diff --git a/distrib/i386/ramdisk/list b/distrib/i386/ramdisk/list
index c211fd481..9f8a82bfb 100644
--- a/distrib/i386/ramdisk/list
+++ b/distrib/i386/ramdisk/list
@@ -1,4 +1,4 @@
-#	$OpenBSD: list,v 1.3 2021/07/18 15:18:48 deraadt Exp $
+#	$OpenBSD: list,v 1.4 2023/08/15 14:24:53 jsg Exp $
 
 SRCDIRS distrib/special
 
@@ -31,7 +31,6 @@ LINK	instbin					sbin/dmesg
 LINK	instbin					sbin/fdisk
 LINK	instbin					sbin/fsck
 LINK	instbin					sbin/fsck_ffs
-LINK	instbin					sbin/fsck_msdos
 LINK	instbin					sbin/ifconfig
 LINK	instbin					sbin/init
 LINK	instbin					sbin/kbd
@@ -39,7 +38,6 @@ LINK	instbin					sbin/mknod
 LINK	instbin					sbin/mount
 LINK	instbin					sbin/mount_cd9660
 LINK	instbin					sbin/mount_ffs
-LINK	instbin					sbin/mount_msdos
 LINK	instbin					sbin/newfs
 LINK	instbin					sbin/ping sbin/ping6
 LINK	instbin					sbin/reboot sbin/halt
diff --git a/distrib/notes/amd64/xfer b/distrib/notes/amd64/xfer
index accf30d3b..1f50dccd2 100644
--- a/distrib/notes/amd64/xfer
+++ b/distrib/notes/amd64/xfer
@@ -1,9 +1,9 @@
-dnl	$OpenBSD: xfer,v 1.17 2023/03/16 18:04:07 miod Exp $
+dnl	$OpenBSD: xfer,v 1.18 2023/08/15 14:37:26 jsg Exp $
 Installation is supported from several media types, including:
 
 	CD-ROM
 	FFS partitions
-	DOS (FAT) partitions
+	DOS (FAT) partitions (NOT supported if booting from floppy)
 	EXT2 partitions (NOT supported if booting from floppy)
 	Remote NFS partition (NOT supported if booting from floppy)
 	HTTP
diff --git a/distrib/notes/i386/xfer b/distrib/notes/i386/xfer
index 315d479c5..eeab4c80f 100644
--- a/distrib/notes/i386/xfer
+++ b/distrib/notes/i386/xfer
@@ -1,9 +1,9 @@
-dnl	$OpenBSD: xfer,v 1.35 2019/08/01 19:42:52 jmc Exp $
+dnl	$OpenBSD: xfer,v 1.36 2023/08/15 14:27:27 miod Exp $
 Installation is supported from several media types, including:
 
 	CD-ROM
 	FFS partitions
-	DOS (FAT) partitions
+	DOS (FAT) partitions (NOT supported if booting from floppy)
 	EXT2 partitions (NOT supported if booting from floppy)
 dnl	Remote NFS partition
 	HTTP
diff --git a/distrib/sets/lists/comp/mi b/distrib/sets/lists/comp/mi
index cae605669..7c5326199 100644
--- a/distrib/sets/lists/comp/mi
+++ b/distrib/sets/lists/comp/mi
@@ -1952,8 +1952,10 @@
 ./usr/share/man/man3/EVP_VerifyInit.3
 ./usr/share/man/man3/EVP_aes_128_cbc.3
 ./usr/share/man/man3/EVP_camellia_128_cbc.3
+./usr/share/man/man3/EVP_chacha20.3
 ./usr/share/man/man3/EVP_des_cbc.3
 ./usr/share/man/man3/EVP_rc4.3
+./usr/share/man/man3/EVP_sha3_224.3
 ./usr/share/man/man3/EVP_sm3.3
 ./usr/share/man/man3/EVP_sm4_cbc.3
 ./usr/share/man/man3/EVP_whirlpool.3
diff --git a/distrib/special/bioctl/Makefile b/distrib/special/bioctl/Makefile
index b6dadf225..557040406 100644
--- a/distrib/special/bioctl/Makefile
+++ b/distrib/special/bioctl/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:01 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:20 kn Exp $
 
 PROG=	bioctl
 SRCS=	bioctl.c
@@ -15,7 +15,5 @@ CDIAGFLAGS+=    -Wunused
 CDIAGFLAGS+=    -Wsign-compare
 CDIAGFLAGS+=    -Wshadow
 
-MAN=	bioctl.8
-
 .PATH:  ${.CURDIR}/../../../sbin/bioctl
 .include <bsd.prog.mk>
diff --git a/distrib/special/chmod/Makefile b/distrib/special/chmod/Makefile
index 950a2db1e..c1795ae2a 100644
--- a/distrib/special/chmod/Makefile
+++ b/distrib/special/chmod/Makefile
@@ -1,8 +1,7 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:01 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:20 kn Exp $
 
 PROG=	chmod
 CFLAGS+=-DSUPPORT_DOT
-MAN=	chmod.1 chgrp.1 chown.8 chflags.1
 LINKS=	${BINDIR}/chmod ${BINDIR}/chgrp \
 	${BINDIR}/chmod /sbin/chown
 
diff --git a/distrib/special/dhcpleased/Makefile b/distrib/special/dhcpleased/Makefile
index a881f3e8e..e76787d37 100644
--- a/distrib/special/dhcpleased/Makefile
+++ b/distrib/special/dhcpleased/Makefile
@@ -1,12 +1,10 @@
-#	$OpenBSD: Makefile,v 1.2 2021/06/18 11:46:06 florian Exp $
+#	$OpenBSD: Makefile,v 1.3 2023/08/14 08:56:20 kn Exp $
 
 PROG=	dhcpleased
 COPTS+=	-DSMALL
 .PATH:  ${.CURDIR}/../../../sbin/dhcpleased
 SRCS=	bpf.c checksum.c dhcpleased.c engine.c frontend.c
 
-MAN=
-
 LDADD+=	-levent -lutil
 DPADD+= ${LIBEVENT} ${LIBUTIL}
 
diff --git a/distrib/special/disklabel/Makefile b/distrib/special/disklabel/Makefile
index 38e61d3a3..0e1e9fae3 100644
--- a/distrib/special/disklabel/Makefile
+++ b/distrib/special/disklabel/Makefile
@@ -1,10 +1,9 @@
-#	$OpenBSD: Makefile,v 1.13 2021/09/21 18:36:09 bluhm Exp $
+#	$OpenBSD: Makefile,v 1.14 2023/08/14 08:56:20 kn Exp $
 
 PROG=	disklabel
 SRCS=	disklabel.c dkcksum.c editor.c manual.c
 DPADD=	${LIBUTIL}
 LDADD=	-lutil
-MAN=	disklabel.8 disklabel.5
 
 CLEANFILES += disklabel.cat8 manual.c
 
diff --git a/distrib/special/fdisk/Makefile b/distrib/special/fdisk/Makefile
index 9f09316c5..d63d9f2c9 100644
--- a/distrib/special/fdisk/Makefile
+++ b/distrib/special/fdisk/Makefile
@@ -1,5 +1,5 @@
 #
-#	$OpenBSD: Makefile,v 1.6 2022/05/23 16:58:11 krw Exp $
+#	$OpenBSD: Makefile,v 1.7 2023/08/14 08:56:20 kn Exp $
 #
 # Copyright (c) 1997 Tobias Weingartner
 #
@@ -38,8 +38,6 @@ manual.c:	fdisk.cat8
 	echo '};'; echo 'const int manpage_sz = sizeof(manpage);') > manual.c
 .endif
 
-MAN=	fdisk.8
-
 .if ${MACHINE} == "amd64" || ${MACHINE} == "i386" || ${MACHINE} == "landisk"
 CFLAGS += -DHAS_MBR
 .endif
diff --git a/distrib/special/fsck/Makefile b/distrib/special/fsck/Makefile
index 7bf702973..87375d73c 100644
--- a/distrib/special/fsck/Makefile
+++ b/distrib/special/fsck/Makefile
@@ -1,8 +1,7 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:20 kn Exp $
 
 PROG=	fsck
 SRCS=	fsck.c fsutil.c preen.c
-MAN=	fsck.8
 DPADD=	${LIBUTIL}
 LDADD=	-lutil
 
diff --git a/distrib/special/fsck_ext2fs/Makefile b/distrib/special/fsck_ext2fs/Makefile
index 62384f15e..764e7e6a4 100644
--- a/distrib/special/fsck_ext2fs/Makefile
+++ b/distrib/special/fsck_ext2fs/Makefile
@@ -1,7 +1,6 @@
-#	$OpenBSD: Makefile,v 1.2 2015/10/15 15:11:10 semarie Exp $
+#	$OpenBSD: Makefile,v 1.3 2023/08/14 08:56:20 kn Exp $
 
 PROG=	fsck_ext2fs
-MAN=    fsck_ext2fs.8
 SRCS=	dir.c inode.c main.c pass1.c pass1b.c pass2.c pass3.c pass4.c \
 	pass5.c fsutil.c setup.c utilities.c ext2fs_bswap.c
 CFLAGS+= -I${.CURDIR}/../../../sbin/fsck -DSMALL
diff --git a/distrib/special/fsck_ffs/Makefile b/distrib/special/fsck_ffs/Makefile
index 3ec683e5c..7e53f58d9 100644
--- a/distrib/special/fsck_ffs/Makefile
+++ b/distrib/special/fsck_ffs/Makefile
@@ -1,7 +1,6 @@
-#	$OpenBSD: Makefile,v 1.3 2018/06/25 16:29:00 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.4 2023/08/14 08:56:20 kn Exp $
 
 PROG=	fsck_ffs
-MAN=	fsck_ffs.8
 SRCS=	dir.c inode.c main.c pass1.c pass1b.c pass2.c pass3.c pass4.c \
 	pass5.c fsutil.c setup.c utilities.c ffs_subr.c ffs_tables.c
 CFLAGS+= -I${.CURDIR}/../../../sbin/fsck -DSMALL
diff --git a/distrib/special/fsck_msdos/Makefile b/distrib/special/fsck_msdos/Makefile
index 2217f918f..71ec70f4a 100644
--- a/distrib/special/fsck_msdos/Makefile
+++ b/distrib/special/fsck_msdos/Makefile
@@ -1,7 +1,6 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:20 kn Exp $
 
 PROG=	fsck_msdos
-MAN=	fsck_msdos.8
 SRCS=	main.c check.c boot.c fat.c dir.c fsutil.c
 .PATH: ${.CURDIR}/../../../sbin/fsck
 CFLAGS+= -I${.CURDIR}/../../../sbin/fsck
diff --git a/distrib/special/ksh/Makefile b/distrib/special/ksh/Makefile
index c4b76dbc6..9bac3c5f6 100644
--- a/distrib/special/ksh/Makefile
+++ b/distrib/special/ksh/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.7 2023/07/23 23:42:03 kn Exp $
+#	$OpenBSD: Makefile,v 1.8 2023/08/14 08:56:20 kn Exp $
 
 PROG=	ksh
 SRCS=	alloc.c c_ksh.c c_sh.c c_test.c c_ulimit.c edit.c emacs.c eval.c \
@@ -8,7 +8,6 @@ SRCS=	alloc.c c_ksh.c c_sh.c c_test.c c_ulimit.c edit.c emacs.c eval.c \
 
 DEFS=	-Wall -DEMACS -DSMALL
 CFLAGS+=${DEFS} -I. -I${.CURDIR}/../../../bin/ksh -I${.CURDIR}/../../../lib/libc/gen
-MAN=	ksh.1 sh.1
 
 LINKS=	${BINDIR}/ksh ${BINDIR}/rksh
 LINKS+=	${BINDIR}/ksh ${BINDIR}/sh
diff --git a/distrib/special/ln/Makefile b/distrib/special/ln/Makefile
index 5d1f233f5..352bc4b4d 100644
--- a/distrib/special/ln/Makefile
+++ b/distrib/special/ln/Makefile
@@ -1,7 +1,6 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:20 kn Exp $
 
 PROG=	ln
-MAN=	ln.1 symlink.7
 
 .PATH:	${.CURDIR}/../../../bin/ln
 .include <bsd.prog.mk>
diff --git a/distrib/special/mknod/Makefile b/distrib/special/mknod/Makefile
index bb7dd6f2f..e81e55aa9 100644
--- a/distrib/special/mknod/Makefile
+++ b/distrib/special/mknod/Makefile
@@ -1,7 +1,6 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:20 kn Exp $
 
 PROG=	mknod
-MAN=	mknod.8 mkfifo.1
 LINKS=	${BINDIR}/mknod ${BINDIR}/mkfifo
 
 .PATH:  ${.CURDIR}/../../../sbin/mknod
diff --git a/distrib/special/mount/Makefile b/distrib/special/mount/Makefile
index 05cc7cc94..d3c824873 100644
--- a/distrib/special/mount/Makefile
+++ b/distrib/special/mount/Makefile
@@ -1,11 +1,10 @@
-#	$OpenBSD: Makefile,v 1.2 2023/07/23 23:21:19 kn Exp $
+#	$OpenBSD: Makefile,v 1.3 2023/08/14 08:56:21 kn Exp $
 
 PROG=	mount
 SRCS=	mount.c
 COPTS+=	-DSMALL
 DPADD=	${LIBUTIL}
 LDADD=	-lutil
-MAN=	mount.8
 
 .PATH:	${.CURDIR}/../../../sbin/mount
 .include <bsd.prog.mk>
diff --git a/distrib/special/mount_cd9660/Makefile b/distrib/special/mount_cd9660/Makefile
index a296ae6e9..c27806a40 100644
--- a/distrib/special/mount_cd9660/Makefile
+++ b/distrib/special/mount_cd9660/Makefile
@@ -1,8 +1,7 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:21 kn Exp $
 
 PROG=	mount_cd9660
 SRCS=	mount_cd9660.c getmntopts.c
-MAN=	mount_cd9660.8
 
 MOUNT=	${.CURDIR}/../../../sbin/mount
 CFLAGS+= -I${MOUNT}
diff --git a/distrib/special/mount_ext2fs/Makefile b/distrib/special/mount_ext2fs/Makefile
index 2a46ad303..1333fba3e 100644
--- a/distrib/special/mount_ext2fs/Makefile
+++ b/distrib/special/mount_ext2fs/Makefile
@@ -1,8 +1,7 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:21 kn Exp $
 
 PROG=	mount_ext2fs
 SRCS=	mount_ext2fs.c getmntopts.c
-MAN=	mount_ext2fs.8
 
 MOUNT=	${.CURDIR}/../../../sbin/mount
 CFLAGS+= -I${MOUNT}
diff --git a/distrib/special/mount_ffs/Makefile b/distrib/special/mount_ffs/Makefile
index 8131b7cc2..3e018e125 100644
--- a/distrib/special/mount_ffs/Makefile
+++ b/distrib/special/mount_ffs/Makefile
@@ -1,8 +1,7 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:21 kn Exp $
 
 PROG=	mount_ffs
 SRCS=	mount_ffs.c getmntopts.c
-MAN=	mount_ffs.8
 
 MOUNT=	${.CURDIR}/../../../sbin/mount
 CFLAGS+= -I${MOUNT}
diff --git a/distrib/special/mount_msdos/Makefile b/distrib/special/mount_msdos/Makefile
index d48d1ab3b..272a251a5 100644
--- a/distrib/special/mount_msdos/Makefile
+++ b/distrib/special/mount_msdos/Makefile
@@ -1,8 +1,7 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:21 kn Exp $
 
 PROG=	mount_msdos
 SRCS=	mount_msdos.c getmntopts.c
-MAN=	mount_msdos.8
 
 MOUNT=	${.CURDIR}/../../../sbin/mount
 CFLAGS+= -I${MOUNT}
diff --git a/distrib/special/mount_nfs/Makefile b/distrib/special/mount_nfs/Makefile
index 9a08775f5..6e7b2d321 100644
--- a/distrib/special/mount_nfs/Makefile
+++ b/distrib/special/mount_nfs/Makefile
@@ -1,8 +1,7 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:21 kn Exp $
 
 PROG=	mount_nfs
 SRCS=	mount_nfs.c getmntopts.c
-MAN=	mount_nfs.8
 
 MOUNT=	${.CURDIR}/../../../sbin/mount
 CFLAGS+= -DNFS -I${MOUNT}
diff --git a/distrib/special/mount_udf/Makefile b/distrib/special/mount_udf/Makefile
index 0f079a27a..d2b7c3fcf 100644
--- a/distrib/special/mount_udf/Makefile
+++ b/distrib/special/mount_udf/Makefile
@@ -1,8 +1,7 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:21 kn Exp $
 
 PROG=	mount_udf
 SRCS=	mount_udf.c getmntopts.c
-MAN=	mount_udf.8
 
 MOUNT=	${.CURDIR}/../../../sbin/mount
 CFLAGS+= -I${MOUNT}
diff --git a/distrib/special/newfs_ext2fs/Makefile b/distrib/special/newfs_ext2fs/Makefile
index 998e8be68..c7f7199e3 100644
--- a/distrib/special/newfs_ext2fs/Makefile
+++ b/distrib/special/newfs_ext2fs/Makefile
@@ -1,7 +1,6 @@
-# $OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+# $OpenBSD: Makefile,v 1.2 2023/08/14 08:56:21 kn Exp $
 PROG=	newfs_ext2fs
 SRCS=	newfs_ext2fs.c mke2fs.c ext2fs_bswap.c
-MAN=	newfs_ext2fs.8
 
 .PATH:	${.CURDIR}/../../../sys/ufs/ext2fs
 DPADD+= ${LIBUTIL}
diff --git a/distrib/special/newfs_msdos/Makefile b/distrib/special/newfs_msdos/Makefile
index 1b6d44e0e..8dca54df1 100644
--- a/distrib/special/newfs_msdos/Makefile
+++ b/distrib/special/newfs_msdos/Makefile
@@ -1,8 +1,7 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:21 kn Exp $
 # $FreeBSD: src/sbin/newfs_msdos/Makefile,v 1.2 1999/08/28 00:13:52 peter Exp $
 
 PROG=	newfs_msdos
-MAN=	newfs_msdos.8
 DPADD=	${LIBUTIL}
 LDADD=	-lutil
 
diff --git a/distrib/special/pdisk/Makefile b/distrib/special/pdisk/Makefile
index 9e8913e59..7c7f0d457 100644
--- a/distrib/special/pdisk/Makefile
+++ b/distrib/special/pdisk/Makefile
@@ -1,4 +1,4 @@
-#	$Id: Makefile,v 1.10 2016/01/27 14:19:59 krw Exp $
+#	$Id: Makefile,v 1.11 2023/08/14 08:56:21 kn Exp $
 
 .if ${MACHINE} == "macppc"
 PROG=	pdisk
@@ -12,8 +12,5 @@ SRCS=	dump.c file_media.c io.c partition_map.c pdisk.c
 NOPROG=yes
 .endif
 
-MAN=	pdisk.8
-MANSUBDIR=macppc
-
 .PATH:  ${.CURDIR}/../../../sbin/pdisk
 .include <bsd.prog.mk>
diff --git a/distrib/special/reboot/Makefile b/distrib/special/reboot/Makefile
index 186846e4b..ed85f77b8 100644
--- a/distrib/special/reboot/Makefile
+++ b/distrib/special/reboot/Makefile
@@ -1,9 +1,8 @@
-#	$OpenBSD: Makefile,v 1.2 2016/03/30 06:38:40 jmc Exp $
+#	$OpenBSD: Makefile,v 1.3 2023/08/14 08:56:21 kn Exp $
 
 PROG=	reboot
 DPADD=	${LIBUTIL}
 LDADD=	-lutil
-MAN=	reboot.8
 LINKS=	${BINDIR}/reboot ${BINDIR}/halt
 
 .PATH:  ${.CURDIR}/../../../sbin/reboot
diff --git a/distrib/special/resolvd/Makefile b/distrib/special/resolvd/Makefile
index 8ce5f4a7f..1f28950c4 100644
--- a/distrib/special/resolvd/Makefile
+++ b/distrib/special/resolvd/Makefile
@@ -1,10 +1,8 @@
-#	$OpenBSD: Makefile,v 1.3 2021/06/18 11:43:38 florian Exp $
+#	$OpenBSD: Makefile,v 1.4 2023/08/14 08:56:21 kn Exp $
 
 PROG=	resolvd
 COPTS+=	-DSMALL
 .PATH:  ${.CURDIR}/../../../sbin/resolvd
 SRCS=   resolvd.c
 
-MAN=
-
 .include <bsd.prog.mk>
diff --git a/distrib/special/route/Makefile b/distrib/special/route/Makefile
index 35d8a8ef9..e575f956c 100644
--- a/distrib/special/route/Makefile
+++ b/distrib/special/route/Makefile
@@ -1,7 +1,6 @@
-#	$OpenBSD: Makefile,v 1.4 2017/10/17 19:31:56 naddy Exp $
+#	$OpenBSD: Makefile,v 1.5 2023/08/14 08:56:21 kn Exp $
 
 PROG=	route
-MAN=	route.8
 SRCS=	route.c show.c
 
 CFLAGS+=	-Wall -DSMALL
diff --git a/distrib/special/slaacd/Makefile b/distrib/special/slaacd/Makefile
index 1e59021a8..53ee96112 100644
--- a/distrib/special/slaacd/Makefile
+++ b/distrib/special/slaacd/Makefile
@@ -1,12 +1,10 @@
-#	$OpenBSD: Makefile,v 1.3 2021/03/20 16:36:52 kn Exp $
+#	$OpenBSD: Makefile,v 1.4 2023/08/14 08:56:21 kn Exp $
 
 PROG=	slaacd
 COPTS+=	-DSMALL
 .PATH:  ${.CURDIR}/../../../sbin/slaacd
 SRCS=	engine.c frontend.c slaacd.c
 
-MAN=
-
 YFLAGS=
 LDADD+=	-levent -lutil
 DPADD+= ${LIBEVENT} ${LIBUTIL}
diff --git a/distrib/special/sync/Makefile b/distrib/special/sync/Makefile
index bbc68ab86..4911f5a83 100644
--- a/distrib/special/sync/Makefile
+++ b/distrib/special/sync/Makefile
@@ -1,7 +1,6 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:03 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:21 kn Exp $
 
 PROG=	sync
-MAN=	sync.8
 
 .PATH:	${.CURDIR}/../../../bin/sync
 .include <bsd.prog.mk>
diff --git a/distrib/special/umount/Makefile b/distrib/special/umount/Makefile
index bb81f0a67..0207d72dc 100644
--- a/distrib/special/umount/Makefile
+++ b/distrib/special/umount/Makefile
@@ -1,7 +1,6 @@
-#	$OpenBSD: Makefile,v 1.1 2014/02/21 19:01:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/08/14 08:56:21 kn Exp $
 
 PROG=	umount
-MAN=	umount.8
 
 CFLAGS+= -DNO_NFS
 DPADD+=	${LIBUTIL}
diff --git a/lib/libc/arch/amd64/gen/Makefile.inc b/lib/libc/arch/amd64/gen/Makefile.inc
index 7dcd8bd9f..c9f2c976e 100644
--- a/lib/libc/arch/amd64/gen/Makefile.inc
+++ b/lib/libc/arch/amd64/gen/Makefile.inc
@@ -1,6 +1,6 @@
-#	$OpenBSD: Makefile.inc,v 1.13 2020/07/06 13:33:05 pirofti Exp $
+#	$OpenBSD: Makefile.inc,v 1.14 2023/08/13 06:55:37 miod Exp $
 
-SRCS+=	_setjmp.S fabs.S infinity.c ldexp.c modf.S nan.c setjmp.S \
+SRCS+=	_setjmp.S fabs.S infinity.c ldexp.c modf.c nan.c setjmp.S \
 	sigsetjmp.S
 SRCS+=	fpclassifyl.c isfinitel.c isinfl.c isnanl.c isnormall.c signbitl.c \
 	usertc.c
diff --git a/lib/libc/arch/amd64/gen/modf.S b/lib/libc/arch/amd64/gen/modf.S
deleted file mode 100644
index 394e682b0..000000000
--- a/lib/libc/arch/amd64/gen/modf.S
+++ /dev/null
@@ -1,94 +0,0 @@
-/*	$OpenBSD: modf.S,v 1.6 2018/07/03 23:14:05 mortimer Exp $	*/
-/*	$NetBSD: modf.S,v 1.1 2001/06/19 00:25:03 fvdl Exp $	*/
-
-/*-
- * Copyright (c) 1990 The Regents of the University of California.
- * All rights reserved.
- *
- * This code is derived from software contributed to Berkeley by
- * Sean Eric Fagan.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- *	from: @(#)modf.s	5.5 (Berkeley) 3/18/91
- */
-
-#include <machine/asm.h>
-
-/*
- * modf(value, iptr): return fractional part of value, and stores the
- * integral part into iptr (a pointer to double).
- *
- * Written by Sean Eric Fagan (sef@kithrup.COM)
- * Sun Mar 11 20:27:30 PST 1990
- */
-
-/* With CHOP mode on, frndint behaves as TRUNC does.  Useful. */
-ENTRY(modf)
-	RETGUARD_SETUP(modf, r11)
-
-	/*
-	 * Set chop mode.
-	 */
-	fnstcw	-12(%rsp)
-	movw	-12(%rsp),%dx
-	orw	$3072,%dx
-	movw	%dx,-16(%rsp)
-	fldcw	-16(%rsp)
-
-	/*
-	 * Get integral part.
-	 */
-	movsd	%xmm0,-24(%rsp)
-	fldl	-24(%rsp)
-	frndint
-	fstpl	-8(%rsp)
-
-	/*
-	 * Restore control word.
-	 */
-	fldcw	-12(%rsp)
-
-	/*
-	 * Store integral part.
-	 */
-	movsd	-8(%rsp),%xmm0
-	movsd	%xmm0,(%rdi)
-
-	/*
-	 * Get fractional part and return it.
-	 */
-	fldl	-24(%rsp)
-	fsubl	-8(%rsp)
-	fstpl	-8(%rsp)
-	movsd   -8(%rsp),%xmm0
-
-	RETGUARD_CHECK(modf, r11)
-	ret
-END(modf)
diff --git a/lib/libc/arch/i386/gen/Makefile.inc b/lib/libc/arch/i386/gen/Makefile.inc
index 30b5f8726..45d0108a1 100644
--- a/lib/libc/arch/i386/gen/Makefile.inc
+++ b/lib/libc/arch/i386/gen/Makefile.inc
@@ -1,7 +1,7 @@
-#	$OpenBSD: Makefile.inc,v 1.15 2020/07/06 13:33:05 pirofti Exp $
+#	$OpenBSD: Makefile.inc,v 1.16 2023/08/13 06:55:37 miod Exp $
 
 SRCS+=	_setjmp.S fabs.S infinity.c ldexp.c usertc.c \
-	modf.S nan.c setjmp.S sigsetjmp.S
+	modf.c nan.c setjmp.S sigsetjmp.S
 SRCS+=	fpclassifyl.c isfinitel.c isinfl.c isnanl.c isnormall.c signbitl.c
 SRCS+=	flt_rounds.S fpgetmask.S fpgetround.S fpgetsticky.S fpsetmask.S \
 	fpsetround.S fpsetsticky.S
diff --git a/lib/libc/arch/i386/gen/modf.S b/lib/libc/arch/i386/gen/modf.S
deleted file mode 100644
index 4b623611a..000000000
--- a/lib/libc/arch/i386/gen/modf.S
+++ /dev/null
@@ -1,68 +0,0 @@
-/* $OpenBSD: modf.S,v 1.7 2011/07/08 22:28:33 martynas Exp $ */
-/*-
- * Copyright (c) 1990 The Regents of the University of California.
- * All rights reserved.
- *
- * This code is derived from software contributed to Berkeley by
- * Sean Eric Fagan.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <machine/asm.h>
-
-/*
- * modf(value, iptr): return fractional part of value, and stores the
- * integral part into iptr (a pointer to double).
- *
- * Written by Sean Eric Fagan (sef@kithrup.COM)
- * Sun Mar 11 20:27:30 PST 1990
- */
-
-/* With CHOP mode on, frndint behaves as TRUNC does.  Useful. */
-ENTRY(modf)
-	pushl	%ebp
-	movl	%esp,%ebp
-	subl	$16,%esp
-	fnstcw	-12(%ebp)
-	movw	-12(%ebp),%dx
-	orw	$3072,%dx
-	movw	%dx,-16(%ebp)
-	fldcw	-16(%ebp)
-	fldl	8(%ebp)
-	frndint
-	fstpl	-8(%ebp)
-	fldcw	-12(%ebp)
-	movl	16(%ebp),%eax
-	movl	-8(%ebp),%edx
-	movl	-4(%ebp),%ecx
-	movl	%edx,(%eax)
-	movl	%ecx,4(%eax)
-	fldl	8(%ebp)
-	fsubl	-8(%ebp)
-	jmp	L1
-L1:
-	leave
-	ret
diff --git a/lib/libc/arch/mips64/gen/Makefile.inc b/lib/libc/arch/mips64/gen/Makefile.inc
index f3f889578..ca34aefd3 100644
--- a/lib/libc/arch/mips64/gen/Makefile.inc
+++ b/lib/libc/arch/mips64/gen/Makefile.inc
@@ -1,6 +1,6 @@
-#	$OpenBSD: Makefile.inc,v 1.13 2020/07/06 13:33:05 pirofti Exp $
+#	$OpenBSD: Makefile.inc,v 1.14 2023/08/13 06:55:37 miod Exp $
 
-SRCS+=	_setjmp.S fabs.S infinity.c ldexp.S modf.S nan.c usertc.c
+SRCS+=	_setjmp.S fabs.S infinity.c ldexp.S modf.c nan.c usertc.c
 SRCS+=	flt_rounds.c fpgetmask.c fpgetround.c fpgetsticky.c fpsetmask.c \
 	fpsetround.c fpsetsticky.c
 SRCS+=	fpclassifyl.c isfinitel.c isinfl.c isnanl.c isnormall.c signbitl.c
diff --git a/lib/libc/arch/mips64/gen/modf.S b/lib/libc/arch/mips64/gen/modf.S
deleted file mode 100644
index 029e70441..000000000
--- a/lib/libc/arch/mips64/gen/modf.S
+++ /dev/null
@@ -1,71 +0,0 @@
-/* $OpenBSD: modf.S,v 1.5 2011/07/08 22:28:33 martynas Exp $ */
-/*-
- * Copyright (c) 1991, 1993, 1995
- *	The Regents of the University of California.  All rights reserved.
- *
- * This code is derived from software contributed to Berkeley by
- * Ralph Campbell.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <machine/asm.h>
-
-/*
- * double modf(val, iptr)
- *	double val, *iptr;
- * returns: xxx and n (in *iptr) where val == n.xxx
- */
-LEAF(modf, 0)
-	.set	reorder
-	cfc1	t0, $31			# get the control register
-	li.d	$f2, 4503599627370496e0 # f2 <- 2^52
-
-	or	t1, t0, 0x3		# set rounding mode to round to zero
-	xor	t1, t1, 0x2		#  (i.e., 01)
-	ctc1	t1, $31
-
-	mov.d	$f0, $f12		# f0 <- f12
-	abs.d	$f4, $f12		# f4 <- |f12|
-	c.olt.d $f4, $f2		# f4 ? < f2 
-	bc1f	1f			# leave f0 alone if Nan, infinity 
-					# or >=2^52
-	c.eq.d	$f12,$f4		# was f12 positive ?
-	add.d	$f4,$f2,$f4		# round off to integer
-	bc1f	2f			# No -> will have to negate result
-	sub.d	$f0,$f4,$f2		# Remove fudge factor
-	j	1f			# integer fraction got
-2:	
-	sub.d	$f0,$f2,$f4		# Remove fudge factor and negate
-1:	
-	ctc1	t0, $31			# restore old rounding mode
-#ifdef __mips64
-	s.d	$f0, 0(a1)		# save the integer part
-#else
-	s.d	$f0, 0(a2)		# save the integer part
-#endif
-	sub.d	$f0, $f12, $f0		# subtract val - integer part
-	j	ra
-END(modf)
diff --git a/lib/libc/arch/sparc64/gen/Makefile.inc b/lib/libc/arch/sparc64/gen/Makefile.inc
index 6d19faf95..5cbb1e622 100644
--- a/lib/libc/arch/sparc64/gen/Makefile.inc
+++ b/lib/libc/arch/sparc64/gen/Makefile.inc
@@ -1,9 +1,9 @@
-#	$OpenBSD: Makefile.inc,v 1.16 2020/07/08 09:20:28 kettenis Exp $
+#	$OpenBSD: Makefile.inc,v 1.17 2023/08/13 06:55:37 miod Exp $
 
 SRCS+=	_setjmp.S fabs.S fixunsdfsi.S flt_rounds.c fpclassifyl.c \
 	fpgetmask.c fpgetround.c fpgetsticky.c fpsetmask.c \
 	fpsetround.c fpsetsticky.c infinity.c isfinitel.c \
-	isinfl.c isnanl.c isnormall.c ldexp.c usertc.c modf.S \
+	isinfl.c isnanl.c isnormall.c ldexp.c usertc.c modf.c \
 	mul.S nan.c setjmp.S signbitl.c sigsetjmp.S umul.S
 
 CFLAGS += -Wa,-Av9b
diff --git a/lib/libc/arch/sparc64/gen/modf.S b/lib/libc/arch/sparc64/gen/modf.S
deleted file mode 100644
index 4fa2ea515..000000000
--- a/lib/libc/arch/sparc64/gen/modf.S
+++ /dev/null
@@ -1,188 +0,0 @@
-/*	$OpenBSD: modf.S,v 1.7 2023/01/13 17:52:08 miod Exp $	*/
-/*	$NetBSD: modf.S,v 1.3 2000/11/01 23:32:41 eeh Exp $	*/
-
-/*
- * Copyright (c) 1992, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * This software was developed by the Computer Systems Engineering group
- * at Lawrence Berkeley Laboratory under DARPA contract BG 91-66 and
- * contributed to Berkeley.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <machine/asm.h>
-
-#include <machine/fsr.h>
-
-/*
- * double modf(double val, double *iptr)
- *
- * Returns the fractional part of `val', storing the integer part of
- * `val' in *iptr.  Both *iptr and the return value have the same sign
- * as `val'.
- *
- * Method:
- *
- * We use the fpu's normalization hardware to compute the integer portion
- * of the double precision argument.  Sun IEEE double precision numbers
- * have 52 bits of mantissa, 11 bits of exponent, and one bit of sign,
- * with the sign occupying bit 31 of word 0, and the exponent bits 30:20
- * of word 0.  Thus, values >= 2^52 are by definition integers.
- *
- * If we take a value that is in the range [+0..2^52) and add 2^52, all
- * of the fractional bits fall out and all of the integer bits are summed
- * with 2^52.  If we then subtract 2^52, we get those integer bits back.
- * This must be done with rounding set to `towards 0' or `towards -inf'.
- * `Toward -inf' fails when the value is 0 (we get -0 back)....
- *
- * Note that this method will work anywhere, but is machine dependent in
- * various aspects.
- *
- * Stack usage:
- *	4@[%fp + BIAS - 4]	saved %fsr
- *	4@[%fp + BIAS - 8]	new %fsr with rounding set to `towards 0'
- *	8@[%fp + BIAS - 16]	space for moving between %i and %f registers
- * Register usage:
- *	%f0:f1		double val;
- *	%l0		scratch
- *	%l1		sign bit (0x80000000)
- *	%i1		double *iptr;
- *	%f2:f3		`magic number' 2^52, in fpu registers
- *	%f4:f5		double v, in fpu registers
- *	%f6:f7		double temp.
- */
-
-	.section .rodata
-	.align	8
-Lmagic:
-	.word	0x43300000	! sign = 0, exponent = 52 + 1023, mantissa = 0
-	.word	0		! (i.e., .double 0r4503599627370496e+00)
-
-L0:
-	.word	0		! 0.0
-	.word	0
-
-	.text
-ENTRY(modf)
-	save	%sp, -CC64FSZ-16, %sp
-#ifdef __PIC__
-	PIC_PROLOGUE(%o5, %o4)
-#endif
-
-	/*
-	 * First, compute v = abs(val)
-	 */
-	fabsd	%f0, %f4		! %f4:f5 = v
-	fcmped	%fcc1, %f0, %f4		! %fcc1 = (val == abs(val))
-#ifdef __PIC__
-	set	Lmagic, %o4
-	ldx	[%o5 + %o4], %l0
-	ldd	[%l0], %f2
-#else
-	sethi	%hi(Lmagic), %l0
-	ldd	[%l0 + %lo(Lmagic)], %f2
-#endif
-
-	/*
-	 * Is %f4:f5 >= %f2:f3 ?  If so, it is all integer bits.
-	 * It is probably less, though.
-	 */
-	fcmped	%f4, %f2
-	fbuge	Lbig			! if >= (or unordered), go out
-	nop
-
-	/*
-	 * v < 2^52, so add 2^52, then subtract 2^52, but do it all
-	 * with rounding set towards zero.  We leave any enabled
-	 * traps enabled, but change the rounding mode.  This might
-	 * not be so good.  Oh well....
-	 */
-	st	%fsr, [%fp + BIAS - 4]	! %l5 = current FSR mode
-	set	FSR_RD, %l3		! %l3 = rounding direction mask
-	ld	[%fp + BIAS - 4], %l5
-	set	FSR_RD_RZ << FSR_RD_SHIFT, %l4
-	andn	%l5, %l3, %l6
-	or	%l6, %l4, %l6		! round towards zero, please
-	and	%l5, %l3, %l5		! save original rounding mode
-	st	%l6, [%fp + BIAS - 8]
-	ld	[%fp + BIAS - 8], %fsr
-
-	faddd	%f4, %f2, %f4		! %f4:f5 += 2^52
-	fsubd	%f4, %f2, %f4		! %f4:f5 -= 2^52
-
-	/*
-	 * Restore %fsr, but leave exceptions accrued.
-	 */
-	st	%fsr, [%fp + BIAS - 4]
-	ld	[%fp + BIAS - 4], %l6
-	andn	%l6, %l3, %l6		! %l6 = %fsr & ~FSR_RD;
-	or	%l5, %l6, %l5		! %l5 |= %l6;
-	st	%l5, [%fp + BIAS - 4]
-	ld	[%fp + BIAS - 4], %fsr	! restore %fsr, leaving accrued stuff
-
-	/*
-	 * Now insert the original sign in %f4:f5.
-	 * %fcc1 should still have the reults of (val == abs(val))
-	 * from above, so we use a conditional move on %fcc1 to: 
-	 *
-	 *	%f4 = (val == abs(val)) ? %f4 : -%f4
-	 *
-	 */
-	fnegd	%f4, %f6
-	fmovdnz	%fcc1, %f6, %f4
-1:
-
-	/*
-	 * The value in %f4:f5 is now the integer portion of the original
-	 * argument.  We need to store this in *ival (%i1), subtract it
-	 * from the original value argument (%d0), and return the result.
-	 */
-	std	%f4, [%i1]		! *ival = %f4:f5;
-	fsubd	%f0, %f4, %f0		! %f0:f1 -= %f4:f5;
-	ret
-	restore
-
-Lbig:
-	/*
-	 * We get here if the original comparison of %f4:f5 (v) to
-	 * %f2:f3 (2^52) came out `greater or unordered'.  In this
-	 * case the integer part is the original value, and the
-	 * fractional part is 0.
-	 */
-#ifdef __PIC__
-	set	L0, %o4
-	ldx	[%o5 + %o4], %l0
-	std	%f0, [%i1]		! *ival = val;
-	ldd	[%l0], %f0		! return 0.0;
-#else
-	sethi	%hi(L0), %l0
-	std	%f0, [%i1]		! *ival = val;
-	ldd	[%l0 + %lo(L0)], %f0	! return 0.0;
-#endif
-	ret
-	 restore
-
diff --git a/lib/libc/gen/modf.c b/lib/libc/gen/modf.c
index 5c523519b..e02e8c106 100644
--- a/lib/libc/gen/modf.c
+++ b/lib/libc/gen/modf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: modf.c,v 1.6 2013/07/03 04:46:36 espie Exp $	*/
+/*	$OpenBSD: modf.c,v 1.7 2023/08/13 06:55:37 miod Exp $	*/
 /*	$NetBSD: modf.c,v 1.1 1995/02/10 17:50:25 cgd Exp $	*/
 
 /*
@@ -51,11 +51,13 @@ modf(double val, double *iptr)
 	u_int64_t frac;
 
 	/*
-	 * If input is Inf or NaN, return it and leave i alone.
+	 * If input is +/-Inf or NaN, return +/-0 or NaN.
 	 */
 	u.v = val;
-	if (u.s.dbl_exp == DBL_EXP_INFNAN)
-		return (u.v);
+	if (u.s.dbl_exp == DBL_EXP_INFNAN) {
+		*iptr = u.v;
+		return (0.0 / u.v);
+	}
 
 	/*
 	 * If input can't have a fractional part, return
diff --git a/lib/libc/sys/kqueue.2 b/lib/libc/sys/kqueue.2
index eb9b6e652..c4c13cca7 100644
--- a/lib/libc/sys/kqueue.2
+++ b/lib/libc/sys/kqueue.2
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: kqueue.2,v 1.47 2022/10/22 06:27:46 jmc Exp $
+.\"	$OpenBSD: kqueue.2,v 1.49 2023/08/13 10:23:26 jmc Exp $
 .\"
 .\" Copyright (c) 2000 Jonathan Lemon
 .\" All rights reserved.
@@ -26,7 +26,7 @@
 .\"
 .\" $FreeBSD: src/lib/libc/sys/kqueue.2,v 1.18 2001/02/14 08:48:35 guido Exp $
 .\"
-.Dd $Mdocdate: October 22 2022 $
+.Dd $Mdocdate: August 13 2023 $
 .Dt KQUEUE 2
 .Os
 .Sh NAME
@@ -457,17 +457,71 @@ Establishes an arbitrary timer identified by
 .Fa ident .
 When adding a timer,
 .Fa data
-specifies the timeout period in milliseconds.
-The timer will be periodic unless
+specifies the timeout period in units described below or, if
+.Dv NOTE_ABSTIME
+is set in
+.Va fflags ,
+the absolute time at which the timer should fire.
+The timer will repeat unless
 .Dv EV_ONESHOT
-is specified.
+is set in
+.Va flags
+or
+.Dv NOTE_ABSTIME
+is set in
+.Va fflags .
 On return,
 .Fa data
 contains the number of times the timeout has expired since the last call to
 .Fn kevent .
-This filter automatically sets the
+This filter automatically sets
 .Dv EV_CLEAR
-flag internally.
+in
+.Va flags
+for periodic timers.
+Timers created with
+.Dv NOTE_ABSTIME
+remain activated on the kqueue once the absolute time has passed unless
+.Dv EV_CLEAR
+or
+.Dv EV_ONESHOT
+are also specified.
+.Pp
+The filter accepts the following flags in the
+.Va fflags
+argument:
+.Bl -tag -width NOTE_MSECONDS
+.It Dv NOTE_SECONDS
+The timer value in
+.Va data
+is expressed in seconds.
+.It Dv NOTE_MSECONDS
+The timer value in
+.Va data
+is expressed in milliseconds.
+.It Dv NOTE_USECONDS
+The timer value in
+.Va data
+is expressed in microseconds.
+.It Dv NOTE_NSECONDS
+The timer value in
+.Va data
+is expressed in nanoseconds.
+.It Dv NOTE_ABSTIME
+The timer value is an absolute time with
+.Dv CLOCK_REALTIME
+as the reference clock.
+.El
+.Pp
+Note that
+.Dv NOTE_SECONDS ,
+.Dv NOTE_MSECONDS ,
+.Dv NOTE_USECONDS ,
+and
+.Dv NOTE_NSECONDS
+are mutually exclusive; behavior is undefined if more than one are specified.
+If a timer value unit is not specified, the default is
+.Dv NOTE_MSECONDS .
 .Pp
 If an existing timer is re-added, the existing timer and related pending events
 will be cancelled.
@@ -558,6 +612,7 @@ No memory was available to register the event.
 The specified process to attach to does not exist.
 .El
 .Sh SEE ALSO
+.Xr clock_gettime 2 ,
 .Xr poll 2 ,
 .Xr read 2 ,
 .Xr select 2 ,
diff --git a/lib/libc/sys/recv.2 b/lib/libc/sys/recv.2
index 2ae0debec..19d02921b 100644
--- a/lib/libc/sys/recv.2
+++ b/lib/libc/sys/recv.2
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: recv.2,v 1.50 2022/09/09 16:48:25 jmc Exp $
+.\"	$OpenBSD: recv.2,v 1.51 2023/08/17 05:45:51 jmc Exp $
 .\"	$NetBSD: recv.2,v 1.6 1995/02/27 12:36:08 cgd Exp $
 .\"
 .\" Copyright (c) 1983, 1990, 1991, 1993
@@ -30,7 +30,7 @@
 .\"
 .\"     @(#)recv.2	8.3 (Berkeley) 2/21/94
 .\"
-.Dd $Mdocdate: September 9 2022 $
+.Dd $Mdocdate: August 17 2023 $
 .Dt RECV 2
 .Os
 .Sh NAME
@@ -61,7 +61,7 @@ are used to receive messages from a socket,
 is normally used only on a
 .Em connected
 socket (see
-.Xr connect 2 ).
+.Xr connect 2 ) .
 .Fn recvfrom ,
 .Fn recvmsg ,
 and
diff --git a/lib/libcrypto/asn1/a_string.c b/lib/libcrypto/asn1/a_string.c
index bfd2abf2f..ec492e71f 100644
--- a/lib/libcrypto/asn1/a_string.c
+++ b/lib/libcrypto/asn1/a_string.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_string.c,v 1.14 2023/07/05 21:23:36 beck Exp $ */
+/* $OpenBSD: a_string.c,v 1.17 2023/08/15 18:05:15 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -119,10 +119,12 @@ ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
 		return -1;
 	if ((cmp = (a->length - b->length)) != 0)
 		return cmp;
-	if ((cmp = memcmp(a->data, b->data, a->length)) != 0)
-		return cmp;
+	if (a->length != 0) {
+		if ((cmp = memcmp(a->data, b->data, a->length)) != 0)
+			return cmp;
+	}
 
-	return (a->type - b->type);
+	return a->type - b->type;
 }
 LCRYPTO_ALIAS(ASN1_STRING_cmp);
 
@@ -184,7 +186,7 @@ ASN1_STRING_set(ASN1_STRING *astr, const void *_data, int len)
 
 	if ((astr->data = calloc(1, len + 1)) == NULL) {
 		ASN1error(ERR_R_MALLOC_FAILURE);
-		return (0);
+		return 0;
 	}
 	astr->length = len;
 
diff --git a/lib/libcrypto/crypto_internal.h b/lib/libcrypto/crypto_internal.h
index 4fe868e9a..e5742657d 100644
--- a/lib/libcrypto/crypto_internal.h
+++ b/lib/libcrypto/crypto_internal.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: crypto_internal.h,v 1.6 2023/05/27 09:18:17 jsing Exp $ */
+/*	$OpenBSD: crypto_internal.h,v 1.7 2023/08/15 08:39:27 jsing Exp $ */
 /*
  * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
  *
@@ -87,6 +87,37 @@ crypto_store_htobe64(uint8_t *dst, uint64_t v)
 }
 #endif
 
+/*
+ * crypto_load_le32toh() loads a 32 bit unsigned little endian value as a 32 bit
+ * unsigned host endian value, from the specified address in memory. The memory
+ * address may have any alignment.
+ */
+#ifndef HAVE_CRYPTO_LOAD_BE32TOH
+static inline uint32_t
+crypto_load_le32toh(const uint8_t *src)
+{
+	uint32_t v;
+
+	memcpy(&v, src, sizeof(v));
+
+	return le32toh(v);
+}
+#endif
+
+/*
+ * crypto_store_htole32() stores a 32 bit unsigned host endian value as a 32 bit
+ * unsigned little endian value, at the specified address in memory. The memory
+ * address may have any alignment.
+ */
+#ifndef HAVE_CRYPTO_STORE_HTOBE32
+static inline void
+crypto_store_htole32(uint8_t *dst, uint32_t v)
+{
+	v = htole32(v);
+	memcpy(dst, &v, sizeof(v));
+}
+#endif
+
 #ifndef HAVE_CRYPTO_ROL_U32
 static inline uint32_t
 crypto_rol_u32(uint32_t v, size_t shift)
diff --git a/lib/libcrypto/dh/dh_ameth.c b/lib/libcrypto/dh/dh_ameth.c
index 4a600b3bb..43beb469f 100644
--- a/lib/libcrypto/dh/dh_ameth.c
+++ b/lib/libcrypto/dh/dh_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_ameth.c,v 1.33 2023/08/10 16:57:15 tb Exp $ */
+/* $OpenBSD: dh_ameth.c,v 1.39 2023/08/12 07:59:48 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -70,7 +70,7 @@
 #include "evp_local.h"
 
 static void
-int_dh_free(EVP_PKEY *pkey)
+dh_free(EVP_PKEY *pkey)
 {
 	DH_free(pkey->pkey.dh);
 }
@@ -78,83 +78,86 @@ int_dh_free(EVP_PKEY *pkey)
 static int
 dh_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
 {
-	const unsigned char *p, *pm;
-	int pklen, pmlen;
+	X509_ALGOR *algor;
 	int ptype;
 	const void *pval;
-	const ASN1_STRING *pstr;
-	X509_ALGOR *palg;
-	ASN1_INTEGER *public_key = NULL;
+	const ASN1_STRING *astr;
+	const unsigned char *key, *params, *p;
+	int key_len, params_len;
+	ASN1_INTEGER *aint = NULL;
 	DH *dh = NULL;
+	int ret = 0;
 
