffail) if(!ex_data && !ex_data_check()) {iffail}
-
-/* This "inner" callback is used by the callback function that follows it */
-static void
-def_cleanup_util_cb(CRYPTO_EX_DATA_FUNCS *funcs)
-{
-	free(funcs);
-}
-
-/* This callback is used in lh_doall to destroy all EX_CLASS_ITEM values from
- * "ex_data" prior to the ex_data hash table being itself destroyed. Doesn't do
- * any locking. */
-static void
-def_cleanup_cb(void *a_void)
-{
-	EX_CLASS_ITEM *item = (EX_CLASS_ITEM *)a_void;
-	sk_CRYPTO_EX_DATA_FUNCS_pop_free(item->meth, def_cleanup_util_cb);
-	free(item);
-}
-
-/* Return the EX_CLASS_ITEM from the "ex_data" hash table that corresponds to a
- * given class. Handles locking. */
-static EX_CLASS_ITEM *
-def_get_class(int class_index)
-{
-	EX_CLASS_ITEM d, *p, *gen;
-	EX_DATA_CHECK(return NULL;)
-	d.class_index = class_index;
-	if (!OPENSSL_init_crypto(0, NULL))
-		return NULL;
-	CRYPTO_w_lock(CRYPTO_LOCK_EX_DATA);
-	p = lh_EX_CLASS_ITEM_retrieve(ex_data, &d);
-	if (!p) {
-		gen = malloc(sizeof(EX_CLASS_ITEM));
-		if (gen) {
-			gen->class_index = class_index;
-			gen->meth_num = 1;
-			gen->meth = sk_CRYPTO_EX_DATA_FUNCS_new_null();
-			if (!gen->meth)
-				free(gen);
-			else {
-				/* Because we're inside the ex_data lock, the
-				 * return value from the insert will be NULL */
-				(void)lh_EX_CLASS_ITEM_insert(ex_data, gen);
-				p = gen;
-			}
-		}
-	}
-	CRYPTO_w_unlock(CRYPTO_LOCK_EX_DATA);
-	if (!p)
-		CRYPTOerror(ERR_R_MALLOC_FAILURE);
-	return p;
-}
-
-/* Add a new method to the given EX_CLASS_ITEM and return the corresponding
- * index (or -1 for error). Handles locking. */
-static int
-def_add_index(EX_CLASS_ITEM *item, long argl, void *argp,
-    CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
-{
-	int toret = -1;
-	CRYPTO_EX_DATA_FUNCS *a = malloc(sizeof(CRYPTO_EX_DATA_FUNCS));
-
-	if (!a) {
-		CRYPTOerror(ERR_R_MALLOC_FAILURE);
-		return -1;
-	}
-	a->argl = argl;
-	a->argp = argp;
-	a->new_func = new_func;
-	a->dup_func = dup_func;
-	a->free_func = free_func;
-	CRYPTO_w_lock(CRYPTO_LOCK_EX_DATA);
-	while (sk_CRYPTO_EX_DATA_FUNCS_num(item->meth) <= item->meth_num) {
-		if (!sk_CRYPTO_EX_DATA_FUNCS_push(item->meth, NULL)) {
-			CRYPTOerror(ERR_R_MALLOC_FAILURE);
-			free(a);
-			goto err;
-		}
-	}
-	toret = item->meth_num++;
-	(void)sk_CRYPTO_EX_DATA_FUNCS_set(item->meth, toret, a);
-err:
-	CRYPTO_w_unlock(CRYPTO_LOCK_EX_DATA);
-	return toret;
-}
-
-/**************************************************************/
-/* The functions in the default CRYPTO_EX_DATA_IMPL structure */
-
-static int
-int_new_class(void)
-{
-	int toret;
-
-	CRYPTO_w_lock(CRYPTO_LOCK_EX_DATA);
-	toret = ex_class++;
-	CRYPTO_w_unlock(CRYPTO_LOCK_EX_DATA);
-	return toret;
-}
-
-static void
-int_cleanup(void)
-{
-	EX_DATA_CHECK(return;)
-	lh_EX_CLASS_ITEM_doall(ex_data, def_cleanup_cb);
-	lh_EX_CLASS_ITEM_free(ex_data);
-	ex_data = NULL;
-	impl = NULL;
-}
-
-static int
-int_get_new_index(int class_index, long argl, void *argp,
-    CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func,
-    CRYPTO_EX_free *free_func)
-{
-	EX_CLASS_ITEM *item = def_get_class(class_index);
-
-	if (!item)
-		return -1;
-	return def_add_index(item, argl, argp, new_func, dup_func, free_func);
-}
-
-/* Thread-safe by copying a class's array of "CRYPTO_EX_DATA_FUNCS" entries in
- * the lock, then using them outside the lock. NB: Thread-safety only applies to
- * the global "ex_data" state (ie. class definitions), not thread-safe on 'ad'
- * itself. */
-static int
-int_new_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad)
-{
-	int mx, i;
-	void *ptr;
-	CRYPTO_EX_DATA_FUNCS **storage = NULL;
-	EX_CLASS_ITEM *item = def_get_class(class_index);
-
-	if (!item)
-		/* error is already set */
-		return 0;
-	ad->sk = NULL;
-	CRYPTO_r_lock(CRYPTO_LOCK_EX_DATA);
-	mx = sk_CRYPTO_EX_DATA_FUNCS_num(item->meth);
-	if (mx > 0) {
-		storage = reallocarray(NULL, mx, sizeof(CRYPTO_EX_DATA_FUNCS*));
-		if (!storage)
-			goto skip;
-		for (i = 0; i < mx; i++)
-			storage[i] = sk_CRYPTO_EX_DATA_FUNCS_value(
-			    item->meth, i);
-	}
-skip:
-	CRYPTO_r_unlock(CRYPTO_LOCK_EX_DATA);
-	if ((mx > 0) && !storage) {
-		CRYPTOerror(ERR_R_MALLOC_FAILURE);
-		return 0;
-	}
-	for (i = 0; i < mx; i++) {
-		if (storage[i] && storage[i]->new_func) {
-			ptr = CRYPTO_get_ex_data(ad, i);
-			storage[i]->new_func(obj, ptr, ad, i,
-			    storage[i]->argl, storage[i]->argp);
-		}
-	}
-	free(storage);
-	return 1;
-}
-
-/* Same thread-safety notes as for "int_new_ex_data" */
-static int
-int_dup_ex_data(int class_index, CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from)
-{
-	int mx, j, i;
-	char *ptr;
-	CRYPTO_EX_DATA_FUNCS **storage = NULL;
-	EX_CLASS_ITEM *item;
-
-	if (!from->sk)
-		/* 'to' should be "blank" which *is* just like 'from' */