-	if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &palg, pubkey))
-		return 0;
-	X509_ALGOR_get0(NULL, &ptype, &pval, palg);
+	if (!X509_PUBKEY_get0_param(NULL, &key, &key_len, &algor, pubkey))
+		goto err;
+	X509_ALGOR_get0(NULL, &ptype, &pval, algor);
 
 	if (ptype != V_ASN1_SEQUENCE) {
 		DHerror(DH_R_PARAMETER_ENCODING_ERROR);
 		goto err;
 	}
 
-	pstr = pval;
-	pm = pstr->data;
-	pmlen = pstr->length;
+	astr = pval;
+	params = astr->data;
+	params_len = astr->length;
 
-	if (!(dh = d2i_DHparams(NULL, &pm, pmlen))) {
+	p = params;
+	if ((dh = d2i_DHparams(NULL, &p, params_len)) == NULL) {
 		DHerror(DH_R_DECODE_ERROR);
 		goto err;
 	}
-
-	if (!(public_key=d2i_ASN1_INTEGER(NULL, &p, pklen))) {
+	p = key;
+	if ((aint = d2i_ASN1_INTEGER(NULL, &p, key_len)) == NULL) {
 		DHerror(DH_R_DECODE_ERROR);
 		goto err;
 	}
-
-	/* We have parameters now set public key */
-	if (!(dh->pub_key = ASN1_INTEGER_to_BN(public_key, NULL))) {
+	BN_free(dh->pub_key);
+	if ((dh->pub_key = ASN1_INTEGER_to_BN(aint, NULL)) == NULL) {
 		DHerror(DH_R_BN_DECODE_ERROR);
 		goto err;
 	}
 
-	ASN1_INTEGER_free(public_key);
-	EVP_PKEY_assign_DH(pkey, dh);
-	return 1;
+	if (!EVP_PKEY_assign_DH(pkey, dh))
+		goto err;
+	dh = NULL;
 
-err:
-	if (public_key)
-		ASN1_INTEGER_free(public_key);
+	ret = 1;
+
+ err:
+	ASN1_INTEGER_free(aint);
 	DH_free(dh);
-	return 0;
+
+	return ret;
 }
 
 static int
 dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
 {
 	const DH *dh = pkey->pkey.dh;
-	ASN1_STRING *params = NULL;
+	ASN1_STRING *astr = NULL;
 	int ptype = V_ASN1_SEQUENCE;
-	ASN1_INTEGER *key = NULL;
+	ASN1_INTEGER *aint = NULL;
 	ASN1_OBJECT *aobj;
-	unsigned char *params_der = NULL, *key_der = NULL;
+	unsigned char *params = NULL, *key = NULL;
 	int params_len = 0, key_len = 0;
 	int ret = 0;
 
-	if ((params_len = i2d_DHparams(dh, &params_der)) <= 0) {
+	if ((params_len = i2d_DHparams(dh, &params)) <= 0) {
 		DHerror(ERR_R_MALLOC_FAILURE);
 		params_len = 0;
 		goto err;
 	}
-	if ((params = ASN1_STRING_new()) == NULL) {
+	if ((astr = ASN1_STRING_new()) == NULL) {
 		DHerror(ERR_R_MALLOC_FAILURE);
 		goto err;
 	}
-	ASN1_STRING_set0(params, params_der, params_len);
-	params_der = NULL;
+	ASN1_STRING_set0(astr, params, params_len);
+	params = NULL;
 	params_len = 0;
 
-	if ((key = BN_to_ASN1_INTEGER(dh->pub_key, NULL)) == NULL)
+	if ((aint = BN_to_ASN1_INTEGER(dh->pub_key, NULL)) == NULL)
 		goto err;
-	if ((key_len = i2d_ASN1_INTEGER(key, &key_der)) <= 0) {
+	if ((key_len = i2d_ASN1_INTEGER(aint, &key)) <= 0) {
 		DHerror(ERR_R_MALLOC_FAILURE);
 		key_len = 0;
 		goto err;
@@ -162,19 +165,19 @@ dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
 
 	if ((aobj = OBJ_nid2obj(EVP_PKEY_DH)) == NULL)
 		goto err;
-	if (!X509_PUBKEY_set0_param(pk, aobj, ptype, params, key_der, key_len))
+	if (!X509_PUBKEY_set0_param(pk, aobj, ptype, astr, key, key_len))
 		goto err;
-	params = NULL;
-	key_der = NULL;
+	astr = NULL;
+	key = NULL;
 	key_len = 0;
 
 	ret = 1;
 
  err:
-	ASN1_STRING_free(params);
-	ASN1_INTEGER_free(key);
-	freezero(params_der, params_len);
-	freezero(key_der, key_len);
+	ASN1_STRING_free(astr);
+	ASN1_INTEGER_free(aint);
+	freezero(params, params_len);
+	freezero(key, key_len);
 
 	return ret;
 }
@@ -188,84 +191,90 @@ dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
 static int
 dh_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8)
 {
-	const unsigned char *p, *pm;
-	int pklen, pmlen;
+	const X509_ALGOR *algor;
 	int ptype;
 	const void *pval;
-	const ASN1_STRING *pstr;
-	const X509_ALGOR *palg;
-	ASN1_INTEGER *privkey = NULL;
+	const ASN1_STRING *astr;
+	const unsigned char *key, *params, *p;
+	int key_len, params_len;
+	ASN1_INTEGER *aint = NULL;
 	DH *dh = NULL;
+	int ret = 0;
 
-	if (!PKCS8_pkey_get0(NULL, &p, &pklen, &palg, p8))
-		return 0;
+	if (!PKCS8_pkey_get0(NULL, &key, &key_len, &algor, p8))
+		goto err;
+	X509_ALGOR_get0(NULL, &ptype, &pval, algor);
 
-	X509_ALGOR_get0(NULL, &ptype, &pval, palg);
-
-	if (ptype != V_ASN1_SEQUENCE)
-		goto decerr;
-
-	if (!(privkey=d2i_ASN1_INTEGER(NULL, &p, pklen)))
-		goto decerr;
-
-	pstr = pval;
-	pm = pstr->data;
-	pmlen = pstr->length;
-	if (!(dh = d2i_DHparams(NULL, &pm, pmlen)))
-		goto decerr;
-	/* We have parameters now set private key */
-	if (!(dh->priv_key = ASN1_INTEGER_to_BN(privkey, NULL))) {
-		DHerror(DH_R_BN_ERROR);
-		goto dherr;
+	if (ptype != V_ASN1_SEQUENCE) {
+		DHerror(DH_R_PARAMETER_ENCODING_ERROR);
+		goto err;
+	}
+
+	astr = pval;
+	params = astr->data;
+	params_len = astr->length;
+
+	p = params;
+	if ((dh = d2i_DHparams(NULL, &p, params_len)) == NULL) {
+		DHerror(DH_R_DECODE_ERROR);
+		goto err;
+	}
+	p = key;
+	if ((aint = d2i_ASN1_INTEGER(NULL, &p, key_len)) == NULL) {
+		DHerror(DH_R_DECODE_ERROR);
+		goto err;
+	}
+	BN_free(dh->priv_key);
+	if ((dh->priv_key = ASN1_INTEGER_to_BN(aint, NULL)) == NULL) {
+		DHerror(DH_R_BN_DECODE_ERROR);
+		goto err;
 	}
-	/* Calculate public key */
 	if (!DH_generate_key(dh))
-		goto dherr;
+		goto err;
 
-	EVP_PKEY_assign_DH(pkey, dh);
+	if (!EVP_PKEY_assign_DH(pkey, dh))
+		goto err;
+	dh = NULL;
 
-	ASN1_INTEGER_free(privkey);
+	ret = 1;
 
-	return 1;
-
-decerr:
-	DHerror(EVP_R_DECODE_ERROR);
-dherr:
-	ASN1_INTEGER_free(privkey);
+ err:
+	ASN1_INTEGER_free(aint);
 	DH_free(dh);
-	return 0;
+
+	return ret;
 }
 
 static int
 dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
 {
 	const DH *dh = pkey->pkey.dh;
-	ASN1_STRING *params = NULL;
+	ASN1_STRING *astr = NULL;
 	int ptype = V_ASN1_SEQUENCE;
-	ASN1_INTEGER *key = NULL;
+	ASN1_INTEGER *aint = NULL;
 	ASN1_OBJECT *aobj;
-	unsigned char *params_der = NULL, *key_der = NULL;
+	unsigned char *params = NULL, *key = NULL;
 	int params_len = 0, key_len = 0;
 	int ret = 0;
 
-	if ((params_len = i2d_DHparams(dh, &params_der)) <= 0) {
+	if ((params_len = i2d_DHparams(dh, &params)) <= 0) {
 		DHerror(ERR_R_MALLOC_FAILURE);
 		params_len = 0;
 		goto err;
 	}
-	if ((params = ASN1_STRING_type_new(V_ASN1_SEQUENCE)) == NULL) {
+	if ((astr = ASN1_STRING_type_new(V_ASN1_SEQUENCE)) == NULL) {
 		DHerror(ERR_R_MALLOC_FAILURE);
 		goto err;
 	}
-	ASN1_STRING_set0(params, params_der, params_len);
-	params_der = NULL;
+	ASN1_STRING_set0(astr, params, params_len);
+	params = NULL;
 	params_len = 0;
 
-	if ((key = BN_to_ASN1_INTEGER(dh->priv_key, NULL)) == NULL) {
+	if ((aint = BN_to_ASN1_INTEGER(dh->priv_key, NULL)) == NULL) {
 		DHerror(DH_R_BN_ERROR);
 		goto err;
 	}
-	if ((key_len = i2d_ASN1_INTEGER(key, &key_der)) <= 0) {
+	if ((key_len = i2d_ASN1_INTEGER(aint, &key)) <= 0) {
 		DHerror(ERR_R_MALLOC_FAILURE);
 		key_len = 0;
 		goto err;
@@ -273,40 +282,49 @@ dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
 
 	if ((aobj = OBJ_nid2obj(NID_dhKeyAgreement)) == NULL)
 		goto err;
-	if (!PKCS8_pkey_set0(p8, aobj, 0, ptype, params, key_der, key_len))
+	if (!PKCS8_pkey_set0(p8, aobj, 0, ptype, astr, key, key_len))
 		goto err;
-	params = NULL;
-	key_der = NULL;
+	astr = NULL;
+	key = NULL;
 	key_len = 0;
 
 	ret = 1;
 
  err:
-	ASN1_STRING_free(params);
-	ASN1_INTEGER_free(key);
-	freezero(params_der, params_len);
-	freezero(key_der, key_len);
+	ASN1_STRING_free(astr);
+	ASN1_INTEGER_free(aint);
+	freezero(params, params_len);
+	freezero(key, key_len);
 
 	return ret;
 }
 
 static int
-dh_param_decode(EVP_PKEY *pkey, const unsigned char **pder, int derlen)
+dh_param_decode(EVP_PKEY *pkey, const unsigned char **params, int params_len)
 {
-	DH *dh;
+	DH *dh = NULL;
+	int ret = 0;
 
-	if (!(dh = d2i_DHparams(NULL, pder, derlen))) {
+	if ((dh = d2i_DHparams(NULL, params, params_len)) == NULL) {
 		DHerror(ERR_R_DH_LIB);
-		return 0;
+		goto err;
 	}
-	EVP_PKEY_assign_DH(pkey, dh);
-	return 1;
+	if (!EVP_PKEY_assign_DH(pkey, dh))
+		goto err;
+	dh = NULL;
+
+	ret = 1;
+
+ err:
+	DH_free(dh);
+
+	return ret;
 }
 
 static int
-dh_param_encode(const EVP_PKEY *pkey, unsigned char **pder)
+dh_param_encode(const EVP_PKEY *pkey, unsigned char **params)
 {
-	return i2d_DHparams(pkey->pkey.dh, pder);
+	return i2d_DHparams(pkey->pkey.dh, params);
 }
 
 static int
@@ -370,7 +388,7 @@ do_dh_print(BIO *bp, const DH *x, int indent, ASN1_PCTX *ctx, int ptype)
 }
 
 static int
-int_dh_size(const EVP_PKEY *pkey)
+dh_size(const EVP_PKEY *pkey)
 {
 	return DH_size(pkey->pkey.dh);
 }
@@ -416,11 +434,11 @@ dh_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
 }
 
 static int
-dh_missing_parameters(const EVP_PKEY *a)
+dh_missing_parameters(const EVP_PKEY *pkey)
 {
-	if (!a->pkey.dh->p || !a->pkey.dh->g)
-		return 1;
-	return 0;
+	const DH *dh = pkey->pkey.dh;
+
+	return dh->p == NULL || dh->g == NULL;
 }
 
 static int
@@ -520,7 +538,7 @@ const EVP_PKEY_ASN1_METHOD dh_asn1_meth = {
 	.priv_encode = dh_priv_encode,
 	.priv_print = dh_private_print,
 
-	.pkey_size = int_dh_size,
+	.pkey_size = dh_size,
 	.pkey_bits = dh_bits,
 	.pkey_security_bits = dh_security_bits,
 
@@ -531,7 +549,7 @@ const EVP_PKEY_ASN1_METHOD dh_asn1_meth = {
 	.param_cmp = dh_cmp_parameters,
 	.param_print = dh_param_print,
 
-	.pkey_free = int_dh_free,
+	.pkey_free = dh_free,
 
 	.pkey_check = NULL,
 	.pkey_public_check = dh_pkey_public_check,
diff --git a/lib/libcrypto/dh/dh_lib.c b/lib/libcrypto/dh/dh_lib.c
index 987f0b1f7..8d6378768 100644
--- a/lib/libcrypto/dh/dh_lib.c
+++ b/lib/libcrypto/dh/dh_lib.c
@@ -1,25 +1,25 @@
-/* $OpenBSD: dh_lib.c,v 1.39 2023/07/08 15:29:03 beck Exp $ */
+/* $OpenBSD: dh_lib.c,v 1.41 2023/08/13 12:09:14 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
  * The implementation was written so as to conform with Netscapes SSL.
- * 
+ *
  * This library is free for commercial and non-commercial use as long as
  * the following conditions are aheared to.  The following conditions
  * apply to all code found in this distribution, be it the RC4, RSA,
  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  * included with this distribution is covered by the same copyright terms
  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
+ *
  * Copyright remains Eric Young's, and as such any Copyright notices in
  * the code are not to be removed.
  * If this package is used in a product, Eric Young should be given attribution
  * as the author of the parts of the library used.
  * This can be in the form of a textual message at program startup or
  * in documentation (online or textual) provided with the package.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -34,10 +34,10 @@
  *     Eric Young (eay@cryptsoft.com)"
  *    The word 'cryptographic' can be left out if the rouines from the library
  *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
+ * 4. If you include any Windows specific code (or a derivative thereof) from
  *    the apps directory (application code) you must include an acknowledgement:
  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -49,7 +49,7 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- * 
+ *
  * The licence and distribution terms for any publically available version or
  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  * copied and put under another distribution licence
@@ -96,19 +96,19 @@ DH_set_method(DH *dh, const DH_METHOD *meth)
 	 * NB: The caller is specifically setting a method, so it's not up to us
 	 * to deal with which ENGINE it comes from.
 	 */
-        const DH_METHOD *mtmp;
+	const DH_METHOD *mtmp;
 
-        mtmp = dh->meth;
-        if (mtmp->finish)
+	mtmp = dh->meth;
+	if (mtmp->finish)
 		mtmp->finish(dh);
 #ifndef OPENSSL_NO_ENGINE
 	ENGINE_finish(dh->engine);
 	dh->engine = NULL;
 #endif
-        dh->meth = meth;
-        if (meth->init)
+	dh->meth = meth;
+	if (meth->init)
 		meth->init(dh);
-        return 1;
+	return 1;
 }
 LCRYPTO_ALIAS(DH_set_method);
 
@@ -122,61 +122,46 @@ LCRYPTO_ALIAS(DH_new);
 DH *
 DH_new_method(ENGINE *engine)
 {
-	DH *ret;
+	DH *dh;
 
-	ret = malloc(sizeof(DH));
-	if (ret == NULL) {
+	if ((dh = calloc(1, sizeof(*dh))) == NULL) {
 		DHerror(ERR_R_MALLOC_FAILURE);
-		return NULL;
+		goto err;
 	}
 
-	ret->meth = DH_get_default_method();
+	dh->meth = DH_get_default_method();
+	dh->flags = dh->meth->flags & ~DH_FLAG_NON_FIPS_ALLOW;
+	dh->references = 1;
+
 #ifndef OPENSSL_NO_ENGINE
-	if (engine) {
+	if (engine != NULL) {
 		if (!ENGINE_init(engine)) {
 			DHerror(ERR_R_ENGINE_LIB);
-			free(ret);
-			return NULL;
+			goto err;
 		}
-		ret->engine = engine;
+		dh->engine = engine;
 	} else
-		ret->engine = ENGINE_get_default_DH();
-	if(ret->engine) {
-		ret->meth = ENGINE_get_DH(ret->engine);
-		if (ret->meth == NULL) {
+		dh->engine = ENGINE_get_default_DH();
+	if (dh->engine != NULL) {
+		if ((dh->meth = ENGINE_get_DH(dh->engine)) == NULL) {
 			DHerror(ERR_R_ENGINE_LIB);
-			ENGINE_finish(ret->engine);
-			free(ret);
-			return NULL;
+			goto err;
 		}
+		dh->flags = dh->meth->flags & ~DH_FLAG_NON_FIPS_ALLOW;
 	}
 #endif
 
-	ret->pad = 0;
-	ret->version = 0;
-	ret->p = NULL;
-	ret->g = NULL;
-	ret->length = 0;
-	ret->pub_key = NULL;
-	ret->priv_key = NULL;
-	ret->q = NULL;
-	ret->j = NULL;
-	ret->seed = NULL;
-	ret->seedlen = 0;
-	ret->counter = NULL;
-	ret->method_mont_p=NULL;
-	ret->references = 1;
-	ret->flags = ret->meth->flags & ~DH_FLAG_NON_FIPS_ALLOW;
-	CRYPTO_new_ex_data(CRYPTO_EX_INDEX_DH, ret, &ret->ex_data);
-	if (ret->meth->init != NULL && !ret->meth->init(ret)) {
-#ifndef OPENSSL_NO_ENGINE
-		ENGINE_finish(ret->engine);
-#endif
-		CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DH, ret, &ret->ex_data);
-		free(ret);
-		ret = NULL;
-	}
-	return ret;
+	if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_DH, dh, &dh->ex_data))
+		goto err;
+	if (dh->meth->init != NULL && !dh->meth->init(dh))
+		goto err;
+
+	return dh;
+
+ err:
+	DH_free(dh);
+
+	return NULL;
 }
 LCRYPTO_ALIAS(DH_new_method);
 
@@ -191,7 +176,7 @@ DH_free(DH *r)
 	if (i > 0)
 		return;
 
-	if (r->meth->finish)
+	if (r->meth != NULL && r->meth->finish != NULL)
 		r->meth->finish(r);
 #ifndef OPENSSL_NO_ENGINE
 	ENGINE_finish(r->engine);
diff --git a/lib/libcrypto/dsa/dsa_ameth.c b/lib/libcrypto/dsa/dsa_ameth.c
index 28aafebc0..4c20b45b1 100644
--- a/lib/libcrypto/dsa/dsa_ameth.c
+++ b/lib/libcrypto/dsa/dsa_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dsa_ameth.c,v 1.46 2023/08/10 16:57:15 tb Exp $ */
+/* $OpenBSD: dsa_ameth.c,v 1.55 2023/08/12 07:59:48 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -75,31 +75,32 @@
 static int
 dsa_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
 {
-	const unsigned char *p, *pm;
-	int pklen, pmlen;
+	X509_ALGOR *algor;
 	int ptype;
 	const void *pval;
-	const ASN1_STRING *pstr;
-	X509_ALGOR *palg;
-	ASN1_INTEGER *public_key = NULL;
-
+	const ASN1_STRING *astr;
+	const unsigned char *key, *params, *p;
+	int key_len, params_len;
+	ASN1_INTEGER *aint = NULL;
 	DSA *dsa = NULL;
+	int ret = 0;
 
-	if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &palg, pubkey))
-		return 0;
-	X509_ALGOR_get0(NULL, &ptype, &pval, palg);
+	if (!X509_PUBKEY_get0_param(NULL, &key, &key_len, &algor, pubkey))
+		goto err;
+	X509_ALGOR_get0(NULL, &ptype, &pval, algor);
 
 	if (ptype == V_ASN1_SEQUENCE) {
-		pstr = pval;
-		pm = pstr->data;
-		pmlen = pstr->length;
+		astr = pval;
+		params = astr->data;
+		params_len = astr->length;
 
-		if (!(dsa = d2i_DSAparams(NULL, &pm, pmlen))) {
+		p = params;
+		if ((dsa = d2i_DSAparams(NULL, &p, params_len)) == NULL) {
 			DSAerror(DSA_R_DECODE_ERROR);
 			goto err;
 		}
 	} else if (ptype == V_ASN1_NULL || ptype == V_ASN1_UNDEF) {
-		if (!(dsa = DSA_new())) {
+		if ((dsa = DSA_new()) == NULL) {
 			DSAerror(ERR_R_MALLOC_FAILURE);
 			goto err;
 		}
@@ -108,12 +109,13 @@ dsa_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
 		goto err;
 	}
 
-	if (!(public_key = d2i_ASN1_INTEGER(NULL, &p, pklen))) {
+	p = key;
+	if ((aint = d2i_ASN1_INTEGER(NULL, &p, key_len)) == NULL) {
 		DSAerror(DSA_R_DECODE_ERROR);
 		goto err;
 	}
-
-	if (!(dsa->pub_key = ASN1_INTEGER_to_BN(public_key, NULL))) {
+	BN_free(dsa->pub_key);
+	if ((dsa->pub_key = ASN1_INTEGER_to_BN(aint, NULL)) == NULL) {
 		DSAerror(DSA_R_BN_DECODE_ERROR);
 		goto err;
 	}
@@ -124,50 +126,52 @@ dsa_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
 			goto err;
 	}
 
-	ASN1_INTEGER_free(public_key);
-	EVP_PKEY_assign_DSA(pkey, dsa);
-	return 1;
+	if (!EVP_PKEY_assign_DSA(pkey, dsa))
+		goto err;
+	dsa = NULL;
 
-err:
-	if (public_key)
-		ASN1_INTEGER_free(public_key);
+	ret = 1;
+
+ err:
+	ASN1_INTEGER_free(aint);
 	DSA_free(dsa);
-	return 0;
+
+	return ret;
 }
 
 static int
 dsa_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
 {
 	const DSA *dsa = pkey->pkey.dsa;
-	ASN1_STRING *params = NULL;
+	ASN1_STRING *astr = NULL;
 	int ptype = V_ASN1_UNDEF;
-	ASN1_INTEGER *key = NULL;
+	ASN1_INTEGER *aint = NULL;
 	ASN1_OBJECT *aobj;
-	unsigned char *params_der = NULL, *key_der = NULL;
+	unsigned char *params = NULL, *key = NULL;
 	int params_len = 0, key_len = 0;
 	int ret = 0;
 
-	if (pkey->save_parameters && dsa->p && dsa->q && dsa->g) {
-		if ((params_len = i2d_DSAparams(dsa, &params_der)) <= 0) {
+	if (pkey->save_parameters > 0 && !EVP_PKEY_missing_parameters(pkey)) {
+		if ((params_len = i2d_DSAparams(dsa, &params)) <= 0) {
 			DSAerror(ERR_R_MALLOC_FAILURE);
 			params_len = 0;
 			goto err;
 		}
-		if ((params = ASN1_STRING_new()) == NULL) {
+		if ((astr = ASN1_STRING_new()) == NULL) {
 			DSAerror(ERR_R_MALLOC_FAILURE);
 			goto err;
 		}
-		ASN1_STRING_set0(params, params_der, params_len);
-		params_der = NULL;
+		ASN1_STRING_set0(astr, params, params_len);
+		params = NULL;
 		params_len = 0;
 		ptype = V_ASN1_SEQUENCE;
 	}
 
-	if ((key = BN_to_ASN1_INTEGER(dsa->pub_key, NULL)) == NULL) {
+	if ((aint = BN_to_ASN1_INTEGER(dsa->pub_key, NULL)) == NULL) {
 		DSAerror(ERR_R_MALLOC_FAILURE);
 		goto err;
 	}
-	if ((key_len = i2d_ASN1_INTEGER(key, &key_der)) <= 0) {
+	if ((key_len = i2d_ASN1_INTEGER(aint, &key)) <= 0) {
 		DSAerror(ERR_R_MALLOC_FAILURE);
 		key_len = 0;
 		goto err;
@@ -175,98 +179,104 @@ dsa_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
 
 	if ((aobj = OBJ_nid2obj(EVP_PKEY_DSA)) == NULL)
 		goto err;
-	if (!X509_PUBKEY_set0_param(pk, aobj, ptype, params, key_der, key_len))
+	if (!X509_PUBKEY_set0_param(pk, aobj, ptype, astr, key, key_len))
 		goto err;
-	params = NULL;
-	key_der = NULL;
+	astr = NULL;
+	key = NULL;
 	key_len = 0;
 
 	ret = 1;
 
  err:
-	ASN1_STRING_free(params);
-	ASN1_INTEGER_free(key);
-	freezero(params_der, params_len);
-	freezero(key_der, key_len);
+	ASN1_STRING_free(astr);
+	ASN1_INTEGER_free(aint);
+	freezero(params, params_len);
+	freezero(key, key_len);
 
 	return ret;
 }
 
-/* In PKCS#8 DSA: you just get a private key integer and parameters in the
+/*
+ * In PKCS#8 DSA: you just get a private key integer and parameters in the
  * AlgorithmIdentifier the pubkey must be recalculated.
  */
 static int
 dsa_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8)
 {
-	const unsigned char *p, *pm;
-	int pklen, pmlen;
+	const X509_ALGOR *algor;
 	int ptype;
 	const void *pval;
-	const ASN1_STRING *pstr;
-	const X509_ALGOR *palg;
-	ASN1_INTEGER *privkey = NULL;
+	const ASN1_STRING *astr;
+	const unsigned char *key, *params, *p;
+	int key_len, params_len;
+	ASN1_INTEGER *aint = NULL;
 	BN_CTX *ctx = NULL;
 	DSA *dsa = NULL;
 	int ret = 0;
 
-	if (!PKCS8_pkey_get0(NULL, &p, &pklen, &palg, p8))
-		return 0;
-	X509_ALGOR_get0(NULL, &ptype, &pval, palg);
-	if (ptype != V_ASN1_SEQUENCE)
-		goto decerr;
+	if (!PKCS8_pkey_get0(NULL, &key, &key_len, &algor, p8))
+		goto err;
+	X509_ALGOR_get0(NULL, &ptype, &pval, algor);
 
-	if ((privkey = d2i_ASN1_INTEGER(NULL, &p, pklen)) == NULL)
-		goto decerr;
-	if (privkey->type == V_ASN1_NEG_INTEGER)
-		goto decerr;
+	if (ptype != V_ASN1_SEQUENCE) {
+		DSAerror(DSA_R_PARAMETER_ENCODING_ERROR);
+		goto err;
+	}
 
-	pstr = pval;
-	pm = pstr->data;
-	pmlen = pstr->length;
-	if (!(dsa = d2i_DSAparams(NULL, &pm, pmlen)))
-		goto decerr;
-	/* We have parameters now set private key */
-	if (!(dsa->priv_key = ASN1_INTEGER_to_BN(privkey, NULL))) {
-		DSAerror(DSA_R_BN_ERROR);
-		goto dsaerr;
+	astr = pval;
+	params = astr->data;
+	params_len = astr->length;
+
+	p = params;
+	if ((dsa = d2i_DSAparams(NULL, &p, params_len)) == NULL) {
+		DSAerror(DSA_R_DECODE_ERROR);
+		goto err;
+	}
+	p = key;
+	if ((aint = d2i_ASN1_INTEGER(NULL, &p, key_len)) == NULL) {
+		DSAerror(DSA_R_DECODE_ERROR);
+		goto err;
+	}
+	BN_free(dsa->priv_key);
+	if ((dsa->priv_key = ASN1_INTEGER_to_BN(aint, NULL)) == NULL) {
+		DSAerror(DSA_R_BN_DECODE_ERROR);
+		goto err;
 	}
 
 	/* Check the key for basic consistency before doing expensive things. */
 	if (!dsa_check_key(dsa))
-		goto dsaerr;
+		goto err;
 
 	/* Calculate public key */
-	if (!(dsa->pub_key = BN_new())) {
+	BN_free(dsa->pub_key);
+	if ((dsa->pub_key = BN_new()) == NULL) {
 		DSAerror(ERR_R_MALLOC_FAILURE);
-		goto dsaerr;
+		goto err;
 	}
 
 	if ((ctx = BN_CTX_new()) == NULL) {
 		DSAerror(ERR_R_MALLOC_FAILURE);
-		goto dsaerr;
+		goto err;
 	}
 
 	BN_CTX_start(ctx);
 
 	if (!BN_mod_exp_ct(dsa->pub_key, dsa->g, dsa->priv_key, dsa->p, ctx)) {
 		DSAerror(DSA_R_BN_ERROR);
-		goto dsaerr;
+		goto err;
 	}
 
 	if (!EVP_PKEY_assign_DSA(pkey, dsa))
-		goto decerr;
+		goto err;
+	dsa = NULL;
 
 	ret = 1;
-	goto done;
 
-decerr:
-	DSAerror(DSA_R_DECODE_ERROR);
-dsaerr:
+ err:
 	DSA_free(dsa);
-done:
 	BN_CTX_end(ctx);
 	BN_CTX_free(ctx);
-	ASN1_INTEGER_free(privkey);
+	ASN1_INTEGER_free(aint);
 
 	return ret;
 }
@@ -275,32 +285,32 @@ static int
 dsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
 {
 	const DSA *dsa = pkey->pkey.dsa;
-	ASN1_STRING *params = NULL;
+	ASN1_STRING *astr = NULL;
 	int ptype = V_ASN1_SEQUENCE;
-	ASN1_INTEGER *key = NULL;
+	ASN1_INTEGER *aint = NULL;
 	ASN1_OBJECT *aobj;
-	unsigned char *params_der = NULL, *key_der = NULL;
+	unsigned char *params = NULL, *key = NULL;
 	int params_len = 0, key_len = 0;
 	int ret = 0;
 
-	if ((params_len = i2d_DSAparams(dsa, &params_der)) <= 0) {
+	if ((params_len = i2d_DSAparams(dsa, &params)) <= 0) {
 		DSAerror(ERR_R_MALLOC_FAILURE);
 		params_len = 0;
 		goto err;
 	}
-	if ((params = ASN1_STRING_type_new(V_ASN1_SEQUENCE)) == NULL) {
+	if ((astr = ASN1_STRING_type_new(V_ASN1_SEQUENCE)) == NULL) {
 		DSAerror(ERR_R_MALLOC_FAILURE);
 		goto err;
 	}
-	ASN1_STRING_set0(params, params_der, params_len);
-	params_der = NULL;
+	ASN1_STRING_set0(astr, params, params_len);
+	params = NULL;
 	params_len = 0;
 
-	if ((key = BN_to_ASN1_INTEGER(dsa->priv_key, NULL)) == NULL) {
+	if ((aint = BN_to_ASN1_INTEGER(dsa->priv_key, NULL)) == NULL) {
 		DSAerror(DSA_R_BN_ERROR);
 		goto err;
 	}
-	if ((key_len = i2d_ASN1_INTEGER(key, &key_der)) <= 0) {
+	if ((key_len = i2d_ASN1_INTEGER(aint, &key)) <= 0) {
 		DSAerror(ERR_R_MALLOC_FAILURE);
 		key_len = 0;
 		goto err;
@@ -308,25 +318,25 @@ dsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
 
 	if ((aobj = OBJ_nid2obj(NID_dsa)) == NULL)
 		goto err;
-	if (!PKCS8_pkey_set0(p8, aobj, 0, ptype, params, key_der, key_len))
+	if (!PKCS8_pkey_set0(p8, aobj, 0, ptype, astr, key, key_len))
 		goto err;
-	params = NULL;
-	key_der = NULL;
+	astr = NULL;
+	key = NULL;
 	key_len = 0;
 
 	ret = 1;
 
  err:
-	ASN1_STRING_free(params);
-	ASN1_INTEGER_free(key);
-	freezero(params_der, params_len);
-	freezero(key_der, key_len);
+	ASN1_STRING_free(astr);
+	ASN1_INTEGER_free(aint);
+	freezero(params, params_len);
+	freezero(key, key_len);
 
 	return ret;
 }
 
 static int
-int_dsa_size(const EVP_PKEY *pkey)
+dsa_size(const EVP_PKEY *pkey)
 {
 	return DSA_size(pkey->pkey.dsa);
 }
@@ -346,12 +356,9 @@ dsa_security_bits(const EVP_PKEY *pkey)
 static int
 dsa_missing_parameters(const EVP_PKEY *pkey)
 {
-	DSA *dsa;
+	const DSA *dsa = pkey->pkey.dsa;
 
-	dsa = pkey->pkey.dsa;
-	if (dsa->p == NULL || dsa->q == NULL || dsa->g == NULL)
-		return 1;
-	return 0;
+	return dsa->p == NULL || dsa->q == NULL || dsa->g == NULL;
 }
 
 static int
@@ -397,7 +404,7 @@ dsa_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
 }
 
 static void
-int_dsa_free(EVP_PKEY *pkey)
+dsa_free(EVP_PKEY *pkey)
 {
 	DSA_free(pkey->pkey.dsa);
 }
@@ -452,26 +459,33 @@ do_dsa_print(BIO *bp, const DSA *x, int off, int ptype)
 }
 
 static int
-dsa_param_decode(EVP_PKEY *pkey, const unsigned char **pder, int derlen)
+dsa_param_decode(EVP_PKEY *pkey, const unsigned char **params, int params_len)
 {
-	DSA *dsa;
+	DSA *dsa = NULL;
+	int ret = 0;
 
-	if (!(dsa = d2i_DSAparams(NULL, pder, derlen))) {
+	if ((dsa = d2i_DSAparams(NULL, params, params_len)) == NULL) {
 		DSAerror(ERR_R_DSA_LIB);
-		return 0;
+		goto err;
 	}
-	if (!dsa_check_key(dsa)) {
-		DSA_free(dsa);
-		return 0;
-	}
-	EVP_PKEY_assign_DSA(pkey, dsa);
-	return 1;
+	if (!dsa_check_key(dsa))
+		goto err;
+	if (!EVP_PKEY_assign_DSA(pkey, dsa))
+		goto err;
+	dsa = NULL;
+
+	ret = 1;
+
+ err:
+	DSA_free(dsa);
+
+	return ret;
 }
 
 static int
-dsa_param_encode(const EVP_PKEY *pkey, unsigned char **pder)
+dsa_param_encode(const EVP_PKEY *pkey, unsigned char **params)
 {
-	return i2d_DSAparams(pkey->pkey.dsa, pder);
+	return i2d_DSAparams(pkey->pkey.dsa, params);
 }
 
 static int
@@ -493,13 +507,14 @@ dsa_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
 }
 
 static int
-old_dsa_priv_decode(EVP_PKEY *pkey, const unsigned char **pder, int derlen)
+old_dsa_priv_decode(EVP_PKEY *pkey, const unsigned char **key, int key_len)
 {
-	DSA *dsa;
+	DSA *dsa = NULL;
 	BN_CTX *ctx = NULL;
 	BIGNUM *result;
+	int ret = 0;
 
-	if ((dsa = d2i_DSAPrivateKey(NULL, pder, derlen)) == NULL) {
+	if ((dsa = d2i_DSAPrivateKey(NULL, key, key_len)) == NULL) {
 		DSAerror(ERR_R_DSA_LIB);
 		goto err;
 	}
@@ -551,23 +566,24 @@ old_dsa_priv_decode(EVP_PKEY *pkey, const unsigned char **pder, int derlen)
 		goto err;
 	}
 
-	BN_CTX_end(ctx);
-	BN_CTX_free(ctx);
+	if (!EVP_PKEY_assign_DSA(pkey, dsa))
+		goto err;
+	dsa = NULL;
 
-	EVP_PKEY_assign_DSA(pkey, dsa);
-	return 1;
+	ret = 1;
 
  err:
 	BN_CTX_end(ctx);
 	BN_CTX_free(ctx);
 	DSA_free(dsa);
-	return 0;
+
+	return ret;
 }
 
 static int
-old_dsa_priv_encode(const EVP_PKEY *pkey, unsigned char **pder)
+old_dsa_priv_encode(const EVP_PKEY *pkey, unsigned char **key)
 {
-	return i2d_DSAPrivateKey(pkey->pkey.dsa, pder);
+	return i2d_DSAPrivateKey(pkey->pkey.dsa, key);
 }
 
 static int
@@ -701,7 +717,7 @@ const EVP_PKEY_ASN1_METHOD dsa_asn1_meths[] = {
 		.priv_encode = dsa_priv_encode,
 		.priv_print = dsa_priv_print,
 
-		.pkey_size = int_dsa_size,
+		.pkey_size = dsa_size,
 		.pkey_bits = dsa_bits,
 		.pkey_security_bits = dsa_security_bits,
 
@@ -713,7 +729,7 @@ const EVP_PKEY_ASN1_METHOD dsa_asn1_meths[] = {
 		.param_print = dsa_param_print,
 		.sig_print = dsa_sig_print,
 
-		.pkey_free = int_dsa_free,
+		.pkey_free = dsa_free,
 		.pkey_ctrl = dsa_pkey_ctrl,
 		.old_priv_decode = old_dsa_priv_decode,
 		.old_priv_encode = old_dsa_priv_encode
diff --git a/lib/libcrypto/dsa/dsa_lib.c b/lib/libcrypto/dsa/dsa_lib.c
index 46a7dbcfb..a9d2179ae 100644
--- a/lib/libcrypto/dsa/dsa_lib.c
+++ b/lib/libcrypto/dsa/dsa_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dsa_lib.c,v 1.43 2023/07/08 14:28:15 beck Exp $ */
+/* $OpenBSD: dsa_lib.c,v 1.44 2023/08/12 06:14:36 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -127,61 +127,46 @@ LCRYPTO_ALIAS(DSA_set_method);
 DSA *
 DSA_new_method(ENGINE *engine)
 {
-	DSA *ret;
+	DSA *dsa;
 
-	ret = malloc(sizeof(DSA));
-	if (ret == NULL) {
+	if ((dsa = calloc(1, sizeof(DSA))) == NULL) {
 		DSAerror(ERR_R_MALLOC_FAILURE);
-		return NULL;
+		goto err;
 	}
-	ret->meth = DSA_get_default_method();
+
+	dsa->meth = DSA_get_default_method();
+	dsa->flags = dsa->meth->flags & ~DSA_FLAG_NON_FIPS_ALLOW;
+	dsa->references = 1;
+
 #ifndef OPENSSL_NO_ENGINE
 	if (engine) {
 		if (!ENGINE_init(engine)) {
 			DSAerror(ERR_R_ENGINE_LIB);
-			free(ret);
-			return NULL;
+			goto err;
 		}
-		ret->engine = engine;
+		dsa->engine = engine;
 	} else
-		ret->engine = ENGINE_get_default_DSA();
-	if (ret->engine) {
-		ret->meth = ENGINE_get_DSA(ret->engine);
-		if (ret->meth == NULL) {
+		dsa->engine = ENGINE_get_default_DSA();
+	if (dsa->engine != NULL) {
+		if ((dsa->meth = ENGINE_get_DSA(dsa->engine)) == NULL) {
 			DSAerror(ERR_R_ENGINE_LIB);
-			ENGINE_finish(ret->engine);
-			free(ret);
-			return NULL;
+			goto err;
 		}
+		dsa->flags = dsa->meth->flags & ~DSA_FLAG_NON_FIPS_ALLOW;
 	}
 #endif
 
-	ret->pad = 0;
-	ret->version = 0;
-	ret->p = NULL;
-	ret->q = NULL;
-	ret->g = NULL;
+	if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_DSA, dsa, &dsa->ex_data))
+		goto err;
+	if (dsa->meth->init != NULL && !dsa->meth->init(dsa))
+		goto err;
 
-	ret->pub_key = NULL;
-	ret->priv_key = NULL;
+	return dsa;
 
-	ret->kinv = NULL;
-	ret->r = NULL;
-	ret->method_mont_p = NULL;
+ err:
+	DSA_free(dsa);
 
-	ret->references = 1;
-	ret->flags = ret->meth->flags & ~DSA_FLAG_NON_FIPS_ALLOW;
-	CRYPTO_new_ex_data(CRYPTO_EX_INDEX_DSA, ret, &ret->ex_data);
-	if (ret->meth->init != NULL && !ret->meth->init(ret)) {
-#ifndef OPENSSL_NO_ENGINE
-		ENGINE_finish(ret->engine);
-#endif
-		CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DSA, ret, &ret->ex_data);
-		free(ret);
-		ret = NULL;
-	}
-
-	return ret;
+	return NULL;
 }
 LCRYPTO_ALIAS(DSA_new_method);
 
@@ -197,7 +182,7 @@ DSA_free(DSA *r)
 	if (i > 0)
 		return;
 
-	if (r->meth->finish)
+	if (r->meth != NULL && r->meth->finish != NULL)
 		r->meth->finish(r);
 #ifndef OPENSSL_NO_ENGINE
 	ENGINE_finish(r->engine);
diff --git a/lib/libcrypto/ec/ec_ameth.c b/lib/libcrypto/ec/ec_ameth.c
index 49ae80494..6adf7ce67 100644
--- a/lib/libcrypto/ec/ec_ameth.c
+++ b/lib/libcrypto/ec/ec_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_ameth.c,v 1.41 2023/07/07 06:59:18 tb Exp $ */
+/* $OpenBSD: ec_ameth.c,v 1.42 2023/08/12 08:07:35 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -359,7 +359,7 @@ eckey_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
 }
 
 static int
-int_ec_size(const EVP_PKEY *pkey)
+ec_size(const EVP_PKEY *pkey)
 {
 	return ECDSA_size(pkey->pkey.ec);
 }
@@ -419,7 +419,7 @@ ec_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
 }
 
 static void
-int_ec_free(EVP_PKEY *pkey)
+ec_free(EVP_PKEY *pkey)
 {
 	EC_KEY_free(pkey->pkey.ec);
 }
@@ -994,7 +994,7 @@ const EVP_PKEY_ASN1_METHOD eckey_asn1_meth = {
 	.priv_encode = eckey_priv_encode,
 	.priv_print = eckey_priv_print,
 
-	.pkey_size = int_ec_size,
+	.pkey_size = ec_size,
 	.pkey_bits = ec_bits,
 	.pkey_security_bits = ec_security_bits,
 
@@ -1005,7 +1005,7 @@ const EVP_PKEY_ASN1_METHOD eckey_asn1_meth = {
 	.param_cmp = ec_cmp_parameters,
 	.param_print = eckey_param_print,
 
-	.pkey_free = int_ec_free,
+	.pkey_free = ec_free,
 	.pkey_ctrl = ec_pkey_ctrl,
 	.old_priv_decode = old_ec_priv_decode,
 	.old_priv_encode = old_ec_priv_encode,
diff --git a/lib/libcrypto/man/DSA_dup_DH.3 b/lib/libcrypto/man/DSA_dup_DH.3
index d82defa37..d6163fd3c 100644
--- a/lib/libcrypto/man/DSA_dup_DH.3
+++ b/lib/libcrypto/man/DSA_dup_DH.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: DSA_dup_DH.3,v 1.8 2019/06/10 14:58:48 schwarze Exp $
+.\"	$OpenBSD: DSA_dup_DH.3,v 1.9 2023/08/12 08:26:38 tb Exp $
 .\"	OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
 .\"
 .\" This file was written by Ulf Moeller <ulf@openssl.org>.
@@ -48,7 +48,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 10 2019 $
+.Dd $Mdocdate: August 12 2023 $
 .Dt DSA_DUP_DH 3
 .Os
 .Sh NAME
@@ -67,10 +67,6 @@ duplicates
 parameters/keys as
 .Vt DH
 parameters/keys.
-.Fa r->q
-is lost during that conversion, but the resulting
-.Vt DH
-parameters contain its length.
 .Sh RETURN VALUES
 .Fn DSA_dup_DH
 returns the new
diff --git a/lib/libcrypto/man/EVP_DigestInit.3 b/lib/libcrypto/man/EVP_DigestInit.3
index ba9d6a048..2d790cb2c 100644
--- a/lib/libcrypto/man/EVP_DigestInit.3
+++ b/lib/libcrypto/man/EVP_DigestInit.3
@@ -1,11 +1,11 @@
-.\" $OpenBSD: EVP_DigestInit.3,v 1.25 2023/04/23 18:24:01 job Exp $
+.\" $OpenBSD: EVP_DigestInit.3,v 1.28 2023/08/14 14:22:32 schwarze Exp $
 .\" full merge up to: OpenSSL 7f572e95 Dec 2 13:57:04 2015 +0000
-.\" selective merge up to: OpenSSL a95d7574 Jul 2 12:16:38 2017 -0400
+.\" selective merge up to: OpenSSL 24a535ea Sep 22 13:14:20 2020 +0100
 .\"
 .\" This file is a derived work.
 .\" The changes are covered by the following Copyright and license:
 .\"
-.\" Copyright (c) 2019 Ingo Schwarze <schwarze@openbsd.org>
+.\" Copyright (c) 2019, 2023 Ingo Schwarze <schwarze@openbsd.org>
 .\"
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -19,9 +19,11 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" The original file was written by Dr. Stephen Henson <steve@openssl.org>
-.\" and Richard Levitte <levitte@openssl.org>.
-.\" Copyright (c) 2000-2004, 2009, 2012-2016 The OpenSSL Project.
+.\" The original file was written by Dr. Stephen Henson <steve@openssl.org>,
+.\" Richard Levitte <levitte@openssl.org>,
+.\" Paul Yang <yang.yang@baishancloud.com>, and
+.\" Antoine Salon <asalon@vmware.com>.
+.\" Copyright (c) 2000-2004, 2009, 2012-2016, 2018, 2019 The OpenSSL Project.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -68,7 +70,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: April 23 2023 $
+.Dd $Mdocdate: August 14 2023 $
 .Dt EVP_DIGESTINIT 3
 .Os
 .Sh NAME
@@ -80,6 +82,9 @@
 .Nm EVP_MD_CTX_cleanup ,
 .Nm EVP_MD_CTX_destroy ,
 .Nm EVP_MD_CTX_ctrl ,
+.Nm EVP_MD_CTX_set_flags ,
+.Nm EVP_MD_CTX_clear_flags ,
+.Nm EVP_MD_CTX_test_flags ,
 .Nm EVP_DigestInit_ex ,
 .Nm EVP_DigestUpdate ,
 .Nm EVP_DigestFinal_ex ,
@@ -93,10 +98,14 @@
 .Nm EVP_MD_pkey_type ,
 .Nm EVP_MD_size ,
 .Nm EVP_MD_block_size ,
+.Nm EVP_MD_flags ,
 .Nm EVP_MD_CTX_md ,
 .Nm EVP_MD_CTX_size ,
 .Nm EVP_MD_CTX_block_size ,
 .Nm EVP_MD_CTX_type ,
+.Nm EVP_MD_CTX_md_data ,
+.Nm EVP_MD_CTX_pkey_ctx ,
+.Nm EVP_MD_CTX_set_pkey_ctx ,
 .Nm EVP_md_null ,
 .Nm EVP_md5 ,
 .Nm EVP_md5_sha1 ,
@@ -141,10 +150,25 @@
 .Ft int
 .Fo EVP_MD_CTX_ctrl
 .Fa "EVP_MD_CTX *ctx"
-.Fa "int cmd"
+.Fa "int command"
 .Fa "int p1"
 .Fa "void* p2"
 .Fc
+.Ft void
+.Fo EVP_MD_CTX_set_flags
+.Fa "EVP_MD_CTX *ctx"
+.Fa "int flags"
+.Fc
+.Ft void
+.Fo EVP_MD_CTX_clear_flags
+.Fa "EVP_MD_CTX *ctx"
+.Fa "int flags"
+.Fc
+.Ft int
+.Fo EVP_MD_CTX_test_flags
+.Fa "const EVP_MD_CTX *ctx"
+.Fa "int flags"
+.Fc
 .Ft int
 .Fo EVP_DigestInit_ex
 .Fa "EVP_MD_CTX *ctx"
@@ -210,21 +234,38 @@
 .Fo EVP_MD_block_size
 .Fa "const EVP_MD *md"
 .Fc
+.Ft unsigned long
+.Fo EVP_MD_flags
+.Fa "const EVP_MD *md"
+.Fc
 .Ft const EVP_MD *
 .Fo EVP_MD_CTX_md
 .Fa "const EVP_MD_CTX *ctx"
 .Fc
 .Ft int
 .Fo EVP_MD_CTX_size
-.Fa "const EVP_MD *ctx"
+.Fa "const EVP_MD_CTX *ctx"
 .Fc
 .Ft int
 .Fo EVP_MD_CTX_block_size
-.Fa "const EVP_MD *ctx"
+.Fa "const EVP_MD_CTX *ctx"
 .Fc
 .Ft int
 .Fo EVP_MD_CTX_type
-.Fa "const EVP_MD *ctx"
+.Fa "const EVP_MD_CTX *ctx"
+.Fc
+.Ft void *
+.Fo EVP_MD_CTX_md_data
+.Fa "const EVP_MD_CTX *ctx"
+.Fc
+.Ft EVP_PKEY_CTX *
+.Fo EVP_MD_CTX_pkey_ctx
+.Fa "const EVP_MD_CTX *ctx"
+.Fc
+.Ft void
+.Fo EVP_MD_CTX_set_pkey_ctx
+.Fa "EVP_MD_CTX *ctx"
+.Fa "EVP_PKEY_CTX *pctx"
 .Fc
 .Ft const EVP_MD *
 .Fn EVP_md_null void
@@ -261,7 +302,7 @@
 .Fa "const ASN1_OBJECT *o"
 .Fc
 .Sh DESCRIPTION
-The EVP digest routines are a high level interface to message digests
+The EVP digest routines are a high-level interface to message digests
 and should be used instead of the cipher-specific functions.
 .Pp
 .Fn EVP_MD_CTX_new
@@ -298,8 +339,68 @@ and
 respectively.
 .Pp
 .Fn EVP_MD_CTX_ctrl
-performs digest-specific control actions on the context
+performs the digest-specific control
+.Fa command
+with the command-specific arguments
+.Fa p1
+and
+.Fa p2
+on
+.Fa ctx ,
+which needs to already be set up with
+.Fn EVP_DigestInit_ex
+before calling this function.
+Other restrictions may apply depending on the control
+.Fa command
+and digest implementation.
+.Pp
+If the
+.Fa command
+is
+.Dv EVP_MD_CTRL_MICALG ,
+.Fa p1
+is ignored and
+.Fa p2
+is an output argument of the type
+.Fa "char **p2" .
+A string specifying the digest Message Integrity Check algorithm
+is allocated and a pointer to this string is returned in
+.Pf * Fa p2 .
+It is the responsibility of the caller to
+.Xr free 3
+.Pf * Fa p2
+when it is no longer needed.
+This
+.Fa command
+is used by
+.Xr SMIME_write_ASN1 3
+when creating S/MIME multipart/signed messages as specified in RFC 3851.
+.Pp
+.Fn EVP_MD_CTX_set_flags
+sets and
+.Fn EVP_MD_CTX_clear_flags
+clears all the flag bits in
+.Fa ctx
+that are set in the
+.Fa flags
+argument.
+.Fn EVP_MD_CTX_test_flags
+tests which of the flag bits that are set in the
+.Fa flags
+argument are also set in
 .Fa ctx .
+Possible flag bits are:
+.Bl -tag -width Ds -offset 2n
+.It Dv EVP_MD_CTX_FLAG_NO_INIT
+Instruct
+.Fn EVP_DigestInit_ex
+and functions calling it not to initialise the internal data
+that is specific to the digest method and its implementation.
+.It Dv EVP_MD_CTX_FLAG_ONESHOT
+Instruct the digest to optimize for one update only, if possible.
+For digest algorithms built into the library, this flag usually
+has no effect.
+.El
 .Pp
 .Fn EVP_DigestInit_ex
 sets up the digest context
@@ -434,15 +535,29 @@ structure.
 .Fn EVP_MD_type
 and
 .Fn EVP_MD_CTX_type
-return the NID of the OBJECT IDENTIFIER representing the given message
-digest when passed an
-.Vt EVP_MD
-structure.
+return the NID of the OBJECT IDENTIFIER representing the message digest.
 For example
 .Fn EVP_MD_type EVP_sha1()
 returns
 .Dv NID_sha1 .
-This function is normally used when setting ASN.1 OIDs.
+These functions are normally used when setting ASN.1 OIDs.
+.Pp
+.Fn EVP_MD_CTX_md_data
+returns the digest method private data of
+.Fa ctx .
+The space was allocated and its size set with
+.Xr EVP_MD_meth_set_app_datasize 3 .
+.Pp
+.Fn EVP_MD_flags
+returns the
+.Fa md
+flags.
+These are different from the
+.Vt EVP_MD_CTX
+ones.
+See
+.Xr EVP_MD_meth_set_flags 3
+for more information.
 .Pp
 .Fn EVP_MD_pkey_type
 returns the NID of the public key signing algorithm associated with this
@@ -454,6 +569,56 @@ is associated with RSA so this will return
 Since digests and signature algorithms are no longer linked, this
 function is only retained for compatibility reasons.
 .Pp
+.Fn EVP_MD_CTX_pkey_ctx
+returns the
+.Vt EVP_PKEY_CTX
+assigned to
+.Fa ctx .
+The returned pointer should not be freed by the caller.
+.Pp
+.Fn EVP_MD_CTX_set_pkey_ctx
+assigns
+.Fa pctx
+to
+.Fa ctx .
+This is normally used to provide a customized
+.Vt EVP_PKEY_CTX
+to
+.Xr EVP_DigestSignInit 3
+or
+.Xr EVP_DigestVerifyInit 3 .
+The caller retains ownership of the
+.Fa pctx
+passed to this function and is responsible for freeing it
+when it is no longer needed.
+.Pp
+If the
+.Fa ctx
+already contains a
+.Vt EVP_PKEY_CTX
+when this function is called, that old
+.Vt EVP_PKEY_CTX
+is freed if it was created internally, but if it was also installed with
+.Fn EVP_MD_CTX_set_pkey_ctx ,
+the pointer to the old
+.Vt EVP_PKEY_CTX
+is merely replaced by the new pointer and ownership of the old
+.Vt EVP_PKEY_CTX
+remains with the previous caller.
+.Pp
+Passing a
+.Dv NULL
+pointer for the
+.Fa pctx
+argument is also allowed.
+In that case, any
+.Vt EVP_PKEY_CTX
+already assigned to
+.Fa ctx
+is dissociated from it as described above, but no new
+.Vt EVP_PKEY_CTX
+is assigned.
+.Pp
 .Fn EVP_md5 ,
 .Fn EVP_sha1 ,
 .Fn EVP_sha224 ,
@@ -502,7 +667,7 @@ and
 are implemented as macros.
 .Pp
 The EVP interface to message digests should almost always be used
-in preference to the low level interfaces.
+in preference to the low-level interfaces.
 This is because the code then becomes transparent to the digest used and
 much more flexible.
 .Pp
@@ -559,6 +724,12 @@ and
 .Fn EVP_MD_CTX_copy
 return 1 for success or 0 for failure.
 .Pp
+.Fn EVP_MD_CTX_test_flags
+returns the bitwise OR of the
+.Fa flags
+argument and the flags set in
+.Fa ctx .
+.Pp
 .Fn EVP_MD_type ,
 .Fn EVP_MD_pkey_type ,
 and
@@ -610,6 +781,7 @@ This example digests the data "Test Message\en" and "Hello World\en",
 using the digest name passed on the command line.
 .Bd -literal -offset indent
 #include <stdio.h>
+#include <string.h>
 #include <openssl/evp.h>
 
 int
@@ -620,7 +792,7 @@ main(int argc, char *argv[])
 	const char mess1[] = "Test Message\en";
 	const char mess2[] = "Hello World\en";
 	unsigned char md_value[EVP_MAX_MD_SIZE];
-	int md_len, i;
+	unsigned int md_len, i;
 
 	if (argc <= 1) {
 		printf("Usage: mdtest digestname\en");
@@ -655,8 +827,10 @@ main(int argc, char *argv[])
 .Xr EVP_BytesToKey 3 ,
 .Xr EVP_DigestSignInit 3 ,
 .Xr EVP_DigestVerifyInit 3 ,
+.Xr EVP_MD_meth_new 3 ,
 .Xr EVP_PKEY_CTX_set_signature_md 3 ,
 .Xr EVP_PKEY_meth_set_signctx 3 ,
+.Xr EVP_sha3_224 3 ,
 .Xr EVP_SignInit 3 ,
 .Xr EVP_sm3 3 ,
 .Xr EVP_VerifyInit 3 ,
@@ -715,6 +889,9 @@ first appeared in OpenSSL 0.9.5 and has been available since
 .Fn EVP_MD_CTX_create ,
 .Fn EVP_MD_CTX_cleanup ,
 .Fn EVP_MD_CTX_destroy ,
+.Fn EVP_MD_CTX_set_flags ,
+.Fn EVP_MD_CTX_clear_flags ,
+.Fn EVP_MD_CTX_test_flags ,
 .Fn EVP_DigestInit_ex ,
 .Fn EVP_DigestFinal_ex ,
 .Fn EVP_Digest ,
@@ -732,11 +909,10 @@ first appeared in OpenSSL 0.9.7h and 0.9.8a
 and have been available since
 .Ox 4.0 .
 .Pp
-.Fn EVP_sha512_224
-and
-.Fn EVP_sha512_256
-first appeared in OpenSSL 1.1.1 and has been available since
-.Ox 7.4 .
+.Fn EVP_MD_flags
+first appeared in OpenSSL 1.0.0
+and has been available since
+.Ox 4.9 .
 .Pp
 .Fn EVP_MD_CTX_ctrl
 first appeared in OpenSSL 1.1.0 and has been available since
@@ -750,6 +926,21 @@ and
 first appeared in OpenSSL 1.1.0 and have been available since
 .Ox 6.3 .
 .Pp
+.Fn EVP_MD_CTX_md_data
+and
+.Fn EVP_MD_CTX_pkey_ctx
+first appeared in OpenSSL 1.1.0 and
+.Fn EVP_MD_CTX_set_pkey_ctx
+in OpenSSL 1.1.1.
+These functions have been available since
+.Ox 7.1 .
+.Pp
+.Fn EVP_sha512_224
+and
+.Fn EVP_sha512_256
+first appeared in OpenSSL 1.1.1 and have been available since
+.Ox 7.4 .
+.Pp
 The link between digests and signing algorithms was fixed in OpenSSL 1.0
 and later, so now
 .Fn EVP_sha1
diff --git a/lib/libcrypto/man/EVP_EncryptInit.3 b/lib/libcrypto/man/EVP_EncryptInit.3
index b4fbfa373..556b50c92 100644
--- a/lib/libcrypto/man/EVP_EncryptInit.3
+++ b/lib/libcrypto/man/EVP_EncryptInit.3
@@ -1,9 +1,7 @@
-.\" $OpenBSD: EVP_EncryptInit.3,v 1.44 2022/08/31 14:27:34 tb Exp $
+.\" $OpenBSD: EVP_EncryptInit.3,v 1.46 2023/08/16 13:50:05 schwarze Exp $
 .\" full merge up to: OpenSSL 5211e094 Nov 11 14:39:11 2014 -0800
 .\"   EVP_bf_cbc.pod EVP_cast5_cbc.pod EVP_idea_cbc.pod EVP_rc2_cbc.pod
 .\"   7c6d372a Nov 20 13:20:01 2018 +0000
-.\" selective merge up to: OpenSSL 16cfc2c9 Mar 8 22:30:28 2018 +0100
-.\"   EVP_chacha20.pod 8fa4d95e Oct 21 11:59:09 2017 +0900
 .\"
 .\" This file is a derived work.
 .\" The changes are covered by the following Copyright and license:
@@ -71,7 +69,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: August 31 2022 $
+.Dd $Mdocdate: August 16 2023 $
 .Dt EVP_ENCRYPTINIT 3
 .Os
 .Sh NAME
@@ -149,8 +147,7 @@
 .Nm EVP_cast5_ecb ,
 .Nm EVP_cast5_cfb64 ,
 .Nm EVP_cast5_cfb ,
-.Nm EVP_cast5_ofb ,
-.Nm EVP_chacha20
+.Nm EVP_cast5_ofb
 .Nd EVP cipher routines
 .Sh SYNOPSIS
 .In openssl/evp.h
@@ -906,6 +903,15 @@ return 1 for success or 0 for failure.
 .Fn EVP_CIPHER_CTX_set_padding
 always returns 1.
 .Pp
+.Fn EVP_CIPHER_CTX_ctrl
+usually returns 1 for success, 0 for failure, or \-1 if the
+.Fa type
+is not supported by the
+.Fa ctx ,
+but there may be exceptions for some
+.Fa type
+arguments.
+.Pp
 .Fn EVP_get_cipherbyname ,
 .Fn EVP_get_cipherbynid ,
 and
@@ -1020,11 +1026,6 @@ This is a variable key length cipher.
 is an alias for
 .Fn EVP_cast5_cfb64 ,
 implemented as a macro.
-.It Fn EVP_chacha20
-The ChaCha20 stream cipher.
-The key length is 256 bits.
-The first 32 bits of the 128-bit IV are used as a counter,
-and the remaining 96 bits as a nonce.
 .El
 .Pp
 See also
@@ -1241,6 +1242,7 @@ do_crypt(FILE *in, FILE *out, int do_encrypt)
 .Xr EVP_AEAD_CTX_init 3 ,
 .Xr EVP_aes_128_cbc 3 ,
 .Xr EVP_camellia_128_cbc 3 ,
+.Xr EVP_chacha20 3 ,
 .Xr EVP_des_cbc 3 ,
 .Xr EVP_OpenInit 3 ,
 .Xr EVP_rc4 3 ,
diff --git a/lib/libcrypto/man/EVP_MD_meth_new.3 b/lib/libcrypto/man/EVP_MD_meth_new.3
index d6720ef8b..0876312ac 100644
--- a/lib/libcrypto/man/EVP_MD_meth_new.3
+++ b/lib/libcrypto/man/EVP_MD_meth_new.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: EVP_MD_meth_new.3,v 1.2 2023/07/09 06:47:51 tb Exp $
+.\" $OpenBSD: EVP_MD_meth_new.3,v 1.3 2023/08/12 16:48:23 schwarze Exp $
 .\" selective merge up to:
 .\" OpenSSL man3/EVP_MD_meth_new 0388d212 Dec 14 12:47:07 2018 -0800
 .\"
@@ -49,7 +49,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: July 9 2023 $
+.Dd $Mdocdate: August 12 2023 $
 .Dt EVP_MD_METH_NEW 3
 .Os
 .Sh NAME
@@ -130,7 +130,7 @@
 .Ft int
 .Fo EVP_MD_meth_set_ctrl
 .Fa "EVP_MD *md"
-.Fa "int (*ctrl)(EVP_MD_CTX *ctx, int cmd, int p1, void *p2)"
+.Fa "int (*control)(EVP_MD_CTX *ctx, int command, int p1, void *p2)"
 .Fc
 .Sh DESCRIPTION
 The
@@ -267,11 +267,21 @@ and
 .Xr EVP_MD_CTX_free 3 .
 .Pp
 .Fn EVP_MD_meth_set_ctrl
-sets the control function for
+sets the
+.Fa control
+function for
 .Fa md .
+The
+.Fa control
+function supplied by the application program has to return 1 to indicate
+success, 0 to indicate failure, or \-1 if the
+.Fa command
+is not supported for this digest method.
 See
 .Xr EVP_MD_CTX_ctrl 3
-for the available controls.
+for the available
+.Fa command
+arguments.
 .Sh RETURN VALUES
 .Fn EVP_MD_meth_new
 and
diff --git a/lib/libcrypto/man/EVP_chacha20.3 b/lib/libcrypto/man/EVP_chacha20.3
new file mode 100644
index 000000000..01193638b
--- /dev/null
+++ b/lib/libcrypto/man/EVP_chacha20.3
@@ -0,0 +1,259 @@
+.\" $OpenBSD: EVP_chacha20.3,v 1.2 2023/08/16 13:47:18 schwarze Exp $
+.\" full merge up to: OpenSSL 35fd9953 May 28 14:49:38 2019 +0200
+.\"
+.\" This file is a derived work.
+.\" The changes are covered by the following Copyright and license:
+.\"
+.\" Copyright (c) 2023 Ingo Schwarze <schwarze@openbsd.org>
+.\"
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.\" The original file was written by Ronald Tse <ronald.tse@ribose.com>.
+.\" Copyright (c) 2017 The OpenSSL Project.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\"
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\"
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in
+.\"    the documentation and/or other materials provided with the
+.\"    distribution.
+.\"
+.\" 3. All advertising materials mentioning features or use of this
+.\"    software must display the following acknowledgment:
+.\"    "This product includes software developed by the OpenSSL Project
+.\"    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+.\"
+.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+.\"    endorse or promote products derived from this software without
+.\"    prior written permission. For written permission, please contact
+.\"    openssl-core@openssl.org.
+.\"
+.\" 5. Products derived from this software may not be called "OpenSSL"
+.\"    nor may "OpenSSL" appear in their names without prior written
+.\"    permission of the OpenSSL Project.
+.\"
+.\" 6. Redistributions of any form whatsoever must retain the following
+.\"    acknowledgment:
+.\"    "This product includes software developed by the OpenSSL Project
+.\"    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+.\" OF THE POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd $Mdocdate: August 16 2023 $
+.Dt EVP_CHACHA20 3
+.Os
+.Sh NAME
+.Nm EVP_chacha20 ,
+.Nm EVP_chacha20_poly1305
+.Nd ChaCha20 stream cipher for EVP
+.Sh SYNOPSIS
+.In openssl/evp.h
+.Ft const EVP_CIPHER *
+.Fn EVP_chacha20 void
+.Ft const EVP_CIPHER *
+.Fn EVP_chacha20_poly1305 void
+.Sh DESCRIPTION
+.Fn EVP_chacha20
+provides the ChaCha20 stream cipher in the EVP framework.
+.Xr EVP_EncryptInit_ex 3 ,
+.Xr EVP_DecryptInit_ex 3 ,
+and
+.Xr EVP_CipherInit_ex 3
+take a
+.Fa key
+argument of 32 bytes = 256 bits and an
+.Fa iv
+argument of 16 bytes = 128 bits, internally using
+.Xr ChaCha_set_key 3
+and
+.Xr ChaCha_set_iv 3 .
+Due to the symmetry of the internal cipher state, interpreting the
+.Fa iv
+argument as a 4 byte counter followed by a 12 byte nonce
+or interpreting it as an 8 byte counter followed by an 8 byte nonce
+is functionally equivalent.
+.Xr EVP_EncryptUpdate 3 ,
+.Xr EVP_EncryptFinal_ex 3 ,
+.Xr EVP_DecryptUpdate 3 ,
+and
+.Xr EVP_DecryptFinal_ex 3
+internally use
+.Xr ChaCha 3
+to perform encryption and decryption.
+.Xr EVP_CIPHER_CTX_ctrl 3
+always fails for
+.Fa ctx
+objects created from
+.Fn EVP_chacha20 .
+.Pp
+.Fn EVP_chacha20_poly1305
+provides authenticated encryption with ChaCha20-Poly1305.
+.Xr EVP_EncryptInit_ex 3 ,
+.Xr EVP_DecryptInit_ex 3 ,
+and
+.Xr EVP_CipherInit_ex 3
+take a
+.Fa key
+argument of 32 bytes = 256 bits and an
+.Fa iv
+argument of 12 bytes = 96 bits.
+This supports additional authenticated data (AAD) and produces a 128-bit
+authentication tag.
+.Pp
+The following
+.Fa type
+arguments are supported for
+.Xr EVP_CIPHER_CTX_ctrl 3 :
+.Bl -tag -width Ds
+.It Dv EVP_CTRL_AEAD_GET_TAG
+Copy the number of bytes indicated by the
+.Fa arg
+argument from the tag to the location indicated by the
+.Fa ptr
+argument;
+to be called after
+.Xr EVP_EncryptFinal_ex 3 .
+This control operation fails if the
+.Fa ctx
+is not configured for encryption or if
+.Fa arg
+is less than 1 or greater than 16.
+.It Dv EVP_CTRL_AEAD_SET_TAG
+Copy the number of bytes indicated by the
+.Fa arg
+argument from the location indicated by the
+.Fa ptr
+argument and designate them as the expected tag length and tag,
+causing subsequent
+.Xr EVP_DecryptFinal_ex 3
+to fail if the tag calculated during decryption does not match.
+It is strongly recommended to specify
+.Fa arg
+as exactly 16.
+Otherwise, only the initial part of the tag may be compared
+and mismatches near the end of the tag may get silently irgnored.
+This control operation fails if the
+.Fa ctx
+is configured for encryption or if
+.Fa arg
+is less than 1 or greater than 16.
+If the
+.Fa ptr
+argument is a
+.Dv NULL
+pointer, this control operation succeeds without having any effect.
+.It EVP_CTRL_AEAD_SET_IV_FIXED
+Set the initialization vector by reading the 12 bytes pointed to by the
+.Fa ptr
+argument, independently of
+.Xr EVP_EncryptInit_ex 3 ,
+.Xr EVP_DecryptInit_ex 3 ,
+and
+.Xr EVP_CipherInit_ex 3 .
+This control operation fails if the
+.Fa arg
+argument is not exactly 12.
+.It Dv EVP_CTRL_AEAD_SET_IVLEN
+Instruct subsequent
+.Xr EVP_EncryptInit_ex 3 ,
+.Xr EVP_DecryptInit_ex 3 ,
+or
+.Xr EVP_CipherInit_ex 3
+to expect an
+.Fa iv
+argument shorter than the default of 12 bytes; the
+.Fa arg
+argument specifies the number of bytes to be used.
+The initialization functions will only read
+the specified smaller number of bytes from
+.Fa iv
+and internally zero-pad them on the left.
+Using this is not recommended because it is likely more fragile
+and less often tested than the equivalent method of simply providing
+a full-sized
+.Fa iv .
+This control operation fails if
+.Fa arg
+is less than 1 or greater than 16.
+.It Dv EVP_CTRL_INIT
+Set the length of the initialization vector to the default value
+of 12 bytes and clear the Poly1305 internal state.
+The application program usually does not need to invoke this contol
+operation manually because it is automatically called internally by
+.Xr EVP_EncryptInit_ex 3 ,
+.Xr EVP_DecryptInit_ex 3 ,
+and
+.Xr EVP_CipherInit_ex 3 .
+.El
+.Sh RETURN VALUES
+.Fn EVP_chacha20
+and
+.Fn EVP_chacha20_poly1305
+return pointers to static
+.Vt EVP_CIPHER
+objects that contain the implementations of the symmetric cipher.
+.Pp
+If
+.Fa ctx
+was created from
+.Fn EVP_chacha20
+or
+.Fn EVP_chacha20_poly1305 ,
+.Xr EVP_CIPHER_CTX_ctrl 3
+returns 1 for success or 0 for failure.
+.Sh SEE ALSO
+.Xr ChaCha 3 ,
+.Xr evp 3 ,
+.Xr EVP_aead_chacha20_poly1305 3 ,
+.Xr EVP_CIPHER_meth_new 3 ,
+.Xr EVP_EncryptInit 3
+.Sh STANDARDS
+.Rs
+.%A A. Langley
+.%A W. Chang
+.%D November 2013
+.%R draft-agl-tls-chacha20poly1305-04
+.%T ChaCha20 and Poly1305 based Cipher Suites for TLS
+.Re
+.Pp
+.Rs
+.%A Y. Nir
+.%A A. Langley
+.%D May 2015
+.%R RFC 7539
+.%T ChaCha20 and Poly1305 for IETF Protocols
+.Re
+.Sh HISTORY
+.Fn EVP_chacha20
+first appeared in
+.Ox 5.6 .
+.Pp
+.Fn EVP_chacha20_poly1305
+first appeared in OpenSSL 1.1.0 and has been available since
+.Ox 7.2 .
diff --git a/lib/libcrypto/man/EVP_sha3_224.3 b/lib/libcrypto/man/EVP_sha3_224.3
new file mode 100644
index 000000000..bd9138c3f
--- /dev/null
+++ b/lib/libcrypto/man/EVP_sha3_224.3
@@ -0,0 +1,92 @@
+.\" $OpenBSD: EVP_sha3_224.3,v 1.2 2023/08/15 11:54:38 schwarze Exp $
+.\" selective merge up to: OpenSSL bbda8ce9 Oct 31 15:43:01 2017 +0800
+.\"
+.\" This file was written by Ronald Tse <ronald.tse@ribose.com>.
+.\" Copyright (c) 2017 The OpenSSL Project.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\"
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\"
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in
+.\"    the documentation and/or other materials provided with the
+.\"    distribution.
+.\"
+.\" 3. All advertising materials mentioning features or use of this
+.\"    software must display the following acknowledgment:
+.\"    "This product includes software developed by the OpenSSL Project
+.\"    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+.\"
+.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+.\"    endorse or promote products derived from this software without
+.\"    prior written permission. For written permission, please contact
+.\"    openssl-core@openssl.org.
+.\"
+.\" 5. Products derived from this software may not be called "OpenSSL"
+.\"    nor may "OpenSSL" appear in their names without prior written
+.\"    permission of the OpenSSL Project.
+.\"
+.\" 6. Redistributions of any form whatsoever must retain the following
+.\"    acknowledgment:
+.\"    "This product includes software developed by the OpenSSL Project
+.\"    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+.\" OF THE POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd $Mdocdate: August 15 2023 $
+.Dt EVP_SHA3_224 3
+.Os
+.Sh NAME
+.Nm EVP_sha3_224 ,
+.Nm EVP_sha3_256 ,
+.Nm EVP_sha3_384 ,
+.Nm EVP_sha3_512
+.Nd Secure Hash Algorithm 3 for EVP
+.Sh SYNOPSIS
+.In openssl/evp.h
+.Ft const EVP_MD *
+.Fn EVP_sha3_224 void
+.Ft const EVP_MD *
+.Fn EVP_sha3_256 void
+.Ft const EVP_MD *
+.Fn EVP_sha3_384 void
+.Ft const EVP_MD *
+.Fn EVP_sha3_512 void
+.Sh DESCRIPTION
+SHA-3 (Secure Hash Algorithm 3) is a family of cryptographic hash
+functions standardized in NIST FIPS 202, first published in 2015.
+It is based on the Keccak algorithm.
+.Pp
+.Fn EVP_sha3_224 ,
+.Fn EVP_sha3_256 ,
+.Fn EVP_sha3_384 ,
+and
+.Fn EVP_sha3_512
+implement the SHA3-224, SHA3-256, SHA3-384, and SHA3-512 algorithms
+and produce 224, 256, 384 and 512 bits of output from a given input,
+respectively.
+.Sh RETURN VALUES
+These functions return pointers to static
+.Vt EVP_MD
+objects implementing the hash functions.
+.Sh SEE ALSO
+.Xr evp 3 ,
+.Xr EVP_DigestInit 3 ,
+.Xr EVP_MD_meth_new 3
+.Sh STANDARDS
+NIST FIPS 202
diff --git a/lib/libcrypto/man/Makefile b/lib/libcrypto/man/Makefile
index 23e48a987..9af9d28c4 100644
--- a/lib/libcrypto/man/Makefile
+++ b/lib/libcrypto/man/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.259 2023/07/28 05:48:33 tb Exp $
+# $OpenBSD: Makefile,v 1.261 2023/08/15 11:26:49 schwarze Exp $
 
 .include <bsd.own.mk>
 
@@ -200,8 +200,10 @@ MAN=	\
 	EVP_VerifyInit.3 \
 	EVP_aes_128_cbc.3 \
 	EVP_camellia_128_cbc.3 \
+	EVP_chacha20.3 \
 	EVP_des_cbc.3 \
 	EVP_rc4.3 \
+	EVP_sha3_224.3 \
 	EVP_sm3.3 \
 	EVP_sm4_cbc.3 \
 	EVP_whirlpool.3 \
diff --git a/lib/libcrypto/man/evp.3 b/lib/libcrypto/man/evp.3
index 6eb6ebfa3..36f0e0700 100644
--- a/lib/libcrypto/man/evp.3
+++ b/lib/libcrypto/man/evp.3
@@ -1,5 +1,5 @@
-.\"	$OpenBSD: evp.3,v 1.15 2023/07/09 06:49:25 tb Exp $
-.\"	OpenSSL a9c85cea Nov 11 09:33:55 2016 +0100
+.\" $OpenBSD: evp.3,v 1.17 2023/08/15 11:26:49 schwarze Exp $
+.\" full merge up to: OpenSSL man7/evp 24a535ea Sep 22 13:14:20 2020 +0100
 .\"
 .\" This file was written by Ulf Moeller <ulf@openssl.org>,
 .\" Matt Caswell <matt@openssl.org>, Geoff Thorpe <geoff@openssl.org>,
@@ -51,16 +51,16 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: July 9 2023 $
+.Dd $Mdocdate: August 15 2023 $
 .Dt EVP 3
 .Os
 .Sh NAME
 .Nm evp
-.Nd high level cryptographic functions
+.Nd high-level cryptographic functions
 .Sh SYNOPSIS
 .In openssl/evp.h
 .Sh DESCRIPTION
-The EVP library provides a high level interface to cryptographic
+The EVP library provides a high-level interface to cryptographic
 functions.
 .Pp
 .Xr EVP_SealInit 3
@@ -95,7 +95,7 @@ functions.
 .Pp
 The
 .Fn EVP_PKEY_*
-functions provide a high level interface to asymmetric algorithms.
+functions provide a high-level interface to asymmetric algorithms.
 To create a new
 .Vt EVP_PKEY ,
 see
@@ -127,7 +127,7 @@ and
 .Xr EVP_PKEY_verify_recover 3 .
 However, note that these functions do not perform a digest of the
 data to be signed.
-Therefore normally you would use the
+Therefore, normally you would use the
 .Xr EVP_DigestSignInit 3
 functions for this purpose.
 .It
@@ -169,45 +169,91 @@ implementations of ciphers or digests are registered as defaults,
 then the various EVP functions will automatically use those
 implementations in preference to built in software implementations.
 .Pp
-Although low level algorithm specific functions exist for many
+Although low-level algorithm specific functions exist for many
 algorithms, their use is discouraged.
 They cannot be used with an
 .Vt ENGINE ,
 and
 .Vt ENGINE
-versions of new algorithms cannot be accessed using the low level
+versions of new algorithms cannot be accessed using the low-level
 functions.
 Using them also makes code harder to adapt to new algorithms, some
 options are not cleanly supported at the low level, and some
-operations are more efficient using the high level interfaces.
+operations are more efficient using the high-level interfaces.
 .Sh SEE ALSO
+.Xr ASN1_item_digest 3 ,
+.Xr ASN1_item_sign 3 ,
+.Xr BIO_f_cipher 3 ,
+.Xr BIO_f_md 3 ,
+.Xr CMAC_Init 3 ,
+.Xr CMS_encrypt 3 ,
+.Xr CMS_sign 3 ,
 .Xr crypto 3 ,
+.Xr d2i_PKCS8PrivateKey_bio 3 ,
+.Xr d2i_PrivateKey 3 ,
+.Xr ENGINE_get_cipher 3 ,
 .Xr ENGINE_register_RSA 3 ,
 .Xr EVP_AEAD_CTX_init 3 ,
 .Xr EVP_aes_128_cbc 3 ,
 .Xr EVP_BytesToKey 3 ,
 .Xr EVP_camellia_128_cbc 3 ,
+.Xr EVP_chacha20 3 ,
+.Xr EVP_CIPHER_meth_new 3 ,
 .Xr EVP_des_cbc 3 ,
 .Xr EVP_DigestInit 3 ,
 .Xr EVP_DigestSignInit 3 ,
+.Xr EVP_DigestVerifyInit 3 ,
 .Xr EVP_EncodeInit 3 ,
 .Xr EVP_EncryptInit 3 ,
 .Xr EVP_MD_meth_new 3 ,
 .Xr EVP_OpenInit 3 ,
+.Xr EVP_PKCS82PKEY 3 ,
+.Xr EVP_PKEY_add1_attr 3 ,
+.Xr EVP_PKEY_asn1_get_count 3 ,
+.Xr EVP_PKEY_asn1_new 3 ,
+.Xr EVP_PKEY_check 3 ,
+.Xr EVP_PKEY_cmp 3 ,
+.Xr EVP_PKEY_CTX_ctrl 3 ,
+.Xr EVP_PKEY_CTX_new 3 ,
+.Xr EVP_PKEY_CTX_set_hkdf_md 3 ,
 .Xr EVP_PKEY_decrypt 3 ,
 .Xr EVP_PKEY_derive 3 ,
 .Xr EVP_PKEY_encrypt 3 ,
+.Xr EVP_PKEY_get_default_digest_nid 3 ,
 .Xr EVP_PKEY_keygen 3 ,
+.Xr EVP_PKEY_meth_get0_info 3 ,
+.Xr EVP_PKEY_meth_new 3 ,
 .Xr EVP_PKEY_new 3 ,
 .Xr EVP_PKEY_print_private 3 ,
 .Xr EVP_PKEY_set1_RSA 3 ,
 .Xr EVP_PKEY_sign 3 ,
+.Xr EVP_PKEY_size 3 ,
 .Xr EVP_PKEY_verify 3 ,
 .Xr EVP_PKEY_verify_recover 3 ,
 .Xr EVP_rc4 3 ,
 .Xr EVP_SealInit 3 ,
+.Xr EVP_sha3_224 3 ,
 .Xr EVP_SignInit 3 ,
 .Xr EVP_sm3 3 ,
 .Xr EVP_sm4_cbc 3 ,
 .Xr EVP_VerifyInit 3 ,
-.Xr EVP_whirlpool 3
+.Xr EVP_whirlpool 3 ,
+.Xr HMAC 3 ,
+.Xr OCSP_basic_sign 3 ,
+.Xr OCSP_request_sign 3 ,
+.Xr PEM_get_EVP_CIPHER_INFO 3 ,
+.Xr PEM_read_bio_PrivateKey 3 ,
+.Xr PKCS12_create 3 ,
+.Xr PKCS5_PBKDF2_HMAC 3 ,
+.Xr PKCS7_encrypt 3 ,
+.Xr PKCS7_sign 3 ,
+.Xr RSA_pkey_ctx_ctrl 3 ,
+.Xr SSL_CTX_set_tlsext_ticket_key_cb 3 ,
+.Xr X509_ALGOR_set_md 3 ,
+.Xr X509_check_private_key 3 ,
+.Xr X509_CRL_METHOD_new 3 ,
+.Xr X509_digest 3 ,
+.Xr X509_get_pubkey 3 ,
+.Xr X509_PUBKEY_set 3 ,
+.Xr X509_sign 3 ,
+.Xr X509_to_X509_REQ 3
diff --git a/lib/libcrypto/md5/md5.c b/lib/libcrypto/md5/md5.c
index f5d062b8c..c2ee2958d 100644
--- a/lib/libcrypto/md5/md5.c
+++ b/lib/libcrypto/md5/md5.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: md5.c,v 1.13 2023/08/10 14:04:54 jsing Exp $ */
+/* $OpenBSD: md5.c,v 1.18 2023/08/15 08:39:27 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -64,21 +64,16 @@
 
 #include <openssl/md5.h>
 
+#include "crypto_internal.h"
+
+/* Ensure that MD5_LONG and uint32_t are equivalent size. */
+CTASSERT(sizeof(MD5_LONG) == sizeof(uint32_t));
+
 #ifdef MD5_ASM
-# if defined(__i386) || defined(__i386__) || defined(_M_IX86) || defined(__INTEL__) || \
-     defined(__x86_64) || defined(__x86_64__) || defined(_M_AMD64) || defined(_M_X64)
-#  define md5_block_data_order md5_block_asm_data_order
-# elif defined(__ia64) || defined(__ia64__) || defined(_M_IA64)
-#  define md5_block_data_order md5_block_asm_data_order
-# endif
+void md5_block_asm_data_order(MD5_CTX *c, const void *p, size_t num);
+#define md5_block_data_order md5_block_asm_data_order
 #endif
 
-__BEGIN_HIDDEN_DECLS
-
-void md5_block_data_order (MD5_CTX *c, const void *p, size_t num);
-
-__END_HIDDEN_DECLS
-
 #define DATA_ORDER_IS_LITTLE_ENDIAN
 
 #define HASH_LONG		MD5_LONG
@@ -129,16 +124,15 @@ __END_HIDDEN_DECLS
 	a=ROTATE(a,s); \
 	a+=b; };
 
-/* Implemented from RFC1321 The MD5 Message-Digest Algorithm
- */
+/* Implemented from RFC1321 The MD5 Message-Digest Algorithm. */
 
-#ifndef md5_block_data_order
-void
-md5_block_data_order(MD5_CTX *c, const void *data_, size_t num)
+#ifndef MD5_ASM
+static void
+md5_block_data_order(MD5_CTX *c, const void *_in, size_t num)
 {
-	const unsigned char *data = data_;
-	unsigned int A, B, C, D, l;
-	unsigned int X0, X1, X2, X3, X4, X5, X6, X7,
+	const uint8_t *in = _in;
+	MD5_LONG A, B, C, D;
+	MD5_LONG X0, X1, X2, X3, X4, X5, X6, X7,
 	    X8, X9, X10, X11, X12, X13, X14, X15;
 
 	A = c->A;
@@ -147,53 +141,39 @@ md5_block_data_order(MD5_CTX *c, const void *data_, size_t num)
 	D = c->D;
 
 	for (; num--; ) {
-		HOST_c2l(data, l);
-		X0 = l;
-		HOST_c2l(data, l);
-		X1 = l;
+		X0 = crypto_load_le32toh(&in[0 * 4]);
+		X1 = crypto_load_le32toh(&in[1 * 4]);
+		X2 = crypto_load_le32toh(&in[2 * 4]);
+		X3 = crypto_load_le32toh(&in[3 * 4]);
+		X4 = crypto_load_le32toh(&in[4 * 4]);
+		X5 = crypto_load_le32toh(&in[5 * 4]);
+		X6 = crypto_load_le32toh(&in[6 * 4]);
+		X7 = crypto_load_le32toh(&in[7 * 4]);
+		X8 = crypto_load_le32toh(&in[8 * 4]);
+		X9 = crypto_load_le32toh(&in[9 * 4]);
+		X10 = crypto_load_le32toh(&in[10 * 4]);
+		X11 = crypto_load_le32toh(&in[11 * 4]);
+		X12 = crypto_load_le32toh(&in[12 * 4]);
+		X13 = crypto_load_le32toh(&in[13 * 4]);
+		X14 = crypto_load_le32toh(&in[14 * 4]);
+		X15 = crypto_load_le32toh(&in[15 * 4]);
+		in += MD5_CBLOCK;
+
 		/* Round 0 */
 		R0(A, B, C, D, X0, 7, 0xd76aa478L);
-		HOST_c2l(data, l);
-		X2 = l;
 		R0(D, A, B, C, X1, 12, 0xe8c7b756L);
-		HOST_c2l(data, l);
-		X3 = l;
 		R0(C, D, A, B, X2, 17, 0x242070dbL);
-		HOST_c2l(data, l);
-		X4 = l;
 		R0(B, C, D, A, X3, 22, 0xc1bdceeeL);
-		HOST_c2l(data, l);
-		X5 = l;
 		R0(A, B, C, D, X4, 7, 0xf57c0fafL);
-		HOST_c2l(data, l);
-		X6 = l;
 		R0(D, A, B, C, X5, 12, 0x4787c62aL);
-		HOST_c2l(data, l);
-		X7 = l;
 		R0(C, D, A, B, X6, 17, 0xa8304613L);
-		HOST_c2l(data, l);
-		X8 = l;
 		R0(B, C, D, A, X7, 22, 0xfd469501L);
-		HOST_c2l(data, l);
-		X9 = l;
 		R0(A, B, C, D, X8, 7, 0x698098d8L);
-		HOST_c2l(data, l);
-		X10 = l;
 		R0(D, A, B, C, X9, 12, 0x8b44f7afL);
-		HOST_c2l(data, l);
-		X11 = l;
 		R0(C, D, A, B, X10, 17, 0xffff5bb1L);
-		HOST_c2l(data, l);
-		X12 = l;
 		R0(B, C, D, A, X11, 22, 0x895cd7beL);
-		HOST_c2l(data, l);
-		X13 = l;
 		R0(A, B, C, D, X12, 7, 0x6b901122L);
-		HOST_c2l(data, l);
-		X14 = l;
 		R0(D, A, B, C, X13, 12, 0xfd987193L);
-		HOST_c2l(data, l);
-		X15 = l;
 		R0(C, D, A, B, X14, 17, 0xa679438eL);
 		R0(B, C, D, A, X15, 22, 0x49b40821L);
 		/* Round 1 */
@@ -256,19 +236,16 @@ md5_block_data_order(MD5_CTX *c, const void *data_, size_t num)
 }
 #endif
 
-#define INIT_DATA_A (unsigned long)0x67452301L
-#define INIT_DATA_B (unsigned long)0xefcdab89L
-#define INIT_DATA_C (unsigned long)0x98badcfeL
-#define INIT_DATA_D (unsigned long)0x10325476L
-
 int
 MD5_Init(MD5_CTX *c)
 {
-	memset (c, 0, sizeof(*c));
-	c->A = INIT_DATA_A;
-	c->B = INIT_DATA_B;
-	c->C = INIT_DATA_C;
-	c->D = INIT_DATA_D;
+	memset(c, 0, sizeof(*c));
+
+	c->A = 0x67452301UL;
+	c->B = 0xefcdab89UL;
+	c->C = 0x98badcfeUL;
+	c->D = 0x10325476UL;
+
 	return 1;
 }
 LCRYPTO_ALIAS(MD5_Init);
@@ -313,8 +290,8 @@ MD5_Update(MD5_CTX *c, const void *data_, size_t len)
 
 	n = len/MD5_CBLOCK;
 	if (n > 0) {
-		md5_block_data_order (c, data, n);
-		n    *= MD5_CBLOCK;
+		md5_block_data_order(c, data, n);
+		n *= MD5_CBLOCK;
 		data += n;
 		len -= n;
 	}
@@ -322,7 +299,7 @@ MD5_Update(MD5_CTX *c, const void *data_, size_t len)
 	if (len != 0) {
 		p = (unsigned char *)c->data;
 		c->num = (unsigned int)len;
-		memcpy (p, data, len);
+		memcpy(p, data, len);
 	}
 	return 1;
 }
@@ -339,7 +316,6 @@ int
 MD5_Final(unsigned char *md, MD5_CTX *c)
 {
 	unsigned char *p = (unsigned char *)c->data;
-	unsigned long ll;
 	size_t n = c->num;
 
 	p[n] = 0x80; /* there is always room for one */
@@ -350,29 +326,19 @@ MD5_Final(unsigned char *md, MD5_CTX *c)
 		n = 0;
 		md5_block_data_order(c, p, 1);
 	}
-	memset(p + n, 0, MD5_CBLOCK - 8 - n);
 
-	p += MD5_CBLOCK - 8;
-#if   defined(DATA_ORDER_IS_BIG_ENDIAN)
-	HOST_l2c(c->Nh, p);
-	HOST_l2c(c->Nl, p);
-#elif defined(DATA_ORDER_IS_LITTLE_ENDIAN)
-	HOST_l2c(c->Nl, p);
-	HOST_l2c(c->Nh, p);
-#endif
-	p -= MD5_CBLOCK;
+	memset(p + n, 0, MD5_CBLOCK - 8 - n);
+	c->data[MD5_LBLOCK - 2] = htole32(c->Nl);
+	c->data[MD5_LBLOCK - 1] = htole32(c->Nh);
+
 	md5_block_data_order(c, p, 1);
 	c->num = 0;
 	memset(p, 0, MD5_CBLOCK);
 
-	ll = c->A;
-	HOST_l2c(ll, md);
-	ll = c->B;
-	HOST_l2c(ll, md);
-	ll = c->C;
-	HOST_l2c(ll, md);
-	ll = c->D;
-	HOST_l2c(ll, md);
+	crypto_store_htole32(&md[0 * 4], c->A);
+	crypto_store_htole32(&md[1 * 4], c->B);
+	crypto_store_htole32(&md[2 * 4], c->C);
+	crypto_store_htole32(&md[3 * 4], c->D);
 
 	return 1;
 }
diff --git a/lib/libcrypto/rsa/rsa_ameth.c b/lib/libcrypto/rsa/rsa_ameth.c
index 46837881e..ae38c205a 100644
--- a/lib/libcrypto/rsa/rsa_ameth.c
+++ b/lib/libcrypto/rsa/rsa_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa_ameth.c,v 1.32 2023/08/10 15:05:28 tb Exp $ */
+/* $OpenBSD: rsa_ameth.c,v 1.33 2023/08/12 08:02:43 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -273,7 +273,7 @@ rsa_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8)
 }
 
 static int
-int_rsa_size(const EVP_PKEY *pkey)
+rsa_size(const EVP_PKEY *pkey)
 {
 	return RSA_size(pkey->pkey.rsa);
 }
@@ -291,7 +291,7 @@ rsa_security_bits(const EVP_PKEY *pkey)
 }
 
 static void
-int_rsa_free(EVP_PKEY *pkey)
+rsa_free(EVP_PKEY *pkey)
 {
 	RSA_free(pkey->pkey.rsa);
 }
@@ -1088,13 +1088,13 @@ const EVP_PKEY_ASN1_METHOD rsa_asn1_meths[] = {
 		.priv_encode = rsa_priv_encode,
 		.priv_print = rsa_priv_print,
 
-		.pkey_size = int_rsa_size,
+		.pkey_size = rsa_size,
 		.pkey_bits = rsa_bits,
 		.pkey_security_bits = rsa_security_bits,
 
 		.sig_print = rsa_sig_print,
 
-		.pkey_free = int_rsa_free,
+		.pkey_free = rsa_free,
 		.pkey_ctrl = rsa_pkey_ctrl,
 		.old_priv_decode = old_rsa_priv_decode,
 		.old_priv_encode = old_rsa_priv_encode,
@@ -1130,13 +1130,13 @@ const EVP_PKEY_ASN1_METHOD rsa_pss_asn1_meth = {
 	.priv_encode = rsa_priv_encode,
 	.priv_print = rsa_priv_print,
 
-	.pkey_size = int_rsa_size,
+	.pkey_size = rsa_size,
 	.pkey_bits = rsa_bits,
 	.pkey_security_bits = rsa_security_bits,
 
 	.sig_print = rsa_sig_print,
 
-	.pkey_free = int_rsa_free,
+	.pkey_free = rsa_free,
 	.pkey_ctrl = rsa_pkey_ctrl,
 	.item_verify = rsa_item_verify,
 	.item_sign = rsa_item_sign
diff --git a/lib/libcrypto/sha/sha256.c b/lib/libcrypto/sha/sha256.c
index 231a5a058..00c936811 100644
--- a/lib/libcrypto/sha/sha256.c
+++ b/lib/libcrypto/sha/sha256.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha256.c,v 1.28 2023/08/10 07:15:23 jsing Exp $ */
+/* $OpenBSD: sha256.c,v 1.30 2023/08/11 15:27:28 jsing Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2011 The OpenSSL Project.  All rights reserved.
  *
@@ -68,24 +68,10 @@
 /* Ensure that SHA_LONG and uint32_t are equivalent. */
 CTASSERT(sizeof(SHA_LONG) == sizeof(uint32_t));
 
-#define	DATA_ORDER_IS_BIG_ENDIAN
-
-#define	HASH_LONG		SHA_LONG
-#define	HASH_CTX		SHA256_CTX
-#define	HASH_CBLOCK		SHA_CBLOCK
-
-#define	HASH_BLOCK_DATA_ORDER	sha256_block_data_order
-
 #ifdef SHA256_ASM
 void sha256_block_data_order(SHA256_CTX *ctx, const void *_in, size_t num);
 #endif
 
-#define HASH_NO_UPDATE
-#define HASH_NO_TRANSFORM
-#define HASH_NO_FINAL
-
-#include "md32_common.h"
-
 #ifndef SHA256_ASM
 static const SHA_LONG K256[64] = {
 	0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
@@ -106,36 +92,77 @@ static const SHA_LONG K256[64] = {
 	0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL,
 };
 
-/*
- * FIPS specification refers to right rotations, while our ROTATE macro
- * is left one. This is why you might notice that rotation coefficients
- * differ from those observed in FIPS document by 32-N...
- */
-#define Sigma0(x)	(ROTATE((x),30) ^ ROTATE((x),19) ^ ROTATE((x),10))
-#define Sigma1(x)	(ROTATE((x),26) ^ ROTATE((x),21) ^ ROTATE((x),7))
-#define sigma0(x)	(ROTATE((x),25) ^ ROTATE((x),14) ^ ((x)>>3))
-#define sigma1(x)	(ROTATE((x),15) ^ ROTATE((x),13) ^ ((x)>>10))
+static inline SHA_LONG
+Sigma0(SHA_LONG x)
+{
+	return crypto_ror_u32(x, 2) ^ crypto_ror_u32(x, 13) ^
+	    crypto_ror_u32(x, 22);
+}
 
-#define Ch(x, y, z)	(((x) & (y)) ^ ((~(x)) & (z)))
-#define Maj(x, y, z)	(((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
+static inline SHA_LONG
+Sigma1(SHA_LONG x)
+{
+	return crypto_ror_u32(x, 6) ^ crypto_ror_u32(x, 11) ^
+	    crypto_ror_u32(x, 25);
+}
 