-		return 1;
-	if ((item = def_get_class(class_index)) == NULL)
-		return 0;
-	CRYPTO_r_lock(CRYPTO_LOCK_EX_DATA);
-	mx = sk_CRYPTO_EX_DATA_FUNCS_num(item->meth);
-	j = sk_void_num(from->sk);
-	if (j < mx)
-		mx = j;
-	if (mx > 0) {
-		storage = reallocarray(NULL, mx, sizeof(CRYPTO_EX_DATA_FUNCS*));
-		if (!storage)
-			goto skip;
-		for (i = 0; i < mx; i++)
-			storage[i] = sk_CRYPTO_EX_DATA_FUNCS_value(
-			    item->meth, i);
-	}
-skip:
-	CRYPTO_r_unlock(CRYPTO_LOCK_EX_DATA);
-	if ((mx > 0) && !storage) {
-		CRYPTOerror(ERR_R_MALLOC_FAILURE);
-		return 0;
-	}
-	for (i = 0; i < mx; i++) {
-		ptr = CRYPTO_get_ex_data(from, i);
-		if (storage[i] && storage[i]->dup_func)
-			storage[i]->dup_func(to, from, &ptr, i,
-			    storage[i]->argl, storage[i]->argp);
-		CRYPTO_set_ex_data(to, i, ptr);
-	}
-	free(storage);
-	return 1;
-}
-
-/* Same thread-safety notes as for "int_new_ex_data" */
-static void
-int_free_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad)
-{
-	int mx, i;
-	EX_CLASS_ITEM *item;
-	void *ptr;
-	CRYPTO_EX_DATA_FUNCS **storage = NULL;
-
-	if ((item = def_get_class(class_index)) == NULL)
-		return;
-	CRYPTO_r_lock(CRYPTO_LOCK_EX_DATA);
-	mx = sk_CRYPTO_EX_DATA_FUNCS_num(item->meth);
-	if (mx > 0) {
-		storage = reallocarray(NULL, mx, sizeof(CRYPTO_EX_DATA_FUNCS*));
-		if (!storage)
-			goto skip;
-		for (i = 0; i < mx; i++)
-			storage[i] = sk_CRYPTO_EX_DATA_FUNCS_value(
-			    item->meth, i);
-	}
-skip:
-	CRYPTO_r_unlock(CRYPTO_LOCK_EX_DATA);
-	if ((mx > 0) && !storage) {
-		CRYPTOerror(ERR_R_MALLOC_FAILURE);
-		return;
-	}
-	for (i = 0; i < mx; i++) {
-		if (storage[i] && storage[i]->free_func) {
-			ptr = CRYPTO_get_ex_data(ad, i);
-			storage[i]->free_func(obj, ptr, ad, i,
-			    storage[i]->argl, storage[i]->argp);
-		}
-	}
-	free(storage);
-	if (ad->sk) {
-		sk_void_free(ad->sk);
-		ad->sk = NULL;
-	}
-}
-
-/********************************************************************/
-/* API functions that defer all "state" operations to the "ex_data"
- * implementation we have set. */
-
-/* Release all "ex_data" state to prevent memory leaks. This can't be made
- * thread-safe without overhauling a lot of stuff, and shouldn't really be
- * called under potential race-conditions anyway (it's for program shutdown
- * after all). */
-void
-CRYPTO_cleanup_all_ex_data(void)
-{
-	IMPL_CHECK
-	EX_IMPL(cleanup)();
-}
-LCRYPTO_ALIAS(CRYPTO_cleanup_all_ex_data);
-
-/* Inside an existing class, get/register a new index. */
-int
-CRYPTO_get_ex_new_index(int class_index, long argl, void *argp,
-    CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
-{
-	int ret = -1;
-
-	IMPL_CHECK
-	ret = EX_IMPL(get_new_index)(class_index,
-	    argl, argp, new_func, dup_func, free_func);
-	return ret;
-}
-LCRYPTO_ALIAS(CRYPTO_get_ex_new_index);
-
-/* Initialise a new CRYPTO_EX_DATA for use in a particular class - including
- * calling new() callbacks for each index in the class used by this variable */
-int
-CRYPTO_new_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad)
-{
-	IMPL_CHECK
-	return EX_IMPL(new_ex_data)(class_index, obj, ad);
-}
-LCRYPTO_ALIAS(CRYPTO_new_ex_data);
-
-/* Duplicate a CRYPTO_EX_DATA variable - including calling dup() callbacks for
- * each index in the class used by this variable */
-int
-CRYPTO_dup_ex_data(int class_index, CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from)
-{
-	IMPL_CHECK
-	return EX_IMPL(dup_ex_data)(class_index, to, from);
-}
-LCRYPTO_ALIAS(CRYPTO_dup_ex_data);
-
-/* Cleanup a CRYPTO_EX_DATA variable - including calling free() callbacks for
- * each index in the class used by this variable */
-void
-CRYPTO_free_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad)
-{
-	IMPL_CHECK
-	EX_IMPL(free_ex_data)(class_index, obj, ad);
-}
-LCRYPTO_ALIAS(CRYPTO_free_ex_data);
-
-/* For a given CRYPTO_EX_DATA variable, set the value corresponding to a
- * particular index in the class used by this variable */
-int
-CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, void *val)
-{
-	int i;
-
-	if (ad->sk == NULL) {
-		if ((ad->sk = sk_void_new_null()) == NULL) {
-			CRYPTOerror(ERR_R_MALLOC_FAILURE);
-			return (0);
-		}
-	}
-	i = sk_void_num(ad->sk);
-
-	while (i <= idx) {
-		if (!sk_void_push(ad->sk, NULL)) {
-			CRYPTOerror(ERR_R_MALLOC_FAILURE);
-			return (0);
-		}
-		i++;
-	}
-	sk_void_set(ad->sk, idx, val);
-	return (1);
-}
-LCRYPTO_ALIAS(CRYPTO_set_ex_data);
-
-/* For a given CRYPTO_EX_DATA_ variable, get the value corresponding to a
- * particular index in the class used by this variable */
-void *
-CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx)
-{
-	if (ad->sk == NULL)
-		return (0);
-	else if (idx >= sk_void_num(ad->sk))
-		return (0);
-	else
-		return (sk_void_value(ad->sk, idx));
-}
-LCRYPTO_ALIAS(CRYPTO_get_ex_data);

lib/libtls/tls.h

@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.h,v 1.66 2024/03/27 07:35:30 joshua Exp $ */
+/* $OpenBSD: tls.h,v 1.67 2024/08/02 15:00:01 tb Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -33,8 +33,8 @@ extern "C" {
  * Deprecated versions of TLS. Using these effectively selects
  * the minimum supported version.
  */
-#define TLS_PROTOCOL_TLSv1_0	(1 << 3)
-#define TLS_PROTOCOL_TLSv1_1	(1 << 3)
+#define TLS_PROTOCOL_TLSv1_0	(1 << 1)
+#define TLS_PROTOCOL_TLSv1_1	(1 << 2)
 /* Supported versions of TLS */
 #define TLS_PROTOCOL_TLSv1_2	(1 << 3)
 #define TLS_PROTOCOL_TLSv1_3	(1 << 4)

lib/libtls/tls_config.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_config.c,v 1.70 2024/03/28 06:55:02 joshua Exp $ */
+/* $OpenBSD: tls_config.c,v 1.71 2024/08/02 15:00:01 tb Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -261,9 +261,9 @@ tls_config_parse_protocols(uint32_t *protocols, const char *protostr)
 		if (strcasecmp(p, "tlsv1") == 0)
 			proto = TLS_PROTOCOL_TLSv1;
 		else if (strcasecmp(p, "tlsv1.0") == 0)
-			proto = TLS_PROTOCOL_TLSv1_2;
+			proto = TLS_PROTOCOL_TLSv1_0;
 		else if (strcasecmp(p, "tlsv1.1") == 0)
-			proto = TLS_PROTOCOL_TLSv1_2;
+			proto = TLS_PROTOCOL_TLSv1_1;
 		else if (strcasecmp(p, "tlsv1.2") == 0)
 			proto = TLS_PROTOCOL_TLSv1_2;
 		else if (strcasecmp(p, "tlsv1.3") == 0)

lib/libz/Makefile

@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.22 2024/01/21 07:33:46 tb Exp $
+#	$OpenBSD: Makefile,v 1.23 2024/08/02 04:59:23 tb Exp $
 
 LIB=	z
 HDRS=	zconf.h zlib.h
@@ -7,6 +7,11 @@ SRCS=	adler32.c compress.c crc32.c deflate.c gzclose.c gzlib.c \
 	trees.c uncompr.c zutil.c
 MAN=	compress.3
 
+VERSION_SCRIPT=	Symbols.map
+SYMBOL_LIST=	${.CURDIR}/Symbols.list
+
+CLEANFILES+=	${VERSION_SCRIPT}
+
 PC_FILES=zlib.pc
 CLEANFILES+=${PC_FILES}
 
@@ -29,4 +34,9 @@ beforeinstall:
 	${INSTALL} ${INSTALL_COPY} -o root -g ${SHAREGRP} \
 	    -m ${SHAREMODE} ${.OBJDIR}/${PC_FILES} ${DESTDIR}/usr/lib/pkgconfig/
 
+${VERSION_SCRIPT}: ${SYMBOL_LIST}
+	{ printf '{\n\tglobal:\n'; \
+	  sed '/^[._a-zA-Z]/s/$$/;/; s/^/		/' ${SYMBOL_LIST}; \
+	  printf '\n\tlocal:\n\t\t*;\n};\n'; } >$@.tmp && mv $@.tmp $@
+
 .include <bsd.lib.mk>