-#define	ROUND_00_15(x, i, a, b, c, d, e, f, g, h)	do {	\
-	T1 = x + h + Sigma1(e) + Ch(e, f, g) + K256[i];	\
-	h = Sigma0(a) + Maj(a, b, c);				\
-	d += T1;	h += T1;		} while (0)
+static inline SHA_LONG
+sigma0(SHA_LONG x)
+{
+	return crypto_ror_u32(x, 7) ^ crypto_ror_u32(x, 18) ^ (x >> 3);
+}
 
-#define	ROUND_16_63(i, a, b, c, d, e, f, g, h, X)	do {	\
-	s0 = X[(i+1)&0x0f];	s0 = sigma0(s0);		\
-	s1 = X[(i+14)&0x0f];	s1 = sigma1(s1);		\
-	T1 = X[(i)&0x0f] += s0 + s1 + X[(i+9)&0x0f];		\
-	ROUND_00_15(T1, i, a, b, c, d, e, f, g, h);	} while (0)
+static inline SHA_LONG
+sigma1(SHA_LONG x)
+{
+	return crypto_ror_u32(x, 17) ^ crypto_ror_u32(x, 19) ^ (x >> 10);
+}
+
+static inline SHA_LONG
+Ch(SHA_LONG x, SHA_LONG y, SHA_LONG z)
+{
+	return (x & y) ^ (~x & z);
+}
+
+static inline SHA_LONG
+Maj(SHA_LONG x, SHA_LONG y, SHA_LONG z)
+{
+	return (x & y) ^ (x & z) ^ (y & z);
+}
+
+static inline void
+sha256_msg_schedule_update(SHA_LONG *W0, SHA_LONG W1,
+    SHA_LONG W9, SHA_LONG W14)
+{
+	*W0 = sigma1(W14) + W9 + sigma0(W1) + *W0;
+}
+
+static inline void
+sha256_round(SHA_LONG *a, SHA_LONG *b, SHA_LONG *c, SHA_LONG *d,
+    SHA_LONG *e, SHA_LONG *f, SHA_LONG *g, SHA_LONG *h,
+    SHA_LONG Kt, SHA_LONG Wt)
+{
+	SHA_LONG T1, T2;
+
+	T1 = *h + Sigma1(*e) + Ch(*e, *f, *g) + Kt + Wt;
+	T2 = Sigma0(*a) + Maj(*a, *b, *c);
+
+	*h = *g;
+	*g = *f;
+	*f = *e;
+	*e = *d + T1;
+	*d = *c;
+	*c = *b;
+	*b = *a;
+	*a = T1 + T2;
+}
 
 static void
 sha256_block_data_order(SHA256_CTX *ctx, const void *_in, size_t num)
 {
 	const uint8_t *in = _in;
 	const SHA_LONG *in32;
-	unsigned int a, b, c, d, e, f, g, h, s0, s1, T1;
+	SHA_LONG a, b, c, d, e, f, g, h;
 	SHA_LONG X[16];
 	int i;
 
@@ -189,33 +216,57 @@ sha256_block_data_order(SHA256_CTX *ctx, const void *_in, size_t num)
 		}
 		in += SHA256_CBLOCK;
 
-		ROUND_00_15(X[0], 0, a, b, c, d, e, f, g, h);
-		ROUND_00_15(X[1], 1, h, a, b, c, d, e, f, g);
-		ROUND_00_15(X[2], 2, g, h, a, b, c, d, e, f);
-		ROUND_00_15(X[3], 3, f, g, h, a, b, c, d, e);
-		ROUND_00_15(X[4], 4, e, f, g, h, a, b, c, d);
-		ROUND_00_15(X[5], 5, d, e, f, g, h, a, b, c);
-		ROUND_00_15(X[6], 6, c, d, e, f, g, h, a, b);
-		ROUND_00_15(X[7], 7, b, c, d, e, f, g, h, a);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[0], X[0]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[1], X[1]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[2], X[2]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[3], X[3]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[4], X[4]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[5], X[5]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[6], X[6]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[7], X[7]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[8], X[8]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[9], X[9]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[10], X[10]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[11], X[11]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[12], X[12]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[13], X[13]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[14], X[14]);
+		sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[15], X[15]);
 
-		ROUND_00_15(X[8], 8, a, b, c, d, e, f, g, h);
-		ROUND_00_15(X[9], 9, h, a, b, c, d, e, f, g);
-		ROUND_00_15(X[10], 10, g, h, a, b, c, d, e, f);
-		ROUND_00_15(X[11], 11, f, g, h, a, b, c, d, e);
-		ROUND_00_15(X[12], 12, e, f, g, h, a, b, c, d);
-		ROUND_00_15(X[13], 13, d, e, f, g, h, a, b, c);
-		ROUND_00_15(X[14], 14, c, d, e, f, g, h, a, b);
-		ROUND_00_15(X[15], 15, b, c, d, e, f, g, h, a);
+		for (i = 16; i < 64; i += 16) {
+			sha256_msg_schedule_update(&X[0], X[1], X[9], X[14]);
+			sha256_msg_schedule_update(&X[1], X[2], X[10], X[15]);
+			sha256_msg_schedule_update(&X[2], X[3], X[11], X[0]);
+			sha256_msg_schedule_update(&X[3], X[4], X[12], X[1]);
+			sha256_msg_schedule_update(&X[4], X[5], X[13], X[2]);
+			sha256_msg_schedule_update(&X[5], X[6], X[14], X[3]);
+			sha256_msg_schedule_update(&X[6], X[7], X[15], X[4]);
+			sha256_msg_schedule_update(&X[7], X[8], X[0], X[5]);
+			sha256_msg_schedule_update(&X[8], X[9], X[1], X[6]);
+			sha256_msg_schedule_update(&X[9], X[10], X[2], X[7]);
+			sha256_msg_schedule_update(&X[10], X[11], X[3], X[8]);
+			sha256_msg_schedule_update(&X[11], X[12], X[4], X[9]);
+			sha256_msg_schedule_update(&X[12], X[13], X[5], X[10]);
+			sha256_msg_schedule_update(&X[13], X[14], X[6], X[11]);
+			sha256_msg_schedule_update(&X[14], X[15], X[7], X[12]);
+			sha256_msg_schedule_update(&X[15], X[0], X[8], X[13]);
 
-		for (i = 16; i < 64; i += 8) {
-			ROUND_16_63(i + 0, a, b, c, d, e, f, g, h, X);
-			ROUND_16_63(i + 1, h, a, b, c, d, e, f, g, X);
-			ROUND_16_63(i + 2, g, h, a, b, c, d, e, f, X);
-			ROUND_16_63(i + 3, f, g, h, a, b, c, d, e, X);
-			ROUND_16_63(i + 4, e, f, g, h, a, b, c, d, X);
-			ROUND_16_63(i + 5, d, e, f, g, h, a, b, c, X);
-			ROUND_16_63(i + 6, c, d, e, f, g, h, a, b, X);
-			ROUND_16_63(i + 7, b, c, d, e, f, g, h, a, X);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 0], X[0]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 1], X[1]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 2], X[2]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 3], X[3]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 4], X[4]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 5], X[5]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 6], X[6]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 7], X[7]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 8], X[8]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 9], X[9]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 10], X[10]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 11], X[11]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 12], X[12]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 13], X[13]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 14], X[14]);
+			sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 15], X[15]);
 		}
 
 		ctx->h[0] += a;
diff --git a/lib/libm/src/s_modff.c b/lib/libm/src/s_modff.c
index 829bfce7c..2a014dea8 100644
--- a/lib/libm/src/s_modff.c
+++ b/lib/libm/src/s_modff.c
@@ -45,6 +45,8 @@ modff(float x, float *iptr)
 	} else {			/* no fraction part */
 	    u_int32_t ix;
 	    *iptr = x*one;
+	    if (jj0 == 0x80)		/* +-inf or NaN */
+ 		return (0.0 / x);		/* +-0 or NaN */
 	    GET_FLOAT_WORD(ix,x);
 	    SET_FLOAT_WORD(x,ix&0x80000000);	/* return +-0 */
 	    return x;
diff --git a/lib/libz/README b/lib/libz/README
index a77433e28..a7df4469e 100644
--- a/lib/libz/README
+++ b/lib/libz/README
@@ -63,7 +63,7 @@ Notes for some targets:
 - zlib doesn't work with gcc 2.6.3 on a DEC 3000/300LX under OSF/1 2.1 it works
   when compiled with cc.
 
-- On Digital Unix 4.0D (formely OSF/1) on AlphaServer, the cc option -std1 is
+- On Digital Unix 4.0D (formerly OSF/1) on AlphaServer, the cc option -std1 is
   necessary to get gzprintf working correctly. This is done by configure.
 
 - zlib doesn't work on HP-UX 9.05 with some versions of /bin/cc. It works with
diff --git a/lib/libz/deflate.c b/lib/libz/deflate.c
index c60bb862a..c9f13669b 100644
--- a/lib/libz/deflate.c
+++ b/lib/libz/deflate.c
@@ -175,6 +175,11 @@ local const config configuration_table[10] = {
  * bit values at the expense of memory usage). We slide even when level == 0 to
  * keep the hash table consistent if we switch back to level > 0 later.
  */
+#if defined(__has_feature)
+#  if __has_feature(memory_sanitizer)
+     __attribute__((no_sanitize("memory")))
+#  endif
+#endif
 local void slide_hash(deflate_state *s) {
     unsigned n, m;
     Posf *p;
diff --git a/lib/libz/gzlib.c b/lib/libz/gzlib.c
index 2b446c448..29fc4486f 100644
--- a/lib/libz/gzlib.c
+++ b/lib/libz/gzlib.c
@@ -308,8 +308,8 @@ int ZEXPORT gzbuffer(gzFile file, unsigned size) {
     /* check and set requested size */
     if ((size << 1) < size)
         return -1;              /* need to be able to double it */
-    if (size < 2)
-        size = 2;               /* need two bytes to check magic header */
+    if (size < 8)
+        size = 8;               /* needed to behave well with flushing */
     state->want = size;
     return 0;
 }
diff --git a/lib/libz/gzread.c b/lib/libz/gzread.c
index 6034a2823..4168cbc88 100644
--- a/lib/libz/gzread.c
+++ b/lib/libz/gzread.c
@@ -443,6 +443,10 @@ int ZEXPORT gzungetc(int c, gzFile file) {
         return -1;
     state = (gz_statep)file;
 
+    /* in case this was just opened, set up the input buffer */
+    if (state->mode == GZ_READ && state->how == LOOK && state->x.have == 0)
+        (void)gz_look(state);
+
     /* check that we're reading and that there's no (serious) error */
     if (state->mode != GZ_READ ||
         (state->err != Z_OK && state->err != Z_BUF_ERROR))
diff --git a/libexec/ld.so/dlfcn.c b/libexec/ld.so/dlfcn.c
index 3b3dbdb83..2aee958d3 100644
--- a/libexec/ld.so/dlfcn.c
+++ b/libexec/ld.so/dlfcn.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dlfcn.c,v 1.114 2023/07/08 14:09:43 jasper Exp $ */
+/*	$OpenBSD: dlfcn.c,v 1.115 2023/08/15 06:26:34 guenther Exp $ */
 
 /*
  * Copyright (c) 1998 Per Fogelstrom, Opsycon AB
@@ -39,7 +39,6 @@
 #include "archdep.h"
 
 int _dl_errno;
-static int _dl_tracelib;
 
 static int _dl_real_close(void *handle);
 static lock_cb *_dl_thread_fnc = NULL;
@@ -72,7 +71,6 @@ dlopen(const char *libname, int flags)
 
 	if ((flags & RTLD_TRACE) == RTLD_TRACE) {
 		_dl_traceld = 1;
-		_dl_tracelib = 1;
 	}
 
 	DL_DEB(("dlopen: loading: %s\n", libname));
@@ -110,6 +108,11 @@ dlopen(const char *libname, int flags)
 		/* if opened but grpsym_vec has not been filled in */
 		if (object->grpsym_vec.len == 0)
 			_dl_cache_grpsym_list_setup(object);
+		if (_dl_traceld) {
+			_dl_show_objects(object);
+			_dl_unload_shlib(object);
+			_dl_exit(0);
+		}
 		goto loaded;
 	}
 
@@ -126,7 +129,7 @@ dlopen(const char *libname, int flags)
 		int err;
 		DL_DEB(("tail %s\n", object->load_name ));
 		if (_dl_traceld) {
-			_dl_show_objects();
+			_dl_show_objects(object);
 			_dl_unload_shlib(object);
 			_dl_exit(0);
 		}
@@ -250,7 +253,7 @@ dlctl(void *handle, int command, void *data)
 		break;
 	}
 	case 0x20:
-		_dl_show_objects();
+		_dl_show_objects(NULL);
 		retval = 0;
 		break;
 	case 0x21:
@@ -486,7 +489,7 @@ _dl_tracefmt(int fd, elf_object_t *object, const char *fmt1, const char *fmt2,
 }
 
 void
-_dl_show_objects(void)
+_dl_show_objects(elf_object_t *trace)
 {
 	elf_object_t *object;
 	char *objtypename;
@@ -514,12 +517,15 @@ _dl_show_objects(void)
 		_dl_dprintf(outputfd, "\tStart   %s End     %s Type  Open Ref GrpRef Name\n",
 		    pad, pad);
 
-	if (_dl_tracelib) {
-		for (; object != NULL; object = object->next)
+	if (trace != NULL) {
+		for (; object != NULL; object = object->next) {
+			if (object == trace)
+				break;
 			if (object->obj_type == OBJTYPE_LDR) {
 				object = object->next;
 				break;
 			}
+		}
 	}
 
 	for (; object != NULL; object = object->next) {
diff --git a/libexec/ld.so/ldd/ldd.c b/libexec/ld.so/ldd/ldd.c
index 9e8c5065c..375a646db 100644
--- a/libexec/ld.so/ldd/ldd.c
+++ b/libexec/ld.so/ldd/ldd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ldd.c,v 1.24 2023/07/24 01:02:47 deraadt Exp $	*/
+/*	$OpenBSD: ldd.c,v 1.26 2023/08/15 13:50:53 deraadt Exp $	*/
 /*
  * Copyright (c) 2001 Artur Grabowski <art@openbsd.org>
  * All rights reserved.
@@ -48,6 +48,9 @@ main(int argc, char **argv)
 {
 	int c, xflag, ret;
 
+	if (pledge("stdio rpath proc exec prot_exec", NULL) == -1)
+		err(1, "pledge");
+
 	xflag = 0;
 	while ((c = getopt(argc, argv, "x")) != -1) {
 		switch (c) {
@@ -96,7 +99,8 @@ doit(char *name)
 {
 	Elf_Ehdr ehdr;
 	Elf_Phdr *phdr;
-	int fd, i, size, status, interp=0;
+	size_t size;
+	int fd, i, status, interp=0;
 	char buf[PATH_MAX];
 	struct stat st;
 	void * dlhandle;
@@ -118,8 +122,8 @@ doit(char *name)
 		return 1;
 	}
 
-	if (read(fd, &ehdr, sizeof(ehdr)) < 0) {
-		warn("read(%s)", name);
+	if (read(fd, &ehdr, sizeof(ehdr)) != sizeof(ehdr)) {
+		warnx("%s: incomplete ELF header", name);
 		close(fd);
 		return 1;
 	}
@@ -141,7 +145,7 @@ doit(char *name)
 	size = ehdr.e_phnum * sizeof(Elf_Phdr);
 
 	if (pread(fd, phdr, size, ehdr.e_phoff) != size) {
-		warn("read(%s)", name);
+		warnx("%s: incomplete program header", name);
 		close(fd);
 		free(phdr);
 		return 1;
@@ -162,6 +166,8 @@ doit(char *name)
 		err(1, "fork");
 	case 0:
 		if (ehdr.e_type == ET_DYN && !interp) {
+			if (pledge("stdio rpath prot_exec", NULL) == -1)
+				err(1, "pledge");
 			if (realpath(name, buf) == NULL) {
 				printf("realpath(%s): %s", name,
 				    strerror(errno));
@@ -177,14 +183,13 @@ doit(char *name)
 			_exit(0);
 		}
 
+		if (pledge("stdio rpath exec", "stdio rpath") == -1)
+			err(1, "pledge");
 		if (i == ehdr.e_phnum) {
 			printf("not a dynamic executable\n");
 			fflush(stdout);
 			_exit(0);
 		}
-
-		if (pledge(NULL, "stdio rpath") == -1)
-			err(1, "pledge");
 		execl(name, name, (char *)NULL);
 		perror(name);
 		_exit(1);
diff --git a/libexec/ld.so/library.c b/libexec/ld.so/library.c
index 8e2f44c19..34bf47ce9 100644
--- a/libexec/ld.so/library.c
+++ b/libexec/ld.so/library.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: library.c,v 1.91 2023/07/12 19:49:06 jasper Exp $ */
+/*	$OpenBSD: library.c,v 1.92 2023/08/15 06:23:31 guenther Exp $ */
 
 /*
  * Copyright (c) 2002 Dale Rahn
@@ -345,7 +345,7 @@ _dl_tryload_shlib(const char *libname, int type, int flags, int nodelete)
 			_dl_set_tls(object, ptls, libaddr, libname);
 
 		/* Request permission for system calls in libc.so's text segment */
-		if (soname != NULL &&
+		if (soname != NULL && !_dl_traceld &&
 		    _dl_strncmp(soname, "libc.so.", 8) == 0) {
 			if (_dl_msyscall(exec_start, exec_size) == -1)
 				_dl_printf("msyscall %lx %lx error\n",
diff --git a/libexec/ld.so/library_mquery.c b/libexec/ld.so/library_mquery.c
index 57775382b..5f7aeb2cf 100644
--- a/libexec/ld.so/library_mquery.c
+++ b/libexec/ld.so/library_mquery.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: library_mquery.c,v 1.71 2023/07/12 19:49:06 jasper Exp $ */
+/*	$OpenBSD: library_mquery.c,v 1.72 2023/08/15 06:23:31 guenther Exp $ */
 
 /*
  * Copyright (c) 2002 Dale Rahn
@@ -354,7 +354,7 @@ retry:
 			    libname);
 
 		/* Request permission for system calls in libc.so's text segment */
-		if (soname != NULL &&
+		if (soname != NULL && !_dl_traceld &&
 		    _dl_strncmp(soname, "libc.so.", 8) == 0) {
 			if (_dl_msyscall(exec_start, exec_size) == -1)
 				_dl_printf("msyscall %lx %lx error\n",
diff --git a/libexec/ld.so/loader.c b/libexec/ld.so/loader.c
index 7a32013d9..52e7b03e9 100644
--- a/libexec/ld.so/loader.c
+++ b/libexec/ld.so/loader.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: loader.c,v 1.213 2023/07/08 14:09:43 jasper Exp $ */
+/*	$OpenBSD: loader.c,v 1.214 2023/08/15 06:26:34 guenther Exp $ */
 
 /*
  * Copyright (c) 1998 Per Fogelstrom, Opsycon AB
@@ -701,7 +701,7 @@ _dl_boot(const char **argv, char **envp, const long dyn_loff, long *dl_data)
 	if (_dl_debug || _dl_traceld) {
 		if (_dl_traceld)
 			_dl_pledge("stdio rpath", NULL);
-		_dl_show_objects();
+		_dl_show_objects(NULL);
 	}
 
 	DL_DEB(("dynamic loading done, %s.\n",
diff --git a/libexec/ld.so/resolve.h b/libexec/ld.so/resolve.h
index 19e8bea4b..d32279d15 100644
--- a/libexec/ld.so/resolve.h
+++ b/libexec/ld.so/resolve.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: resolve.h,v 1.104 2023/01/29 20:30:56 gnezdo Exp $ */
+/*	$OpenBSD: resolve.h,v 1.105 2023/08/15 06:26:34 guenther Exp $ */
 
 /*
  * Copyright (c) 1998 Per Fogelstrom, Opsycon AB
@@ -347,6 +347,9 @@ void	_dl_trace_setup(char **) __boot;
 void	_dl_trace_object_setup(elf_object_t *);
 int	_dl_trace_plt(const elf_object_t *, const char *);
 
+/* dlfcn.c */
+void	_dl_show_objects(elf_object_t *_object);
+
 /* tib.c */
 void	_dl_allocate_tls_offsets(void) __boot;
 void	_dl_allocate_first_tib(void) __boot;
diff --git a/libexec/ld.so/util.h b/libexec/ld.so/util.h
index d2f47baf1..6a9147202 100644
--- a/libexec/ld.so/util.h
+++ b/libexec/ld.so/util.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: util.h,v 1.38 2023/01/29 20:30:21 gnezdo Exp $	*/
+/*	$OpenBSD: util.h,v 1.39 2023/08/15 06:26:34 guenther Exp $	*/
 
 /*
  * Copyright (c) 1998 Todd C. Miller <millert@openbsd.org>
@@ -59,7 +59,6 @@ size_t _dl_strlcat(char *dst, const char *src, size_t siz);
 void _dl_printf(const char *fmt, ...);
 void _dl_vprintf(const char *fmt, va_list ap);
 void _dl_dprintf(int, const char *fmt, ...);
-void _dl_show_objects(void);
 void _dl_arc4randombuf(void *, size_t);
 u_int32_t _dl_arc4random(void);
 ssize_t _dl_write(int fd, const char* buf, size_t len);
diff --git a/regress/lib/libc/modf/modf_test.c b/regress/lib/libc/modf/modf_test.c
index f73253363..b96618e1f 100644
--- a/regress/lib/libc/modf/modf_test.c
+++ b/regress/lib/libc/modf/modf_test.c
@@ -1,35 +1,67 @@
-/* Public domain, 2014, Tobias Ulmer <tobiasu@tmux.org> */
+/*	$OpenBSD: modf_test.c,v 1.2 2023/08/13 06:57:04 miod Exp $	*/
+
+#include <assert.h>
+#include <math.h>
 
 /* Test for bug introduced in 4.4BSD modf() on sparc */
-
-#include <math.h>
+/* Public domain, 2014, Tobias Ulmer <tobiasu@tmux.org> */
 
 #define BIGFLOAT (5e15) /* Number large enough to trigger the "big" case */
 
-int
-main(void)
+void
+modf_sparc(void)
 {
 	double f, i;
 
 	f = modf(BIGFLOAT, &i);
-	if (i != BIGFLOAT)
-		return 1;
-	if (f != 0.0)
-		return 1;
+	assert(i == BIGFLOAT);
+	assert(f == 0.0);
 
 	/* Repeat, maybe we were lucky */
 	f = modf(BIGFLOAT, &i);
-	if (i != BIGFLOAT)
-		return 1;
-	if (f != 0.0)
-		return 1;
+	assert(i == BIGFLOAT);
+	assert(f == 0.0);
 
 	/* With negative number, for good measure */
 	f = modf(-BIGFLOAT, &i);
-	if (i != -BIGFLOAT)
-		return 1;
-	if (f != 0.0)
-		return 1;
-
-	return 0;
+	assert(i == -BIGFLOAT);
+	assert(f == 0.0);
+}
+
+/* Test for modf() behaviour on Inf and Nan */
+/* Written by Willemijn Coene.  Public domain */
+
+void
+modf_infnan(void)
+{
+	double f, i;
+
+	f = modf(__builtin_inf(), &i);
+	assert(isinf(i));
+	assert(signbit(i) == 0);
+	assert(f == 0.0);
+
+	f = modf(-__builtin_inf(), &i);
+	assert(isinf(i));
+	assert(signbit(i) != 0);
+	assert(f == -0.0);
+
+	f = modf(NAN, &i);
+	assert(isnan(i));
+	assert(signbit(i) == 0);
+	assert(isnan(f));
+	assert(signbit(f) == 0);
+
+	f = modf(-NAN, &i);
+	assert(isnan(i));
+	assert(signbit(i) != 0);
+	assert(isnan(f));
+	assert(signbit(f) != 0);
+}
+
+int
+main(void)
+{
+	modf_sparc();
+	modf_infnan();
 }
diff --git a/regress/lib/libcrypto/asn1/asn1basic.c b/regress/lib/libcrypto/asn1/asn1basic.c
index 1703ba964..5bcb9009a 100644
--- a/regress/lib/libcrypto/asn1/asn1basic.c
+++ b/regress/lib/libcrypto/asn1/asn1basic.c
@@ -1,6 +1,7 @@
-/* $OpenBSD: asn1basic.c,v 1.13 2022/11/26 16:08:56 tb Exp $ */
+/* $OpenBSD: asn1basic.c,v 1.15 2023/08/15 21:05:44 tb Exp $ */
 /*
  * Copyright (c) 2017, 2021 Joel Sing <jsing@openbsd.org>
+ * Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -750,6 +751,378 @@ asn1_integer_test(void)
 	return failed;
 }
 
+static const struct asn1_string_new_test {
+	const char *name;
+	ASN1_STRING *(*new)(void);
+	void (*free)(ASN1_STRING *);
+	int type;
+	long flags;
+} asn1_string_new_tests[] = {
+	{
+		.name = "ASN1_STRING",
+		.new = ASN1_STRING_new,
+		.free = ASN1_STRING_free,
+		.type = V_ASN1_OCTET_STRING,
+	},
+	{
+		.name = "ASN1_OCTET_STRING",
+		.new = ASN1_OCTET_STRING_new,
+		.free = ASN1_OCTET_STRING_free,
+		.type = V_ASN1_OCTET_STRING,
+	},
+	{
+		.name = "ASN1_BIT_STRING",
+		.new = ASN1_BIT_STRING_new,
+		.free = ASN1_BIT_STRING_free,
+		.type = V_ASN1_BIT_STRING,
+	},
+	{
+		.name = "ASN1_INTEGER",
+		.new = ASN1_INTEGER_new,
+		.free = ASN1_INTEGER_free,
+		.type = V_ASN1_INTEGER,
+	},
+	{
+		.name = "ASN1_ENUMERATED",
+		.new = ASN1_ENUMERATED_new,
+		.free = ASN1_ENUMERATED_free,
+		.type = V_ASN1_ENUMERATED,
+	},
+	{
+		.name = "ASN1_UTF8STRING",
+		.new = ASN1_UTF8STRING_new,
+		.free = ASN1_UTF8STRING_free,
+		.type = V_ASN1_UTF8STRING,
+	},
+	{
+		.name = "ASN1_IA5STRING",
+		.new = ASN1_IA5STRING_new,
+		.free = ASN1_IA5STRING_free,
+		.type = V_ASN1_IA5STRING,
+	},
+	{
+		.name = "ASN1_UNIVERSALSTRING",
+		.new = ASN1_UNIVERSALSTRING_new,
+		.free = ASN1_UNIVERSALSTRING_free,
+		.type = V_ASN1_UNIVERSALSTRING,
+	},
+	{
+		.name = "ASN1_BMPSTRING",
+		.new = ASN1_BMPSTRING_new,
+		.free = ASN1_BMPSTRING_free,
+		.type = V_ASN1_BMPSTRING,
+	},
+	{
+		.name = "ASN1_GENERALSTRING",
+		.new = ASN1_GENERALSTRING_new,
+		.free = ASN1_GENERALSTRING_free,
+		.type = V_ASN1_GENERALSTRING,
+	},
+	{
+		.name = "ASN1_T61STRING",
+		.new = ASN1_T61STRING_new,
+		.free = ASN1_T61STRING_free,
+		.type = V_ASN1_T61STRING,
+	},
+	{
+		.name = "ASN1_VISIBLESTRING",
+		.new = ASN1_VISIBLESTRING_new,
+		.free = ASN1_VISIBLESTRING_free,
+		.type = V_ASN1_VISIBLESTRING,
+	},
+	{
+		.name = "ASN1_PRINTABLESTRING",
+		.new = ASN1_PRINTABLESTRING_new,
+		.free = ASN1_PRINTABLESTRING_free,
+		.type = V_ASN1_PRINTABLESTRING,
+	},
+	{
+		.name = "ASN1_PRINTABLE",
+		.new = ASN1_PRINTABLE_new,
+		.free = ASN1_PRINTABLE_free,
+		.type = V_ASN1_UNDEF,
+		.flags = ASN1_STRING_FLAG_MSTRING,
+	},
+	{
+		.name = "DIRECTORYSTRING",
+		.new = DIRECTORYSTRING_new,
+		.free = DIRECTORYSTRING_free,
+		.type = V_ASN1_UNDEF,
+		.flags = ASN1_STRING_FLAG_MSTRING,
+	},
+	{
+		.name = "DISPLAYTEXT",
+		.new = DISPLAYTEXT_new,
+		.free = DISPLAYTEXT_free,
+		.type = V_ASN1_UNDEF,
+		.flags = ASN1_STRING_FLAG_MSTRING,
+	},
+	{
+		.name = "ASN1_GENERALIZEDTIME",
+		.new = ASN1_GENERALIZEDTIME_new,
+		.free = ASN1_GENERALIZEDTIME_free,
+		.type = V_ASN1_GENERALIZEDTIME,
+	},
+	{
+		.name = "ASN1_UTCTIME",
+		.new = ASN1_UTCTIME_new,
+		.free = ASN1_UTCTIME_free,
+		.type = V_ASN1_UTCTIME,
+	},
+	{
+		.name = "ASN1_TIME",
+		.new = ASN1_TIME_new,
+		.free = ASN1_TIME_free,
+		.type = V_ASN1_UNDEF,
+		.flags = ASN1_STRING_FLAG_MSTRING,
+	},
+};
+
+#define N_ASN1_STRING_NEW_TESTS \
+    (sizeof(asn1_string_new_tests) / sizeof(asn1_string_new_tests[0]))
+
+static int
+asn1_string_new_test(void)
+{
+	size_t i;
+	ASN1_STRING *astr = NULL;
+	int failed = 1;
+
+	for (i = 0; i < N_ASN1_STRING_NEW_TESTS; i++) {
+		const struct asn1_string_new_test *asnt = &asn1_string_new_tests[i];
+
+		if ((astr = asnt->new()) == NULL) {
+			fprintf(stderr, "%s_new() failed\n", asnt->name);
+			goto err;
+		}
+		if (ASN1_STRING_type(astr) != asnt->type) {
+			fprintf(stderr, "%s type: want %d, got %d\n",
+			    asnt->name, asnt->type, ASN1_STRING_type(astr));
+			goto err;
+		}
+		if (ASN1_STRING_data(astr) != NULL) {
+			fprintf(stderr, "%s data != NULL\n", asnt->name);
+			goto err;
+		}
+		if (ASN1_STRING_get0_data(astr) != NULL) {
+			fprintf(stderr, "%s data != NULL\n", asnt->name);
+			goto err;
+		}
+		if (ASN1_STRING_length(astr) != 0) {
+			fprintf(stderr, "%s length %d != 0\n", asnt->name,
+			    ASN1_STRING_length(astr));
+			goto err;
+		}
+		ASN1_STRING_length_set(astr, 20);
+		if (ASN1_STRING_length(astr) != 20) {
+			fprintf(stderr, "%s length %d != 20\n", asnt->name,
+			    ASN1_STRING_length(astr));
+			goto err;
+		}
+		astr->flags |= ASN1_STRING_FLAG_NDEF;
+		if (astr->flags != (asnt->flags | ASN1_STRING_FLAG_NDEF)) {
+			fprintf(stderr, "%s flags: %lx\n", asnt->name,
+			    astr->flags);
+			goto err;
+		}
+		/* ASN1_STRING_set0() clears ASN1_STRING_FLAG_NDEF. */
+		ASN1_STRING_set0(astr, NULL, 0);
+		if (astr->flags != asnt->flags) {
+			fprintf(stderr, "%s flags: %lx != %lx\n", asnt->name,
+			    astr->flags, asnt->flags);
+			goto err;
+		}
+		asnt->free(astr);
+		astr = NULL;
+
+		if ((astr = ASN1_STRING_type_new(asnt->type)) == NULL) {
+			fprintf(stderr, "ASN1_STRING_type_new(%s) failed\n",
+			    asnt->name);
+			goto err;
+		}
+		if (ASN1_STRING_type(astr) != asnt->type) {
+			fprintf(stderr, "%s type: want %d, got %d\n",
+			    asnt->name, asnt->type, ASN1_STRING_type(astr));
+			goto err;
+		}
+		if (ASN1_STRING_data(astr) != NULL) {
+			fprintf(stderr, "%s data != NULL\n", asnt->name);
+			goto err;
+		}
+		/* ASN1_STRING_type_new() does not set flags. */
+		if (astr->flags != 0) {
+			fprintf(stderr, "%s flags %lx\n", asnt->name,
+			    astr->flags);
+			goto err;
+		}
+		asnt->free(astr);
+		astr = NULL;
+
+	}
+
+	failed = 0;
+
+ err:
+	ASN1_STRING_free(astr);
+
+	return failed;
+}
+
+static char *comparison_str = "mystring";
+
+static int
+asn1_string_cmp_test(void)
+{
+	ASN1_STRING *a = NULL, *b = NULL;
+	int got, want;
+	int failed = 1;
+
+	if ((got = ASN1_STRING_cmp(NULL, NULL)) != -1) {
+		fprintf(stderr, "ASN1_STRING_cmp(NULL, NULL): %d != -1\n", got);
+		goto err;
+	}
+
+	if ((a = ASN1_STRING_new()) == NULL) {
+		fprintf(stderr, "a = ASN1_STRING_new() failed\n");
+		goto err;
+	}
+	if ((b = ASN1_STRING_type_new(V_ASN1_UTF8STRING)) == NULL) {
+		fprintf(stderr, "b = ASN1_STRING_type_new() failed\n");
+		goto err;
+	}
+
+	if ((got = ASN1_STRING_cmp(a, NULL)) != -1) {
+		fprintf(stderr, "ASN1_STRING_cmp(a, NULL): %d != -1\n", got);
+		goto err;
+	}
+	if ((got = ASN1_STRING_cmp(NULL, a)) != -1) {
+		fprintf(stderr, "ASN1_STRING_cmp(NULL, a): %d != -1\n", got);
+		goto err;
+	}
+
+	if (ASN1_STRING_cmp(a, b) >= 0) {
+		fprintf(stderr, "V_ASN1_OCTET_STRING >= V_ASN1_UTF8STRING\n");
+		goto err;
+	}
+	want = V_ASN1_UTF8STRING - V_ASN1_OCTET_STRING;
+	if ((got = ASN1_STRING_cmp(b, a)) != want) {
+		fprintf(stderr, "comparison of octet with utf8 string:"
+		    "want %d, got %d\n", want, got);
+		goto err;
+	}
+
+	ASN1_STRING_set0(a, comparison_str, strlen(comparison_str));
+	ASN1_STRING_set0(b, comparison_str, strlen(comparison_str));
+
+	/* Ensure any data set on a or b isn't freed/zeroed. */
+	a->flags |= ASN1_STRING_FLAG_NDEF;
+	b->flags |= ASN1_STRING_FLAG_NDEF;
+
+	if ((got = ASN1_STRING_cmp(b, a)) != want) {
+		fprintf(stderr, "comparison of octet with utf8 string:"
+		    "want %d, got %d\n", want, got);
+		goto err;
+	}
+
+	b->type = V_ASN1_OCTET_STRING;
+
+	if ((got = ASN1_STRING_cmp(a, b)) != 0) {
+		fprintf(stderr, "same string on both. want 0, got %d\n", got);
+		goto err;
+	}
+
+	if (!ASN1_STRING_set(b, "myString", -1)) {
+		fprintf(stderr, "ASN1_STRING_set(b) failed\n");
+		goto err;
+	}
+
+	if ((got = ASN1_STRING_cmp(a, b)) <= 0) {
+		fprintf(stderr, "capitalized letter compares larger: got %d\n",
+		    got);
+		goto err;
+	}
+	if ((got = ASN1_STRING_cmp(b, a)) >= 0) {
+		fprintf(stderr, "capitalized letter is larger 2: %d\n", got);
+		goto err;
+	}
+
+	ASN1_STRING_length_set(b, 2);
+
+	want = strlen(comparison_str) - 2;
+
+	if ((got = ASN1_STRING_cmp(a, b)) != want) {
+		fprintf(stderr, "comparison of a with truncated b: "
+		    "want %d, got %d\n", want, got);
+		goto err;
+	}
+
+	want = -want;
+
+	if ((got = ASN1_STRING_cmp(b, a)) != want) {
+		fprintf(stderr, "comparison of truncated b with a: "
+		    "want %d, got %d\n", want, got);
+		goto err;
+	}
+
+	ASN1_STRING_length_set(a, 2);
+
+	if ((got = ASN1_STRING_cmp(a, b)) != 0) {
+		fprintf(stderr, "both truncated compared to %d\n", got);
+		goto err;
+	}
+
+	ASN1_STRING_length_set(a, strlen(comparison_str));
+
+	ASN1_STRING_set0(b, NULL, 0);
+
+	want = strlen(comparison_str);
+	if ((got = ASN1_STRING_cmp(a, b)) != want) {
+		fprintf(stderr, "comparison of a with zeroed b: "
+		    "want %d, got %d\n", want, got);
+		goto err;
+	}
+
+	ASN1_STRING_set0(b, "", 0);
+	b->flags |= ASN1_STRING_FLAG_NDEF;
+
+	if ((got = ASN1_STRING_cmp(a, b)) != want) {
+		fprintf(stderr, "comparison of a with zero-length b: "
+		    "want %d, got %d\n", want, got);
+		goto err;
+	}
+
+	ASN1_STRING_set0(a, NULL, 0);
+	if ((got = ASN1_STRING_cmp(a, b)) != 0) {
+		fprintf(stderr, "comparison of zeroed a with zero-length b: "
+		    "want 0, got %d\n", got);
+		goto err;
+	}
+	if ((got = ASN1_STRING_cmp(b, a)) != 0) {
+		fprintf(stderr, "comparison of zero-length b with zeroed a: "
+		    "want 0, got %d\n", got);
+		goto err;
+	}
+
+	failed = 0;
+
+ err:
+	ASN1_STRING_free(a);
+	ASN1_STRING_free(b);
+
+	return failed;
+}
+
+static int
+asn1_string_test(void)
+{
+	int failed = 0;
+
+	failed |= asn1_string_new_test();
+	failed |= asn1_string_cmp_test();
+
+	return failed;
+}
+
 int
 main(int argc, char **argv)
 {
@@ -758,6 +1131,7 @@ main(int argc, char **argv)
 	failed |= asn1_bit_string_test();
 	failed |= asn1_boolean_test();
 	failed |= asn1_integer_test();
+	failed |= asn1_string_test();
 
 	return (failed);
 }
diff --git a/regress/lib/libcrypto/asn1/asn1x509.c b/regress/lib/libcrypto/asn1/asn1x509.c
index 4d689aa7d..972b8290f 100644
--- a/regress/lib/libcrypto/asn1/asn1x509.c
+++ b/regress/lib/libcrypto/asn1/asn1x509.c
@@ -1,6 +1,7 @@
-/* $OpenBSD: asn1x509.c,v 1.4 2023/02/13 09:50:47 tb Exp $ */
+/* $OpenBSD: asn1x509.c,v 1.5 2023/08/11 22:50:44 tb Exp $ */
 /*
  * Copyright (c) 2017 Joel Sing <jsing@openbsd.org>
+ * Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -72,6 +73,20 @@ unsigned char dsa_test_asn1_pubkey[] = {
 	0x43, 0x86, 0x13, 0x9d, 0x22,
 };
 
+const unsigned char dsa_test_asn1_pubkey_noparams[] = {
+	0x30, 0x51, 0x30, 0x09, 0x06, 0x07, 0x2a, 0x86,
+	0x48, 0xce, 0x38, 0x04, 0x01, 0x03, 0x44, 0x00,
+	0x02, 0x41, 0x00, 0x80, 0xd1, 0xb7, 0x4a, 0xd0,
+	0x18, 0x6a, 0xc5, 0x09, 0x12, 0x78, 0x3b, 0x7f,
+	0x48, 0xaa, 0x57, 0xf6, 0xef, 0x22, 0x0e, 0xe8,
+	0x6a, 0xb5, 0xa6, 0x96, 0xc4, 0x5a, 0xfb, 0x2f,
+	0xcf, 0x86, 0x12, 0x21, 0x9b, 0x06, 0xd3, 0x6b,
+	0xe5, 0x06, 0x5c, 0xd5, 0x22, 0x15, 0x0b, 0x7e,
+	0xd3, 0x67, 0x92, 0x93, 0x79, 0xf4, 0xc1, 0x6d,
+	0x22, 0x3c, 0x7c, 0x46, 0xc6, 0xc4, 0x43, 0x86,
+	0x13, 0x9d, 0x22,
+};
+
 const char *ec_test_key =
     "-----BEGIN EC PRIVATE KEY-----\n"
     "MHcCAQEEIEDkF84aPdBNu4vbPE+QV3EP9ULp4Enr1N0lz4vzuc2boAoGCCqGSM49\n"
@@ -121,6 +136,94 @@ unsigned char rsa_test_asn1_pubkey[] = {
 	0x87, 0x02, 0x03, 0x01, 0x00, 0x01,
 };
 
+const char dh_test_key[] =
+	"-----BEGIN PRIVATE KEY-----\n"
+	"MIICJgIBADCCARcGCSqGSIb3DQEDATCCAQgCggEBAIXmHiRswMxVCnVzq4GuaErl\n"
+	"2fBPDquOzFaxd/YSN7tVxnz3wcMNfBsHZWqtAXxTBWeyt8ydHcrIWx4EB3XTSwSi\n"
+	"Jqh3CEcFhDfqKdo/u7vffxG+43lEsvZZIzZHYMcYsHIpcERRoAu0xnqjHUQTkvoi\n"
+	"w7ukbuWr28bJrncPaxFGC8zZvLhSnUst5yzdyAsIddQvHgYBdCn2UEbz6qBx8gvJ\n"
+	"lb3Jv1BiVJJ0odL94vpNXRGNZ57PPm5Xlj/n8l8LHpzzxbtjc52MVYbMPpVuWzmv\n"
+	"2nWV0eL14708S/XG6e2AWGKb8AX8hCitdtVQ28SbEsf8Yd1dyWNo++oedFvU49sC\n"
+	"AQIEggEEAoIBAGywTP/vBwEeuWIgTPnBf1/jWQgfFA5no3HdRIQsHVgo2EEZHErS\n"
+	"X82hALavaUTEu+pHu+/yv3BLPr/8Lau6O7LOiqeXMjYX4HtSNmLZIEjugd1aCyCp\n"
+	"n+jZjIHQCG0fvnwWFqkKTADe4n4DUz5qxuHYmlFY4NsdMj5yARAh9mn7hqwYX+Mf\n"
+	"WhHLhHIHngXKNs7vKdHH/guo638uL6dv6OuTS0wbBsjLMFvQvccVlVUWlUFkH6I8\n"
+	"GFt8kAFLdrzz8+oMq3hHsoWIrDSp0GYq6keSu3pBj4q2mTP7ugUU8ag/dZnga5sB\n"
+	"Mdt2hicktiw/mQZP578plm6z2Lg0gl5yLxk=\n"
+	"-----END PRIVATE KEY-----\n";
+
+const unsigned char dh_test_asn1_pubkey[] = {
+	0x30, 0x82, 0x02, 0x24, 0x30, 0x82, 0x01, 0x17,
+	0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
+	0x01, 0x03, 0x01, 0x30, 0x82, 0x01, 0x08, 0x02,
+	0x82, 0x01, 0x01, 0x00, 0x85, 0xe6, 0x1e, 0x24,
+	0x6c, 0xc0, 0xcc, 0x55, 0x0a, 0x75, 0x73, 0xab,
+	0x81, 0xae, 0x68, 0x4a, 0xe5, 0xd9, 0xf0, 0x4f,
+	0x0e, 0xab, 0x8e, 0xcc, 0x56, 0xb1, 0x77, 0xf6,
+	0x12, 0x37, 0xbb, 0x55, 0xc6, 0x7c, 0xf7, 0xc1,
+	0xc3, 0x0d, 0x7c, 0x1b, 0x07, 0x65, 0x6a, 0xad,
+	0x01, 0x7c, 0x53, 0x05, 0x67, 0xb2, 0xb7, 0xcc,
+	0x9d, 0x1d, 0xca, 0xc8, 0x5b, 0x1e, 0x04, 0x07,
+	0x75, 0xd3, 0x4b, 0x04, 0xa2, 0x26, 0xa8, 0x77,
+	0x08, 0x47, 0x05, 0x84, 0x37, 0xea, 0x29, 0xda,
+	0x3f, 0xbb, 0xbb, 0xdf, 0x7f, 0x11, 0xbe, 0xe3,
+	0x79, 0x44, 0xb2, 0xf6, 0x59, 0x23, 0x36, 0x47,
+	0x60, 0xc7, 0x18, 0xb0, 0x72, 0x29, 0x70, 0x44,
+	0x51, 0xa0, 0x0b, 0xb4, 0xc6, 0x7a, 0xa3, 0x1d,
+	0x44, 0x13, 0x92, 0xfa, 0x22, 0xc3, 0xbb, 0xa4,
+	0x6e, 0xe5, 0xab, 0xdb, 0xc6, 0xc9, 0xae, 0x77,
+	0x0f, 0x6b, 0x11, 0x46, 0x0b, 0xcc, 0xd9, 0xbc,
+	0xb8, 0x52, 0x9d, 0x4b, 0x2d, 0xe7, 0x2c, 0xdd,
+	0xc8, 0x0b, 0x08, 0x75, 0xd4, 0x2f, 0x1e, 0x06,
+	0x01, 0x74, 0x29, 0xf6, 0x50, 0x46, 0xf3, 0xea,
+	0xa0, 0x71, 0xf2, 0x0b, 0xc9, 0x95, 0xbd, 0xc9,
+	0xbf, 0x50, 0x62, 0x54, 0x92, 0x74, 0xa1, 0xd2,
+	0xfd, 0xe2, 0xfa, 0x4d, 0x5d, 0x11, 0x8d, 0x67,
+	0x9e, 0xcf, 0x3e, 0x6e, 0x57, 0x96, 0x3f, 0xe7,
+	0xf2, 0x5f, 0x0b, 0x1e, 0x9c, 0xf3, 0xc5, 0xbb,
+	0x63, 0x73, 0x9d, 0x8c, 0x55, 0x86, 0xcc, 0x3e,
+	0x95, 0x6e, 0x5b, 0x39, 0xaf, 0xda, 0x75, 0x95,
+	0xd1, 0xe2, 0xf5, 0xe3, 0xbd, 0x3c, 0x4b, 0xf5,
+	0xc6, 0xe9, 0xed, 0x80, 0x58, 0x62, 0x9b, 0xf0,
+	0x05, 0xfc, 0x84, 0x28, 0xad, 0x76, 0xd5, 0x50,
+	0xdb, 0xc4, 0x9b, 0x12, 0xc7, 0xfc, 0x61, 0xdd,
+	0x5d, 0xc9, 0x63, 0x68, 0xfb, 0xea, 0x1e, 0x74,
+	0x5b, 0xd4, 0xe3, 0xdb, 0x02, 0x01, 0x02, 0x03,
+	0x82, 0x01, 0x05, 0x00, 0x02, 0x82, 0x01, 0x00,
+	0x44, 0x30, 0x25, 0xe2, 0xeb, 0x8f, 0xd0, 0x81,
+	0x96, 0x3e, 0x7d, 0x1d, 0x9b, 0x82, 0x8a, 0x2d,
+	0x0f, 0xb3, 0x2d, 0x9c, 0x2b, 0xb2, 0x88, 0xda,
+	0xc6, 0xef, 0x6c, 0x9d, 0x1c, 0x80, 0xf1, 0xee,
+	0x9d, 0x6b, 0x31, 0xb7, 0xb1, 0x9f, 0x30, 0x0d,
+	0xb7, 0x92, 0xcf, 0x56, 0xeb, 0xfc, 0x91, 0x16,
+	0x35, 0x96, 0x0c, 0x7b, 0x95, 0xbc, 0x65, 0x66,
+	0x10, 0x81, 0x4b, 0x46, 0x04, 0xee, 0x95, 0xca,
+	0xc9, 0x0c, 0xea, 0xc1, 0xd7, 0x3b, 0x83, 0xfb,
+	0xce, 0x76, 0x17, 0xb4, 0x15, 0xad, 0x03, 0xd0,
+	0x00, 0xef, 0xb2, 0xee, 0x12, 0x3f, 0x75, 0xd1,
+	0xb8, 0x6c, 0xfd, 0x87, 0xb5, 0x07, 0xfa, 0x1e,
+	0x60, 0x9b, 0x49, 0x6f, 0x89, 0xc2, 0x75, 0x4d,
+	0x7d, 0x21, 0xdb, 0xb6, 0x85, 0x78, 0xa5, 0x77,
+	0xbe, 0xeb, 0x4d, 0x9e, 0x1c, 0x05, 0xbc, 0x51,
+	0x97, 0x0f, 0xe9, 0x68, 0x78, 0x5a, 0xc8, 0x4e,
+	0xef, 0x72, 0x8f, 0x53, 0x41, 0x0d, 0x57, 0xf2,
+	0xc5, 0x29, 0x33, 0x67, 0xdd, 0x35, 0x43, 0xfc,
+	0x13, 0x49, 0x92, 0x1d, 0x14, 0x92, 0x40, 0x14,
+	0x38, 0x32, 0xdb, 0x14, 0x95, 0x44, 0x2a, 0x03,
+	0xb7, 0x87, 0xa3, 0x5a, 0x5a, 0xe2, 0x3b, 0xc5,
+	0x44, 0xa4, 0x06, 0xf6, 0x14, 0xe6, 0x08, 0x9c,
+	0x51, 0x09, 0x2a, 0xc4, 0x2e, 0x72, 0xb3, 0x20,
+	0x46, 0x77, 0xe2, 0xda, 0x07, 0xd8, 0x10, 0x89,
+	0xcf, 0x2b, 0xef, 0x67, 0xa2, 0x48, 0xfd, 0xa3,
+	0x71, 0x59, 0xf0, 0x89, 0x3a, 0x35, 0x31, 0x87,
+	0xad, 0x45, 0x9e, 0x35, 0xbd, 0x64, 0xec, 0xd1,
+	0xd7, 0xea, 0x92, 0xed, 0x72, 0x9c, 0x81, 0x8e,
+	0x11, 0x4e, 0xa5, 0xe7, 0x12, 0xe3, 0x7c, 0x53,
+	0x2b, 0x31, 0xd4, 0x3d, 0xd5, 0xd9, 0xbd, 0x44,
+	0x27, 0xa3, 0x4a, 0x3f, 0x20, 0x87, 0xce, 0x73,
+	0x0e, 0xa8, 0x90, 0xcd, 0xfe, 0x32, 0x69, 0x9a,
+};
+
 static void
 hexdump(const unsigned char *buf, size_t len)
 {
@@ -152,6 +255,93 @@ compare_data(const char *label, const unsigned char *d1, size_t d1_len,
 	return 0;
 }
 