lib/libz/Symbols.list

@@ -0,0 +1,90 @@
+adler32
+adler32_combine
+adler32_combine64
+adler32_z
+compress
+compress2
+compressBound
+crc32
+crc32_combine
+crc32_combine64
+crc32_combine_gen
+crc32_combine_gen64
+crc32_combine_op
+crc32_z
+deflate
+deflateBound
+deflateCopy
+deflateEnd
+deflateGetDictionary
+deflateInit2_
+deflateInit_
+deflateParams
+deflatePending
+deflatePrime
+deflateReset
+deflateResetKeep
+deflateSetDictionary
+deflateSetHeader
+deflateTune
+deflateUsed
+get_crc_table
+gzbuffer
+gzclearerr
+gzclose
+gzclose_r
+gzclose_w
+gzdirect
+gzdopen
+gzeof
+gzerror
+gzflush
+gzfread
+gzfwrite
+gzgetc
+gzgetc_
+gzgets
+gzoffset
+gzoffset64
+gzopen
+gzopen64
+gzprintf
+gzputc
+gzputs
+gzread
+gzrewind
+gzseek
+gzseek64
+gzsetparams
+gztell
+gztell64
+gzungetc
+gzvprintf
+gzwrite
+inflate
+inflateBack
+inflateBackEnd
+inflateBackInit_
+inflateCodesUsed
+inflateCopy
+inflateEnd
+inflateGetDictionary
+inflateGetHeader
+inflateInit2_
+inflateInit_
+inflateMark
+inflatePrime
+inflateReset
+inflateReset2
+inflateResetKeep
+inflateSetDictionary
+inflateSync
+inflateSyncPoint
+inflateUndermine
+inflateValidate
+uncompress
+uncompress2
+zError
+z_errmsg
+zlibCompileFlags
+zlibVersion

lib/libz/shlib_version

@@ -1,2 +1,2 @@
 major=7
-minor=0
+minor=1

regress/lib/libtls/config/configtest.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: configtest.c,v 1.3 2023/07/02 06:37:27 beck Exp $ */
+/* $OpenBSD: configtest.c,v 1.5 2024/08/02 16:02:35 tb Exp $ */
 /*
  * Copyright (c) 2017 Joel Sing <jsing@openbsd.org>
  *
@@ -71,27 +71,30 @@ struct parse_protocols_test parse_protocols_tests[] = {
 	{
 		.protostr = "tlsv1.0:tlsv1.1:tlsv1.2:tlsv1.3",
 		.want_return = 0,
-		.want_protocols = TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3,
+		.want_protocols = TLS_PROTOCOL_TLSv1_0 | TLS_PROTOCOL_TLSv1_1 |
+		    TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3,
 	},
 	{
 		.protostr = "tlsv1.0,tlsv1.1,tlsv1.2,tlsv1.3",
 		.want_return = 0,
-		.want_protocols = TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3,
+		.want_protocols = TLS_PROTOCOL_TLSv1_0 | TLS_PROTOCOL_TLSv1_1 |
+		    TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3,
 	},
 	{
 		.protostr = "tlsv1.1,tlsv1.2,tlsv1.0",
 		.want_return = 0,
-		.want_protocols = TLS_PROTOCOL_TLSv1_2,
+		.want_protocols = TLS_PROTOCOL_TLSv1_0 | TLS_PROTOCOL_TLSv1_1 |
+		    TLS_PROTOCOL_TLSv1_2,
 	},
 	{
 		.protostr = "tlsv1.1,tlsv1.2,tlsv1.1",
 		.want_return = 0,
-		.want_protocols = TLS_PROTOCOL_TLSv1_2,
+		.want_protocols = TLS_PROTOCOL_TLSv1_1 | TLS_PROTOCOL_TLSv1_2,
 	},
 	{
 		.protostr = "tlsv1.1,tlsv1.2,!tlsv1.1",
 		.want_return = 0,
-		.want_protocols = 0,
+		.want_protocols = TLS_PROTOCOL_TLSv1_2,
 	},
 	{
 		.protostr = "unknown",
@@ -111,17 +114,17 @@ struct parse_protocols_test parse_protocols_tests[] = {
 	{
 		.protostr = "all,!tlsv1.0",
 		.want_return = 0,
-		.want_protocols = TLS_PROTOCOL_TLSv1_3,
+		.want_protocols = TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3,
 	},
 	{
 		.protostr = "!tlsv1.0",
 		.want_return = 0,
-		.want_protocols = TLS_PROTOCOL_TLSv1_3,
+		.want_protocols = TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3,
 	},
 	{
 		.protostr = "!tlsv1.0,!tlsv1.1,!tlsv1.3",
 		.want_return = 0,
-		.want_protocols = 0,
+		.want_protocols = TLS_PROTOCOL_TLSv1_2,
 	},
 	{
 		.protostr = "!tlsv1.0,!tlsv1.1,tlsv1.2,!tlsv1.3",

regress/lib/libtls/gotls/tls.go

@@ -45,6 +45,8 @@ const (
 )
 
 var protocolNames = map[ProtocolVersion]string{
+	ProtocolTLSv10: "TLSv1",
+	ProtocolTLSv11: "TLSv1.1",
 	ProtocolTLSv12: "TLSv1.2",
 	ProtocolTLSv13: "TLSv1.3",
 	ProtocolsAll:   "all",

regress/lib/libtls/tls/tlstest.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: tlstest.c,v 1.15 2022/07/16 07:46:08 tb Exp $ */
+/* $OpenBSD: tlstest.c,v 1.16 2024/08/02 15:02:22 tb Exp $ */
 /*
  * Copyright (c) 2017 Joel Sing <jsing@openbsd.org>
  *
@@ -497,16 +497,15 @@ struct test_versions {
 static struct test_versions tls_test_versions[] = {
 	{"tlsv1.3", "all"},
 	{"tlsv1.2", "all"},
-	{"tlsv1.1", "all"},
-	{"tlsv1.0", "all"},
 	{"all", "tlsv1.3"},
 	{"all", "tlsv1.2"},
-	{"all", "tlsv1.1"},
-	{"all", "tlsv1.0"},
+	{"all:!tlsv1.1", "tlsv1.2"},
+	{"all:!tlsv1.2", "tlsv1.3"},
+	{"all:!tlsv1.3", "tlsv1.2"},
+	{"all:!tlsv1.2:!tlsv1.1", "tlsv1.3"},
+	{"all:!tlsv1.2:!tlsv1.1:!tlsv1.0", "tlsv1.3"},
 	{"tlsv1.3", "tlsv1.3"},
 	{"tlsv1.2", "tlsv1.2"},
-	{"tlsv1.1", "tlsv1.1"},
-	{"tlsv1.0", "tlsv1.0"},
 };
 
 #define N_TLS_VERSION_TESTS \

share/man/man4/qcgpio.4

@@ -1,4 +1,4 @@
-.\"	$OpenBSD: qcgpio.4,v 1.1 2022/11/10 12:36:38 patrick Exp $
+.\"	$OpenBSD: qcgpio.4,v 1.2 2024/08/01 21:55:48 mglocker Exp $
 .\"
 .\" Copyright (c) 2022 Mark Kettenis <kettenis@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: November 10 2022 $
+.Dd $Mdocdate: August 1 2024 $
 .Dt QCGPIO 4
 .Os
 .Sh NAME
@@ -22,6 +22,7 @@
 .Nd Qualcomm Snapdragon GPIO controller
 .Sh SYNOPSIS
 .Cd "qcgpio* at acpi?"
+.Cd "qcgpio* at fdt?"
 .Sh DESCRIPTION
 The
 .Nm

sys/dev/acpi/acpipwrres.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: acpipwrres.c,v 1.14 2024/07/14 10:48:55 kettenis Exp $ */
+/* $OpenBSD: acpipwrres.c,v 1.15 2024/08/02 09:28:35 kettenis Exp $ */
 
 /*
  * Copyright (c) 2013 Martin Pieuchot <mpi@openbsd.org>
@@ -148,7 +148,7 @@ acpipwrres_activate(struct device *self, int act)
 	struct acpipwrres_softc *sc = (struct acpipwrres_softc *)self;
 
 	switch (act) {
-	case DVACT_SUSPEND:
+	case DVACT_POWERDOWN:
 		if (sc->sc_cons_ref == 0 && sc->sc_state != ACPIPWRRES_OFF) {
 			aml_evalname(sc->sc_acpi, sc->sc_devnode, "_OFF", 0,
 			    NULL, NULL);

sys/dev/rnd.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: rnd.c,v 1.228 2024/06/14 10:17:05 claudio Exp $	*/
+/*	$OpenBSD: rnd.c,v 1.229 2024/08/02 01:53:21 guenther Exp $	*/
 
 /*
  * Copyright (c) 2011,2020 Theo de Raadt.
@@ -75,6 +75,7 @@
 #include <sys/msgbuf.h>
 #include <sys/mount.h>
 #include <sys/syscallargs.h>
+#include <sys/syslimits.h>
 
 #include <crypto/sha2.h>
 
@@ -814,11 +815,11 @@ sys_getentropy(struct proc *p, void *v, register_t *retval)
 		syscallarg(void *) buf;
 		syscallarg(size_t) nbyte;
 	} */ *uap = v;
-	char buf[256];
+	char buf[GETENTROPY_MAX];
 	int error;
 
 	if (SCARG(uap, nbyte) > sizeof(buf))
-		return (EIO);
+		return (EINVAL);
 	arc4random_buf(buf, SCARG(uap, nbyte));
 	if ((error = copyout(buf, SCARG(uap, buf), SCARG(uap, nbyte))) != 0)
 		return (error);

sys/kern/init_sysent.c

@@ -1,10 +1,10 @@
-/*	$OpenBSD: init_sysent.c,v 1.281 2024/05/18 05:21:02 guenther Exp $	*/
+/*	$OpenBSD: init_sysent.c,v 1.282 2024/08/02 14:35:56 mvs Exp $	*/
 
 /*
  * System call switch table.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.264 2024/05/18 05:20:22 guenther Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.265 2024/08/02 14:34:45 mvs Exp 
  */
 
 #include <sys/param.h>
@@ -441,7 +441,7 @@ const struct sysent sysent[] = {
 	    sys_nosys },			/* 200 = obsolete pad_truncate */
 	{ 0, 0, 0,
 	    sys_nosys },			/* 201 = obsolete pad_ftruncate */
-	{ 6, s(struct sys_sysctl_args), 0,
+	{ 6, s(struct sys_sysctl_args), SY_NOLOCK | 0,
 	    sys_sysctl },			/* 202 = sysctl */
 	{ 2, s(struct sys_mlock_args), 0,
 	    sys_mlock },			/* 203 = mlock */

sys/kern/kern_sysctl.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sysctl.c,v 1.429 2024/07/11 14:11:55 bluhm Exp $	*/
+/*	$OpenBSD: kern_sysctl.c,v 1.430 2024/08/02 14:34:45 mvs Exp $	*/
 /*	$NetBSD: kern_sysctl.c,v 1.17 1996/05/20 17:49:05 mrg Exp $	*/
 
 /*-
@@ -153,6 +153,11 @@ void fill_file(struct kinfo_file *, struct file *, struct filedesc *, int,
     struct vnode *, struct process *, struct proc *, struct socket *, int);
 void fill_kproc(struct process *, struct kinfo_proc *, struct proc *, int);
 
+int kern_sysctl_locked(int *, u_int, void *, size_t *, void *, size_t,
+	struct proc *);
+int hw_sysctl_locked(int *, u_int, void *, size_t *,void *, size_t,
+	struct proc *);
+
 int (*cpu_cpuspeed)(int *);
 
 /*
@@ -162,6 +167,45 @@ int (*cpu_cpuspeed)(int *);
 struct rwlock sysctl_lock = RWLOCK_INITIALIZER("sysctllk");
 struct rwlock sysctl_disklock = RWLOCK_INITIALIZER("sysctldlk");
 