+static int
+dh_pubkey_test(void)
+{
+	EVP_PKEY *pkey = NULL;
+	EVP_PKEY *pkey_a = NULL, *pkey_b = NULL;
+	unsigned char *out = NULL, *data = NULL;
+	DH *dh_a = NULL, *dh_b = NULL;
+	const unsigned char *p;
+	BIO *bio_mem = NULL;
+	int failure = 1;
+	int len;
+
+	ERR_clear_error();
+
+	if ((bio_mem = BIO_new_mem_buf(dh_test_key, -1)) == NULL)
+		errx(1, "failed to create BIO");
+
+	if ((pkey = PEM_read_bio_PrivateKey(bio_mem, NULL, NULL, NULL)) == NULL) {
+		ERR_print_errors_fp(stderr);
+		errx(1, "failed to decode DH key from PEM");
+	}
+
+	/*
+	 * Test PEM_write_bio_PrivateKey().
+	 */
+	BIO_free_all(bio_mem);
+	if ((bio_mem = BIO_new(BIO_s_mem())) == NULL)
+                errx(1, "BIO_new failed for BIO_s_mem");
+
+	if (!PEM_write_bio_PrivateKey(bio_mem, pkey, NULL, NULL, 0, 0, NULL)) {
+		fprintf(stderr, "FAIL: PEM_write_bio_PrivateKey failed\n");
+		goto done;
+	}
+
+	len = BIO_get_mem_data(bio_mem, &data);
+	if (compare_data("DH PrivateKey", data, len,
+	    dh_test_key, sizeof(dh_test_key) - 1) == -1)
+		goto done;
+
+	/*
+	 * Test i2d_PUBKEY/d2i_PUBKEY.
+	 */
+
+	if ((dh_a = EVP_PKEY_get1_DH(pkey)) == NULL) {
+		ERR_print_errors_fp(stderr);
+		errx(1, "failed to get1 DH key from PEM");
+	}
+
+	if ((pkey_a = EVP_PKEY_new()) == NULL)
+		errx(1, "failed to create EVP_PKEY");
+	if (!EVP_PKEY_set1_DH(pkey_a, dh_a))
+		errx(1, "failed to set DH on EVP_PKEY");
+
+	if ((len = i2d_PUBKEY(pkey_a, &out)) < 0) {
+		fprintf(stderr, "FAIL: i2d_PUBKEY failed\n");
+		goto done;
+	}
+	if (compare_data("DH PUBKEY", out, len, dh_test_asn1_pubkey,
+	    sizeof(dh_test_asn1_pubkey)) == -1)
+		goto done;
+
+	p = out;
+	if ((pkey_b = d2i_PUBKEY(NULL, &p, len)) == NULL) {
+		fprintf(stderr, "FAIL: d2i_PUBKEY failed\n");
+		goto done;
+	}
+
+	if (BN_cmp(DH_get0_pub_key(EVP_PKEY_get0_DH(pkey_a)),
+	    DH_get0_pub_key(EVP_PKEY_get0_DH(pkey_b))) != 0) {
+		fprintf(stderr, "FAIL: DH public keys mismatch\n");
+		goto done;
+	}
+
+	failure = 0;
+
+ done:
+	BIO_free_all(bio_mem);
+	EVP_PKEY_free(pkey);
+	DH_free(dh_a);
+	DH_free(dh_b);
+	EVP_PKEY_free(pkey_a);
+	EVP_PKEY_free(pkey_b);
+	free(out);
+
+	return failure;
+}
+
 static int
 dsa_pubkey_test(void)
 {
@@ -161,7 +351,7 @@ dsa_pubkey_test(void)
 	const unsigned char *p;
 	BIO *bio_mem = NULL;
 	int failure = 1;
-	int len;
+	int len, ret;
 
 	ERR_clear_error();
 
@@ -201,6 +391,80 @@ dsa_pubkey_test(void)
 		goto done;
 	}
 
+	if (EVP_PKEY_missing_parameters(pkey_b)) {
+		fprintf(stderr, "FAIL: DSA pkey_b has missing parameters\n");
+		goto done;
+	}
+
+	if (!EVP_PKEY_cmp_parameters(pkey_a, pkey_b)) {
+		fprintf(stderr, "FAIL: DSA parameters mismatch\n");
+		goto done;
+	}
+
+	/*
+	 * Check save_parameters defaults - EVP_PKEY_save_parameters() returns
+	 * the current save_parameters; mode -1 inspects without setting.
+	 */
+	if ((ret = EVP_PKEY_save_parameters(pkey_b, 0)) != 1) {
+		fprintf(stderr, "FAIL: DSA save_parameters want 1, got %d\n", ret);
+		goto done;
+	}
+	if ((ret = EVP_PKEY_save_parameters(pkey_b, -1)) != 0) {
+		fprintf(stderr, "FAIL: DSA save_parameters want 0, got %d\n", ret);
+		goto done;
+	}
+
+	free(out);
+	out = NULL;
+
+	if ((len = i2d_PUBKEY(pkey_b, &out)) < 0) {
+		fprintf(stderr, "FAIL: i2d_PUBKEY (no params) failed\n");
+		goto done;
+	}
+
+	if (compare_data("PUBKEY (no params)", dsa_test_asn1_pubkey_noparams,
+	    sizeof(dsa_test_asn1_pubkey_noparams), out, len) == -1)
+		goto done;
+
+	EVP_PKEY_free(pkey_b);
+
+	p = out;
+	if ((pkey_b = d2i_PUBKEY(NULL, &p, len)) == NULL) {
+		fprintf(stderr, "FAIL: d2i_PUBKEY (no params) failed\n");
+		goto done;
+	}
+
+	if (!EVP_PKEY_missing_parameters(pkey_b)) {
+		fprintf(stderr, "FAIL: DSA pkey_b has no missing parameters\n");
+		goto done;
+	}
+
+	if (BN_cmp(DSA_get0_pub_key(EVP_PKEY_get0_DSA(pkey_a)),
+	    DSA_get0_pub_key(EVP_PKEY_get0_DSA(pkey_b))) != 0) {
+		fprintf(stderr, "FAIL: DSA public keys mismatch\n");
+		goto done;
+	}
+
+	if (EVP_PKEY_cmp_parameters(pkey_a, pkey_b)) {
+		fprintf(stderr, "FAIL: DSA parameters match\n");
+		goto done;
+	}
+
+	if (EVP_PKEY_cmp(pkey_a, pkey_b)) {
+		fprintf(stderr, "FAIL: DSA keys should not match\n");
+		goto done;
+	}
+
+	if (!EVP_PKEY_copy_parameters(pkey_b, pkey_a)) {
+		fprintf(stderr, "FAIL: failed to copy DSA parameters\n");
+		goto done;
+	}
+
+	if (!EVP_PKEY_cmp(pkey_a, pkey_b)) {
+		fprintf(stderr, "FAIL: DSA keys should match\n");
+		goto done;
+	}
+
 	free(out);
 	out = NULL;
 
@@ -569,6 +833,7 @@ main(int argc, char **argv)
 
 	ERR_load_crypto_strings();
 
+	failed |= dh_pubkey_test();
 	failed |= dsa_pubkey_test();
 	failed |= ec_pubkey_test();
 	failed |= rsa_pubkey_test();
diff --git a/regress/lib/libcrypto/dh/dhtest.c b/regress/lib/libcrypto/dh/dhtest.c
index 7ddd11812..00eb23079 100644
--- a/regress/lib/libcrypto/dh/dhtest.c
+++ b/regress/lib/libcrypto/dh/dhtest.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dhtest.c,v 1.8 2023/07/28 13:05:59 tb Exp $	*/
+/*	$OpenBSD: dhtest.c,v 1.12 2023/08/12 06:30:43 tb Exp $	*/
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -96,62 +96,69 @@ int
 main(int argc, char *argv[])
 {
 	BN_GENCB *_cb;
-	DH *a = NULL;
-	unsigned char *abuf = NULL;
-	int i, alen, aout;
+	DH *dh = NULL;
+	unsigned char *buf = NULL;
+	int i, buf_len, secret_len;
 	int ret = 1;
 
 	if ((_cb = BN_GENCB_new()) == NULL)
 		err(1, "BN_GENCB_new");
 
 	BN_GENCB_set(_cb, &cb, NULL);
-	if ((a = DH_new()) == NULL)
+	if ((dh = DH_new()) == NULL)
 		goto err;
 
-	if (!DH_generate_parameters_ex(a, 64, DH_GENERATOR_5, _cb))
+#ifdef OPENSSL_NO_ENGINE
+	if (DH_get0_engine(dh) != NULL) {
+		fprintf(stderr, "ENGINE was not NULL\n");
+		goto err;
+	}
+#endif
+
+	if (!DH_generate_parameters_ex(dh, 64, DH_GENERATOR_5, _cb))
 		goto err;
 
-	if (!DH_check(a, &i))
+	if (!DH_check(dh, &i))
 		goto err;
 	if (i & DH_CHECK_P_NOT_PRIME)
-		puts("p value is not prime\n");
+		printf("p value is not prime\n");
 	if (i & DH_CHECK_P_NOT_SAFE_PRIME)
-		puts("p value is not a safe prime\n");
+		printf("p value is not a safe prime\n");
 	if (i & DH_UNABLE_TO_CHECK_GENERATOR)
-		puts("unable to check the generator value\n");
+		printf("unable to check the generator value\n");
 	if (i & DH_NOT_SUITABLE_GENERATOR)
-		puts("the g value is not a generator\n");
+		printf("the g value is not a generator\n");
 
 	printf("\np    = ");
-	if (!BN_print_fp(stdout, DH_get0_p(a)))
+	if (!BN_print_fp(stdout, DH_get0_p(dh)))
 		goto err;
 	printf("\ng    = ");
-	if (!BN_print_fp(stdout, DH_get0_g(a)))
+	if (!BN_print_fp(stdout, DH_get0_g(dh)))
 		goto err;
 	printf("\n");
 
-	if (!DH_generate_key(a))
+	if (!DH_generate_key(dh))
 		goto err;
 	printf("pri1 = ");
-	if (!BN_print_fp(stdout, DH_get0_priv_key(a)))
+	if (!BN_print_fp(stdout, DH_get0_priv_key(dh)))
 		goto err;
 	printf("\npub1 = ");
-	if (!BN_print_fp(stdout, DH_get0_pub_key(a)))
+	if (!BN_print_fp(stdout, DH_get0_pub_key(dh)))
 		goto err;
 	printf("\n");
 
-	alen = DH_size(a);
-	if ((abuf = malloc(alen)) == NULL)
+	buf_len = DH_size(dh);
+	if ((buf = malloc(buf_len)) == NULL)
 		err(1, "malloc");
-	aout = DH_compute_key(abuf, DH_get0_pub_key(a), a);
+	secret_len = DH_compute_key(buf, DH_get0_pub_key(dh), dh);
 
 	printf("key1 = ");
-	for (i = 0; i < aout; i++) {
-		printf("%02X", abuf[i]);
+	for (i = 0; i < secret_len; i++) {
+		printf("%02X", buf[i]);
 	}
 	printf("\n");
 
-	if (aout < 4) {
+	if (secret_len < 4) {
 		fprintf(stderr, "Error in DH routines\n");
 		goto err;
 	}
@@ -160,8 +167,8 @@ main(int argc, char *argv[])
 err:
 	ERR_print_errors_fp(stderr);
 
-	free(abuf);
-	DH_free(a);
+	free(buf);
+	DH_free(dh);
 	BN_GENCB_free(_cb);
 
 	return (ret);
diff --git a/regress/lib/libcrypto/dsa/dsatest.c b/regress/lib/libcrypto/dsa/dsatest.c
index e5b56c08d..b21f1b975 100644
--- a/regress/lib/libcrypto/dsa/dsatest.c
+++ b/regress/lib/libcrypto/dsa/dsatest.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dsatest.c,v 1.7 2022/01/12 08:59:56 tb Exp $	*/
+/*	$OpenBSD: dsatest.c,v 1.8 2023/08/12 06:23:59 tb Exp $	*/
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -143,6 +143,13 @@ main(int argc, char **argv)
 	if ((dsa = DSA_new()) == NULL)
 		goto end;
 
+#ifdef OPENSSL_NO_ENGINE
+	if (DSA_get0_engine(dsa) != NULL) {
+		BIO_printf(bio_err, "ENGINE was not NULL\n");
+		goto end;
+	}
+#endif
+
 	if (!DSA_generate_parameters_ex(dsa, 512, seed, 20, &counter, &h, cb))
 		goto end;
 
diff --git a/regress/lib/libcrypto/man/check_complete.pl b/regress/lib/libcrypto/man/check_complete.pl
index 4f5d6d125..6af5f8c32 100755
--- a/regress/lib/libcrypto/man/check_complete.pl
+++ b/regress/lib/libcrypto/man/check_complete.pl
@@ -30,6 +30,10 @@ my %internal = (
 	BN_MASK2 BN_MASK2h BN_MASK2h1 BN_MASK2l
 	BN_TBIT BN_ULLONG
     )],
+    evp => [qw(
+        EVP_MD_CTRL_ALG_CTRL
+        EVP_MD_CTX_FLAG_CLEANED EVP_MD_CTX_FLAG_REUSE
+    )],
     objects => [qw(
 	OBJ_bsearch_ OBJ_bsearch_ex_
     )],
@@ -61,6 +65,11 @@ my %obsolete = (
     bn => [qw(
 	BN_HEX_FMT1 BN_HEX_FMT2 BN_MASK
     )],
+    evp => [qw(
+        EVP_MD_CTRL_DIGALGID
+        EVP_MD_CTX_FLAG_NON_FIPS_ALLOW EVP_MD_CTX_FLAG_PAD_MASK
+        EVP_MD_CTX_FLAG_PAD_PKCS1 EVP_MD_CTX_FLAG_PAD_PSS
+    )],
 );
 
 my %postponed = (
@@ -267,7 +276,7 @@ try_again:
 			print "D- $line\n" if $verbose;
 			next;
 		}
-		if ($id =~ /^(?:ASN1|BIO|BN|X509(?:V3)?)_[FR]_\w+$/) {
+		if ($id =~ /^(?:ASN1|BIO|BN|EVP|X509(?:V3)?)_[FR]_\w+$/) {
 			print "D- $line\n" if $verbose;
 			next;
 		}
diff --git a/regress/lib/libm/Makefile b/regress/lib/libm/Makefile
index feac435a8..c826d8638 100644
--- a/regress/lib/libm/Makefile
+++ b/regress/lib/libm/Makefile
@@ -1,6 +1,6 @@
-#	$OpenBSD: Makefile,v 1.15 2019/02/21 16:14:45 bluhm Exp $
+#	$OpenBSD: Makefile,v 1.16 2023/08/13 07:02:36 miod Exp $
 
-SUBDIR+= exp fenv floor fpaccuracy lgamma nextafter msun rint round \
+SUBDIR+= exp fenv floor fpaccuracy lgamma modf msun nextafter rint round \
 	 tgamma toint trivial1
 
 .if defined(REGRESS_FULL) || make(clean) || make(cleandir) || make(obj)
diff --git a/regress/lib/libm/modf/Makefile b/regress/lib/libm/modf/Makefile
new file mode 100644
index 000000000..aa6e5fd55
--- /dev/null
+++ b/regress/lib/libm/modf/Makefile
@@ -0,0 +1,5 @@
+PROG=modf_test
+LDADD+= -lm
+DPADD+= ${LIBM}
+
+.include <bsd.regress.mk>
diff --git a/regress/lib/libm/modf/modf_test.c b/regress/lib/libm/modf/modf_test.c
new file mode 100644
index 000000000..7deb74584
--- /dev/null
+++ b/regress/lib/libm/modf/modf_test.c
@@ -0,0 +1,71 @@
+/*	$OpenBSD: modf_test.c,v 1.1 2023/08/13 07:02:36 miod Exp $	*/
+
+/*
+ * Written by Willemijn Coene.  Public domain
+ */
+
+#include <assert.h>
+#include <math.h>
+
+void
+modff_infnan(void)
+{
+	float f, i;
+
+	f = modff(__builtin_inff(), &i);
+	assert(isinf(i));
+	assert(signbit(i) == 0);
+	assert(f == 0.0f);
+
+	f = modff(-__builtin_inff(), &i);
+	assert(isinf(i));
+	assert(signbit(i) != 0);
+	assert(f == -0.0f);
+
+	f = modff(NAN, &i);
+	assert(isnan(i));
+	assert(signbit(i) == 0);
+	assert(isnan(f));
+	assert(signbit(f) == 0);
+
+	f = modff(-NAN, &i);
+	assert(isnan(i));
+	assert(signbit(i) != 0);
+	assert(isnan(f));
+	assert(signbit(f) != 0);
+}
+
+void
+modfl_infnan(void)
+{
+	long double f, i;
+
+	f = modfl(__builtin_infl(), &i);
+	assert(isinf(i));
+	assert(signbit(i) == 0);
+	assert(f == 0.0L);
+
+	f = modfl(-__builtin_infl(), &i);
+	assert(isinf(i));
+	assert(signbit(i) != 0);
+	assert(f == -0.0L);
+
+	f = modfl(NAN, &i);
+	assert(isnan(i));
+	assert(signbit(i) == 0);
+	assert(isnan(f));
+	assert(signbit(f) == 0);
+
+	f = modfl(-NAN, &i);
+	assert(isnan(i));
+	assert(signbit(i) != 0);
+	assert(isnan(f));
+	assert(signbit(f) != 0);
+}
+
+int
+main(void)
+{
+	modff_infnan();
+	modfl_infnan();
+}
diff --git a/regress/lib/libm/msun/Makefile b/regress/lib/libm/msun/Makefile
index a7489ddb0..1ea48f810 100644
--- a/regress/lib/libm/msun/Makefile
+++ b/regress/lib/libm/msun/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.12 2022/05/20 20:08:43 mbuhl Exp $
+#	$OpenBSD: Makefile,v 1.13 2023/08/14 09:26:37 anton Exp $
 
 # Copyright (c) 2021 Moritz Buhl <mbuhl@openbsd.org>
 #
@@ -50,7 +50,7 @@ FAILING = run-cexp_test-{2,3,4} run-csqrt_test-{1,2,3} \
 	run-ctrig_test-{2,3,4,6} run-fma_test-7 \
 	run-invctrig_test-{1,2,3,4} run-invtrig_test-{1,2,3,5,6} \
 	run-logarithm_test-1 run-lround_test-1 run-nan_test-1 \
-	run-nearbyint_test-1 run-next_test-5 run-rem_test-3
+	run-next_test-5 run-rem_test-3
 
 . if ${MACHINE} == amd64
 FAILING+=	run-cexp_test-{1,7}
@@ -66,6 +66,7 @@ FAILING+=	run-fma_test-{1,2,4,5,6,7}
 FAILING+=	run-invtrig_test-7
 FAILING+=	run-logarithm_test-5
 FAILING+=	run-lrint_test-1
+FAILING+=	run-nearbyint_test-1
 FAILING+=	run-next_test-{1,2,4}
 FAILING+=	run-rem_test-{1,2}
 FAILING+=	run-trig_test-1
@@ -75,6 +76,7 @@ FAILING+=	run-ctrig_test-{1,5}
 FAILING+=	run-exponential_test-1 
 FAILING+=	run-invtrig_test-7
 FAILING+=	run-lrint_test-1
+FAILING+=	run-nearbyint_test-1
 FAILING+=	run-trig_test-1
 . elif ${MACHINE} == i386
 FAILING+=	run-cexp_test-{1,7}
@@ -83,12 +85,14 @@ FAILING+=	run-fma_test-{1,6}
 FAILING+=	run-invtrig_test-4
 FAILING+=	run-logarithm_test-3
 FAILING+=	run-lrint_test-1
+FAILING+=	run-nearbyint_test-1
 FAILING+=	run-next_test-{1,2,4}
 . elif ${MACHINE} == powerpc64
 FAILING+=	run-cexp_test-7
 FAILING+=	run-ctrig_test-{1,5}
 FAILING+=	run-exponential_test-1 
 FAILING+=	run-invtrig_test-7
+FAILING+=	run-nearbyint_test-1
 . elif ${MACHINE} == macppc
 FAILING+=	run-cexp_test-7
 FAILING+=	run-ctrig_test-{1,5}
@@ -97,6 +101,7 @@ FAILING+=	run-fenv_test-{7,8}
 FAILING+=	run-invtrig_test-7
 FAILING+=	run-logarithm_test-3
 FAILING+=	run-lrint_test-1
+FAILING+=	run-nearbyint_test-1
 . elif ${MACHINE} == sparc64
 FAILING+=	run-ctrig_test-5
 FAILING+=	run-exponential_test-1 
@@ -104,6 +109,7 @@ FAILING+=	run-fma_test-{1,2,4,5,6}
 FAILING+=	run-invtrig_test-{4,7}
 FAILING+=	run-logarithm_test-5
 FAILING+=	run-lrint_test-1
+FAILING+=	run-nearbyint_test-1
 FAILING+=	run-next_test-{1,2,4}
 FAILING+=	run-rem_test-{1,2}
 FAILING+=	run-trig_test-{1,2}
@@ -115,6 +121,7 @@ FAILING+=	run-fma_test-{1,2,3,4,5,6}
 FAILING+=	run-invtrig_test-{4,7}
 FAILING+=	run-logarithm_test-5
 FAILING+=	run-lrint_test-1
+FAILING+=	run-nearbyint_test-1
 FAILING+=	run-next_test-{1,2,3,4}
 FAILING+=	run-rem_test-{1,2}
 FAILING+=	run-trig_test-{1,2}
@@ -127,6 +134,7 @@ FAILING+=	run-ilogb_test-3
 FAILING+=	run-invtrig_test-{4,7}
 FAILING+=	run-logarithm_test-5
 FAILING+=	run-lrint_test-1
+FAILING+=	run-nearbyint_test-1
 FAILING+=	run-next_test-{1,2,4}
 FAILING+=	run-rem_test-{1,2}
 FAILING+=	run-trig_test-{1,2}
diff --git a/regress/lib/libssl/ssl/ssltest.c b/regress/lib/libssl/ssl/ssltest.c
index f50824d24..f95ea44a9 100644
--- a/regress/lib/libssl/ssl/ssltest.c
+++ b/regress/lib/libssl/ssl/ssltest.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ssltest.c,v 1.42 2023/07/27 07:08:09 tb Exp $ */
+/*	$OpenBSD: ssltest.c,v 1.43 2023/08/15 11:20:57 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -281,8 +281,8 @@ verify_alpn(SSL *client, SSL *server)
 	free(alpn_selected);
 	alpn_selected = NULL;
 
-	if (client_proto_len != server_proto_len ||
-	    memcmp(client_proto, server_proto, client_proto_len) != 0) {
+	if (client_proto_len != server_proto_len || (client_proto_len > 0 &&
+	    memcmp(client_proto, server_proto, client_proto_len) != 0)) {
 		BIO_printf(bio_stdout, "ALPN selected protocols differ!\n");
 		goto err;
 	}
diff --git a/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py b/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py
index a31c8fae0..4b29dded4 100644
--- a/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py
+++ b/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py
@@ -1,4 +1,4 @@
-#   $OpenBSD: tlsfuzzer.py,v 1.51 2023/08/03 20:13:12 tb Exp $
+#   $OpenBSD: tlsfuzzer.py,v 1.52 2023/08/14 18:10:42 tb Exp $
 #
 # Copyright (c) 2020 Theo Buehler <tb@openbsd.org>
 #
@@ -370,7 +370,6 @@ tls12_tests = TestGroup("TLSv1.2 tests", [
     Test("test-message-skipping.py"),
     Test("test-no-heartbeat.py"),
     Test("test-record-layer-fragmentation.py"),
-    Test("test-sessionID-resumption.py"),
     Test("test-sslv2-connection.py"),
     Test("test-truncating-of-finished.py"),
     Test("test-truncating-of-kRSA-client-key-exchange.py"),
@@ -388,7 +387,7 @@ tls12_tests = TestGroup("TLSv1.2 tests", [
     Test(
         "test-ccs.py", [
             "-x", "two bytes long CCS",
-            "-X", "does not match received \"decode_error\"",
+            "-X", substitute_alert("unexpected_message", "decode_error"),
         ]
     ),
     Test(
@@ -439,6 +438,11 @@ tls12_tests = TestGroup("TLSv1.2 tests", [
         "-e", "drop extended_master_secret in renegotiation",
     ]),
 
+    Test("test-sessionID-resumption.py", [
+        "-x", "Client Hello too long session ID",
+        "-X", substitute_alert("decode_error", "illegal_parameter"),
+    ]),
+
     # Without --sig-algs-drop-ok, two tests fail since we do not currently
     # implement the signature_algorithms_cert extension (although we MUST).
     Test("test-sig-algs-renegotiation-resumption.py", ["--sig-algs-drop-ok"]),
@@ -558,6 +562,12 @@ tls12_failing_tests = TestGroup("failing TLSv1.2 tests", [
     # 'resumption with cipher from old CH but not selected by server'
     Test("test-resumption-with-wrong-ciphers.py"),
 
+    # 'session resumption with empty session_id'
+    # 'session resumption with random session_id'
+    # 'session resumption with renegotiation'
+    # AssertionError: Server did not send extension(s): session_ticket
+    Test("test-session-ticket-resumption.py"),
+
     # 5 failures:
     #   'empty sigalgs'
     #   'only undefined sigalgs'
diff --git a/regress/libexec/ld.so/Makefile b/regress/libexec/ld.so/Makefile
index ec8d983e6..5390db2a2 100644
--- a/regress/libexec/ld.so/Makefile
+++ b/regress/libexec/ld.so/Makefile
@@ -1,10 +1,10 @@
-#	$OpenBSD: Makefile,v 1.19 2022/08/20 14:13:48 sthen Exp $
+#	$OpenBSD: Makefile,v 1.20 2023/08/12 13:43:22 gnezdo Exp $
 
 SUBDIR+= elf hidden weak dlsym dlopen dlclose lazy
 SUBDIR+= constructor
 SUBDIR+= link-order edgecases initfirst
 SUBDIR+= df_1_noopen randomdata subst dependencies
-SUBDIR+= init-env nodelete noload
+SUBDIR+= init-env nodelete noload ldd
 
 install:
 
diff --git a/regress/libexec/ld.so/ldd/Makefile b/regress/libexec/ld.so/ldd/Makefile
new file mode 100644
index 000000000..db93f0890
--- /dev/null
+++ b/regress/libexec/ld.so/ldd/Makefile
@@ -0,0 +1,16 @@
+# $OpenBSD: Makefile,v 1.2 2023/08/13 18:34:49 anton Exp $
+
+REGRESS_TARGETS+=	empty
+REGRESS_TARGETS+=	short
+
+CLEANFILES+=	*.in *.out
+
+empty:
+	: >$@.in
+	ldd $@.in 2>&1 | tee $@.out | grep -q 'incomplete ELF header'
+
+short:
+	dd if=/usr/bin/ldd of=$@.in count=128 bs=1 status=none
+	ldd $@.in 2>&1 | tee $@.out | grep -q 'incomplete program header'
+
+.include <bsd.regress.mk>
diff --git a/regress/sys/kern/kqueue/kqueue-timer.c b/regress/sys/kern/kqueue/kqueue-timer.c
index 060e753ae..814973041 100644
--- a/regress/sys/kern/kqueue/kqueue-timer.c
+++ b/regress/sys/kern/kqueue/kqueue-timer.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kqueue-timer.c,v 1.4 2021/06/12 13:30:14 visa Exp $	*/
+/*	$OpenBSD: kqueue-timer.c,v 1.5 2023/08/13 08:29:28 visa Exp $	*/
 /*
  * Copyright (c) 2015 Bret Stephen Lambert <blambert@openbsd.org>
  *
@@ -22,6 +22,7 @@
 #include <err.h>
 #include <errno.h>
 #include <stdio.h>
+#include <stdint.h>
 #include <string.h>
 #include <time.h>
 #include <unistd.h>
@@ -31,9 +32,13 @@
 int
 do_timer(void)
 {
-	int kq, n;
+	static const int units[] = {
+		NOTE_SECONDS, NOTE_MSECONDS, NOTE_USECONDS, NOTE_NSECONDS
+	};
 	struct kevent ev;
-	struct timespec ts;
+	struct timespec ts, start, end, now;
+	int64_t usecs;
+	int i, kq, n;
 
 	ASS((kq = kqueue()) >= 0,
 	    warn("kqueue"));
@@ -68,6 +73,125 @@ do_timer(void)
 	n = kevent(kq, NULL, 0, &ev, 1, &ts);
 	ASSX(n == 1);
 
+	/* Test with different time units */
+
+	for (i = 0; i < sizeof(units) / sizeof(units[0]); i++) {
+		memset(&ev, 0, sizeof(ev));
+		ev.filter = EVFILT_TIMER;
+		ev.flags = EV_ADD | EV_ENABLE;
+		ev.fflags = units[i];
+		ev.data = 1;
+
+		n = kevent(kq, &ev, 1, NULL, 0, NULL);
+		ASSX(n != -1);
+
+		ts.tv_sec = 2;			/* wait 2s for kqueue timeout */
+		ts.tv_nsec = 0;
+
+		n = kevent(kq, NULL, 0, &ev, 1, &ts);
+		ASSX(n == 1);
+
+		/* Delete timer to clear EV_CLEAR */
+
+		memset(&ev, 0, sizeof(ev));
+		ev.filter = EVFILT_TIMER;
+		ev.flags = EV_DELETE;
+
+		n = kevent(kq, &ev, 1, NULL, 0, NULL);
+		ASSX(n != -1);
+
+		/* Test with NOTE_ABSTIME, deadline in the future */
+
+		clock_gettime(CLOCK_MONOTONIC, &start);
+
+		clock_gettime(CLOCK_REALTIME, &now);
+		memset(&ev, 0, sizeof(ev));
+		ev.filter = EVFILT_TIMER;
+		ev.flags = EV_ADD | EV_ENABLE;
+		ev.fflags = NOTE_ABSTIME | units[i];
+
+		switch (units[i]) {
+		case NOTE_SECONDS:
+			ev.data = now.tv_sec + 1;
+			break;
+		case NOTE_MSECONDS:
+			ev.data = now.tv_sec * 1000 + now.tv_nsec / 1000000
+			     + 100;
+			break;
+		case NOTE_USECONDS:
+			ev.data = now.tv_sec * 1000000 + now.tv_nsec / 1000
+			    + 100 * 1000;
+			break;
+		case NOTE_NSECONDS:
+			ev.data = now.tv_sec * 1000000000 + now.tv_nsec
+			    + 100 * 1000000;
+			break;
+		}
+
+		n = kevent(kq, &ev, 1, NULL, 0, NULL);
+		ASSX(n != -1);
+
+		ts.tv_sec = 2;			/* wait 2s for kqueue timeout */
+		ts.tv_nsec = 0;
+
+		n = kevent(kq, NULL, 0, &ev, 1, &ts);
+		ASSX(n == 1);
+
+		clock_gettime(CLOCK_MONOTONIC, &end);
+		timespecsub(&end, &start, &ts);
+		usecs = ts.tv_sec * 1000000 + ts.tv_nsec / 1000;
+		ASSX(usecs > 0);
+		ASSX(usecs < 1500000);		/* allow wide margin */
+
+		/* Test with NOTE_ABSTIME, deadline in the past. */
+
+		clock_gettime(CLOCK_MONOTONIC, &start);
+
+		memset(&ev, 0, sizeof(ev));
+		ev.filter = EVFILT_TIMER;
+		ev.flags = EV_ADD | EV_ENABLE;
+		ev.fflags = NOTE_ABSTIME | units[i];
+
+		clock_gettime(CLOCK_REALTIME, &now);
+		switch (units[i]) {
+		case NOTE_SECONDS:
+			ev.data = now.tv_sec - 1;
+			break;
+		case NOTE_MSECONDS:
+			ev.data = now.tv_sec * 1000 + now.tv_nsec / 1000000
+			     - 100;
+			break;
+		case NOTE_USECONDS:
+			ev.data = now.tv_sec * 1000000 + now.tv_nsec / 1000
+			    - 100 * 1000;
+			break;
+		case NOTE_NSECONDS:
+			ev.data = now.tv_sec * 1000000000 + now.tv_nsec
+			    - 100 * 1000000;
+			break;
+		}
+
+		n = kevent(kq, &ev, 1, NULL, 0, NULL);
+		ASSX(n != -1);
+
+		n = kevent(kq, NULL, 0, &ev, 1, &ts);
+		ASSX(n == 1);
+
+		clock_gettime(CLOCK_MONOTONIC, &end);
+		timespecsub(&end, &start, &ts);
+		usecs = ts.tv_sec * 1000000 + ts.tv_nsec / 1000;
+		ASSX(usecs > 0);
+		ASSX(usecs < 100000);		/* allow wide margin */
+
+		/* Test that the event remains active */
+
+		ts.tv_sec = 2;			/* wait 2s for kqueue timeout */
+		ts.tv_nsec = 0;
+
+		n = kevent(kq, NULL, 0, &ev, 1, &ts);
+		ASSX(n == 1);
+	}
+
 	return (0);
 }
 
@@ -96,6 +220,37 @@ do_invalid_timer(void)
 		    (long long)invalid_ts[i].tv_sec, invalid_ts[i].tv_nsec));
 	}
 
+	/* Test invalid fflags */
+
+	memset(&ev, 0, sizeof(ev));
+	ev.filter = EVFILT_TIMER;
+	ev.flags = EV_ADD | EV_ENABLE;
+	ev.fflags = ~NOTE_SECONDS;
+	ev.data = 1;
+
+	n = kevent(kq, &ev, 1, NULL, 0, NULL);
+	ASSX(n == -1 && errno == EINVAL);
+
+	memset(&ev, 0, sizeof(ev));
+	ev.filter = EVFILT_TIMER;
+	ev.flags = EV_ADD | EV_ENABLE;
+	ev.fflags = NOTE_MSECONDS;
+	ev.data = 500;
+
+	n = kevent(kq, &ev, 1, NULL, 0, NULL);
+	ASSX(n == 0);
+
+	/* Modify the existing timer */
+
+	memset(&ev, 0, sizeof(ev));
+	ev.filter = EVFILT_TIMER;
+	ev.flags = EV_ADD | EV_ENABLE;
+	ev.fflags = ~NOTE_SECONDS;
+	ev.data = 1;
+
+	n = kevent(kq, &ev, 1, NULL, 0, NULL);
+	ASSX(n == -1 && errno == EINVAL);
+
 	return (0);
 }
 
diff --git a/regress/sys/kern/mount/Makefile b/regress/sys/kern/mount/Makefile
index b6a437754..eb51810b9 100644
--- a/regress/sys/kern/mount/Makefile
+++ b/regress/sys/kern/mount/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.8 2020/12/16 23:10:48 bluhm Exp $
+# $OpenBSD: Makefile,v 1.9 2023/08/14 12:03:12 miod Exp $
 
 # This regress test uses a vnd device to run mount and unmount.
 # All tests have to be run as root.
@@ -75,7 +75,7 @@ run-unmount-busy: mount
 
 run-readonly-busy run-readonly-dangling:
 	# Remounting a file system read-only that has dangling vnodes fails
-	# currently.  It is marked as clean but has unreferneced files.
+	# currently.  It is marked as clean but has unreferenced files.
 	@echo DISABLED
 
 # Create a 1 GB vnd partition and fill the ffs file system it with
diff --git a/regress/sys/net/pf_table/Makefile b/regress/sys/net/pf_table/Makefile
index 7b4de2862..d4c6d386c 100644
--- a/regress/sys/net/pf_table/Makefile
+++ b/regress/sys/net/pf_table/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.4 2023/08/10 16:44:04 sashan Exp $
+#	$OpenBSD: Makefile,v 1.5 2023/08/13 21:21:53 sashan Exp $
 
 REGRESS_TARGETS=	hit miss cleanup flags
 CLEANFILES=		stamp-*	\
@@ -13,7 +13,7 @@ CLEANFILES=		stamp-*	\
 
 
 stamp-setup:
-	${SUDO} pfctl -a regress/ttest -Fa
+	${SUDO} pfctl -q -a regress/ttest -Fa || exit 0
 	${SUDO} pfctl -qt __regress_tbl -T add -f ${.CURDIR}/table.in
 	date >$@
 
diff --git a/regress/usr.sbin/bgpd/config/bgpd.conf.14.ok b/regress/usr.sbin/bgpd/config/bgpd.conf.14.ok
index ca01bfcb0..32bbf3c60 100644
--- a/regress/usr.sbin/bgpd/config/bgpd.conf.14.ok
+++ b/regress/usr.sbin/bgpd/config/bgpd.conf.14.ok
@@ -12,7 +12,7 @@ aspa-set {
 	customer-as 1 provider-as { 2 3 4 5 6 }
 	customer-as 2 expires 1668181648 provider-as { 3 4 }
 	customer-as 3 provider-as { 5 }
-	customer-as 5 provider-as { 1 2 inet 7 inet6 }
+	customer-as 5 provider-as { 1 2 7 }
 	customer-as 17 provider-as { 12 }
 	customer-as 41 provider-as { 2 }
 	customer-as 42 expires 12345 provider-as { 3 4 }
diff --git a/regress/usr.sbin/bgpd/unittests/rde_aspa_test.c b/regress/usr.sbin/bgpd/unittests/rde_aspa_test.c
index 78578ec5b..a9d68849e 100644
--- a/regress/usr.sbin/bgpd/unittests/rde_aspa_test.c
+++ b/regress/usr.sbin/bgpd/unittests/rde_aspa_test.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde_aspa_test.c,v 1.4 2023/01/24 11:31:13 claudio Exp $ */
+/*	$OpenBSD: rde_aspa_test.c,v 1.5 2023/08/16 08:29:41 claudio Exp $ */
 
 /*
  * Copyright (c) 2022 Claudio Jeker <claudio@openbsd.org>
@@ -32,7 +32,6 @@ struct aspa_test_set {
 	uint32_t	customeras;
 	const uint32_t	*providers;
 	uint32_t	pascnt;
-	const uint32_t	*afimasks;
 };
 
 struct cp_test {
@@ -56,118 +55,115 @@ struct aspa_test {
 
 struct aspa_test_set testset[] = {
 	/* test vectors from  github.com/benmaddison/aspa-fuzz */
-	{ 1, (const uint32_t []){ 4, 5, 6 }, 3, NULL },
-	{ 2, (const uint32_t []){ 10, 11 }, 2, NULL },
-	{ 3, (const uint32_t []){ 1, 13, 14 }, 3, NULL },
-	{ 4, (const uint32_t []){ 16, 24 }, 2, NULL },
-	{ 5, (const uint32_t []){ 1, 17, 25 }, 3, NULL },
-	{ 8, (const uint32_t []){ 0 }, 1, NULL },
-	{ 9, (const uint32_t []){ 2 }, 1, NULL },
-	{ 10, (const uint32_t []){ 0 }, 1, NULL },
-	{ 11, (const uint32_t []){ 2 }, 1, NULL },
-	{ 12, (const uint32_t []){ 3 }, 1, NULL },
-	{ 13, (const uint32_t []){ 0 }, 1, NULL },
-	{ 14, (const uint32_t []){ 3, 25 }, 2, NULL },
-	{ 15, (const uint32_t []){ 4 }, 1, NULL },
-	{ 16, (const uint32_t []){ 4 }, 1, NULL },
-	{ 17, (const uint32_t []){ 5 }, 1, NULL },
-	{ 18, (const uint32_t []){ 6 }, 1, NULL },
-	{ 20, (const uint32_t []){ 19 }, 1, NULL },
-	{ 21, (const uint32_t []){ 0 }, 1, NULL },
-	{ 23, (const uint32_t []){ 22 }, 1, NULL },
-	{ 24, (const uint32_t []){ 0 }, 1, NULL },
-	{ 25, (const uint32_t []){ 0 }, 1, NULL },
-	{ 26, (const uint32_t []){ 5 }, 1, NULL },
-	{ 27, (const uint32_t []){ 14 }, 1, NULL },
+	{ 1, (const uint32_t []){ 4, 5, 6 }, 3 },
+	{ 2, (const uint32_t []){ 10, 11 }, 2 },
+	{ 3, (const uint32_t []){ 1, 13, 14 }, 3 },
+	{ 4, (const uint32_t []){ 16, 24 }, 2 },
+	{ 5, (const uint32_t []){ 1, 17, 25 }, 3 },
+	{ 8, (const uint32_t []){ 0 }, 1 },
+	{ 9, (const uint32_t []){ 2 }, 1 },
+	{ 10, (const uint32_t []){ 0 }, 1 },
+	{ 11, (const uint32_t []){ 2 }, 1 },
+	{ 12, (const uint32_t []){ 3 }, 1 },
+	{ 13, (const uint32_t []){ 0 }, 1 },
+	{ 14, (const uint32_t []){ 3, 25 }, 2 },
+	{ 15, (const uint32_t []){ 4 }, 1 },
+	{ 16, (const uint32_t []){ 4 }, 1 },
+	{ 17, (const uint32_t []){ 5 }, 1 },
+	{ 18, (const uint32_t []){ 6 }, 1 },
+	{ 20, (const uint32_t []){ 19 }, 1 },
+	{ 21, (const uint32_t []){ 0 }, 1 },
+	{ 23, (const uint32_t []){ 22 }, 1 },
+	{ 24, (const uint32_t []){ 0 }, 1 },
+	{ 25, (const uint32_t []){ 0 }, 1 },
+	{ 26, (const uint32_t []){ 5 }, 1 },
+	{ 27, (const uint32_t []){ 14 }, 1 },
 	/* tests to simulate slides-110-sidrops-sriram-aspa-alg-accuracy-01 */
-	{ 101, (const uint32_t []){ 102 }, 1, NULL },
-	{ 102, (const uint32_t []){ 103, 104, 105 }, 3, NULL },
-	{ 103, (const uint32_t []){ 111, 112, 203 }, 3, NULL },
+	{ 101, (const uint32_t []){ 102 }, 1 },
+	{ 102, (const uint32_t []){ 103, 104, 105 }, 3 },
+	{ 103, (const uint32_t []){ 111, 112, 203 }, 3 },
 	/* 104 no ASPA */
-	{ 105, (const uint32_t []){ 0 }, 1, NULL },
+	{ 105, (const uint32_t []){ 0 }, 1 },
 
 	/* 111 no ASPA */
-	{ 112, (const uint32_t []){ 0 }, 1, NULL },
-	{ 113, (const uint32_t []){ 104, 105, 204, 205 }, 4, NULL },
+	{ 112, (const uint32_t []){ 0 }, 1 },
+	{ 113, (const uint32_t []){ 104, 105, 204, 205 }, 4 },
 
-	{ 121, (const uint32_t []){ 131, 132, 133 }, 3, NULL },
-	{ 123, (const uint32_t []){ 0 }, 1, NULL },
-	{ 131, (const uint32_t []){ 121, 122, 123 }, 3, NULL },
-	{ 133, (const uint32_t []){ 0 }, 1, NULL },
+	{ 121, (const uint32_t []){ 131, 132, 133 }, 3 },
+	{ 123, (const uint32_t []){ 0 }, 1 },
+	{ 131, (const uint32_t []){ 121, 122, 123 }, 3 },
+	{ 133, (const uint32_t []){ 0 }, 1 },
 	
 
-	{ 201, (const uint32_t []){ 202 }, 1, NULL },
-	{ 202, (const uint32_t []){ 203, 204, 205 }, 3, NULL },
-	{ 203, (const uint32_t []){ 103, 111, 112 }, 3, NULL },
+	{ 201, (const uint32_t []){ 202 }, 1 },
+	{ 202, (const uint32_t []){ 203, 204, 205 }, 3 },
+	{ 203, (const uint32_t []){ 103, 111, 112 }, 3 },
 	/* 204 no ASPA */
-	{ 205, (const uint32_t []){ 0 }, 1, NULL },
+	{ 205, (const uint32_t []){ 0 }, 1 },
 
 	/* extra test for big table test */
 	{ 65000, (const uint32_t []){
 	    3, 5, 10, 15, 20, 21, 22, 23, 24, 25, 
 	    30, 35, 40, 45, 50, 51, 52, 53, 54, 55, 
-	    60, 65, 70, 75, 80, 81, 82, 83, 87, 90 }, 30, NULL },
-	/* extra test for AFI check */
-	{ 196618, (const uint32_t []){ 1, 2, 3, 4 }, 4,
-	    (const uint32_t []){ 0xf9 }},
+	    60, 65, 70, 75, 80, 81, 82, 83, 87, 90 }, 30 },
+	{ 196618, (const uint32_t []){ 1, 2, 3, 4 }, 4 },
 };
 
 struct cp_test cp_testset[] = {
-	{ 6, 1, CP(UNKNOWN, UNKNOWN) },
-	{ 42, 1, CP(UNKNOWN, UNKNOWN) },
+	{ 6, 1, UNKNOWN },
+	{ 42, 1, UNKNOWN },
 
-	{ 1, 2, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 1, 3, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 1, 7, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 5, 2, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 5, 16, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 5, 18, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 5, 24, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 5, 26, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 8, 2, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 9, 5, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 27, 13, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 27, 15, CP(NOT_PROVIDER, NOT_PROVIDER) },
+	{ 1, 2, NOT_PROVIDER },
+	{ 1, 3, NOT_PROVIDER },
+	{ 1, 7, NOT_PROVIDER },
+	{ 5, 2, NOT_PROVIDER },
+	{ 5, 16, NOT_PROVIDER },
+	{ 5, 18, NOT_PROVIDER },
+	{ 5, 24, NOT_PROVIDER },
+	{ 5, 26, NOT_PROVIDER },
+	{ 8, 2, NOT_PROVIDER },
+	{ 9, 5, NOT_PROVIDER },
+	{ 27, 13, NOT_PROVIDER },
+	{ 27, 15, NOT_PROVIDER },
 
-	{ 1, 4, CP(PROVIDER, PROVIDER) },
-	{ 1, 5, CP(PROVIDER, PROVIDER) },
-	{ 1, 6, CP(PROVIDER, PROVIDER) },
-	{ 2, 10, CP(PROVIDER, PROVIDER) },
-	{ 2, 11, CP(PROVIDER, PROVIDER) },
-	{ 9, 2, CP(PROVIDER, PROVIDER) },
-	{ 27, 14, CP(PROVIDER, PROVIDER) },
+	{ 1, 4, PROVIDER },
+	{ 1, 5, PROVIDER },
+	{ 1, 6, PROVIDER },
+	{ 2, 10, PROVIDER },
+	{ 2, 11, PROVIDER },
+	{ 9, 2, PROVIDER },
+	{ 27, 14, PROVIDER },
 
-	/* per AID tests */
-	{ 196618, 1, CP(PROVIDER, NOT_PROVIDER) },
-	{ 196618, 2, CP(NOT_PROVIDER, PROVIDER) },
-	{ 196618, 3, CP(PROVIDER, PROVIDER) },
-	{ 196618, 4, CP(PROVIDER, PROVIDER) },
-	{ 196618, 5, CP(NOT_PROVIDER, NOT_PROVIDER) },
+	{ 196618, 1, PROVIDER },
+	{ 196618, 2, PROVIDER },
+	{ 196618, 3, PROVIDER },
+	{ 196618, 4, PROVIDER },
+	{ 196618, 5, NOT_PROVIDER },
 