+int
+sysctl_vslock(void *addr, size_t len)
+{
+	int error;
+
+	KERNEL_LOCK();
+	error = rw_enter(&sysctl_lock, RW_WRITE|RW_INTR);
+	if (error)
+		goto out;
+
+	if (addr) {
+		if (atop(len) > uvmexp.wiredmax - uvmexp.wired) {
+			error = ENOMEM;
+			goto out2;
+		}
+		error = uvm_vslock(curproc, addr, len, PROT_READ | PROT_WRITE);
+		if (error)
+			goto out2;
+	}
+
+	return (0);
+out2:
+	rw_exit_write(&sysctl_lock);
+out:
+	KERNEL_UNLOCK();
+	return (error);
+}
+
+void
+sysctl_vsunlock(void *addr, size_t len)
+{
+	KERNEL_ASSERT_LOCKED();
+
+	if (addr)
+		uvm_vsunlock(curproc, addr, len);
+	rw_exit_write(&sysctl_lock);
+	KERNEL_UNLOCK();
+}
+
 int
 sys_sysctl(struct proc *p, void *v, register_t *retval)
 {
@@ -198,9 +242,11 @@ sys_sysctl(struct proc *p, void *v, register_t *retval)
 
 	switch (name[0]) {
 	case CTL_KERN:
+		dolock = 0;
 		fn = kern_sysctl;
 		break;
 	case CTL_HW:
+		dolock = 0;
 		fn = hw_sysctl;
 		break;
 	case CTL_VM:
@@ -235,30 +281,18 @@ sys_sysctl(struct proc *p, void *v, register_t *retval)
 	if (SCARG(uap, oldlenp) &&
 	    (error = copyin(SCARG(uap, oldlenp), &oldlen, sizeof(oldlen))))
 		return (error);
-	if (SCARG(uap, old) != NULL) {
-		if ((error = rw_enter(&sysctl_lock, RW_WRITE|RW_INTR)) != 0)
+
+	if (dolock) {
+		error = sysctl_vslock(SCARG(uap, old), oldlen);
+		if (error)
 			return (error);
-		if (dolock) {
-			if (atop(oldlen) > uvmexp.wiredmax - uvmexp.wired) {
-				rw_exit_write(&sysctl_lock);
-				return (ENOMEM);
-			}
-			error = uvm_vslock(p, SCARG(uap, old), oldlen,
-			    PROT_READ | PROT_WRITE);
-			if (error) {
-				rw_exit_write(&sysctl_lock);
-				return (error);
-			}
-		}
 		savelen = oldlen;
 	}
 	error = (*fn)(&name[1], SCARG(uap, namelen) - 1, SCARG(uap, old),
 	    &oldlen, SCARG(uap, new), SCARG(uap, newlen), p);
-	if (SCARG(uap, old) != NULL) {
-		if (dolock)
-			uvm_vsunlock(p, SCARG(uap, old), savelen);
-		rw_exit_write(&sysctl_lock);
-	}
+	if (dolock)
+		sysctl_vsunlock(SCARG(uap, old), savelen);
+
 	if (error)
 		return (error);
 	if (SCARG(uap, oldlenp))
@@ -449,14 +483,18 @@ int
 kern_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
     size_t newlen, struct proc *p)
 {
-	int error, level, inthostid, stackgap;
-	dev_t dev;
-	extern int pool_debug;
+	int error;
+	size_t savelen;
 
 	/* dispatch the non-terminal nodes first */
 	if (namelen != 1) {
-		return kern_sysctl_dirs(name[0], name + 1, namelen - 1,
+		savelen = *oldlenp;
+		if ((error = sysctl_vslock(oldp, savelen)))
+			return (error);
+		error = kern_sysctl_dirs(name[0], name + 1, namelen - 1,
 		    oldp, oldlenp, newp, newlen, p);
+		sysctl_vsunlock(oldp, savelen);
+		return (error);
 	}
 
 	switch (name[0]) {
@@ -470,6 +508,45 @@ kern_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
 		return (sysctl_rdstring(oldp, oldlenp, newp, version));
 	case KERN_NUMVNODES:  /* XXX numvnodes is a long */
 		return (sysctl_rdint(oldp, oldlenp, newp, numvnodes));
+	case KERN_MBSTAT: {
+		extern struct cpumem *mbstat;
+		uint64_t counters[MBSTAT_COUNT];
+		struct mbstat mbs;
+		unsigned int i;
+
+		memset(&mbs, 0, sizeof(mbs));
+		counters_read(mbstat, counters, MBSTAT_COUNT, NULL);
+		for (i = 0; i < MBSTAT_TYPES; i++)
+			mbs.m_mtypes[i] = counters[i];
+
+		mbs.m_drops = counters[MBSTAT_DROPS];
+		mbs.m_wait = counters[MBSTAT_WAIT];
+		mbs.m_drain = counters[MBSTAT_DRAIN];
+
+		return (sysctl_rdstruct(oldp, oldlenp, newp,
+		    &mbs, sizeof(mbs)));
+	}
+	}
+
+	savelen = *oldlenp;
+	if ((error = sysctl_vslock(oldp, savelen)))
+		return (error);
+	error = kern_sysctl_locked(name, namelen, oldp, oldlenp,
+	    newp, newlen, p);
+	sysctl_vsunlock(oldp, savelen);
+
+	return (error);
+}
+
+int
+kern_sysctl_locked(int *name, u_int namelen, void *oldp, size_t *oldlenp,
+    void *newp, size_t newlen, struct proc *p)
+{
+	int error, level, inthostid, stackgap;
+	dev_t dev;
+	extern int pool_debug;
+
+	switch (name[0]) {
 	case KERN_SECURELVL:
 		level = securelevel;
 		if ((error = sysctl_int(oldp, oldlenp, newp, newlen, &level)) ||
@@ -516,24 +593,6 @@ kern_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
 		microboottime(&bt);
 		return (sysctl_rdstruct(oldp, oldlenp, newp, &bt, sizeof bt));
 	  }
-	case KERN_MBSTAT: {
-		extern struct cpumem *mbstat;
-		uint64_t counters[MBSTAT_COUNT];
-		struct mbstat mbs;
-		unsigned int i;
-
-		memset(&mbs, 0, sizeof(mbs));
-		counters_read(mbstat, counters, MBSTAT_COUNT, NULL);
-		for (i = 0; i < MBSTAT_TYPES; i++)
-			mbs.m_mtypes[i] = counters[i];
-
-		mbs.m_drops = counters[MBSTAT_DROPS];
-		mbs.m_wait = counters[MBSTAT_WAIT];
-		mbs.m_drain = counters[MBSTAT_DRAIN];
-
-		return (sysctl_rdstruct(oldp, oldlenp, newp,
-		    &mbs, sizeof(mbs)));
-	}
 	case KERN_MSGBUFSIZE:
 	case KERN_CONSBUFSIZE: {
 		struct msgbuf *mp;
@@ -682,7 +741,7 @@ hw_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
     size_t newlen, struct proc *p)
 {
 	extern char machine[], cpu_model[];
-	int err, cpuspeed;
+	int err;
 