 	/* big provider set test */
-	{ 65000, 1, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 65000, 2, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 65000, 3, CP(PROVIDER, PROVIDER) },
-	{ 65000, 4, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 65000, 5, CP(PROVIDER, PROVIDER) },
-	{ 65000, 15, CP(PROVIDER, PROVIDER) },
-	{ 65000, 19, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 65000, 20, CP(PROVIDER, PROVIDER) },
-	{ 65000, 21, CP(PROVIDER, PROVIDER) },
-	{ 65000, 22, CP(PROVIDER, PROVIDER) },
-	{ 65000, 23, CP(PROVIDER, PROVIDER) },
-	{ 65000, 24, CP(PROVIDER, PROVIDER) },
-	{ 65000, 25, CP(PROVIDER, PROVIDER) },
-	{ 65000, 26, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 65000, 85, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 65000, 86, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 65000, 87, CP(PROVIDER, PROVIDER) },
-	{ 65000, 88, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 65000, 89, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 65000, 90, CP(PROVIDER, PROVIDER) },
-	{ 65000, 91, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 65000, 92, CP(NOT_PROVIDER, NOT_PROVIDER) },
-	{ 65000, 6666, CP(NOT_PROVIDER, NOT_PROVIDER) },
+	{ 65000, 1, NOT_PROVIDER },
+	{ 65000, 2, NOT_PROVIDER },
+	{ 65000, 3, PROVIDER },
+	{ 65000, 4, NOT_PROVIDER },
+	{ 65000, 5, PROVIDER },
+	{ 65000, 15, PROVIDER },
+	{ 65000, 19, NOT_PROVIDER },
+	{ 65000, 20, PROVIDER },
+	{ 65000, 21, PROVIDER },
+	{ 65000, 22, PROVIDER },
+	{ 65000, 23, PROVIDER },
+	{ 65000, 24, PROVIDER },
+	{ 65000, 25, PROVIDER },
+	{ 65000, 26, NOT_PROVIDER },
+	{ 65000, 85, NOT_PROVIDER },
+	{ 65000, 86, NOT_PROVIDER },
+	{ 65000, 87, PROVIDER },
+	{ 65000, 88, NOT_PROVIDER },
+	{ 65000, 89, NOT_PROVIDER },
+	{ 65000, 90, PROVIDER },
+	{ 65000, 91, NOT_PROVIDER },
+	{ 65000, 92, NOT_PROVIDER },
+	{ 65000, 6666, NOT_PROVIDER },
 };
 
 struct aspath_test	aspath_testset[] = {
@@ -379,19 +375,14 @@ load_test_set(struct aspa_test_set *testv, uint32_t numentries)
 	size_t data_size = 0;
 	uint32_t i;
 
-	for (i = 0; i < numentries; i++) {
+	for (i = 0; i < numentries; i++)
 		data_size += testv[i].pascnt * sizeof(uint32_t);
-		if (testv[i].afimasks)
-			data_size += (testv[i].pascnt * 2 + 31) / 8;
-	}
 
 	aspa = aspa_table_prep(numentries, data_size);
 
-	for (i = numentries; i > 0; i--) {
+	for (i = numentries; i > 0; i--)
 		aspa_add_set(aspa, testv[i - 1].customeras,
-		    testv[i - 1].providers, testv[i - 1].pascnt,
-		    testv[i - 1].afimasks);
-	}
+		    testv[i - 1].providers, testv[i - 1].pascnt);
 
 	return aspa;
 }
@@ -399,16 +390,10 @@ load_test_set(struct aspa_test_set *testv, uint32_t numentries)
 static uint8_t
 vstate_for_role(struct rde_aspa_state *vstate, enum role role)
 {
-	if (vstate->onlyup_v4 != vstate->onlyup_v6 ||
-	    vstate->downup_v4 != vstate->downup_v6) {
-		printf("failed: vstate differ per AID ");
-			return 0xff;
-	}
-
 	if (role != ROLE_CUSTOMER) {
-		return (vstate->onlyup_v4);
+		return (vstate->onlyup);
 	} else {
-		return (vstate->downup_v4);
+		return (vstate->downup);
 	}
 }
 
@@ -451,13 +436,13 @@ main(int argc, char **argv)
 
 	printf("testing aspa_check_aspath: ");
 	for (i = 0; i < num_aspath; i++) {
-		struct aspa_state st[2], revst;
+		struct aspa_state st, revst;
 		struct aspath *a;
 
-		memset(st, 0, sizeof(st));
+		memset(&st, 0, sizeof(st));
 		a = build_aspath(aspath_testset[i].aspath,
 		    aspath_testset[i].aspathcnt, 0);
-		if (aspa_check_aspath(aspa, a, st) == -1) {
+		if (aspa_check_aspath(aspa, a, &st) == -1) {
 			printf("failed: aspath_testset[%zu]: "
 			    "aspath %s got -1\n", i,
 			    print_aspath(aspath_testset[i].aspath,
@@ -465,30 +450,21 @@ main(int argc, char **argv)
 			aspath_failed = 1;
 		}
 
-		if (memcmp(&aspath_testset[i].state, st, sizeof(*st))) {
+		if (memcmp(&aspath_testset[i].state, &st, sizeof(st))) {
 			printf("failed: aspath_testset[%zu]: aspath %s "
 			    "bad state", i,
 			    print_aspath(aspath_testset[i].aspath,
 			    aspath_testset[i].aspathcnt));
-			print_state(&aspath_testset[i].state, st);
-			printf("\n");
-			aspath_failed = 1;
-		}
-		if (memcmp(&aspath_testset[i].state, st + 1, sizeof(*st))) {
-			printf("failed: aspath_testset[%zu]: aspath %s "
-			    "bad state AID_INET6", i,
-			    print_aspath(aspath_testset[i].aspath,
-			    aspath_testset[i].aspathcnt));
-			print_state(&aspath_testset[i].state, st + 1);
+			print_state(&aspath_testset[i].state, &st);
 			printf("\n");
 			aspath_failed = 1;
 		}
 		free(a);
 
-		memset(st, 0, sizeof(st));
+		memset(&st, 0, sizeof(st));
 		a = build_aspath(aspath_testset[i].aspath,
 		    aspath_testset[i].aspathcnt, 1);
-		if (aspa_check_aspath(aspa, a, st) == -1) {
+		if (aspa_check_aspath(aspa, a, &st) == -1) {
 			printf("failed: reverse aspath_testset[%zu]: "
 			    "aspath %s got -1\n", i,
 			    print_aspath(aspath_testset[i].aspath,
@@ -497,21 +473,12 @@ main(int argc, char **argv)
 		}
 
 		reverse_state(&aspath_testset[i].state, &revst);
-		if (memcmp(&revst, st, sizeof(*st))) {
+		if (memcmp(&revst, &st, sizeof(st))) {
 			printf("failed: reverse aspath_testset[%zu]: aspath %s "
 			    "bad state", i,
 			    print_aspath(aspath_testset[i].aspath,
 			    aspath_testset[i].aspathcnt));
-			print_state(&revst, st);
-			printf("\n");
-			aspath_failed = 1;
-		}
-		if (memcmp(&revst, st + 1, sizeof(*st))) {
-			printf("failed: reverse aspath_testset[%zu]: aspath %s "
-			    "bad state AID_INET6", i,
-			    print_aspath(aspath_testset[i].aspath,
-			    aspath_testset[i].aspathcnt));
-			print_state(&revst, st + 1);
+			print_state(&revst, &st);
 			printf("\n");
 			aspath_failed = 1;
 		}
diff --git a/regress/usr.sbin/btrace/Makefile b/regress/usr.sbin/btrace/Makefile
index 04c322f9e..29f90cef4 100644
--- a/regress/usr.sbin/btrace/Makefile
+++ b/regress/usr.sbin/btrace/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.26 2022/11/12 14:19:08 mpi Exp $
+# $OpenBSD: Makefile,v 1.27 2023/08/13 09:49:47 mpi Exp $
 
 BTRACE?=		 /usr/sbin/btrace
 ALLOWDT!=		sysctl -n kern.allowdt 2>/dev/null
@@ -14,7 +14,7 @@ BT_LANG_SCRIPTS=	arithm beginend boolean comments delete exit \
 BT_ARG_LANG_SCRIPTS=	staticv str
 
 # scripts that use kernel probes
-BT_KERN_SCRIPTS=	filters multiprobe
+BT_KERN_SCRIPTS=	filters mapoverwrite multiprobe
 
 REGRESS_EXPECTED_FAILURES=	run-maxoperand
 
diff --git a/regress/usr.sbin/btrace/mapoverwrite.bt b/regress/usr.sbin/btrace/mapoverwrite.bt
new file mode 100644
index 000000000..43fffc97c
--- /dev/null
+++ b/regress/usr.sbin/btrace/mapoverwrite.bt
@@ -0,0 +1,23 @@
+BEGIN
+{
+	@counter = 0;
+
+	@map[0] = 1;
+	@map[1] = 2;
+	@map[3] = 3;
+}
+
+/*
+ * Overwrite map periodically to ensure there's no double-free.
+ */
+interval:hz:1
+{
+	if (@counter >= 10)
+		exit();
+
+	@counter = @counter + 1;
+
+	@map[0] = 11;
+	@map[1] = 22;
+	@map[3] = 33;
+}
diff --git a/regress/usr.sbin/btrace/mapoverwrite.ok b/regress/usr.sbin/btrace/mapoverwrite.ok
new file mode 100644
index 000000000..e69de29bb
diff --git a/regress/usr.sbin/rpki-client/openssl11/unistd.h b/regress/usr.sbin/rpki-client/openssl11/unistd.h
index 6fd88bccd..b3f5c3adc 100644
--- a/regress/usr.sbin/rpki-client/openssl11/unistd.h
+++ b/regress/usr.sbin/rpki-client/openssl11/unistd.h
@@ -8,6 +8,9 @@
 
 #include <openssl/stack.h>
 
+#define CMS_get_version(cms, version) (*(version) = 3, 1)
+#define CMS_SignerInfo_get_version(si, version) (*(version) = 3, 1)
+
 #ifndef DECLARE_STACK_OF
 #define DECLARE_STACK_OF DEFINE_STACK_OF
 #endif
diff --git a/sbin/iked/iked.h b/sbin/iked/iked.h
index 2c7fbe14a..bdfac0ee7 100644
--- a/sbin/iked/iked.h
+++ b/sbin/iked/iked.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: iked.h,v 1.223 2023/07/28 11:23:03 claudio Exp $	*/
+/*	$OpenBSD: iked.h,v 1.224 2023/08/11 11:24:55 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -260,6 +260,7 @@ struct iked_policy {
 #define IKED_POLICY_SKIP		 0x10
 #define IKED_POLICY_IPCOMP		 0x20
 #define IKED_POLICY_TRANSPORT		 0x40
+#define IKED_POLICY_ROUTING		 0x80
 
 	int				 pol_refcnt;
 
diff --git a/sbin/iked/ikev2.c b/sbin/iked/ikev2.c
index bf6bf0fb0..e243432a7 100644
--- a/sbin/iked/ikev2.c
+++ b/sbin/iked/ikev2.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ikev2.c,v 1.377 2023/08/04 19:06:25 claudio Exp $	*/
+/*	$OpenBSD: ikev2.c,v 1.378 2023/08/11 11:24:55 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -6532,63 +6532,65 @@ ikev2_childsa_enable(struct iked *env, struct iked_sa *sa)
 	peer_changed = (memcmp(&sa->sa_peer_loaded, &sa->sa_peer,
 	    sizeof(sa->sa_peer_loaded)) != 0);
 
-	TAILQ_FOREACH(flow, &sa->sa_flows, flow_entry) {
-		/* re-load the flow if the peer for the flow has changed */
-		reload = 0;
-		if (flow->flow_loaded) {
-			if (!peer_changed) {
-				log_debug("%s: flow already loaded %p",
-				    __func__, flow);
-				continue;
+	if (!(sa->sa_policy->pol_flags & IKED_POLICY_ROUTING)) {
+		TAILQ_FOREACH(flow, &sa->sa_flows, flow_entry) {
+			/* re-load the flow if the peer for the flow has changed */
+			reload = 0;
+			if (flow->flow_loaded) {
+				if (!peer_changed) {
+					log_debug("%s: flow already loaded %p",
+					    __func__, flow);
+					continue;
+				}
+				RB_REMOVE(iked_flows, &env->sc_activeflows, flow);
+				(void)pfkey_flow_delete(env, flow);
+				flow->flow_loaded = 0; /* we did RB_REMOVE */
+				reload = 1;
 			}
-			RB_REMOVE(iked_flows, &env->sc_activeflows, flow);
-			(void)pfkey_flow_delete(env, flow);
-			flow->flow_loaded = 0; /* we did RB_REMOVE */
-			reload = 1;
-		}
 
-		if (pfkey_flow_add(env, flow) != 0) {
-			log_debug("%s: failed to load flow", __func__);
-			goto done;
-		}
+			if (pfkey_flow_add(env, flow) != 0) {
+				log_debug("%s: failed to load flow", __func__);
+				goto done;
+			}
 
-		if ((oflow = RB_FIND(iked_flows, &env->sc_activeflows, flow))
-		    != NULL) {
-			log_debug("%s: replaced old flow %p with %p",
-			    __func__, oflow, flow);
-			oflow->flow_loaded = 0;
-			RB_REMOVE(iked_flows, &env->sc_activeflows, oflow);
-		}
+			if ((oflow = RB_FIND(iked_flows, &env->sc_activeflows, flow))
+			    != NULL) {
+				log_debug("%s: replaced old flow %p with %p",
+				    __func__, oflow, flow);
+				oflow->flow_loaded = 0;
+				RB_REMOVE(iked_flows, &env->sc_activeflows, oflow);
+			}
 
-		RB_INSERT(iked_flows, &env->sc_activeflows, flow);
+			RB_INSERT(iked_flows, &env->sc_activeflows, flow);
 
-		log_debug("%s: %sloaded flow %p", __func__,
-		    reload ? "re" : "", flow);
+			log_debug("%s: %sloaded flow %p", __func__,
+			    reload ? "re" : "", flow);
 
-		/* append flow to log buffer */
-		if (flow->flow_dir == IPSP_DIRECTION_OUT &&
-		    flow->flow_prenat.addr_af != 0)
-			snprintf(prenat_mask, sizeof(prenat_mask), "%d",
-			    flow->flow_prenat.addr_mask);
-		else
-			prenat_mask[0] = '\0';
-		if (flow->flow_dir == IPSP_DIRECTION_OUT) {
-			if (ftello(flowf) > 0)
-				fputs(", ", flowf);
-			fprintf(flowf, "%s-%s/%d%s%s%s%s%s=%s/%d(%u)%s",
-			    print_map(flow->flow_saproto, ikev2_saproto_map),
-			    print_addr(&flow->flow_src.addr),
-			    flow->flow_src.addr_mask,
-			    flow->flow_prenat.addr_af != 0 ? "[": "",
-			    flow->flow_prenat.addr_af != 0 ?
-			    print_addr(&flow->flow_prenat.addr) : "",
-			    flow->flow_prenat.addr_af != 0 ? "/" : "",
-			    flow->flow_prenat.addr_af != 0 ? prenat_mask : "",
-			    flow->flow_prenat.addr_af != 0 ? "]": "",
-			    print_addr(&flow->flow_dst.addr),
-			    flow->flow_dst.addr_mask,
-			    flow->flow_ipproto,
-			    reload ? "-R" : "");
+			/* append flow to log buffer */
+			if (flow->flow_dir == IPSP_DIRECTION_OUT &&
+			    flow->flow_prenat.addr_af != 0)
+				snprintf(prenat_mask, sizeof(prenat_mask), "%d",
+				    flow->flow_prenat.addr_mask);
+			else
+				prenat_mask[0] = '\0';
+			if (flow->flow_dir == IPSP_DIRECTION_OUT) {
+				if (ftello(flowf) > 0)
+					fputs(", ", flowf);
+				fprintf(flowf, "%s-%s/%d%s%s%s%s%s=%s/%d(%u)%s",
+				    print_map(flow->flow_saproto, ikev2_saproto_map),
+				    print_addr(&flow->flow_src.addr),
+				    flow->flow_src.addr_mask,
+				    flow->flow_prenat.addr_af != 0 ? "[": "",
+				    flow->flow_prenat.addr_af != 0 ?
+				    print_addr(&flow->flow_prenat.addr) : "",
+				    flow->flow_prenat.addr_af != 0 ? "/" : "",
+				    flow->flow_prenat.addr_af != 0 ? prenat_mask : "",
+				    flow->flow_prenat.addr_af != 0 ? "]": "",
+				    print_addr(&flow->flow_dst.addr),
+				    flow->flow_dst.addr_mask,
+				    flow->flow_ipproto,
+				    reload ? "-R" : "");
+			}
 		}
 	}
 
diff --git a/sbin/iked/parse.y b/sbin/iked/parse.y
index 075981db3..5fadcd200 100644
--- a/sbin/iked/parse.y
+++ b/sbin/iked/parse.y
@@ -1,4 +1,4 @@
-/*	$OpenBSD: parse.y,v 1.143 2023/06/14 14:09:29 claudio Exp $	*/
+/*	$OpenBSD: parse.y,v 1.144 2023/08/11 11:24:55 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -2519,6 +2519,10 @@ create_ike(char *name, int af, struct ipsec_addr_wrap *ipproto,
 	}
 
 	if (iface != NULL) {
+		/* sec(4) */
+		if (strncmp("sec", iface, strlen("sec")) == 0)
+			pol.pol_flags |= IKED_POLICY_ROUTING;
+
 		pol.pol_iface = if_nametoindex(iface);
 		if (pol.pol_iface == 0) {
 			yyerror("invalid iface");
diff --git a/sbin/iked/pfkey.c b/sbin/iked/pfkey.c
index eaebe53a9..ac9e79c20 100644
--- a/sbin/iked/pfkey.c
+++ b/sbin/iked/pfkey.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfkey.c,v 1.82 2023/06/13 12:34:12 tb Exp $	*/
+/*	$OpenBSD: pfkey.c,v 1.84 2023/08/14 12:02:02 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
@@ -25,6 +25,7 @@
 
 #include <netinet/in.h>
 #include <netinet/ip_ipsp.h>
+#include <net/if.h>
 #include <net/pfkeyv2.h>
 
 #include <err.h>
@@ -40,7 +41,7 @@
 #include "ikev2.h"
 
 #define ROUNDUP(x) (((x) + (PFKEYV2_CHUNK - 1)) & ~(PFKEYV2_CHUNK - 1))
-#define IOV_CNT 27
+#define IOV_CNT 28
 
 #define PFKEYV2_CHUNK sizeof(uint64_t)
 #define PFKEY_REPLY_TIMEOUT 1000
@@ -453,6 +454,7 @@ pfkey_flow(struct iked *env, uint8_t satype, uint8_t action, struct iked_flow *f
 int
 pfkey_sa(struct iked *env, uint8_t satype, uint8_t action, struct iked_childsa *sa)
 {
+	char			 iface[IF_NAMESIZE];
 	struct sadb_msg		 smsg;
 	struct sadb_sa		 sadb;
 	struct sadb_address	 sa_src, sa_dst, sa_pxy;
@@ -460,6 +462,7 @@ pfkey_sa(struct iked *env, uint8_t satype, uint8_t action, struct iked_childsa *
 	struct sadb_lifetime	 sa_ltime_hard, sa_ltime_soft;
 	struct sadb_x_udpencap	 udpencap;
 	struct sadb_x_tag	 sa_tag;
+	struct sadb_x_iface	 sa_iface;
 	char			*tag = NULL;
 	struct sadb_x_tap	 sa_tap;
 	struct sadb_x_rdomain	 sa_rdomain;
@@ -469,6 +472,8 @@ pfkey_sa(struct iked *env, uint8_t satype, uint8_t action, struct iked_childsa *
 	struct iked_policy	*pol;
 	struct iked_addr	*dst;
 	struct iovec		 iov[IOV_CNT];
+	const char		*errstr = NULL;
+	uint32_t		 ifminor;
 	uint32_t		 jitter;
 	int			 iov_cnt;
 	int			 ret, dotap = 0;
@@ -549,6 +554,7 @@ pfkey_sa(struct iked *env, uint8_t satype, uint8_t action, struct iked_childsa *
 	bzero(&udpencap, sizeof udpencap);
 	bzero(&sa_ltime_hard, sizeof(sa_ltime_hard));
 	bzero(&sa_ltime_soft, sizeof(sa_ltime_soft));
+	bzero(&sa_iface, sizeof(sa_iface));
 
 	if (pol->pol_rdomain >= 0) {
 		bzero(&sa_rdomain, sizeof(sa_rdomain));
@@ -688,6 +694,24 @@ pfkey_sa(struct iked *env, uint8_t satype, uint8_t action, struct iked_childsa *
 		sa_tap.sadb_x_tap_unit = pol->pol_tap;
 	}
 
+	if (pol->pol_flags & IKED_POLICY_ROUTING) {
+		sa_iface.sadb_x_iface_exttype = SADB_X_EXT_IFACE;
+		sa_iface.sadb_x_iface_len = sizeof(sa_iface) / 8;
+		if (if_indextoname(pol->pol_iface, iface) == 0) {
+			log_warn("%s: unsupported interface %d",
+			    __func__, pol->pol_iface);
+			return (-1);
+		}
+		ifminor = strtonum(iface + strlen("sec"), 0, UINT_MAX, &errstr);
+		if (errstr != NULL) {
+			log_warnx("%s: unsupported interface %s",
+			    __func__, iface);
+			return (-1);
+		}
+		sa_iface.sadb_x_iface_unit = ifminor;
+		sa_iface.sadb_x_iface_direction = sa->csa_dir;
+	}
+
  send:
 
 #define PAD(len)					\
@@ -816,6 +840,13 @@ pfkey_sa(struct iked *env, uint8_t satype, uint8_t action, struct iked_childsa *
 		PAD(strlen(tag) + 1);
 	}
 
+	if (sa_iface.sadb_x_iface_len) {
+		iov[iov_cnt].iov_base = &sa_iface;
+		iov[iov_cnt].iov_len = sa_iface.sadb_x_iface_len * 8;
+		smsg.sadb_msg_len += sa_iface.sadb_x_iface_len;
+		iov_cnt++;
+	}
+
 	if (dotap != 0) {
 		/* enc(4) device tap unit */
 		iov[iov_cnt].iov_base = &sa_tap;
diff --git a/sbin/iked/policy.c b/sbin/iked/policy.c
index 0048b4a92..dc6b3e768 100644
--- a/sbin/iked/policy.c
+++ b/sbin/iked/policy.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: policy.c,v 1.95 2023/06/13 12:34:12 tb Exp $	*/
+/*	$OpenBSD: policy.c,v 1.96 2023/08/14 11:55:03 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2020-2021 Tobias Heider <tobhe@openbsd.org>
@@ -737,9 +737,13 @@ sa_configure_iface(struct iked *env, struct iked_sa *sa, int add)
 
 		switch(saflow->flow_src.addr_af) {
 		case AF_INET:
+			if (sa->sa_cp_addr == NULL)
+				continue;
 			caddr = (struct sockaddr *)&sa->sa_cp_addr->addr;
 			break;
 		case AF_INET6:
+			if (sa->sa_cp_addr6 == NULL)
+				continue;
 			caddr = (struct sockaddr *)&sa->sa_cp_addr6->addr;
 			break;
 		default:
diff --git a/share/man/man4/ifmedia.4 b/share/man/man4/ifmedia.4
index a231be841..5e80c42c0 100644
--- a/share/man/man4/ifmedia.4
+++ b/share/man/man4/ifmedia.4
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ifmedia.4,v 1.29 2022/03/31 17:27:20 naddy Exp $
+.\"	$OpenBSD: ifmedia.4,v 1.30 2023/08/15 00:43:00 jsg Exp $
 .\"	$NetBSD: ifmedia.4,v 1.14 2001/06/30 17:57:56 bjh21 Exp $
 .\"
 .\" Copyright (c) 1998 The NetBSD Foundation, Inc.
@@ -29,7 +29,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: March 31 2022 $
+.Dd $Mdocdate: August 15 2023 $
 .Dt IFMEDIA 4
 .Os
 .Sh NAME
@@ -456,7 +456,7 @@ HT OFDM MCS x (where x is in the range 0 - 31, inclusive).
 .El
 .Pp
 In practice, only MCS-0 to MCS-32 are supported by commonly available devices.
-The remaining MCS define combinations where distinct spacial streams employ
+The remaining MCS define combinations where distinct spatial streams employ
 distinct modulations, a feature which was not widely implemented by hardware
 vendors.
 .Pp
diff --git a/share/man/man4/uwacom.4 b/share/man/man4/uwacom.4
index b645d1943..59b0d8042 100644
--- a/share/man/man4/uwacom.4
+++ b/share/man/man4/uwacom.4
@@ -1,4 +1,4 @@
-.\" $OpenBSD: uwacom.4,v 1.4 2022/10/08 06:53:06 mglocker Exp $
+.\" $OpenBSD: uwacom.4,v 1.5 2023/08/12 20:49:29 miod Exp $
 .\"
 .\" Copyright (c) 2016 Frank Groeneveld <frank@frankgroeneveld.nl>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: October 8 2022 $
+.Dd $Mdocdate: August 12 2023 $
 .Dt UWACOM 4
 .Os
 .Sh NAME
@@ -42,6 +42,7 @@ driver supports the following Wacom tablets:
 .Bl -column "Intuos Draw" "Model Number" -offset 6n
 .It Em Name Ta Em Model Number
 .It Li Intuos Draw Ta CTL-490
+.It Li Intuos S Ta CTL-4100
 .It Li One S Ta CTL-472
 .It Li One M Ta CTL-672
 .El
@@ -61,5 +62,9 @@ The
 .Nm
 driver was written by
 .An Frank Groeneveld Aq Mt frank@frankgroeneveld.nl .
+Support for
+.Dq S
+models was written by
+.An Vladimir Meshcheriakov Aq Mt vladimir.meshcheriakov@epita.fr .
 .Sh CAVEATS
 Advanced features such as pen tip pressure are not supported.
diff --git a/share/man/man5/cargo-module.5 b/share/man/man5/cargo-module.5
index afe6c9c3f..3538714b0 100644
--- a/share/man/man5/cargo-module.5
+++ b/share/man/man5/cargo-module.5
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: cargo-module.5,v 1.4 2021/07/25 11:29:42 espie Exp $
+.\"	$OpenBSD: cargo-module.5,v 1.5 2023/08/17 05:43:09 tb Exp $
 .\"
 .\" Copyright (c) 2008 Marc Espie
 .\" Copyright (c) 2017 Daniel Jakots
@@ -25,7 +25,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: July 25 2021 $
+.Dd $Mdocdate: August 17 2023 $
 .Dt CARGO-MODULE 5
 .Os
 .Sh NAME
@@ -85,7 +85,7 @@ By default
 is used to download the crates.
 .Pp
 This module defines:
-.Bl -tag -width MODCARGO_CRATES_UPDATE
+.Bl -tag -width MODCARGO_INSTALL_TARGET_PATH
 .It MODCARGO_CARGOTOML
 Path to cargo manifest.
 Defaults to
@@ -96,6 +96,12 @@ Crates that will be downloaded by the module.
 List of crates to update, overriding the version listed in Cargo.lock.
 .It MODCARGO_FEATURES
 List of features to be used when building.
+.It MODCARGO_INSTALL_TARGET_PATH
+Path to pass to
+.Cm cargo install
+instead of
+.Pa \&. .
+Needs to be set for some virtual manifests.
 .It MODCARGO_VENDOR_DIR
 Name of the local directory for vendoring crates.
 Defaults to
diff --git a/sys/arch/amd64/amd64/identcpu.c b/sys/arch/amd64/amd64/identcpu.c
index 557e40586..ecbdc0afe 100644
--- a/sys/arch/amd64/amd64/identcpu.c
+++ b/sys/arch/amd64/amd64/identcpu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: identcpu.c,v 1.136 2023/08/09 00:01:44 jsg Exp $	*/
+/*	$OpenBSD: identcpu.c,v 1.137 2023/08/16 04:07:37 jsg Exp $	*/
 /*	$NetBSD: identcpu.c,v 1.1 2003/04/26 18:39:28 fvdl Exp $	*/
 
 /*
@@ -271,6 +271,8 @@ const struct {
 	{ ARCH_CAP_XAPIC_DISABLE_STATUS, "XAPIC_DIS" },
 	{ ARCH_CAP_OVERCLOCKING_STATUS,	"OVERCLOCK" },
 	{ ARCH_CAP_PBRSB_NO,		"PBRSB_NO" },
+	{ ARCH_CAP_GDS_CTRL,		"GDS_CTRL" },
+	{ ARCH_CAP_GDS_NO,		"GDS_NO" },
 };
 
 int
diff --git a/sys/arch/amd64/amd64/vmm_machdep.c b/sys/arch/amd64/amd64/vmm_machdep.c
index 24a376a8f..352126d81 100644
--- a/sys/arch/amd64/amd64/vmm_machdep.c
+++ b/sys/arch/amd64/amd64/vmm_machdep.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: vmm_machdep.c,v 1.4 2023/07/10 03:32:10 guenther Exp $ */
+/* $OpenBSD: vmm_machdep.c,v 1.5 2023/08/15 08:27:29 miod Exp $ */
 /*
  * Copyright (c) 2014 Mike Larkin <mlarkin@openbsd.org>
  *
@@ -6447,7 +6447,7 @@ vcpu_run_svm(struct vcpu *vcpu, struct vm_run_params *vrp)
 		/* Handle vmd(8) injected interrupts */
 		/* Is there an interrupt pending injection? */
 		if (irq != 0xFFFF && vcpu->vc_irqready) {
-			vmcb->v_eventinj = (irq & 0xFF) | (1 << 31);
+			vmcb->v_eventinj = (irq & 0xFF) | (1U << 31);
 			irq = 0xFFFF;
 		}
 
@@ -6467,7 +6467,7 @@ vcpu_run_svm(struct vcpu *vcpu, struct vm_run_params *vrp)
 				case VMM_EX_AC:
 					vmcb->v_eventinj |= (1ULL << 11);
 			}
-			vmcb->v_eventinj |= (vcpu->vc_event) | (1 << 31);
+			vmcb->v_eventinj |= (vcpu->vc_event) | (1U << 31);
 			vmcb->v_eventinj |= (3ULL << 8); /* Exception */
 			vcpu->vc_event = 0;
 		}
diff --git a/sys/arch/amd64/include/specialreg.h b/sys/arch/amd64/include/specialreg.h
index 86ca64ea1..2d7c0307e 100644
--- a/sys/arch/amd64/include/specialreg.h
+++ b/sys/arch/amd64/include/specialreg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: specialreg.h,v 1.107 2023/07/27 16:33:56 guenther Exp $	*/
+/*	$OpenBSD: specialreg.h,v 1.108 2023/08/16 04:07:37 jsg Exp $	*/
 /*	$NetBSD: specialreg.h,v 1.1 2003/04/26 18:39:48 fvdl Exp $	*/
 /*	$NetBSD: x86/specialreg.h,v 1.2 2003/04/25 21:54:30 fvdl Exp $	*/
 
@@ -425,6 +425,8 @@
 #define ARCH_CAP_XAPIC_DISABLE_STATUS	(1 << 21) /* can disable xAPIC */
 #define ARCH_CAP_OVERCLOCKING_STATUS	(1 << 23) /* has OVRCLCKNG_STAT MSR */
 #define ARCH_CAP_PBRSB_NO		(1 << 24) /* PBSR safe */
+#define ARCH_CAP_GDS_CTRL		(1 << 25) /* has GDS_MITG_DIS/LOCK */
+#define ARCH_CAP_GDS_NO			(1 << 26) /* GDS safe */
 #define MSR_FLUSH_CMD		0x10b
 #define FLUSH_CMD_L1D_FLUSH	0x1	/* (1ULL << 0) */
 #define	MSR_BBL_CR_ADDR		0x116	/* PII+ only */
diff --git a/sys/arch/arm64/arm64/copy.S b/sys/arch/arm64/arm64/copy.S
index 1a4ed25b0..bc7a3c71c 100644
--- a/sys/arch/arm64/arm64/copy.S
+++ b/sys/arch/arm64/arm64/copy.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: copy.S,v 1.9 2020/10/09 17:36:47 kettenis Exp $ */
+/* $OpenBSD: copy.S,v 1.10 2023/08/12 06:28:13 miod Exp $ */
 /*
  * Copyright (c) 2015 Dale Rahn <drahn@dalerahn.com>
  * Copyright (c) 2014 Patrick Wildt <patrick@blueri.se>
@@ -161,7 +161,7 @@ ENTRY(copyout)
 	cbnz	x2, 3b
 
 .Lcopyout0:
-	str	x4, [x3, #(PCB_ONFAULT)]	// clear handler
+	str	x4, [x3, #(PCB_ONFAULT)]	// restore handler
 	mov	x0, xzr
 	RETGUARD_CHECK(copy, x15)
 	ret
@@ -215,7 +215,7 @@ ENTRY(kcopy)
 	cbnz	x2, 3b
 
 .Lkcopy0:
-	str	x4, [x3, #(PCB_ONFAULT)]	// clear handler
+	str	x4, [x3, #(PCB_ONFAULT)]	// restore handler
 	mov	x0, xzr
 	RETGUARD_CHECK(copy, x15)
 	ret
diff --git a/sys/arch/i386/conf/RAMDISK b/sys/arch/i386/conf/RAMDISK
index 9775b6a0c..258baa48f 100644
--- a/sys/arch/i386/conf/RAMDISK
+++ b/sys/arch/i386/conf/RAMDISK
@@ -1,4 +1,4 @@
-#	$OpenBSD: RAMDISK,v 1.202 2023/07/20 02:26:24 yasuoka Exp $
+#	$OpenBSD: RAMDISK,v 1.203 2023/08/15 14:24:53 jsg Exp $
 
 machine		i386
 maxusers	4
@@ -15,7 +15,6 @@ option		SCSITERSE
 
 option		FFS
 option		FFS2
-option		MSDOSFS
 
 option		WS_KERNEL_FG=WSCOL_LIGHT_GREEN
 option		WS_KERNEL_BG=WSCOL_BLACK
diff --git a/sys/arch/i386/i386/machdep.c b/sys/arch/i386/i386/machdep.c
index fe922d372..9ade46b53 100644
--- a/sys/arch/i386/i386/machdep.c
+++ b/sys/arch/i386/i386/machdep.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: machdep.c,v 1.666 2023/08/09 00:01:44 jsg Exp $	*/
+/*	$OpenBSD: machdep.c,v 1.668 2023/08/16 09:51:39 jsg Exp $	*/
 /*	$NetBSD: machdep.c,v 1.214 1996/11/10 03:16:17 thorpej Exp $	*/
 
 /*-
@@ -1863,9 +1863,11 @@ identifycpu(struct cpu_info *ci)
 		uint64_t level = 0;
 		uint32_t dummy;
 
-		if (strcmp(cpu_vendor, "AuthenticAMD") == 0) {
+		if (strcmp(cpu_vendor, "AuthenticAMD") == 0 &&
+		    ci->ci_family >= 0x0f) {
 			level = rdmsr(MSR_PATCH_LEVEL);
-		} else if (strcmp(cpu_vendor, "GenuineIntel") == 0) {
+		} else if (strcmp(cpu_vendor, "GenuineIntel") == 0 &&
+		    ci->ci_family >= 6) {
 			wrmsr(MSR_BIOS_SIGN, 0);
 			CPUID(1, dummy, dummy, dummy, dummy);
 			level = rdmsr(MSR_BIOS_SIGN) >> 32;
diff --git a/sys/arch/i386/include/specialreg.h b/sys/arch/i386/include/specialreg.h
index d97942479..3cc4f6d58 100644
--- a/sys/arch/i386/include/specialreg.h
+++ b/sys/arch/i386/include/specialreg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: specialreg.h,v 1.84 2023/07/28 03:06:46 jsg Exp $	*/
+/*	$OpenBSD: specialreg.h,v 1.85 2023/08/16 04:07:38 jsg Exp $	*/
 /*	$NetBSD: specialreg.h,v 1.7 1994/10/27 04:16:26 cgd Exp $	*/
 
 /*-
@@ -370,6 +370,8 @@
 #define ARCH_CAP_XAPIC_DISABLE_STATUS	(1 << 21) /* can disable xAPIC */
 #define ARCH_CAP_OVERCLOCKING_STATUS	(1 << 23) /* has OVRCLCKNG_STAT MSR */
 #define ARCH_CAP_PBRSB_NO		(1 << 24) /* PBSR safe */
+#define ARCH_CAP_GDS_CTRL		(1 << 25) /* has GDS_MITG_DIS/LOCK */
+#define ARCH_CAP_GDS_NO			(1 << 26) /* GDS safe */
 #define MSR_FLUSH_CMD		0x10b
 #define FLUSH_CMD_L1D_FLUSH	(1ULL << 0)
 #define	MSR_BBL_CR_ADDR		0x116	/* PII+ only */
diff --git a/sys/dev/acpi/tpm.c b/sys/dev/acpi/tpm.c
index 518b087e7..a00368c38 100644
--- a/sys/dev/acpi/tpm.c
+++ b/sys/dev/acpi/tpm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tpm.c,v 1.17 2022/04/06 18:59:27 naddy Exp $ */
+/* $OpenBSD: tpm.c,v 1.18 2023/08/15 08:27:29 miod Exp $ */
 
 /*
  * Minimal interface to Trusted Platform Module chips implementing the
@@ -150,7 +150,7 @@
 #define TPM_CRB_CTRL_CANCEL_CLEAR	0x0
 
 #define TPM_CRB_CTRL_START_CMD		(1 << 0)
-#define TPM_CRB_INT_ENABLED_BIT		(1 << 31)
+#define TPM_CRB_INT_ENABLED_BIT		(1U << 31)
 
 #define TPM2_RC_SUCCESS			0x0000
 #define TPM2_RC_INITIALIZE		0x0100
diff --git a/sys/dev/dt/dt_prov_static.c b/sys/dev/dt/dt_prov_static.c
index dc2398175..0d6783280 100644
--- a/sys/dev/dt/dt_prov_static.c
+++ b/sys/dev/dt/dt_prov_static.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dt_prov_static.c,v 1.20 2023/07/06 19:46:53 kn Exp $ */
+/*	$OpenBSD: dt_prov_static.c,v 1.21 2023/08/14 08:33:24 mpi Exp $ */
 
 /*
  * Copyright (c) 2019 Martin Pieuchot <mpi@openbsd.org>
@@ -39,11 +39,14 @@ struct dt_provider dt_prov_static = {
  */
 DT_STATIC_PROBE2(sched, dequeue, "pid_t", "pid_t");
 DT_STATIC_PROBE2(sched, enqueue, "pid_t", "pid_t");
+DT_STATIC_PROBE3(sched, fork, "pid_t", "pid_t", "int");
 DT_STATIC_PROBE2(sched, off__cpu, "pid_t", "pid_t");
 DT_STATIC_PROBE0(sched, on__cpu);
 DT_STATIC_PROBE0(sched, remain__cpu);
 DT_STATIC_PROBE0(sched, sleep);
-DT_STATIC_PROBE0(sched, wakeup);
+DT_STATIC_PROBE3(sched, steal, "pid_t", "pid_t", "int");
+DT_STATIC_PROBE2(sched, unsleep, "pid_t", "pid_t");
+DT_STATIC_PROBE3(sched, wakeup, "pid_t", "pid_t", "int");
 
 /*
  * Raw syscalls
@@ -106,10 +109,13 @@ struct dt_probe *const dtps_static[] = {
 	/* Scheduler */
 	&_DT_STATIC_P(sched, dequeue),
 	&_DT_STATIC_P(sched, enqueue),
+	&_DT_STATIC_P(sched, fork),
 	&_DT_STATIC_P(sched, off__cpu),
 	&_DT_STATIC_P(sched, on__cpu),
 	&_DT_STATIC_P(sched, remain__cpu),
 	&_DT_STATIC_P(sched, sleep),
+	&_DT_STATIC_P(sched, steal),
+	&_DT_STATIC_P(sched, unsleep),
 	&_DT_STATIC_P(sched, wakeup),
 	/* Raw syscalls */
 	&_DT_STATIC_P(raw_syscalls, sys_enter),
diff --git a/sys/dev/fdt/amlclock.c b/sys/dev/fdt/amlclock.c
index e3807ecfe..ab8f6a53c 100644
--- a/sys/dev/fdt/amlclock.c
+++ b/sys/dev/fdt/amlclock.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: amlclock.c,v 1.14 2022/06/28 23:43:12 naddy Exp $	*/
+/*	$OpenBSD: amlclock.c,v 1.15 2023/08/15 08:27:29 miod Exp $	*/
 /*
  * Copyright (c) 2019 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -89,7 +89,7 @@
 #define HHI_NAND_CLK_CNTL	0x97
 #define HHI_SD_EMMC_CLK_CNTL	0x99
 #define HHI_SYS_PLL_CNTL0	0xbd
-#define  HHI_SYS_DPLL_LOCK	(1 << 31)
+#define  HHI_SYS_DPLL_LOCK	(1U << 31)
 #define  HHI_SYS_DPLL_RESET	(1 << 29)
 #define  HHI_SYS_DPLL_EN	(1 << 28)
 #define  HHI_SYS_DPLL_OD(x)	(((x) >> 16) & 0x7)
diff --git a/sys/dev/fdt/com_fdt.c b/sys/dev/fdt/com_fdt.c
index 473658a39..0b0c80fad 100644
--- a/sys/dev/fdt/com_fdt.c
+++ b/sys/dev/fdt/com_fdt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: com_fdt.c,v 1.7 2022/01/11 11:51:14 uaa Exp $ */
+/* $OpenBSD: com_fdt.c,v 1.8 2023/08/15 07:56:27 miod Exp $ */
 /*
  * Copyright (c) 2016 Patrick Wildt <patrick@blueri.se>
  *
@@ -130,7 +130,7 @@ com_fdt_attach(struct device *parent, struct device *self, void *aux)
 	sc->sc_uarttype = COM_UART_16550;
 	sc->sc_frequency = freq ? freq : COM_FREQ;
 
-	if (OF_is_compatible(stdout_node, "ns16550a")) {
+	if (OF_is_compatible(faa->fa_node, "ns16550a")) {
 		width = 1;
 		shift = 0;
 	} else {
diff --git a/sys/dev/fdt/if_cad.c b/sys/dev/fdt/if_cad.c
index dfc2735a6..7e20c9f3e 100644
--- a/sys/dev/fdt/if_cad.c
+++ b/sys/dev/fdt/if_cad.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_cad.c,v 1.12 2022/08/14 21:10:08 jca Exp $	*/
+/*	$OpenBSD: if_cad.c,v 1.13 2023/08/15 08:27:30 miod Exp $	*/
 
 /*
  * Copyright (c) 2021-2022 Visa Hankala
@@ -220,7 +220,7 @@ struct cad_desc64 {
 #define GEM_RXD_ADDR_WRAP	(1 << 1)
 #define GEM_RXD_ADDR_USED	(1 << 0)
 
-#define GEM_RXD_BCAST		(1 << 31)
+#define GEM_RXD_BCAST		(1U << 31)
 #define GEM_RXD_MCAST		(1 << 30)
 #define GEM_RXD_UCAST		(1 << 29)
 #define GEM_RXD_SPEC		(1 << 27)
@@ -237,7 +237,7 @@ struct cad_desc64 {
 #define GEM_RXD_BADFCS		(1 << 13)
 #define GEM_RXD_LEN_MASK	0x1fff
 
-#define GEM_TXD_USED		(1 << 31)
+#define GEM_TXD_USED		(1U << 31)
 #define GEM_TXD_WRAP		(1 << 30)
 #define GEM_TXD_RLIMIT		(1 << 29)
 #define GEM_TXD_CORRUPT		(1 << 27)
diff --git a/sys/dev/fdt/if_dwge.c b/sys/dev/fdt/if_dwge.c
index 528a4516f..377c3ce91 100644
--- a/sys/dev/fdt/if_dwge.c
+++ b/sys/dev/fdt/if_dwge.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_dwge.c,v 1.18 2023/07/06 08:32:37 jmatthew Exp $	*/
+/*	$OpenBSD: if_dwge.c,v 1.19 2023/08/15 08:27:30 miod Exp $	*/
 /*
  * Copyright (c) 2008, 2019 Mark Kettenis <kettenis@openbsd.org>
  * Copyright (c) 2017 Patrick Wildt <patrick@blueri.se>
@@ -194,7 +194,7 @@ struct dwge_desc {
 #define TDES0_PCE		(1 << 12)
 #define TDES0_JT		(1 << 14)
 #define TDES0_IHE		(1 << 16)
-#define TDES0_OWN		(1 << 31)
+#define TDES0_OWN		(1U << 31)
 
 #define ETDES0_TCH		(1 << 20)
 #define ETDES0_FS		(1 << 28)
@@ -217,7 +217,7 @@ struct dwge_desc {
 #define RDES0_FL_MASK		0x3fff
 #define RDES0_FL_SHIFT		16
 #define RDES0_AFM		(1 << 30)
-#define RDES0_OWN		(1 << 31)
+#define RDES0_OWN		(1U << 31)
 
 /* Tx size bits */
 #define TDES1_TBS1		(0xfff << 0)
@@ -229,12 +229,12 @@ struct dwge_desc {
 #define TDES1_CIC_FULL		(3 << 27)
 #define TDES1_FS		(1 << 29)
 #define TDES1_LS		(1 << 30)
-#define TDES1_IC		(1 << 31)
+#define TDES1_IC		(1U << 31)
 
 /* Rx size bits */
 #define RDES1_RBS1		(0xfff << 0)
 #define RDES1_RCH		(1 << 24)
-#define RDES1_DIC		(1 << 31)
+#define RDES1_DIC		(1U << 31)
 
 #define ERDES1_RCH		(1 << 14)
 
diff --git a/sys/dev/fdt/if_dwxe.c b/sys/dev/fdt/if_dwxe.c
index 430459d79..6f3e1af05 100644
--- a/sys/dev/fdt/if_dwxe.c
+++ b/sys/dev/fdt/if_dwxe.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_dwxe.c,v 1.21 2022/07/09 20:51:39 kettenis Exp $	*/
+/*	$OpenBSD: if_dwxe.c,v 1.22 2023/08/15 08:27:30 miod Exp $	*/
 /*
  * Copyright (c) 2008 Mark Kettenis
  * Copyright (c) 2017 Patrick Wildt <patrick@blueri.se>
@@ -184,7 +184,7 @@ struct dwxe_desc {
 #define DWXE_TX_PAYLOAD_ERR		(1 << 12)
 #define DWXE_TX_LENGTH_ERR		(1 << 14)
 #define DWXE_TX_HEADER_ERR		(1 << 16)
-#define DWXE_TX_DESC_CTL		(1 << 31)
+#define DWXE_TX_DESC_CTL		(1U << 31)
 
 /* Rx status bits */
 #define DWXE_RX_PAYLOAD_ERR		(1 << 0)
@@ -202,7 +202,7 @@ struct dwxe_desc {
 #define DWXE_RX_FRM_LEN_MASK		0x3fff
 #define DWXE_RX_FRM_LEN_SHIFT		16
 #define DWXE_RX_DAF_FAIL		(1 << 30)
-#define DWXE_RX_DESC_CTL		(1 << 31)
+#define DWXE_RX_DESC_CTL		(1U << 31)
 
 /* Tx size bits */
 #define DWXE_TX_BUF_SIZE		(0xfff << 0)
@@ -213,11 +213,11 @@ struct dwxe_desc {
 #define DWXE_TX_CHECKSUM_CTL_FULL	(3 << 27)
 #define DWXE_TX_FIR_DESC		(1 << 29)
 #define DWXE_TX_LAST_DESC		(1 << 30)
-#define DWXE_TX_INT_CTL		(1 << 31)
+#define DWXE_TX_INT_CTL		(1U << 31)
 
 /* Rx size bits */
 #define DWXE_RX_BUF_SIZE		(0xfff << 0)
-#define DWXE_RX_INT_CTL		(1 << 31)
+#define DWXE_RX_INT_CTL		(1U << 31)
 
 /* EMAC syscon bits */
 #define SYSCON_EMAC			0x30
diff --git a/sys/dev/fdt/imxiomuxc.c b/sys/dev/fdt/imxiomuxc.c
index e4c19fe34..dee363e1d 100644
--- a/sys/dev/fdt/imxiomuxc.c
+++ b/sys/dev/fdt/imxiomuxc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: imxiomuxc.c,v 1.7 2021/10/24 17:52:26 mpi Exp $ */
+/* $OpenBSD: imxiomuxc.c,v 1.8 2023/08/15 08:27:30 miod Exp $ */
 /*
  * Copyright (c) 2013 Patrick Wildt <patrick@blueri.se>
  * Copyright (c) 2016 Mark Kettenis <kettenis@openbsd.org>
@@ -35,7 +35,7 @@
 
 #define IOMUX_CONFIG_SION		(1 << 4)
 
-#define IMX_PINCTRL_NO_PAD_CTL		(1 << 31)
+#define IMX_PINCTRL_NO_PAD_CTL		(1U << 31)
 #define IMX_PINCTRL_SION		(1 << 30)
 
 struct imxiomuxc_softc {
diff --git a/sys/dev/fdt/mvpinctrl.c b/sys/dev/fdt/mvpinctrl.c
index f5805ce26..c5d239f11 100644
--- a/sys/dev/fdt/mvpinctrl.c
+++ b/sys/dev/fdt/mvpinctrl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mvpinctrl.c,v 1.11 2022/06/28 23:43:12 naddy Exp $ */
+/* $OpenBSD: mvpinctrl.c,v 1.12 2023/08/15 08:27:30 miod Exp $ */
 /*
  * Copyright (c) 2013,2016 Patrick Wildt <patrick@blueri.se>
  * Copyright (c) 2016 Mark Kettenis <kettenis@openbsd.org>
@@ -332,7 +332,7 @@ mvpinctrl_set_pin(void *cookie, uint32_t *cells, int val)
 /* Armada 3700 XTAL block */
 
 #define XTAL			0xc
-#define  XTAL_MODE			(1 << 31)
+#define  XTAL_MODE			(1U << 31)
 
 uint32_t
 a3700_xtal_get_frequency(void *cookie, uint32_t *cells)
diff --git a/sys/dev/fdt/sxiccmu.c b/sys/dev/fdt/sxiccmu.c
index 917eebc9b..fd06636a7 100644
--- a/sys/dev/fdt/sxiccmu.c
+++ b/sys/dev/fdt/sxiccmu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sxiccmu.c,v 1.31 2022/06/28 23:43:12 naddy Exp $	*/
+/*	$OpenBSD: sxiccmu.c,v 1.32 2023/08/15 08:27:30 miod Exp $	*/
 /*
  * Copyright (c) 2007,2009 Dale Rahn <drahn@openbsd.org>
  * Copyright (c) 2013 Artturi Alm
@@ -1158,7 +1158,7 @@ sxiccmu_a80_get_frequency(struct sxiccmu_softc *sc, uint32_t idx)
 
 /* Allwinner H3/H5 */
 #define H3_PLL_CPUX_CTRL_REG		0x0000
-#define H3_PLL_CPUX_ENABLE		(1 << 31)
+#define H3_PLL_CPUX_ENABLE		(1U << 31)
 #define H3_PLL_CPUX_LOCK		(1 << 28)
 #define H3_PLL_CPUX_OUT_EXT_DIVP(x)	(((x) >> 16) & 0x3)
 #define H3_PLL_CPUX_OUT_EXT_DIVP_MASK	(0x3 << 16)
diff --git a/sys/dev/hid/hid.c b/sys/dev/hid/hid.c
index 40ec12468..9b27634a0 100644
--- a/sys/dev/hid/hid.c
+++ b/sys/dev/hid/hid.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hid.c,v 1.5 2022/05/20 05:03:45 anton Exp $ */
+/*	$OpenBSD: hid.c,v 1.6 2023/08/12 20:47:06 miod Exp $ */
 /*	$NetBSD: hid.c,v 1.23 2002/07/11 21:14:25 augustss Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/hid.c,v 1.11 1999/11/17 22:33:39 n_hibma Exp $ */
 
@@ -657,3 +657,52 @@ hid_is_collection(const void *desc, int size, uint8_t id, int32_t usage)
 	hid_end_parse(hd);
 	return (0);
 }
+
+struct hid_data *
+hid_get_collection_data(const void *desc, int size, int32_t usage,
+    uint32_t collection)
+{
+	struct hid_data *hd;
+	struct hid_item hi;
+
+	hd = hid_start_parse(desc, size, hid_all);
+
+	DPRINTF("%s: usage=0x%x\n", __func__, usage);
+	while (hid_get_item(hd, &hi)) {
+		DPRINTF("%s: kind=%d id=%d usage=0x%x(0x%x)\n", __func__,
+		    hi.kind, hi.report_ID, hi.usage, usage);
+		if (hi.kind == hid_collection &&
+		    hi.collection == collection && hi.usage == usage) {
+			DPRINTF("%s: found\n", __func__);
+			return hd;
+		}
+	}
+	DPRINTF("%s: not found\n", __func__);
+	hid_end_parse(hd);
+	return NULL;
+}
+
+int
+hid_get_id_of_collection(const void *desc, int size, int32_t usage,
+    uint32_t collection)
+{
+	struct hid_data *hd;
+	struct hid_item hi;
+
+	hd = hid_start_parse(desc, size, hid_all);
+
+	DPRINTF("%s: id=%d usage=0x%x\n", __func__, id, usage);
+	while (hid_get_item(hd, &hi)) {
+		DPRINTF("%s: kind=%d id=%d usage=0x%x(0x%x)\n", __func__,
+		    hi.kind, hi.report_ID, hi.usage, usage);
+		if (hi.kind == hid_collection &&
+		    hi.collection == collection && hi.usage == usage) {
+			DPRINTF("%s: found\n", __func__);
+			hid_end_parse(hd);
+			return hi.report_ID;
+		}
+	}
+	DPRINTF("%s: not found\n", __func__);
+	hid_end_parse(hd);
+	return -1;
+}
diff --git a/sys/dev/hid/hid.h b/sys/dev/hid/hid.h
index 7400e920b..3c5cc2ada 100644
--- a/sys/dev/hid/hid.h
+++ b/sys/dev/hid/hid.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hid.h,v 1.10 2022/05/20 05:03:45 anton Exp $ */
+/*	$OpenBSD: hid.h,v 1.11 2023/08/12 20:47:06 miod Exp $ */
 /*	$NetBSD: hid.h,v 1.8 2002/07/11 21:14:25 augustss Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/hid.h,v 1.7 1999/11/17 22:33:40 n_hibma Exp $ */
 
@@ -93,6 +93,8 @@ int	hid_locate(const void *, int, int32_t, uint8_t, enum hid_kind,
 int32_t	hid_get_data(const uint8_t *buf, int, struct hid_location *);
 uint32_t hid_get_udata(const uint8_t *buf, int, struct hid_location *);
 int	hid_is_collection(const void *, int, uint8_t, int32_t);
+struct hid_data *hid_get_collection_data(const void *, int, int32_t, uint32_t);
+int	hid_get_id_of_collection(const void *, int, int32_t, uint32_t);
 
 #endif /* _KERNEL */
 
@@ -353,6 +355,7 @@ int	hid_is_collection(const void *, int, uint8_t, int32_t);
 #define HUD_TOUCHSCREEN		0x0004
 #define HUD_TOUCHPAD		0x0005
 #define HUD_CONFIG		0x000e
+#define HUD_STYLUS		0x0020
 #define HUD_FINGER		0x0022
 #define HUD_TIP_PRESSURE	0x0030
 #define HUD_BARREL_PRESSURE	0x0031
@@ -387,6 +390,12 @@ int	hid_is_collection(const void *, int, uint8_t, int32_t);
 #define HUD_CONTACT_MAX		0x0055
 #define HUD_SCAN_TIME		0x0056
 #define HUD_BUTTON_TYPE		0x0059
+#define HUD_SECONDARY_BARREL_SWITCH	0x005A
+#define HUD_WACOM_X		0x0130
+#define HUD_WACOM_Y		0x0131
+#define HUD_WACOM_DISTANCE		0x0132
+#define HUD_WACOM_PAD_BUTTONS00		0x0910
+#define HUD_WACOM_BATTERY		0x1013
 
 /* Usages, LED */
 #define HUL_NUM_LOCK		0x0001
diff --git a/sys/dev/hid/hidms.c b/sys/dev/hid/hidms.c
index 011139a76..aa865757c 100644
--- a/sys/dev/hid/hidms.c
+++ b/sys/dev/hid/hidms.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hidms.c,v 1.9 2022/06/16 20:52:38 bru Exp $ */
+/*	$OpenBSD: hidms.c,v 1.10 2023/08/12 20:47:06 miod Exp $ */
 /*	$NetBSD: ums.c,v 1.60 2003/03/11 16:44:00 augustss Exp $	*/
 
 /*
@@ -61,6 +61,188 @@ int	hidmsdebug = 0;
 #define MOUSE_FLAGS_MASK	(HIO_CONST | HIO_RELATIVE)
 #define NOTMOUSE(f)		(((f) & MOUSE_FLAGS_MASK) != HIO_RELATIVE)
 
+void
+hidms_stylus_hid_parse(struct hidms *ms, struct hid_data *d,
+    struct hid_location *loc_stylus_btn)
+{
+	struct hid_item h;
+
+	while (hid_get_item(d, &h)) {
+		if (h.kind == hid_endcollection)
+			break;
+		if (h.kind != hid_input || (h.flags & HIO_CONST) != 0)
+			continue;
+		/* All the possible stylus reported usages go here */
+#ifdef HIDMS_DEBUG
+		printf("stylus usage: 0x%x\n", h.usage);
+#endif
+		switch (h.usage) {
+		/* Buttons */
+		case HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_TIP_SWITCH):
+			DPRINTF("Stylus usage tip set\n");
+			if (ms->sc_num_stylus_buttons >= MAX_BUTTONS)
+				break;
+			loc_stylus_btn[ms->sc_num_stylus_buttons++] = h.loc;
+			ms->sc_flags |= HIDMS_TIP;
+			break;
+		case HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_BARREL_SWITCH):
+			DPRINTF("Stylus usage barrel set\n");
+			if (ms->sc_num_stylus_buttons >= MAX_BUTTONS)
+				break;
+			loc_stylus_btn[ms->sc_num_stylus_buttons++] = h.loc;
+			ms->sc_flags |= HIDMS_BARREL;
+			break;
+		case HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS,
+		    HUD_SECONDARY_BARREL_SWITCH):
+			DPRINTF("Stylus usage secondary barrel set\n");
+			if (ms->sc_num_stylus_buttons >= MAX_BUTTONS)
+				break;
+			loc_stylus_btn[ms->sc_num_stylus_buttons++] = h.loc;
+			ms->sc_flags |= HIDMS_SEC_BARREL;
+			break;
+		case HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_IN_RANGE):
+			DPRINTF("Stylus usage in range set\n");
+			if (ms->sc_num_stylus_buttons >= MAX_BUTTONS)
+				break;
+			loc_stylus_btn[ms->sc_num_stylus_buttons++] = h.loc;
+			break;
+		case HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_QUALITY):
+			DPRINTF("Stylus usage quality set\n");
+			if (ms->sc_num_stylus_buttons >= MAX_BUTTONS)
+				break;
+			loc_stylus_btn[ms->sc_num_stylus_buttons++] = h.loc;
+			break;
+		/* Axes */
+		case HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_WACOM_X):
+			DPRINTF("Stylus usage x set\n");
+			ms->sc_loc_x = h.loc;
+			ms->sc_tsscale.minx = h.logical_minimum;
+			ms->sc_tsscale.maxx = h.logical_maximum;
+			ms->sc_flags |= HIDMS_ABSX;
+			break;
+		case HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_WACOM_Y):
+			DPRINTF("Stylus usage y set\n");
+			ms->sc_loc_y = h.loc;
+			ms->sc_tsscale.miny = h.logical_minimum;
+			ms->sc_tsscale.maxy = h.logical_maximum;
+			ms->sc_flags |= HIDMS_ABSY;
+			break;
+		case HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_TIP_PRESSURE):
+			DPRINTF("Stylus usage pressure set\n");
+			ms->sc_loc_z = h.loc;
+			ms->sc_tsscale.minz = h.logical_minimum;
+			ms->sc_tsscale.maxz = h.logical_maximum;
+			ms->sc_flags |= HIDMS_Z;
+			break;
+		case HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_WACOM_DISTANCE):
+			DPRINTF("Stylus usage distance set\n");
+			ms->sc_loc_w = h.loc;
+			ms->sc_tsscale.minw = h.logical_minimum;
+			ms->sc_tsscale.maxw = h.logical_maximum;
+			ms->sc_flags |= HIDMS_W;
+			break;
+		default:
+#ifdef HIDMS_DEBUG
+			printf("Unknown stylus usage: 0x%x\n",
+			    h.usage);
+#endif
+			break;
+		}
+	}
+}
+
+void
+hidms_pad_buttons_hid_parse(struct hidms *ms, struct hid_data *d,
+    struct hid_location *loc_pad_btn)
+{
+	struct hid_item h;
+
+	while (hid_get_item(d, &h)) {
+		if (h.kind == hid_endcollection)
+			break;
+		if (h.kind == hid_input && (h.flags & HIO_CONST) != 0 &&
+		    h.usage == HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS,
+		    HUD_WACOM_PAD_BUTTONS00 | ms->sc_num_pad_buttons)) {
+			if (ms->sc_num_pad_buttons >= MAX_BUTTONS)
+				break;
+			loc_pad_btn[ms->sc_num_pad_buttons++] = h.loc;
+		}
+	}
+}
+
+int
+hidms_wacom_setup(struct device *self, struct hidms *ms, void *desc, int dlen)
+{
+	struct hid_data *hd;
+	int i;
+	struct hid_location loc_pad_btn[MAX_BUTTONS];
+	struct hid_location loc_stylus_btn[MAX_BUTTONS];
+
+	ms->sc_flags = 0;
+
+	/* Set x,y,z and w to zero by default */
+	ms->sc_loc_x.size = 0;
+	ms->sc_loc_y.size = 0;
+	ms->sc_loc_z.size = 0;
+	ms->sc_loc_w.size = 0;
+
+	if ((hd = hid_get_collection_data(desc, dlen,
+	     HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_DIGITIZER),
+	     HCOLL_APPLICATION))) {
+		DPRINTF("found the global collection\n");
+		hid_end_parse(hd);
+		if ((hd = hid_get_collection_data(desc, dlen,
+		     HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_STYLUS),
+		     HCOLL_PHYSICAL))) {
+			DPRINTF("found stylus collection\n");
+			hidms_stylus_hid_parse(ms, hd, loc_stylus_btn);
+			hid_end_parse(hd);
+		}
+		if ((hd = hid_get_collection_data(desc, dlen,
+		     HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_TABLET_FKEYS),
+		     HCOLL_PHYSICAL))) {
+			DPRINTF("found tablet keys collection\n");
+			hidms_pad_buttons_hid_parse(ms, hd, loc_pad_btn);
+			hid_end_parse(hd);
+		}
+#ifdef notyet
+		if ((hd = hid_get_collection_data(desc, dlen,
+		     HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_WACOM_BATTERY),
+		     HCOLL_PHYSICAL))) {
+			DPRINTF("found battery collection\n");
+			/* parse and set the battery info */
+			/* not yet used */
+			hid_end_parse(hd);
+		}
+#endif
+		/*
+		 * Ignore the device config, it's not really needed;
+		 * Ignore the usage 0x10AC which is the debug collection, and
+		 * ignore firmware collection and other collections for now.
+		 */
+	}
+
+	/* Map the pad and stylus buttons to mouse buttons */
+	for (i = 0; i < ms->sc_num_stylus_buttons; i++)
+		memcpy(&ms->sc_loc_btn[i], &loc_stylus_btn[i],
+		    sizeof(struct hid_location));
+	if (ms->sc_num_pad_buttons + ms->sc_num_stylus_buttons >= MAX_BUTTONS)
+		ms->sc_num_pad_buttons =
+		    MAX_BUTTONS - ms->sc_num_stylus_buttons;
+	for (; i < ms->sc_num_pad_buttons + ms->sc_num_stylus_buttons; i++)
+		memcpy(&ms->sc_loc_btn[i], &loc_pad_btn[i],
+		    sizeof(struct hid_location));
+	ms->sc_num_buttons = i;
+	DPRINTF("Button information\n");
+#ifdef HIDMS_DEBUG
+	for (i = 0; i < ms->sc_num_buttons; i++)
+		printf("size: 0x%x, pos: 0x%x, count: 0x%x\n",
+		    ms->sc_loc_btn[i].size, ms->sc_loc_btn[i].pos,
+		    ms->sc_loc_btn[i].count);
+#endif
+	return 0;
+}
+
 int
 hidms_setup(struct device *self, struct hidms *ms, uint32_t quirks,
     int id, void *desc, int dlen)
@@ -75,11 +257,15 @@ hidms_setup(struct device *self, struct hidms *ms, uint32_t quirks,
 
 	ms->sc_flags = quirks;
 
+	/* We are setting up a Wacom tablet, not a regular mouse */
+	if (quirks & HIDMS_WACOM_SETUP)
+		return hidms_wacom_setup(self, ms, desc, dlen);
+
 	if (!hid_locate(desc, dlen, HID_USAGE2(HUP_GENERIC_DESKTOP, HUG_X), id,
 	    hid_input, &ms->sc_loc_x, &flags))
 		ms->sc_loc_x.size = 0;
 
-	switch(flags & MOUSE_FLAGS_MASK) {
+	switch (flags & MOUSE_FLAGS_MASK) {
 	case 0:
 		ms->sc_flags |= HIDMS_ABSX;
 		break;
diff --git a/sys/dev/hid/hidmsvar.h b/sys/dev/hid/hidmsvar.h
index a430b90dd..3cd754c89 100644
--- a/sys/dev/hid/hidmsvar.h
+++ b/sys/dev/hid/hidmsvar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hidmsvar.h,v 1.2 2021/01/10 16:32:48 thfr Exp $ */
+/*	$OpenBSD: hidmsvar.h,v 1.3 2023/08/12 20:47:06 miod Exp $ */
 /*	$NetBSD: ums.c,v 1.60 2003/03/11 16:44:00 augustss Exp $	*/
 
 /*
@@ -36,11 +36,16 @@
 struct tsscale {
 	int	minx, maxx;
 	int	miny, maxy;
+	int 	minz, maxz;
+	int 	minw, maxw;
 	int	swapxy;
 	int	resx, resy;
 };
 
 struct hidms {
+	struct device	*sc_device;
+	struct device	*sc_wsmousedev;
+
 	int		sc_enabled;
 	int		sc_flags;	/* device configuration */
 #define HIDMS_SPUR_BUT_UP	0x0001	/* spurious button up events */
@@ -51,17 +56,20 @@ struct hidms {
 #define HIDMS_LEADINGBYTE	0x0020	/* Unknown leading byte */
 #define HIDMS_ABSX		0x0040	/* X-axis is absolute */
 #define HIDMS_ABSY		0x0080	/* Y-axis is absolute */
-#define HIDMS_TIP		0x0100   /* Tip switch on a digitiser pen */
+#define HIDMS_TIP		0x0100	/* Tip switch on a digitiser pen */
 #define HIDMS_BARREL		0x0200	/* Barrel switch on a digitiser pen */
-#define HIDMS_ERASER		0x0400   /* Eraser switch on a digitiser pen */
+#define HIDMS_ERASER		0x0400	/* Eraser switch on a digitiser pen */
 #define HIDMS_MS_BAD_CLASS	0x0800	/* Mouse doesn't identify properly */
 #define HIDMS_VENDOR_BUTTONS	0x1000	/* extra buttons in vendor page */
+#define HIDMS_SEC_BARREL	0x2000	/* Secondary Barrel switch on a digitiser pen */
+#define HIDMS_WACOM_SETUP	0x4000	/* Requires Wacom-style setup */
 
 	int		sc_num_buttons;
 	u_int32_t	sc_buttons;	/* mouse button status */
 
-	struct device	*sc_device;
-	struct device	*sc_wsmousedev;
+	/* Wacom-specific fields */
+	int 		sc_num_pad_buttons;
+	int 		sc_num_stylus_buttons;
 
 	/* locators */
 	struct hid_location sc_loc_x;
diff --git a/sys/dev/i2c/ihidev.c b/sys/dev/i2c/ihidev.c
index 233739404..d02893034 100644
--- a/sys/dev/i2c/ihidev.c
+++ b/sys/dev/i2c/ihidev.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ihidev.c,v 1.28 2022/08/31 15:14:01 kettenis Exp $ */
+/* $OpenBSD: ihidev.c,v 1.29 2023/08/12 10:03:05 kettenis Exp $ */
 /*
  * HID-over-i2c driver
  *
@@ -198,6 +198,9 @@ ihidev_attach(struct device *parent, struct device *self, void *aux)
 		sc->sc_subdevs[repid] = (struct ihidev *)dev;
 	}
 
+	if (sc->sc_refcnt > 0)
+		return;
+	
 	/* power down until we're opened */
 	if (ihidev_hid_command(sc, I2C_HID_CMD_SET_POWER, &I2C_HID_POWER_OFF)) {
 		printf("%s: failed to power down\n", sc->sc_dev.dv_xname);
diff --git a/sys/dev/ic/ufshcireg.h b/sys/dev/ic/ufshcireg.h
index 17e272d01..18091ec49 100644
--- a/sys/dev/ic/ufshcireg.h
+++ b/sys/dev/ic/ufshcireg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ufshcireg.h,v 1.2 2023/02/17 08:01:03 jsg Exp $ */
+/*	$OpenBSD: ufshcireg.h,v 1.3 2023/08/15 08:27:30 miod Exp $ */
 
 /*
  * Copyright (c) 2022 Marcus Glocker <mglocker@openbsd.org>
@@ -119,7 +119,7 @@
 #define UFSHCI_REG_UECDME		0x48
 /* UTP Transfer Request Interrupt Aggregation Control Register */
 #define UFSHCI_REG_UTRIACR		0x4C
-#define  UFSHCI_REG_UTRIACR_IAEN	(1 << 31) /* RW */
+#define  UFSHCI_REG_UTRIACR_IAEN	(1U << 31) /* RW */
 #define  UFSHCI_REG_UTRIACR_IAPWEN	(1 << 24) /* WO */
 #define  UFSHCI_REG_UTRIACR_IASB	(1 << 20) /* RO */
 #define  UFSHCI_REG_UTRIACR_CTR		(1 << 16) /* WO */
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu.h b/sys/dev/pci/drm/amd/amdgpu/amdgpu.h
index cfad9d3fd..6bd8895f3 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu.h
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu.h
@@ -246,6 +246,7 @@ extern int amdgpu_num_kcq;
 
 #define AMDGPU_VCNFW_LOG_SIZE (32 * 1024)
 extern int amdgpu_vcnfw_log;
+extern int amdgpu_sg_display;
 
 #define AMDGPU_VM_MAX_NUM_CTX			4096
 #define AMDGPU_SG_THRESHOLD			(256*1024*1024)
@@ -287,6 +288,9 @@ extern int amdgpu_vcnfw_log;
 #define AMDGPU_SMARTSHIFT_MAX_BIAS (100)
 #define AMDGPU_SMARTSHIFT_MIN_BIAS (-100)
 
+/* Extra time delay(in ms) to eliminate the influence of temperature momentary fluctuation */
+#define AMDGPU_SWCTF_EXTRA_DELAY		50
+
 struct amdgpu_device;
 struct amdgpu_irq_src;
 struct amdgpu_fpriv;
@@ -1291,6 +1295,7 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,
 void amdgpu_device_pci_config_reset(struct amdgpu_device *adev);
 int amdgpu_device_pci_reset(struct amdgpu_device *adev);
 bool amdgpu_device_need_post(struct amdgpu_device *adev);
+bool amdgpu_sg_display_supported(struct amdgpu_device *adev);
 bool amdgpu_device_pcie_dynamic_switching_supported(void);
 bool amdgpu_device_should_use_aspm(struct amdgpu_device *adev);
 bool amdgpu_device_aspm_support_quirk(void);
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_atomfirmware.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_atomfirmware.c
index b81b77a9e..9b97fa39d 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_atomfirmware.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_atomfirmware.c
@@ -101,39 +101,97 @@ void amdgpu_atomfirmware_scratch_regs_init(struct amdgpu_device *adev)
 	}
 }
 
+static int amdgpu_atomfirmware_allocate_fb_v2_1(struct amdgpu_device *adev,
+	struct vram_usagebyfirmware_v2_1 *fw_usage, int *usage_bytes)
+{
+	uint32_t start_addr, fw_size, drv_size;
+
+	start_addr = le32_to_cpu(fw_usage->start_address_in_kb);
+	fw_size = le16_to_cpu(fw_usage->used_by_firmware_in_kb);
+	drv_size = le16_to_cpu(fw_usage->used_by_driver_in_kb);
+
+	DRM_DEBUG("atom firmware v2_1 requested %08x %dkb fw %dkb drv\n",
+			  start_addr,
+			  fw_size,
+			  drv_size);
+
+	if ((start_addr & ATOM_VRAM_OPERATION_FLAGS_MASK) ==
+		(uint32_t)(ATOM_VRAM_BLOCK_SRIOV_MSG_SHARE_RESERVATION <<
+		ATOM_VRAM_OPERATION_FLAGS_SHIFT)) {
+		/* Firmware request VRAM reservation for SR-IOV */
+		adev->mman.fw_vram_usage_start_offset = (start_addr &
+			(~ATOM_VRAM_OPERATION_FLAGS_MASK)) << 10;
+		adev->mman.fw_vram_usage_size = fw_size << 10;
+		/* Use the default scratch size */
+		*usage_bytes = 0;
+	} else {
+		*usage_bytes = drv_size << 10;
+	}
+	return 0;
+}
+
+static int amdgpu_atomfirmware_allocate_fb_v2_2(struct amdgpu_device *adev,
+		struct vram_usagebyfirmware_v2_2 *fw_usage, int *usage_bytes)
+{
+	uint32_t fw_start_addr, fw_size, drv_start_addr, drv_size;
+
+	fw_start_addr = le32_to_cpu(fw_usage->fw_region_start_address_in_kb);
+	fw_size = le16_to_cpu(fw_usage->used_by_firmware_in_kb);
+
+	drv_start_addr = le32_to_cpu(fw_usage->driver_region0_start_address_in_kb);
+	drv_size = le32_to_cpu(fw_usage->used_by_driver_region0_in_kb);
+
+	DRM_DEBUG("atom requested fw start at %08x %dkb and drv start at %08x %dkb\n",
+			  fw_start_addr,
+			  fw_size,
+			  drv_start_addr,
+			  drv_size);
+
+	if ((fw_start_addr & (ATOM_VRAM_BLOCK_NEEDS_NO_RESERVATION << 30)) == 0) {
+		/* Firmware request VRAM reservation for SR-IOV */
+		adev->mman.fw_vram_usage_start_offset = (fw_start_addr &
+			(~ATOM_VRAM_OPERATION_FLAGS_MASK)) << 10;
+		adev->mman.fw_vram_usage_size = fw_size << 10;
+	}
+
+	if ((drv_start_addr & (ATOM_VRAM_BLOCK_NEEDS_NO_RESERVATION << 30)) == 0) {
+		/* driver request VRAM reservation for SR-IOV */
+		adev->mman.drv_vram_usage_start_offset = (drv_start_addr &
+			(~ATOM_VRAM_OPERATION_FLAGS_MASK)) << 10;
+		adev->mman.drv_vram_usage_size = drv_size << 10;
+	}
+
+	*usage_bytes = 0;
+	return 0;
+}
+
 int amdgpu_atomfirmware_allocate_fb_scratch(struct amdgpu_device *adev)
 {
 	struct atom_context *ctx = adev->mode_info.atom_context;
 	int index = get_index_into_master_table(atom_master_list_of_data_tables_v2_1,
 						vram_usagebyfirmware);
-	struct vram_usagebyfirmware_v2_1 *firmware_usage;
-	uint32_t start_addr, size;
+	struct vram_usagebyfirmware_v2_1 *fw_usage_v2_1;
+	struct vram_usagebyfirmware_v2_2 *fw_usage_v2_2;
 	uint16_t data_offset;
+	uint8_t frev, crev;
 	int usage_bytes = 0;
 
-	if (amdgpu_atom_parse_data_header(ctx, index, NULL, NULL, NULL, &data_offset)) {
-		firmware_usage = (struct vram_usagebyfirmware_v2_1 *)(ctx->bios + data_offset);
-		DRM_DEBUG("atom firmware requested %08x %dkb fw %dkb drv\n",
-			  le32_to_cpu(firmware_usage->start_address_in_kb),
-			  le16_to_cpu(firmware_usage->used_by_firmware_in_kb),
-			  le16_to_cpu(firmware_usage->used_by_driver_in_kb));
-
-		start_addr = le32_to_cpu(firmware_usage->start_address_in_kb);
-		size = le16_to_cpu(firmware_usage->used_by_firmware_in_kb);
-
-		if ((uint32_t)(start_addr & ATOM_VRAM_OPERATION_FLAGS_MASK) ==
-			(uint32_t)(ATOM_VRAM_BLOCK_SRIOV_MSG_SHARE_RESERVATION <<
-			ATOM_VRAM_OPERATION_FLAGS_SHIFT)) {
-			/* Firmware request VRAM reservation for SR-IOV */
-			adev->mman.fw_vram_usage_start_offset = (start_addr &
-				(~ATOM_VRAM_OPERATION_FLAGS_MASK)) << 10;
-			adev->mman.fw_vram_usage_size = size << 10;
-			/* Use the default scratch size */
-			usage_bytes = 0;
-		} else {
-			usage_bytes = le16_to_cpu(firmware_usage->used_by_driver_in_kb) << 10;
+	if (amdgpu_atom_parse_data_header(ctx, index, NULL, &frev, &crev, &data_offset)) {
+		if (frev == 2 && crev == 1) {
+			fw_usage_v2_1 =
+				(struct vram_usagebyfirmware_v2_1 *)(ctx->bios + data_offset);
+			amdgpu_atomfirmware_allocate_fb_v2_1(adev,
+					fw_usage_v2_1,
+					&usage_bytes);
+		} else if (frev >= 2 && crev >= 2) {
+			fw_usage_v2_2 =
+				(struct vram_usagebyfirmware_v2_2 *)(ctx->bios + data_offset);
+			amdgpu_atomfirmware_allocate_fb_v2_2(adev,
+					fw_usage_v2_2,
+					&usage_bytes);
 		}
 	}
+
 	ctx->scratch_size_bytes = 0;
 	if (usage_bytes == 0)
 		usage_bytes = 20 * 1024;
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
index 8f9a1cfe2..b2b64a6f7 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
@@ -287,7 +287,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
 
 	if (!p->gang_size) {
 		ret = -EINVAL;
-		goto free_partial_kdata;
+		goto free_all_kdata;
 	}
 
 	for (i = 0; i < p->gang_size; ++i) {
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c
index b48d639d8..73fa47c34 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c
@@ -1351,6 +1351,32 @@ bool amdgpu_device_need_post(struct amdgpu_device *adev)
 	return true;
 }
 
+/*
+ * On APUs with >= 64GB white flickering has been observed w/ SG enabled.
+ * Disable S/G on such systems until we have a proper fix.
+ * https://gitlab.freedesktop.org/drm/amd/-/issues/2354
+ * https://gitlab.freedesktop.org/drm/amd/-/issues/2735
+ */
+bool amdgpu_sg_display_supported(struct amdgpu_device *adev)
+{
+	switch (amdgpu_sg_display) {
+	case -1:
+		break;
+	case 0:
+		return false;
+	case 1:
+		return true;
+	default:
+		return false;
+	}
+	if ((totalram_pages() << (PAGE_SHIFT - 10)) +
+	    (adev->gmc.real_vram_size / 1024) >= 64000000) {
+		DRM_WARN("Disabling S/G due to >=64GB RAM\n");
+		return false;
+	}
+	return true;
+}
+
 /*
  * Intel hosts such as Raptor Lake and Sapphire Rapids don't support dynamic
  * speed switching. Until we have confirmation from Intel that a specific host
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_drv.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_drv.c
index 630ba2f33..1e2c32dd8 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_drv.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_drv.c
@@ -185,6 +185,7 @@ int amdgpu_num_kcq = -1;
 int amdgpu_smartshift_bias;
 int amdgpu_use_xgmi_p2p = 1;
 int amdgpu_vcnfw_log;
+int amdgpu_sg_display = -1; /* auto */
 
 static void amdgpu_drv_delayed_reset_work_handler(struct work_struct *work);
 
@@ -929,6 +930,16 @@ module_param_named(num_kcq, amdgpu_num_kcq, int, 0444);
 MODULE_PARM_DESC(vcnfw_log, "Enable vcnfw log(0 = disable (default value), 1 = enable)");
 module_param_named(vcnfw_log, amdgpu_vcnfw_log, int, 0444);
 
+/**
+ * DOC: sg_display (int)
+ * Disable S/G (scatter/gather) display (i.e., display from system memory).
+ * This option is only relevant on APUs.  Set this option to 0 to disable
+ * S/G display if you experience flickering or other issues under memory
+ * pressure and report the issue.
+ */
+MODULE_PARM_DESC(sg_display, "S/G Display (-1 = auto (default), 0 = disable)");
+module_param_named(sg_display, amdgpu_sg_display, int, 0444);
+
 /**
  * DOC: smu_pptable_id (int)
  * Used to override pptable id. id = 0 use VBIOS pptable.
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_object.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_object.c
index 5c44cb7e1..a6b66b4d4 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_object.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_object.c
@@ -348,17 +348,16 @@ int amdgpu_bo_create_kernel(struct amdgpu_device *adev,
  * @adev: amdgpu device object
  * @offset: offset of the BO
  * @size: size of the BO
- * @domain: where to place it
  * @bo_ptr:  used to initialize BOs in structures
  * @cpu_addr: optional CPU address mapping
  *
- * Creates a kernel BO at a specific offset in the address space of the domain.
+ * Creates a kernel BO at a specific offset in VRAM.
  *
  * Returns:
  * 0 on success, negative error code otherwise.
  */
 int amdgpu_bo_create_kernel_at(struct amdgpu_device *adev,
-			       uint64_t offset, uint64_t size, uint32_t domain,
+			       uint64_t offset, uint64_t size,
 			       struct amdgpu_bo **bo_ptr, void **cpu_addr)
 {
 	struct ttm_operation_ctx ctx = { false, false };
@@ -368,8 +367,9 @@ int amdgpu_bo_create_kernel_at(struct amdgpu_device *adev,
 	offset &= LINUX_PAGE_MASK;
 	size = roundup2(size, PAGE_SIZE);
 
-	r = amdgpu_bo_create_reserved(adev, size, PAGE_SIZE, domain, bo_ptr,
-				      NULL, cpu_addr);
+	r = amdgpu_bo_create_reserved(adev, size, PAGE_SIZE,
+				      AMDGPU_GEM_DOMAIN_VRAM, bo_ptr, NULL,
+				      cpu_addr);
 	if (r)
 		return r;
 
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_object.h b/sys/dev/pci/drm/amd/amdgpu/amdgpu_object.h
index 9afdd36fb..db2ddf155 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_object.h
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_object.h
@@ -285,7 +285,7 @@ int amdgpu_bo_create_kernel(struct amdgpu_device *adev,
 			    u32 domain, struct amdgpu_bo **bo_ptr,
 			    u64 *gpu_addr, void **cpu_addr);
 int amdgpu_bo_create_kernel_at(struct amdgpu_device *adev,
-			       uint64_t offset, uint64_t size, uint32_t domain,
+			       uint64_t offset, uint64_t size,
 			       struct amdgpu_bo **bo_ptr, void **cpu_addr);
 int amdgpu_bo_create_user(struct amdgpu_device *adev,
 			  struct amdgpu_bo_param *bp,
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_ttm.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_ttm.c
index 556c6f6cc..ace91f89b 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_ttm.c
@@ -1574,6 +1574,23 @@ static void amdgpu_ttm_fw_reserve_vram_fini(struct amdgpu_device *adev)
 		NULL, &adev->mman.fw_vram_usage_va);
 }
 
+/*
+ * Driver Reservation functions
+ */
+/**
+ * amdgpu_ttm_drv_reserve_vram_fini - free drv reserved vram
+ *
+ * @adev: amdgpu_device pointer
+ *
+ * free drv reserved vram if it has been reserved.
+ */
+static void amdgpu_ttm_drv_reserve_vram_fini(struct amdgpu_device *adev)
+{
+	amdgpu_bo_free_kernel(&adev->mman.drv_vram_usage_reserved_bo,
+						  NULL,
+						  NULL);
+}
+
 /**
  * amdgpu_ttm_fw_reserve_vram_init - create bo vram reservation from fw
  *
@@ -1595,11 +1612,34 @@ static int amdgpu_ttm_fw_reserve_vram_init(struct amdgpu_device *adev)
 	return amdgpu_bo_create_kernel_at(adev,
 					  adev->mman.fw_vram_usage_start_offset,
 					  adev->mman.fw_vram_usage_size,
-					  AMDGPU_GEM_DOMAIN_VRAM,
 					  &adev->mman.fw_vram_usage_reserved_bo,
 					  &adev->mman.fw_vram_usage_va);
 }
 
+/**
+ * amdgpu_ttm_drv_reserve_vram_init - create bo vram reservation from driver
+ *
+ * @adev: amdgpu_device pointer
+ *
+ * create bo vram reservation from drv.
+ */
+static int amdgpu_ttm_drv_reserve_vram_init(struct amdgpu_device *adev)
+{
+	uint64_t vram_size = adev->gmc.visible_vram_size;
+
+	adev->mman.drv_vram_usage_reserved_bo = NULL;
+
+	if (adev->mman.drv_vram_usage_size == 0 ||
+	    adev->mman.drv_vram_usage_size > vram_size)
+		return 0;
+
+	return amdgpu_bo_create_kernel_at(adev,
+					  adev->mman.drv_vram_usage_start_offset,
+					  adev->mman.drv_vram_usage_size,
+					  &adev->mman.drv_vram_usage_reserved_bo,
+					  NULL);
+}
+
 /*
  * Memoy training reservation functions
  */
@@ -1622,14 +1662,15 @@ static int amdgpu_ttm_training_reserve_vram_fini(struct amdgpu_device *adev)
 	return 0;
 }
 
-static void amdgpu_ttm_training_data_block_init(struct amdgpu_device *adev)
+static void amdgpu_ttm_training_data_block_init(struct amdgpu_device *adev,
+						uint32_t reserve_size)
 {
 	struct psp_memory_training_context *ctx = &adev->psp.mem_train_ctx;
 
 	memset(ctx, 0, sizeof(*ctx));
 
 	ctx->c2p_train_data_offset =
-		roundup2((adev->gmc.mc_vram_size - adev->mman.discovery_tmr_size - SZ_1M), SZ_1M);
+		roundup2((adev->gmc.mc_vram_size - reserve_size - SZ_1M), SZ_1M);
 	ctx->p2c_train_data_offset =
 		(adev->gmc.mc_vram_size - GDDR6_MEM_TRAINING_OFFSET);
 	ctx->train_data_size =
@@ -1647,9 +1688,10 @@ static void amdgpu_ttm_training_data_block_init(struct amdgpu_device *adev)
  */
 static int amdgpu_ttm_reserve_tmr(struct amdgpu_device *adev)
 {
-	int ret;
 	struct psp_memory_training_context *ctx = &adev->psp.mem_train_ctx;
 	bool mem_train_support = false;
+	uint32_t reserve_size = 0;
+	int ret;
 
 	if (!amdgpu_sriov_vf(adev)) {
 		if (amdgpu_atomfirmware_mem_training_supported(adev))
@@ -1665,18 +1707,18 @@ static int amdgpu_ttm_reserve_tmr(struct amdgpu_device *adev)
 	 * Otherwise, fallback to legacy approach to check and reserve tmr block for ip
 	 * discovery data and G6 memory training data respectively
 	 */
-	adev->mman.discovery_tmr_size =
-		amdgpu_atomfirmware_get_fw_reserved_fb_size(adev);
-	if (!adev->mman.discovery_tmr_size)
-		adev->mman.discovery_tmr_size = DISCOVERY_TMR_OFFSET;
+	if (adev->bios)
+		reserve_size =
+			amdgpu_atomfirmware_get_fw_reserved_fb_size(adev);
+	if (!reserve_size)
+		reserve_size = DISCOVERY_TMR_OFFSET;
 
 	if (mem_train_support) {
 		/* reserve vram for mem train according to TMR location */
-		amdgpu_ttm_training_data_block_init(adev);
+		amdgpu_ttm_training_data_block_init(adev, reserve_size);
 		ret = amdgpu_bo_create_kernel_at(adev,
 					 ctx->c2p_train_data_offset,
 					 ctx->train_data_size,
-					 AMDGPU_GEM_DOMAIN_VRAM,
 					 &ctx->c2p_bo,
 					 NULL);
 		if (ret) {
@@ -1688,14 +1730,14 @@ static int amdgpu_ttm_reserve_tmr(struct amdgpu_device *adev)
 	}
 
 	ret = amdgpu_bo_create_kernel_at(adev,
-				adev->gmc.real_vram_size - adev->mman.discovery_tmr_size,
-				adev->mman.discovery_tmr_size,
-				AMDGPU_GEM_DOMAIN_VRAM,
-				&adev->mman.discovery_memory,
+				adev->gmc.real_vram_size - reserve_size,
+				reserve_size,
+				&adev->mman.fw_reserved_memory,
 				NULL);
 	if (ret) {
 		DRM_ERROR("alloc tmr failed(%d)!\n", ret);
-		amdgpu_bo_free_kernel(&adev->mman.discovery_memory, NULL, NULL);
+		amdgpu_bo_free_kernel(&adev->mman.fw_reserved_memory,
+				      NULL, NULL);
 		return ret;
 	}
 
@@ -1788,6 +1830,14 @@ int amdgpu_ttm_init(struct amdgpu_device *adev)
 		return r;
 	}
 
+	/*
+	 *The reserved vram for driver must be pinned to the specified
+	 *place on the VRAM, so reserve it early.
+	 */
+	r = amdgpu_ttm_drv_reserve_vram_init(adev);
+	if (r)
+		return r;
+
 	/*
 	 * only NAVI10 and onwards ASIC support for IP discovery.
 	 * If IP discovery enabled, a block of memory should be
@@ -1804,21 +1854,18 @@ int amdgpu_ttm_init(struct amdgpu_device *adev)
 	 * avoid display artifacts while transitioning between pre-OS
 	 * and driver.  */
 	r = amdgpu_bo_create_kernel_at(adev, 0, adev->mman.stolen_vga_size,
-				       AMDGPU_GEM_DOMAIN_VRAM,
 				       &adev->mman.stolen_vga_memory,
 				       NULL);
 	if (r)
 		return r;
 	r = amdgpu_bo_create_kernel_at(adev, adev->mman.stolen_vga_size,
 				       adev->mman.stolen_extended_size,
-				       AMDGPU_GEM_DOMAIN_VRAM,
 				       &adev->mman.stolen_extended_memory,
 				       NULL);
 	if (r)
 		return r;
 	r = amdgpu_bo_create_kernel_at(adev, adev->mman.stolen_reserved_offset,
 				       adev->mman.stolen_reserved_size,
-				       AMDGPU_GEM_DOMAIN_VRAM,
 				       &adev->mman.stolen_reserved_memory,
 				       NULL);
 	if (r)
@@ -1910,14 +1957,16 @@ void amdgpu_ttm_fini(struct amdgpu_device *adev)
 	/* return the stolen vga memory back to VRAM */
 	amdgpu_bo_free_kernel(&adev->mman.stolen_vga_memory, NULL, NULL);
 	amdgpu_bo_free_kernel(&adev->mman.stolen_extended_memory, NULL, NULL);
-	/* return the IP Discovery TMR memory back to VRAM */
-	amdgpu_bo_free_kernel(&adev->mman.discovery_memory, NULL, NULL);
+	/* return the FW reserved memory back to VRAM */
+	amdgpu_bo_free_kernel(&adev->mman.fw_reserved_memory, NULL,
+			      NULL);
 	if (adev->mman.stolen_reserved_size)
 		amdgpu_bo_free_kernel(&adev->mman.stolen_reserved_memory,
 				      NULL, NULL);
 	amdgpu_bo_free_kernel(&adev->mman.sdma_access_bo, NULL,
 					&adev->mman.sdma_access_ptr);
 	amdgpu_ttm_fw_reserve_vram_fini(adev);
+	amdgpu_ttm_drv_reserve_vram_fini(adev);
 
 	if (drm_dev_enter(adev_to_drm(adev), &idx)) {
 
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_ttm.h b/sys/dev/pci/drm/amd/amdgpu/amdgpu_ttm.h
index 252c8dfcc..1d899477e 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_ttm.h
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_ttm.h
@@ -79,7 +79,8 @@ struct amdgpu_mman {
 	/* discovery */
 	uint8_t				*discovery_bin;
 	uint32_t			discovery_tmr_size;
-	struct amdgpu_bo		*discovery_memory;
+	/* fw reserved memory */
+	struct amdgpu_bo		*fw_reserved_memory;
 
 	/* firmware VRAM reservation */
 	u64		fw_vram_usage_start_offset;
@@ -87,6 +88,11 @@ struct amdgpu_mman {
 	struct amdgpu_bo	*fw_vram_usage_reserved_bo;
 	void		*fw_vram_usage_va;
 
+	/* driver VRAM reservation */
+	u64		drv_vram_usage_start_offset;
+	u64		drv_vram_usage_size;
+	struct amdgpu_bo	*drv_vram_usage_reserved_bo;
+
 	/* PAGE_SIZE'd BO for process memory r/w over SDMA. */
 	struct amdgpu_bo	*sdma_access_bo;
 	void			*sdma_access_ptr;
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_virt.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_virt.c
index 5681a482a..5791baf50 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_virt.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_virt.c
@@ -391,7 +391,6 @@ static void amdgpu_virt_ras_reserve_bps(struct amdgpu_device *adev)
 		 */
 		if (amdgpu_bo_create_kernel_at(adev, bp << AMDGPU_GPU_PAGE_SHIFT,
 					       AMDGPU_GPU_PAGE_SIZE,
-					       AMDGPU_GEM_DOMAIN_VRAM,
 					       &bo, NULL))
 			DRM_DEBUG("RAS WARN: reserve vram for retired page %llx fail\n", bp);
 
diff --git a/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 5acc0b43f..25febd19d 100644
--- a/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -351,6 +351,19 @@ static inline bool is_dc_timing_adjust_needed(struct dm_crtc_state *old_state,
 		return false;
 }
 
+static inline void reverse_planes_order(struct dc_surface_update *array_of_surface_update,
+					int planes_count)
+{
+	int i, j;
+	struct dc_surface_update surface_updates_temp;
+
+	for (i = 0, j = planes_count - 1; i < j; i++, j--) {
+		surface_updates_temp = array_of_surface_update[i];
+		array_of_surface_update[i] = array_of_surface_update[j];
+		array_of_surface_update[j] = surface_updates_temp;
+	}
+}
+
 /**
  * update_planes_and_stream_adapter() - Send planes to be updated in DC
  *
@@ -367,6 +380,8 @@ static inline bool update_planes_and_stream_adapter(struct dc *dc,
 						    struct dc_stream_update *stream_update,
 						    struct dc_surface_update *array_of_surface_update)
 {
+	reverse_planes_order(array_of_surface_update, planes_count);
+
 	/*
 	 * Previous frame finished and HW is ready for optimization.
 	 */
@@ -1621,6 +1636,8 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
 		}
 		break;
 	}
+	if (init_data.flags.gpu_vm_support)
+		init_data.flags.gpu_vm_support = amdgpu_sg_display_supported(adev);
 
 	if (init_data.flags.gpu_vm_support)
 		adev->mode_info.gpu_vm_support = true;
diff --git a/sys/dev/pci/drm/amd/display/dc/core/amdgpu_dc.c b/sys/dev/pci/drm/amd/display/dc/core/amdgpu_dc.c
index 8f9c60ed6..674ab6d9b 100644
--- a/sys/dev/pci/drm/amd/display/dc/core/amdgpu_dc.c
+++ b/sys/dev/pci/drm/amd/display/dc/core/amdgpu_dc.c
@@ -1079,6 +1079,7 @@ static void disable_dangling_plane(struct dc *dc, struct dc_state *context)
 	struct dc_state *dangling_context = dc_create_state(dc);
 	struct dc_state *current_ctx;
 	struct pipe_ctx *pipe;
+	struct timing_generator *tg;
 
 	if (dangling_context == NULL)
 		return;
@@ -1122,6 +1123,7 @@ static void disable_dangling_plane(struct dc *dc, struct dc_state *context)
 
 		if (should_disable && old_stream) {
 			pipe = &dc->current_state->res_ctx.pipe_ctx[i];
+			tg = pipe->stream_res.tg;
 			/* When disabling plane for a phantom pipe, we must turn on the
 			 * phantom OTG so the disable programming gets the double buffer
 			 * update. Otherwise the pipe will be left in a partially disabled
@@ -1129,7 +1131,8 @@ static void disable_dangling_plane(struct dc *dc, struct dc_state *context)
 			 * again for different use.
 			 */
 			if (old_stream->mall_stream_config.type == SUBVP_PHANTOM) {
-				pipe->stream_res.tg->funcs->enable_crtc(pipe->stream_res.tg);
+				if (tg->funcs->enable_crtc)
+					tg->funcs->enable_crtc(tg);
 			}
 			dc_rem_all_planes_for_stream(dc, old_stream, dangling_context);
 			disable_all_writeback_pipes_for_stream(dc, old_stream, dangling_context);
@@ -1146,6 +1149,15 @@ static void disable_dangling_plane(struct dc *dc, struct dc_state *context)
 				dc->hwss.interdependent_update_lock(dc, dc->current_state, false);
 				dc->hwss.post_unlock_program_front_end(dc, dangling_context);
 			}
+			/* We need to put the phantom OTG back into it's default (disabled) state or we
+			 * can get corruption when transition from one SubVP config to a different one.
+			 * The OTG is set to disable on falling edge of VUPDATE so the plane disable
+			 * will still get it's double buffer update.
+			 */
+			if (old_stream->mall_stream_config.type == SUBVP_PHANTOM) {
+				if (tg->funcs->disable_phantom_crtc)
+					tg->funcs->disable_phantom_crtc(tg);
+			}
 		}
 	}
 
@@ -1942,6 +1954,9 @@ enum dc_status dc_commit_streams(struct dc *dc,
 	struct pipe_ctx *pipe;
 	bool handle_exit_odm2to1 = false;
 
+	if (dc->ctx->dce_environment == DCE_ENV_VIRTUAL_HW)
+		return res;
+
 	if (!streams_changed(dc, streams, stream_count))
 		return res;
 
@@ -1984,21 +1999,33 @@ enum dc_status dc_commit_streams(struct dc *dc,
 
 	dc_resource_state_copy_construct_current(dc, context);
 