 	/*
 	 * all sysctl names at this level except sensors and battery
@@ -705,36 +764,28 @@ hw_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
 		return (sysctl_rdint(oldp, oldlenp, newp,
 		    ptoa(physmem - uvmexp.wired)));
 	case HW_DISKNAMES:
-		err = sysctl_diskinit(0, p);
-		if (err)
-			return err;
-		if (disknames)
-			return (sysctl_rdstring(oldp, oldlenp, newp,
-			    disknames));
-		else
-			return (sysctl_rdstring(oldp, oldlenp, newp, ""));
 	case HW_DISKSTATS:
-		err = sysctl_diskinit(1, p);
-		if (err)
-			return err;
-		return (sysctl_rdstruct(oldp, oldlenp, newp, diskstats,
-		    disk_count * sizeof(struct diskstats)));
 	case HW_CPUSPEED:
-		if (!cpu_cpuspeed)
-			return (EOPNOTSUPP);
-		err = cpu_cpuspeed(&cpuspeed);
-		if (err)
-			return err;
-		return (sysctl_rdint(oldp, oldlenp, newp, cpuspeed));
 #ifndef	SMALL_KERNEL
 	case HW_SENSORS:
-		return (sysctl_sensors(name + 1, namelen - 1, oldp, oldlenp,
-		    newp, newlen));
 	case HW_SETPERF:
-		return (sysctl_hwsetperf(oldp, oldlenp, newp, newlen));
 	case HW_PERFPOLICY:
-		return (sysctl_hwperfpolicy(oldp, oldlenp, newp, newlen));
+	case HW_BATTERY:
 #endif /* !SMALL_KERNEL */
+	case HW_ALLOWPOWERDOWN:
+	case HW_UCOMNAMES:
+#ifdef __HAVE_CPU_TOPOLOGY
+	case HW_SMT:
+#endif
+	{
+		size_t savelen = *oldlenp;
+		if ((err = sysctl_vslock(oldp, savelen)))
+			return (err);
+		err = hw_sysctl_locked(name, namelen, oldp, oldlenp,
+		    newp, newlen, p);
+		sysctl_vsunlock(oldp, savelen);
+		return (err);
+	}
 	case HW_VENDOR:
 		if (hw_vendor)
 			return (sysctl_rdstring(oldp, oldlenp, newp,
@@ -768,6 +819,51 @@ hw_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
 	case HW_USERMEM64:
 		return (sysctl_rdquad(oldp, oldlenp, newp,
 		    ptoa((psize_t)physmem - uvmexp.wired)));
+	default:
+		return sysctl_bounded_arr(hw_vars, nitems(hw_vars), name,
+		    namelen, oldp, oldlenp, newp, newlen);
+	}
+	/* NOTREACHED */
+}
+
+int
+hw_sysctl_locked(int *name, u_int namelen, void *oldp, size_t *oldlenp,
+    void *newp, size_t newlen, struct proc *p)
+{
+	int err, cpuspeed;
+
+	switch (name[0]) {
+	case HW_DISKNAMES:
+		err = sysctl_diskinit(0, p);
+		if (err)
+			return err;
+		if (disknames)
+			return (sysctl_rdstring(oldp, oldlenp, newp,
+			    disknames));
+		else
+			return (sysctl_rdstring(oldp, oldlenp, newp, ""));
+	case HW_DISKSTATS:
+		err = sysctl_diskinit(1, p);
+		if (err)
+			return err;
+		return (sysctl_rdstruct(oldp, oldlenp, newp, diskstats,
+		    disk_count * sizeof(struct diskstats)));
+	case HW_CPUSPEED:
+		if (!cpu_cpuspeed)
+			return (EOPNOTSUPP);
+		err = cpu_cpuspeed(&cpuspeed);
+		if (err)
+			return err;
+		return (sysctl_rdint(oldp, oldlenp, newp, cpuspeed));
+#ifndef SMALL_KERNEL
+	case HW_SENSORS:
+		return (sysctl_sensors(name + 1, namelen - 1, oldp, oldlenp,
+		    newp, newlen));
+	case HW_SETPERF:
+		return (sysctl_hwsetperf(oldp, oldlenp, newp, newlen));
+	case HW_PERFPOLICY:
+		return (sysctl_hwperfpolicy(oldp, oldlenp, newp, newlen));
+#endif /* !SMALL_KERNEL */
 	case HW_ALLOWPOWERDOWN:
 		return (sysctl_securelevel_int(oldp, oldlenp, newp, newlen,
 		    &allowpowerdown));
@@ -788,8 +884,7 @@ hw_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
 		    newp, newlen));
 #endif
 	default:
-		return sysctl_bounded_arr(hw_vars, nitems(hw_vars), name,
-		    namelen, oldp, oldlenp, newp, newlen);
+		return (EOPNOTSUPP);
 	}
 	/* NOTREACHED */
 }

sys/kern/syscalls.c

@@ -1,10 +1,10 @@
-/*	$OpenBSD: syscalls.c,v 1.279 2024/05/18 05:21:02 guenther Exp $	*/
+/*	$OpenBSD: syscalls.c,v 1.280 2024/08/02 14:35:56 mvs Exp $	*/
 