-	/*
-	 * Previous validation was perfomred with fast_validation = true and
-	 * the full DML state required for hardware programming was skipped.
-	 *
-	 * Re-validate here to calculate these parameters / watermarks.
-	 */
-	res = dc_validate_global_state(dc, context, false);
+	res = dc_validate_with_context(dc, set, stream_count, context, false);
 	if (res != DC_OK) {
-		DC_LOG_ERROR("DC commit global validation failure: %s (%d)",
-			     dc_status_to_str(res), res);
-		return res;
+		BREAK_TO_DEBUGGER();
+		goto fail;
 	}
 
 	res = dc_commit_state_no_check(dc, context);
 
+	for (i = 0; i < stream_count; i++) {
+		for (j = 0; j < context->stream_count; j++) {
+			if (streams[i]->stream_id == context->streams[j]->stream_id)
+				streams[i]->out.otg_offset = context->stream_status[j].primary_otg_inst;
+
+			if (dc_is_embedded_signal(streams[i]->signal)) {
+				struct dc_stream_status *status = dc_stream_get_status_from_state(context, streams[i]);
+
+				if (dc->hwss.is_abm_supported)
+					status->is_abm_supported = dc->hwss.is_abm_supported(dc, context, streams[i]);
+				else
+					status->is_abm_supported = true;
+			}
+		}
+	}
+
+fail:
+	dc_release_state(context);
+
 context_alloc_fail:
 
 	DC_LOG_DC("%s Finished.\n", __func__);
@@ -3122,6 +3149,19 @@ static bool update_planes_and_stream_state(struct dc *dc,
 
 	if (update_type == UPDATE_TYPE_FULL) {
 		if (!dc->res_pool->funcs->validate_bandwidth(dc, context, false)) {
+			/* For phantom pipes we remove and create a new set of phantom pipes
+			 * for each full update (because we don't know if we'll need phantom
+			 * pipes until after the first round of validation). However, if validation
+			 * fails we need to keep the existing phantom pipes (because we don't update
+			 * the dc->current_state).
+			 *
+			 * The phantom stream/plane refcount is decremented for validation because
+			 * we assume it'll be removed (the free comes when the dc_state is freed),
+			 * but if validation fails we have to increment back the refcount so it's
+			 * consistent.
+			 */
+			if (dc->res_pool->funcs->retain_phantom_pipes)
+				dc->res_pool->funcs->retain_phantom_pipes(dc, dc->current_state);
 			BREAK_TO_DEBUGGER();
 			goto fail;
 		}
@@ -3987,6 +4027,18 @@ void dc_commit_updates_for_stream(struct dc *dc,
 	struct dc_context *dc_ctx = dc->ctx;
 	int i, j;
 
+	/* TODO: Since change commit sequence can have a huge impact,
+	 * we decided to only enable it for DCN3x. However, as soon as
+	 * we get more confident about this change we'll need to enable
+	 * the new sequence for all ASICs.
+	 */
+	if (dc->ctx->dce_version >= DCN_VERSION_3_2) {
+		dc_update_planes_and_stream(dc, srf_updates,
+					    surface_count, stream,
+					    stream_update);
+		return;
+	}
+
 	stream_status = dc_stream_get_status(stream);
 	context = dc->current_state;
 
diff --git a/sys/dev/pci/drm/amd/display/dc/core/dc_link.c b/sys/dev/pci/drm/amd/display/dc/core/dc_link.c
index 13598a2af..8ea26f6e2 100644
--- a/sys/dev/pci/drm/amd/display/dc/core/dc_link.c
+++ b/sys/dev/pci/drm/amd/display/dc/core/dc_link.c
@@ -1141,6 +1141,11 @@ static bool detect_link_and_local_sink(struct dc_link *link,
 					(link->dpcd_caps.dongle_type !=
 							DISPLAY_DONGLE_DP_HDMI_CONVERTER))
 				converter_disable_audio = true;
+
+			/* limited link rate to HBR3 for DPIA until we implement USB4 V2 */
+			if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA &&
+					link->reported_link_cap.link_rate > LINK_RATE_HIGH3)
+				link->reported_link_cap.link_rate = LINK_RATE_HIGH3;
 			break;
 		}
 
@@ -2092,6 +2097,7 @@ static enum dc_status enable_link_dp_mst(
 		struct pipe_ctx *pipe_ctx)
 {
 	struct dc_link *link = pipe_ctx->stream->link;
+	unsigned char mstm_cntl;
 
 	/* sink signal type after MST branch is MST. Multiple MST sinks
 	 * share one link. Link DP PHY is enable or training only once.
@@ -2100,7 +2106,9 @@ static enum dc_status enable_link_dp_mst(
 		return DC_OK;
 
 	/* clear payload table */
-	dm_helpers_dp_mst_clear_payload_allocation_table(link->ctx, link);
+	core_link_read_dpcd(link, DP_MSTM_CTRL, &mstm_cntl, 1);
+	if (mstm_cntl & DP_MST_EN)
+		dm_helpers_dp_mst_clear_payload_allocation_table(link->ctx, link);
 
 	/* to make sure the pending down rep can be processed
 	 * before enabling the link
diff --git a/sys/dev/pci/drm/amd/display/dc/core/dc_resource.c b/sys/dev/pci/drm/amd/display/dc/core/dc_resource.c
index 79fc7182f..2b58cd310 100644
--- a/sys/dev/pci/drm/amd/display/dc/core/dc_resource.c
+++ b/sys/dev/pci/drm/amd/display/dc/core/dc_resource.c
@@ -2616,15 +2616,241 @@ bool dc_resource_is_dsc_encoding_supported(const struct dc *dc)
 	return dc->res_pool->res_cap->num_dsc > 0;
 }
 
+static bool planes_changed_for_existing_stream(struct dc_state *context,
+					       struct dc_stream_state *stream,
+					       const struct dc_validation_set set[],
+					       int set_count)
+{
+	int i, j;
+	struct dc_stream_status *stream_status = NULL;
+
+	for (i = 0; i < context->stream_count; i++) {
+		if (context->streams[i] == stream) {
+			stream_status = &context->stream_status[i];
+			break;
+		}
+	}
+
+	if (!stream_status)
+		ASSERT(0);
+
+	for (i = 0; i < set_count; i++)
+		if (set[i].stream == stream)
+			break;
+
+	if (i == set_count)
+		ASSERT(0);
+
+	if (set[i].plane_count != stream_status->plane_count)
+		return true;
+
+	for (j = 0; j < set[i].plane_count; j++)
+		if (set[i].plane_states[j] != stream_status->plane_states[j])
+			return true;
+
+	return false;
+}
 
 /**
- * dc_validate_global_state() - Determine if HW can support a given state
- * Checks HW resource availability and bandwidth requirement.
+ * dc_validate_with_context - Validate and update the potential new stream in the context object
+ *
+ * @dc: Used to get the current state status
+ * @set: An array of dc_validation_set with all the current streams reference
+ * @set_count: Total of streams
+ * @context: New context
+ * @fast_validate: Enable or disable fast validation
+ *
+ * This function updates the potential new stream in the context object. It
+ * creates multiple lists for the add, remove, and unchanged streams. In
+ * particular, if the unchanged streams have a plane that changed, it is
+ * necessary to remove all planes from the unchanged streams. In summary, this
+ * function is responsible for validating the new context.
+ *
+ * Return:
+ * In case of success, return DC_OK (1), otherwise, return a DC error.
+ */
+enum dc_status dc_validate_with_context(struct dc *dc,
+					const struct dc_validation_set set[],
+					int set_count,
+					struct dc_state *context,
+					bool fast_validate)
+{
+	struct dc_stream_state *unchanged_streams[MAX_PIPES] = { 0 };
+	struct dc_stream_state *del_streams[MAX_PIPES] = { 0 };
+	struct dc_stream_state *add_streams[MAX_PIPES] = { 0 };
+	int old_stream_count = context->stream_count;
+	enum dc_status res = DC_ERROR_UNEXPECTED;
+	int unchanged_streams_count = 0;
+	int del_streams_count = 0;
+	int add_streams_count = 0;
+	bool found = false;
+	int i, j, k;
+
+	DC_LOGGER_INIT(dc->ctx->logger);
+
+	/* First build a list of streams to be remove from current context */
+	for (i = 0; i < old_stream_count; i++) {
+		struct dc_stream_state *stream = context->streams[i];
+
+		for (j = 0; j < set_count; j++) {
+			if (stream == set[j].stream) {
+				found = true;
+				break;
+			}
+		}
+
+		if (!found)
+			del_streams[del_streams_count++] = stream;
+
+		found = false;
+	}
+
+	/* Second, build a list of new streams */
+	for (i = 0; i < set_count; i++) {
+		struct dc_stream_state *stream = set[i].stream;
+
+		for (j = 0; j < old_stream_count; j++) {
+			if (stream == context->streams[j]) {
+				found = true;
+				break;
+			}
+		}
+
+		if (!found)
+			add_streams[add_streams_count++] = stream;
+
+		found = false;
+	}
+
+	/* Build a list of unchanged streams which is necessary for handling
+	 * planes change such as added, removed, and updated.
+	 */
+	for (i = 0; i < set_count; i++) {
+		/* Check if stream is part of the delete list */
+		for (j = 0; j < del_streams_count; j++) {
+			if (set[i].stream == del_streams[j]) {
+				found = true;
+				break;
+			}
+		}
+
+		if (!found) {
+			/* Check if stream is part of the add list */
+			for (j = 0; j < add_streams_count; j++) {
+				if (set[i].stream == add_streams[j]) {
+					found = true;
+					break;
+				}
+			}
+		}
+
+		if (!found)
+			unchanged_streams[unchanged_streams_count++] = set[i].stream;
+
+		found = false;
+	}
+
+	/* Remove all planes for unchanged streams if planes changed */
+	for (i = 0; i < unchanged_streams_count; i++) {
+		if (planes_changed_for_existing_stream(context,
+						       unchanged_streams[i],
+						       set,
+						       set_count)) {
+			if (!dc_rem_all_planes_for_stream(dc,
+							  unchanged_streams[i],
+							  context)) {
+				res = DC_FAIL_DETACH_SURFACES;
+				goto fail;
+			}
+		}
+	}
+
+	/* Remove all planes for removed streams and then remove the streams */
+	for (i = 0; i < del_streams_count; i++) {
+		/* Need to cpy the dwb data from the old stream in order to efc to work */
+		if (del_streams[i]->num_wb_info > 0) {
+			for (j = 0; j < add_streams_count; j++) {
+				if (del_streams[i]->sink == add_streams[j]->sink) {
+					add_streams[j]->num_wb_info = del_streams[i]->num_wb_info;
+					for (k = 0; k < del_streams[i]->num_wb_info; k++)
+						add_streams[j]->writeback_info[k] = del_streams[i]->writeback_info[k];
+				}
+			}
+		}
+
+		if (!dc_rem_all_planes_for_stream(dc, del_streams[i], context)) {
+			res = DC_FAIL_DETACH_SURFACES;
+			goto fail;
+		}
+
+		res = dc_remove_stream_from_ctx(dc, context, del_streams[i]);
+		if (res != DC_OK)
+			goto fail;
+	}
+
+	/* Swap seamless boot stream to pipe 0 (if needed) to ensure pipe_ctx
+	 * matches. This may change in the future if seamless_boot_stream can be
+	 * multiple.
+	 */
+	for (i = 0; i < add_streams_count; i++) {
+		mark_seamless_boot_stream(dc, add_streams[i]);
+		if (add_streams[i]->apply_seamless_boot_optimization && i != 0) {
+			struct dc_stream_state *temp = add_streams[0];
+
+			add_streams[0] = add_streams[i];
+			add_streams[i] = temp;
+			break;
+		}
+	}
+
+	/* Add new streams and then add all planes for the new stream */
+	for (i = 0; i < add_streams_count; i++) {
+		calculate_phy_pix_clks(add_streams[i]);
+		res = dc_add_stream_to_ctx(dc, context, add_streams[i]);
+		if (res != DC_OK)
+			goto fail;
+
+		if (!add_all_planes_for_stream(dc, add_streams[i], set, set_count, context)) {
+			res = DC_FAIL_ATTACH_SURFACES;
+			goto fail;
+		}
+	}
+
+	/* Add all planes for unchanged streams if planes changed */
+	for (i = 0; i < unchanged_streams_count; i++) {
+		if (planes_changed_for_existing_stream(context,
+						       unchanged_streams[i],
+						       set,
+						       set_count)) {
+			if (!add_all_planes_for_stream(dc, unchanged_streams[i], set, set_count, context)) {
+				res = DC_FAIL_ATTACH_SURFACES;
+				goto fail;
+			}
+		}
+	}
+
+	res = dc_validate_global_state(dc, context, fast_validate);
+
+fail:
+	if (res != DC_OK)
+		DC_LOG_WARNING("%s:resource validation failed, dc_status:%d\n",
+			       __func__,
+			       res);
+
+	return res;
+}
+
+/**
+ * dc_validate_global_state() - Determine if hardware can support a given state
+ *
  * @dc: dc struct for this driver
  * @new_ctx: state to be validated
  * @fast_validate: set to true if only yes/no to support matters
  *
- * Return: DC_OK if the result can be programmed.  Otherwise, an error code.
+ * Checks hardware resource availability and bandwidth requirement.
+ *
+ * Return:
+ * DC_OK if the result can be programmed. Otherwise, an error code.
  */
 enum dc_status dc_validate_global_state(
 		struct dc *dc,
@@ -3757,4 +3983,4 @@ bool dc_resource_acquire_secondary_pipe_for_mpc_odm(
 	}
 
 	return true;
-}
\ No newline at end of file
+}
diff --git a/sys/dev/pci/drm/amd/display/dc/dc.h b/sys/dev/pci/drm/amd/display/dc/dc.h
index bc185452d..b7a18d422 100644
--- a/sys/dev/pci/drm/amd/display/dc/dc.h
+++ b/sys/dev/pci/drm/amd/display/dc/dc.h
@@ -1298,6 +1298,12 @@ enum dc_status dc_validate_plane(struct dc *dc, const struct dc_plane_state *pla
 
 void get_clock_requirements_for_state(struct dc_state *state, struct AsicStateEx *info);
 
+enum dc_status dc_validate_with_context(struct dc *dc,
+					const struct dc_validation_set set[],
+					int set_count,
+					struct dc_state *context,
+					bool fast_validate);
+
 bool dc_set_generic_gpio_for_stereo(bool enable,
 		struct gpio_service *gpio_service);
 
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index a6fde27d1..394027118 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -2284,6 +2284,12 @@ void dcn10_enable_timing_synchronization(
 		opp = grouped_pipes[i]->stream_res.opp;
 		tg = grouped_pipes[i]->stream_res.tg;
 		tg->funcs->get_otg_active_size(tg, &width, &height);
+
+		if (!tg->funcs->is_tg_enabled(tg)) {
+			DC_SYNC_INFO("Skipping timing sync on disabled OTG\n");
+			return;
+		}
+
 		if (opp->funcs->opp_program_dpg_dimensions)
 			opp->funcs->opp_program_dpg_dimensions(opp, width, 2*(height) + 1);
 	}
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn30/dcn30_dpp.c b/sys/dev/pci/drm/amd/display/dc/dcn30/dcn30_dpp.c
index e5b7ef742..50dc83404 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn30/dcn30_dpp.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn30/dcn30_dpp.c
@@ -357,8 +357,11 @@ void dpp3_set_cursor_attributes(
 	int cur_rom_en = 0;
 
 	if (color_format == CURSOR_MODE_COLOR_PRE_MULTIPLIED_ALPHA ||
-		color_format == CURSOR_MODE_COLOR_UN_PRE_MULTIPLIED_ALPHA)
-		cur_rom_en = 1;
+		color_format == CURSOR_MODE_COLOR_UN_PRE_MULTIPLIED_ALPHA) {
+		if (cursor_attributes->attribute_flags.bits.ENABLE_CURSOR_DEGAMMA) {
+			cur_rom_en = 1;
+		}
+	}
 
 	REG_UPDATE_3(CURSOR0_CONTROL,
 			CUR0_MODE, color_format,
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_optc.c b/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_optc.c
index fe941b103..a974f86e7 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_optc.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_optc.c
@@ -167,6 +167,13 @@ static void optc32_phantom_crtc_post_enable(struct timing_generator *optc)
 	REG_WAIT(OTG_CLOCK_CONTROL, OTG_BUSY, 0, 1, 100000);
 }
 
+static void optc32_disable_phantom_otg(struct timing_generator *optc)
+{
+	struct optc *optc1 = DCN10TG_FROM_TG(optc);
+
+	REG_UPDATE(OTG_CONTROL, OTG_MASTER_EN, 0);
+}
+
 static void optc32_set_odm_bypass(struct timing_generator *optc,
 		const struct dc_crtc_timing *dc_crtc_timing)
 {
@@ -260,6 +267,7 @@ static struct timing_generator_funcs dcn32_tg_funcs = {
 		.enable_crtc = optc32_enable_crtc,
 		.disable_crtc = optc32_disable_crtc,
 		.phantom_crtc_post_enable = optc32_phantom_crtc_post_enable,
+		.disable_phantom_crtc = optc32_disable_phantom_otg,
 		/* used by enable_timing_synchronization. Not need for FPGA */
 		.is_counter_moving = optc1_is_counter_moving,
 		.get_position = optc1_get_position,
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_resource.c b/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_resource.c
index 814620e66..2b8700b29 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_resource.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_resource.c
@@ -1719,6 +1719,27 @@ static struct dc_stream_state *dcn32_enable_phantom_stream(struct dc *dc,
 	return phantom_stream;
 }
 
+void dcn32_retain_phantom_pipes(struct dc *dc, struct dc_state *context)
+{
+	int i;
+	struct dc_plane_state *phantom_plane = NULL;
+	struct dc_stream_state *phantom_stream = NULL;
+
+	for (i = 0; i < dc->res_pool->pipe_count; i++) {
+		struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i];
+
+		if (!pipe->top_pipe && !pipe->prev_odm_pipe &&
+				pipe->plane_state && pipe->stream &&
+				pipe->stream->mall_stream_config.type == SUBVP_PHANTOM) {
+			phantom_plane = pipe->plane_state;
+			phantom_stream = pipe->stream;
+
+			dc_plane_state_retain(phantom_plane);
+			dc_stream_retain(phantom_stream);
+		}
+	}
+}
+
 // return true if removed piped from ctx, false otherwise
 bool dcn32_remove_phantom_pipes(struct dc *dc, struct dc_state *context)
 {
@@ -2035,6 +2056,7 @@ static struct resource_funcs dcn32_res_pool_funcs = {
 	.update_soc_for_wm_a = dcn30_update_soc_for_wm_a,
 	.add_phantom_pipes = dcn32_add_phantom_pipes,
 	.remove_phantom_pipes = dcn32_remove_phantom_pipes,
+	.retain_phantom_pipes = dcn32_retain_phantom_pipes,
 };
 
 static uint32_t read_pipe_fuses(struct dc_context *ctx)
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_resource.h b/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_resource.h
index 615244a1f..026cf13d2 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_resource.h
+++ b/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_resource.h
@@ -83,6 +83,9 @@ bool dcn32_release_post_bldn_3dlut(
 bool dcn32_remove_phantom_pipes(struct dc *dc,
 		struct dc_state *context);
 
+void dcn32_retain_phantom_pipes(struct dc *dc,
+		struct dc_state *context);
+
 void dcn32_add_phantom_pipes(struct dc *dc,
 		struct dc_state *context,
 		display_e2e_pipe_params_st *pipes,
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn321/dcn321_resource.c b/sys/dev/pci/drm/amd/display/dc/dcn321/dcn321_resource.c
index 213ff3672..aed92ced7 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn321/dcn321_resource.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn321/dcn321_resource.c
@@ -1619,6 +1619,7 @@ static struct resource_funcs dcn321_res_pool_funcs = {
 	.update_soc_for_wm_a = dcn30_update_soc_for_wm_a,
 	.add_phantom_pipes = dcn32_add_phantom_pipes,
 	.remove_phantom_pipes = dcn32_remove_phantom_pipes,
+	.retain_phantom_pipes = dcn32_retain_phantom_pipes,
 };
 
 static uint32_t read_pipe_fuses(struct dc_context *ctx)
diff --git a/sys/dev/pci/drm/amd/display/dc/inc/core_types.h b/sys/dev/pci/drm/amd/display/dc/inc/core_types.h
index c8d8a1d3c..4a968de5b 100644
--- a/sys/dev/pci/drm/amd/display/dc/inc/core_types.h
+++ b/sys/dev/pci/drm/amd/display/dc/inc/core_types.h
@@ -234,6 +234,7 @@ struct resource_funcs {
             unsigned int index);
 
 	bool (*remove_phantom_pipes)(struct dc *dc, struct dc_state *context);
+	void (*retain_phantom_pipes)(struct dc *dc, struct dc_state *context);
 	void (*get_panel_config_defaults)(struct dc_panel_config *panel_config);
 };
 
diff --git a/sys/dev/pci/drm/amd/display/dc/inc/hw/timing_generator.h b/sys/dev/pci/drm/amd/display/dc/inc/hw/timing_generator.h
index 060668098..e67abcbd0 100644
--- a/sys/dev/pci/drm/amd/display/dc/inc/hw/timing_generator.h
+++ b/sys/dev/pci/drm/amd/display/dc/inc/hw/timing_generator.h
@@ -185,6 +185,7 @@ struct timing_generator_funcs {
 #ifdef CONFIG_DRM_AMD_DC_DCN
 	void (*phantom_crtc_post_enable)(struct timing_generator *tg);
 #endif
+	void (*disable_phantom_crtc)(struct timing_generator *tg);
 	bool (*immediate_disable_crtc)(struct timing_generator *tg);
 	bool (*is_counter_moving)(struct timing_generator *tg);
 	void (*get_position)(struct timing_generator *tg,
diff --git a/sys/dev/pci/drm/amd/include/atomfirmware.h b/sys/dev/pci/drm/amd/include/atomfirmware.h
index ff855cb21..bbe1337a8 100644
--- a/sys/dev/pci/drm/amd/include/atomfirmware.h
+++ b/sys/dev/pci/drm/amd/include/atomfirmware.h
@@ -705,20 +705,65 @@ struct atom_gpio_pin_lut_v2_1
 };
 
 
-/* 
-  ***************************************************************************
-    Data Table vram_usagebyfirmware  structure
-  ***************************************************************************
-*/
+/*
+ * VBIOS/PRE-OS always reserve a FB region at the top of frame buffer. driver should not write
+ * access that region. driver can allocate their own reservation region as long as it does not
+ * overlap firwmare's reservation region.
+ * if (pre-NV1X) atom data table firmwareInfoTable version < 3.3:
+ * in this case, atom data table vram_usagebyfirmwareTable version always <= 2.1
+ *   if VBIOS/UEFI GOP is posted:
+ *     VBIOS/UEFIGOP update used_by_firmware_in_kb = total reserved size by VBIOS
+ *     update start_address_in_kb = total_mem_size_in_kb - used_by_firmware_in_kb;
+ *     ( total_mem_size_in_kb = reg(CONFIG_MEMSIZE)<<10)
+ *     driver can allocate driver reservation region under firmware reservation,
+ *     used_by_driver_in_kb = driver reservation size
+ *     driver reservation start address =  (start_address_in_kb - used_by_driver_in_kb)
+ *     Comment1[hchan]: There is only one reservation at the beginning of the FB reserved by
+ *     host driver. Host driver would overwrite the table with the following
+ *     used_by_firmware_in_kb = total reserved size for pf-vf info exchange and
+ *     set SRIOV_MSG_SHARE_RESERVATION mask start_address_in_kb = 0
+ *   else there is no VBIOS reservation region:
+ *     driver must allocate driver reservation region at top of FB.
+ *     driver set used_by_driver_in_kb = driver reservation size
+ *     driver reservation start address =  (total_mem_size_in_kb - used_by_driver_in_kb)
+ *     same as Comment1
+ * else (NV1X and after):
+ *   if VBIOS/UEFI GOP is posted:
+ *     VBIOS/UEFIGOP update:
+ *       used_by_firmware_in_kb = atom_firmware_Info_v3_3.fw_reserved_size_in_kb;
+ *       start_address_in_kb = total_mem_size_in_kb - used_by_firmware_in_kb;
+ *       (total_mem_size_in_kb = reg(CONFIG_MEMSIZE)<<10)
+ *   if vram_usagebyfirmwareTable version <= 2.1:
+ *     driver can allocate driver reservation region under firmware reservation,
+ *     driver set used_by_driver_in_kb = driver reservation size
+ *     driver reservation start address = start_address_in_kb - used_by_driver_in_kb
+ *     same as Comment1
+ *   else driver can:
+ *     allocate it reservation any place as long as it does overlap pre-OS FW reservation area
+ *     set used_by_driver_region0_in_kb = driver reservation size
+ *     set driver_region0_start_address_in_kb =  driver reservation region start address
+ *     Comment2[hchan]: Host driver can set used_by_firmware_in_kb and start_address_in_kb to
+ *     zero as the reservation for VF as it doesn’t exist.  And Host driver should also
+ *     update atom_firmware_Info table to remove the same VBIOS reservation as well.
+ */
 
 struct vram_usagebyfirmware_v2_1
 {
-  struct  atom_common_table_header  table_header;
-  uint32_t  start_address_in_kb;
-  uint16_t  used_by_firmware_in_kb;
-  uint16_t  used_by_driver_in_kb; 
+	struct  atom_common_table_header  table_header;
+	uint32_t  start_address_in_kb;
+	uint16_t  used_by_firmware_in_kb;
+	uint16_t  used_by_driver_in_kb;
 };
 
+struct vram_usagebyfirmware_v2_2 {
+	struct  atom_common_table_header  table_header;
+	uint32_t  fw_region_start_address_in_kb;
+	uint16_t  used_by_firmware_in_kb;
+	uint16_t  reserved;
+	uint32_t  driver_region0_start_address_in_kb;
+	uint32_t  used_by_driver_region0_in_kb;
+	uint32_t  reserved32[7];
+};
 
 /* 
   ***************************************************************************
diff --git a/sys/dev/pci/drm/amd/include/kgd_pp_interface.h b/sys/dev/pci/drm/amd/include/kgd_pp_interface.h
index d18162e9e..f3d64c78f 100644
--- a/sys/dev/pci/drm/amd/include/kgd_pp_interface.h
+++ b/sys/dev/pci/drm/amd/include/kgd_pp_interface.h
@@ -139,6 +139,8 @@ enum amd_pp_sensors {
 	AMDGPU_PP_SENSOR_MIN_FAN_RPM,
 	AMDGPU_PP_SENSOR_MAX_FAN_RPM,
 	AMDGPU_PP_SENSOR_VCN_POWER_STATE,
+	AMDGPU_PP_SENSOR_PEAK_PSTATE_SCLK,
+	AMDGPU_PP_SENSOR_PEAK_PSTATE_MCLK,
 };
 
 enum amd_pp_task {
diff --git a/sys/dev/pci/drm/amd/pm/inc/amdgpu_dpm.h b/sys/dev/pci/drm/amd/pm/inc/amdgpu_dpm.h
index 76abd40b7..2a239451a 100644
--- a/sys/dev/pci/drm/amd/pm/inc/amdgpu_dpm.h
+++ b/sys/dev/pci/drm/amd/pm/inc/amdgpu_dpm.h
@@ -89,6 +89,8 @@ struct amdgpu_dpm_thermal {
 	int                max_mem_crit_temp;
 	/* memory max emergency(shutdown) temp */
 	int                max_mem_emergency_temp;
+	/* SWCTF threshold */
+	int                sw_ctf_threshold;
 	/* was last interrupt low to high or high to low */
 	bool               high_to_low;
 	/* interrupt source */
diff --git a/sys/dev/pci/drm/amd/pm/powerplay/amd_powerplay.c b/sys/dev/pci/drm/amd/pm/powerplay/amd_powerplay.c
index ff4963a40..aa1b7a4cb 100644
--- a/sys/dev/pci/drm/amd/pm/powerplay/amd_powerplay.c
+++ b/sys/dev/pci/drm/amd/pm/powerplay/amd_powerplay.c
@@ -26,6 +26,7 @@
 #include <linux/gfp.h>
 #include <linux/slab.h>
 #include <linux/firmware.h>
+#include <linux/reboot.h>
 #include "amd_shared.h"
 #include "amd_powerplay.h"
 #include "power_state.h"
@@ -91,6 +92,45 @@ static int pp_early_init(void *handle)
 	return 0;
 }
 
+static void pp_swctf_delayed_work_handler(struct work_struct *work)
+{
+	struct pp_hwmgr *hwmgr =
+		container_of(work, struct pp_hwmgr, swctf_delayed_work.work);
+	struct amdgpu_device *adev = hwmgr->adev;
+	struct amdgpu_dpm_thermal *range =
+				&adev->pm.dpm.thermal;
+	uint32_t gpu_temperature, size;
+	int ret;
+
+	/*
+	 * If the hotspot/edge temperature is confirmed as below SW CTF setting point
+	 * after the delay enforced, nothing will be done.
+	 * Otherwise, a graceful shutdown will be performed to prevent further damage.
+	 */
+	if (range->sw_ctf_threshold &&
+	    hwmgr->hwmgr_func->read_sensor) {
+		ret = hwmgr->hwmgr_func->read_sensor(hwmgr,
+						     AMDGPU_PP_SENSOR_HOTSPOT_TEMP,
+						     &gpu_temperature,
+						     &size);
+		/*
+		 * For some legacy ASICs, hotspot temperature retrieving might be not
+		 * supported. Check the edge temperature instead then.
+		 */
+		if (ret == -EOPNOTSUPP)
+			ret = hwmgr->hwmgr_func->read_sensor(hwmgr,
+							     AMDGPU_PP_SENSOR_EDGE_TEMP,
+							     &gpu_temperature,
+							     &size);
+		if (!ret && gpu_temperature / 1000 < range->sw_ctf_threshold)
+			return;
+	}
+
+	dev_emerg(adev->dev, "ERROR: GPU over temperature range(SW CTF) detected!\n");
+	dev_emerg(adev->dev, "ERROR: System is going to shutdown due to GPU SW CTF!\n");
+	orderly_poweroff(true);
+}
+
 static int pp_sw_init(void *handle)
 {
 	struct amdgpu_device *adev = handle;
@@ -101,6 +141,10 @@ static int pp_sw_init(void *handle)
 
 	pr_debug("powerplay sw init %s\n", ret ? "failed" : "successfully");
 
+	if (!ret)
+		INIT_DELAYED_WORK(&hwmgr->swctf_delayed_work,
+				  pp_swctf_delayed_work_handler);
+
 	return ret;
 }
 
@@ -136,6 +180,8 @@ static int pp_hw_fini(void *handle)
 	struct amdgpu_device *adev = handle;
 	struct pp_hwmgr *hwmgr = adev->powerplay.pp_handle;
 
+	cancel_delayed_work_sync(&hwmgr->swctf_delayed_work);
+
 	hwmgr_hw_fini(hwmgr);
 
 	return 0;
@@ -222,6 +268,8 @@ static int pp_suspend(void *handle)
 	struct amdgpu_device *adev = handle;
 	struct pp_hwmgr *hwmgr = adev->powerplay.pp_handle;
 
+	cancel_delayed_work_sync(&hwmgr->swctf_delayed_work);
+
 	return hwmgr_suspend(hwmgr);
 }
 
@@ -769,10 +817,16 @@ static int pp_dpm_read_sensor(void *handle, int idx,
 
 	switch (idx) {
 	case AMDGPU_PP_SENSOR_STABLE_PSTATE_SCLK:
-		*((uint32_t *)value) = hwmgr->pstate_sclk;
+		*((uint32_t *)value) = hwmgr->pstate_sclk * 100;
 		return 0;
 	case AMDGPU_PP_SENSOR_STABLE_PSTATE_MCLK:
-		*((uint32_t *)value) = hwmgr->pstate_mclk;
+		*((uint32_t *)value) = hwmgr->pstate_mclk * 100;
+		return 0;
+	case AMDGPU_PP_SENSOR_PEAK_PSTATE_SCLK:
+		*((uint32_t *)value) = hwmgr->pstate_sclk_peak * 100;
+		return 0;
+	case AMDGPU_PP_SENSOR_PEAK_PSTATE_MCLK:
+		*((uint32_t *)value) = hwmgr->pstate_mclk_peak * 100;
 		return 0;
 	case AMDGPU_PP_SENSOR_MIN_FAN_RPM:
 		*((uint32_t *)value) = hwmgr->thermal_controller.fanInfo.ulMinRPM;
diff --git a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/hardwaremanager.c b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/hardwaremanager.c
index 981dc8c71..90452b66e 100644
--- a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/hardwaremanager.c
+++ b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/hardwaremanager.c
@@ -241,7 +241,8 @@ int phm_start_thermal_controller(struct pp_hwmgr *hwmgr)
 		TEMP_RANGE_MAX,
 		TEMP_RANGE_MIN,
 		TEMP_RANGE_MAX,
-		TEMP_RANGE_MAX};
+		TEMP_RANGE_MAX,
+		0};
 	struct amdgpu_device *adev = hwmgr->adev;
 
 	if (!hwmgr->not_vf)
@@ -265,6 +266,7 @@ int phm_start_thermal_controller(struct pp_hwmgr *hwmgr)
 	adev->pm.dpm.thermal.min_mem_temp = range.mem_min;
 	adev->pm.dpm.thermal.max_mem_crit_temp = range.mem_crit_max;
 	adev->pm.dpm.thermal.max_mem_emergency_temp = range.mem_emergency_max;
+	adev->pm.dpm.thermal.sw_ctf_threshold = range.sw_ctf_threshold;
 
 	return ret;
 }
diff --git a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c
index eec9518b0..a25737cbb 100644
--- a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c
+++ b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c
@@ -375,6 +375,17 @@ static int smu10_enable_gfx_off(struct pp_hwmgr *hwmgr)
 	return 0;
 }
 
+static void smu10_populate_umdpstate_clocks(struct pp_hwmgr *hwmgr)
+{
+	hwmgr->pstate_sclk = SMU10_UMD_PSTATE_GFXCLK;
+	hwmgr->pstate_mclk = SMU10_UMD_PSTATE_FCLK;
+
+	smum_send_msg_to_smc(hwmgr,
+			     PPSMC_MSG_GetMaxGfxclkFrequency,
+			     &hwmgr->pstate_sclk_peak);
+	hwmgr->pstate_mclk_peak = SMU10_UMD_PSTATE_PEAK_FCLK;
+}
+
 static int smu10_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
 {
 	struct amdgpu_device *adev = hwmgr->adev;
@@ -398,6 +409,8 @@ static int smu10_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
 			return ret;
 	}
 
+	smu10_populate_umdpstate_clocks(hwmgr);
+
 	return 0;
 }
 
@@ -574,9 +587,6 @@ static int smu10_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
 
 	hwmgr->platform_descriptor.minimumClocksReductionPercentage = 50;
 
-	hwmgr->pstate_sclk = SMU10_UMD_PSTATE_GFXCLK * 100;
-	hwmgr->pstate_mclk = SMU10_UMD_PSTATE_FCLK * 100;
-
 	/* enable the pp_od_clk_voltage sysfs file */
 	hwmgr->od_enabled = 1;
 	/* disabled fine grain tuning function by default */
diff --git a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
index 98dfe66d4..66eda8e0d 100644
--- a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+++ b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
@@ -1501,6 +1501,67 @@ static int smu7_populate_edc_leakage_registers(struct pp_hwmgr *hwmgr)
 	return ret;
 }
 
+static void smu7_populate_umdpstate_clocks(struct pp_hwmgr *hwmgr)
+{
+	struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
+	struct smu7_dpm_table *golden_dpm_table = &data->golden_dpm_table;
+	int32_t tmp_sclk, count, percentage;
+
+	if (golden_dpm_table->mclk_table.count == 1) {
+		percentage = 70;
+		hwmgr->pstate_mclk = golden_dpm_table->mclk_table.dpm_levels[0].value;
+	} else {
+		percentage = 100 * golden_dpm_table->sclk_table.dpm_levels[golden_dpm_table->sclk_table.count - 1].value /
+				golden_dpm_table->mclk_table.dpm_levels[golden_dpm_table->mclk_table.count - 1].value;
+		hwmgr->pstate_mclk = golden_dpm_table->mclk_table.dpm_levels[golden_dpm_table->mclk_table.count - 2].value;
+	}
+
+	tmp_sclk = hwmgr->pstate_mclk * percentage / 100;
+
+	if (hwmgr->pp_table_version == PP_TABLE_V0) {
+		struct phm_clock_voltage_dependency_table *vddc_dependency_on_sclk =
+			hwmgr->dyn_state.vddc_dependency_on_sclk;
+
+		for (count = vddc_dependency_on_sclk->count - 1; count >= 0; count--) {
+			if (tmp_sclk >= vddc_dependency_on_sclk->entries[count].clk) {
+				hwmgr->pstate_sclk = vddc_dependency_on_sclk->entries[count].clk;
+				break;
+			}
+		}
+		if (count < 0)
+			hwmgr->pstate_sclk = vddc_dependency_on_sclk->entries[0].clk;
+
+		hwmgr->pstate_sclk_peak =
+			vddc_dependency_on_sclk->entries[vddc_dependency_on_sclk->count - 1].clk;
+	} else if (hwmgr->pp_table_version == PP_TABLE_V1) {
+		struct phm_ppt_v1_information *table_info =
+			(struct phm_ppt_v1_information *)(hwmgr->pptable);
+		struct phm_ppt_v1_clock_voltage_dependency_table *vdd_dep_on_sclk =
+			table_info->vdd_dep_on_sclk;
+
+		for (count = vdd_dep_on_sclk->count - 1; count >= 0; count--) {
+			if (tmp_sclk >= vdd_dep_on_sclk->entries[count].clk) {
+				hwmgr->pstate_sclk = vdd_dep_on_sclk->entries[count].clk;
+				break;
+			}
+		}
+		if (count < 0)
+			hwmgr->pstate_sclk = vdd_dep_on_sclk->entries[0].clk;
+
+		hwmgr->pstate_sclk_peak =
+			vdd_dep_on_sclk->entries[vdd_dep_on_sclk->count - 1].clk;
+	}
+
+	hwmgr->pstate_mclk_peak =
+		golden_dpm_table->mclk_table.dpm_levels[golden_dpm_table->mclk_table.count - 1].value;
+
+	/* make sure the output is in Mhz */
+	hwmgr->pstate_sclk /= 100;
+	hwmgr->pstate_mclk /= 100;
+	hwmgr->pstate_sclk_peak /= 100;
+	hwmgr->pstate_mclk_peak /= 100;
+}
+
 static int smu7_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
 {
 	int tmp_result = 0;
@@ -1625,6 +1686,8 @@ static int smu7_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
 	PP_ASSERT_WITH_CODE((0 == tmp_result),
 			"pcie performance request failed!", result = tmp_result);
 
+	smu7_populate_umdpstate_clocks(hwmgr);
+
 	return 0;
 }
 
@@ -3143,15 +3206,12 @@ static int smu7_get_profiling_clk(struct pp_hwmgr *hwmgr, enum amd_dpm_forced_le
 		for (count = hwmgr->dyn_state.vddc_dependency_on_sclk->count-1;
 			count >= 0; count--) {
 			if (tmp_sclk >= hwmgr->dyn_state.vddc_dependency_on_sclk->entries[count].clk) {
-				tmp_sclk = hwmgr->dyn_state.vddc_dependency_on_sclk->entries[count].clk;
 				*sclk_mask = count;
 				break;
 			}
 		}
-		if (count < 0 || level == AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK) {
+		if (count < 0 || level == AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK)
 			*sclk_mask = 0;
-			tmp_sclk = hwmgr->dyn_state.vddc_dependency_on_sclk->entries[0].clk;
-		}
 
 		if (level == AMD_DPM_FORCED_LEVEL_PROFILE_PEAK)
 			*sclk_mask = hwmgr->dyn_state.vddc_dependency_on_sclk->count-1;
@@ -3161,15 +3221,12 @@ static int smu7_get_profiling_clk(struct pp_hwmgr *hwmgr, enum amd_dpm_forced_le
 
 		for (count = table_info->vdd_dep_on_sclk->count-1; count >= 0; count--) {
 			if (tmp_sclk >= table_info->vdd_dep_on_sclk->entries[count].clk) {
-				tmp_sclk = table_info->vdd_dep_on_sclk->entries[count].clk;
 				*sclk_mask = count;
 				break;
 			}
 		}
-		if (count < 0 || level == AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK) {
+		if (count < 0 || level == AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK)
 			*sclk_mask = 0;
-			tmp_sclk =  table_info->vdd_dep_on_sclk->entries[0].clk;
-		}
 
 		if (level == AMD_DPM_FORCED_LEVEL_PROFILE_PEAK)
 			*sclk_mask = table_info->vdd_dep_on_sclk->count - 1;
@@ -3181,8 +3238,6 @@ static int smu7_get_profiling_clk(struct pp_hwmgr *hwmgr, enum amd_dpm_forced_le
 		*mclk_mask = golden_dpm_table->mclk_table.count - 1;
 
 	*pcie_mask = data->dpm_table.pcie_speed_table.count - 1;
-	hwmgr->pstate_sclk = tmp_sclk;
-	hwmgr->pstate_mclk = tmp_mclk;
 
 	return 0;
 }
@@ -3195,9 +3250,6 @@ static int smu7_force_dpm_level(struct pp_hwmgr *hwmgr,
 	uint32_t mclk_mask = 0;
 	uint32_t pcie_mask = 0;
 
-	if (hwmgr->pstate_sclk == 0)
-		smu7_get_profiling_clk(hwmgr, level, &sclk_mask, &mclk_mask, &pcie_mask);
-
 	switch (level) {
 	case AMD_DPM_FORCED_LEVEL_HIGH:
 		ret = smu7_force_dpm_highest(hwmgr);
@@ -5381,6 +5433,8 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
 		thermal_data->max = data->thermal_temp_setting.temperature_shutdown *
 			PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
 
+	thermal_data->sw_ctf_threshold = thermal_data->max;
+
 	return 0;
 }
 
diff --git a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c
index 87554f0f7..f8d864e7e 100644
--- a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c
+++ b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c
@@ -1016,6 +1016,18 @@ static void smu8_reset_acp_boot_level(struct pp_hwmgr *hwmgr)
 	data->acp_boot_level = 0xff;
 }
 
+static void smu8_populate_umdpstate_clocks(struct pp_hwmgr *hwmgr)
+{
+	struct phm_clock_voltage_dependency_table *table =
+				hwmgr->dyn_state.vddc_dependency_on_sclk;
+
+	hwmgr->pstate_sclk = table->entries[0].clk / 100;
+	hwmgr->pstate_mclk = 0;
+
+	hwmgr->pstate_sclk_peak = table->entries[table->count - 1].clk / 100;
+	hwmgr->pstate_mclk_peak = 0;
+}
+
 static int smu8_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
 {
 	smu8_program_voting_clients(hwmgr);
@@ -1024,6 +1036,8 @@ static int smu8_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
 	smu8_program_bootup_state(hwmgr);
 	smu8_reset_acp_boot_level(hwmgr);
 
+	smu8_populate_umdpstate_clocks(hwmgr);
+
 	return 0;
 }
 
@@ -1167,8 +1181,6 @@ static int smu8_phm_unforce_dpm_levels(struct pp_hwmgr *hwmgr)
 
 	data->sclk_dpm.soft_min_clk = table->entries[0].clk;
 	data->sclk_dpm.hard_min_clk = table->entries[0].clk;
-	hwmgr->pstate_sclk = table->entries[0].clk;
-	hwmgr->pstate_mclk = 0;
 
 	level = smu8_get_max_sclk_level(hwmgr) - 1;
 
diff --git a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu_helper.c b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu_helper.c
index bfe80ac0a..d0b1ab6c4 100644
--- a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu_helper.c
+++ b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/smu_helper.c
@@ -603,21 +603,17 @@ int phm_irq_process(struct amdgpu_device *adev,
 			   struct amdgpu_irq_src *source,
 			   struct amdgpu_iv_entry *entry)
 {
+	struct pp_hwmgr *hwmgr = adev->powerplay.pp_handle;
 	uint32_t client_id = entry->client_id;
 	uint32_t src_id = entry->src_id;
 
 	if (client_id == AMDGPU_IRQ_CLIENTID_LEGACY) {
 		if (src_id == VISLANDS30_IV_SRCID_CG_TSS_THERMAL_LOW_TO_HIGH) {
-			dev_emerg(adev->dev, "ERROR: GPU over temperature range(SW CTF) detected!\n");
-			/*
-			 * SW CTF just occurred.
-			 * Try to do a graceful shutdown to prevent further damage.
-			 */
-			dev_emerg(adev->dev, "ERROR: System is going to shutdown due to GPU SW CTF!\n");
-			orderly_poweroff(true);
-		} else if (src_id == VISLANDS30_IV_SRCID_CG_TSS_THERMAL_HIGH_TO_LOW)
+			schedule_delayed_work(&hwmgr->swctf_delayed_work,
+					      msecs_to_jiffies(AMDGPU_SWCTF_EXTRA_DELAY));
+		} else if (src_id == VISLANDS30_IV_SRCID_CG_TSS_THERMAL_HIGH_TO_LOW) {
 			dev_emerg(adev->dev, "ERROR: GPU under temperature range detected!\n");
-		else if (src_id == VISLANDS30_IV_SRCID_GPIO_19) {
+		} else if (src_id == VISLANDS30_IV_SRCID_GPIO_19) {
 			dev_emerg(adev->dev, "ERROR: GPU HW Critical Temperature Fault(aka CTF) detected!\n");
 			/*
 			 * HW CTF just occurred. Shutdown to prevent further damage.
@@ -626,15 +622,10 @@ int phm_irq_process(struct amdgpu_device *adev,
 			orderly_poweroff(true);
 		}
 	} else if (client_id == SOC15_IH_CLIENTID_THM) {
-		if (src_id == 0) {
-			dev_emerg(adev->dev, "ERROR: GPU over temperature range(SW CTF) detected!\n");
-			/*
-			 * SW CTF just occurred.
-			 * Try to do a graceful shutdown to prevent further damage.
-			 */
-			dev_emerg(adev->dev, "ERROR: System is going to shutdown due to GPU SW CTF!\n");
-			orderly_poweroff(true);
-		} else
+		if (src_id == 0)
+			schedule_delayed_work(&hwmgr->swctf_delayed_work,
+					      msecs_to_jiffies(AMDGPU_SWCTF_EXTRA_DELAY));
+		else
 			dev_emerg(adev->dev, "ERROR: GPU under temperature range detected!\n");
 	} else if (client_id == SOC15_IH_CLIENTID_ROM_SMUIO) {
 		dev_emerg(adev->dev, "ERROR: GPU HW Critical Temperature Fault(aka CTF) detected!\n");
diff --git a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
index bee0412d3..55709f880 100644
--- a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
+++ b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
@@ -3008,6 +3008,30 @@ static int vega10_enable_disable_PCC_limit_feature(struct pp_hwmgr *hwmgr, bool
 	return 0;
 }
 
+static void vega10_populate_umdpstate_clocks(struct pp_hwmgr *hwmgr)
+{
+	struct phm_ppt_v2_information *table_info =
+			(struct phm_ppt_v2_information *)(hwmgr->pptable);
+
+	if (table_info->vdd_dep_on_sclk->count > VEGA10_UMD_PSTATE_GFXCLK_LEVEL &&
+	    table_info->vdd_dep_on_mclk->count > VEGA10_UMD_PSTATE_MCLK_LEVEL) {
+		hwmgr->pstate_sclk = table_info->vdd_dep_on_sclk->entries[VEGA10_UMD_PSTATE_GFXCLK_LEVEL].clk;
+		hwmgr->pstate_mclk = table_info->vdd_dep_on_mclk->entries[VEGA10_UMD_PSTATE_MCLK_LEVEL].clk;
+	} else {
+		hwmgr->pstate_sclk = table_info->vdd_dep_on_sclk->entries[0].clk;
+		hwmgr->pstate_mclk = table_info->vdd_dep_on_mclk->entries[0].clk;
+	}
+
+	hwmgr->pstate_sclk_peak = table_info->vdd_dep_on_sclk->entries[table_info->vdd_dep_on_sclk->count - 1].clk;
+	hwmgr->pstate_mclk_peak = table_info->vdd_dep_on_mclk->entries[table_info->vdd_dep_on_mclk->count - 1].clk;
+
+	/* make sure the output is in Mhz */
+	hwmgr->pstate_sclk /= 100;
+	hwmgr->pstate_mclk /= 100;
+	hwmgr->pstate_sclk_peak /= 100;
+	hwmgr->pstate_mclk_peak /= 100;
+}
+
 static int vega10_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
 {
 	struct vega10_hwmgr *data = hwmgr->backend;
@@ -3082,6 +3106,8 @@ static int vega10_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
 				    result = tmp_result);
 	}
 
+	vega10_populate_umdpstate_clocks(hwmgr);
+
 	return result;
 }
 
@@ -4169,8 +4195,6 @@ static int vega10_get_profiling_clk_mask(struct pp_hwmgr *hwmgr, enum amd_dpm_fo
 		*sclk_mask = VEGA10_UMD_PSTATE_GFXCLK_LEVEL;
 		*soc_mask = VEGA10_UMD_PSTATE_SOCCLK_LEVEL;
 		*mclk