 /*
  * System call names.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.264 2024/05/18 05:20:22 guenther Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.265 2024/08/02 14:34:45 mvs Exp 
  */
 
 const char *const syscallnames[] = {

sys/kern/syscalls.master

@@ -1,4 +1,4 @@
-;	$OpenBSD: syscalls.master,v 1.264 2024/05/18 05:20:22 guenther Exp $
+;	$OpenBSD: syscalls.master,v 1.265 2024/08/02 14:34:45 mvs Exp $
 ;	$NetBSD: syscalls.master,v 1.32 1996/04/23 10:24:21 mycroft Exp $
 
 ;	@(#)syscalls.master	8.2 (Berkeley) 1/13/94
@@ -361,7 +361,7 @@
 199	OBSOL		pad_lseek
 200	OBSOL		pad_truncate
 201	OBSOL		pad_ftruncate
-202	STD		{ int sys_sysctl(const int *name, u_int namelen, \
+202	STD NOLOCK	{ int sys_sysctl(const int *name, u_int namelen, \
 			    void *old, size_t *oldlenp, void *new, \
 			    size_t newlen); }
 203	STD		{ int sys_mlock(const void *addr, size_t len); }

sys/sys/syscall.h

@@ -1,10 +1,10 @@
-/*	$OpenBSD: syscall.h,v 1.278 2024/05/18 05:21:02 guenther Exp $	*/
+/*	$OpenBSD: syscall.h,v 1.279 2024/08/02 14:35:56 mvs Exp $	*/
 
 /*
  * System call numbers.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.264 2024/05/18 05:20:22 guenther Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.265 2024/08/02 14:34:45 mvs Exp 
  */
 
 /* syscall: "exit" ret: "void" args: "int" */

sys/sys/syscallargs.h

@@ -1,10 +1,10 @@
-/*	$OpenBSD: syscallargs.h,v 1.281 2024/05/18 05:21:02 guenther Exp $	*/
+/*	$OpenBSD: syscallargs.h,v 1.282 2024/08/02 14:35:56 mvs Exp $	*/
 
 /*
  * System call argument lists.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.264 2024/05/18 05:20:22 guenther Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.265 2024/08/02 14:34:45 mvs Exp 
  */
 
 #ifdef	syscallarg

sys/sys/sysctl.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: sysctl.h,v 1.236 2024/07/08 13:17:12 claudio Exp $	*/
+/*	$OpenBSD: sysctl.h,v 1.237 2024/08/02 14:34:45 mvs Exp $	*/
 /*	$NetBSD: sysctl.h,v 1.16 1996/04/09 20:55:36 cgd Exp $	*/
 
 /*
@@ -1049,6 +1049,9 @@ struct sysctl_bounded_args {
  */
 typedef int (sysctlfn)(int *, u_int, void *, size_t *, void *, size_t, struct proc *);
 
+int sysctl_vslock(void *, size_t);
+void sysctl_vsunlock(void *, size_t);
+
 int sysctl_int_lower(void *, size_t *, void *, size_t, int *);
 int sysctl_int(void *, size_t *, void *, size_t, int *);
 int sysctl_rdint(void *, size_t *, void *, int);

sys/sys/syslimits.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: syslimits.h,v 1.15 2022/02/22 16:58:08 deraadt Exp $	*/
+/*	$OpenBSD: syslimits.h,v 1.16 2024/08/02 01:53:21 guenther Exp $	*/
 /*	$NetBSD: syslimits.h,v 1.12 1995/10/05 05:26:19 thorpej Exp $	*/
 
 /*
@@ -76,4 +76,8 @@
 #define HOST_NAME_MAX		255	/* max hostname length w/o NUL */
 #endif
 
+#if __POSIX_VISIBLE >= 202405
+#define	GETENTROPY_MAX		  256	/* max bytes from getentropy(2) */
+#endif
+
 #define _MAXCOMLEN		24	/* includes NUL */

usr.sbin/npppd/npppd/npppd.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: npppd.c,v 1.55 2024/08/01 00:05:16 yasuoka Exp $ */
+/*	$OpenBSD: npppd.c,v 1.56 2024/08/02 12:43:55 yasuoka Exp $ */
 
 /*-
  * Copyright (c) 2005-2008,2009 Internet Initiative Japan Inc.
@@ -29,7 +29,7 @@
  * Next pppd(nppd). This file provides a npppd daemon process and operations
  * for npppd instance.
  * @author	Yasuoka Masahiko
- * $Id: npppd.c,v 1.55 2024/08/01 00:05:16 yasuoka Exp $
+ * $Id: npppd.c,v 1.56 2024/08/02 12:43:55 yasuoka Exp $
  */
 #include "version.h"
 #include <sys/param.h>	/* ALIGNED_POINTER */
@@ -608,7 +608,7 @@ npppd_reset_routing_table(npppd *_this, int pool_only)
 				if (is_first)
 					in_route_add(&snp->snp_addr,
 					    &snp->snp_mask, &loop,
-					    LOOPBACK_IFNAME, RTF_REJECT, 0);
+					    LOOPBACK_IFNAME, RTF_BLACKHOLE, 0);
 				break;
 
 			case SNP_PPP: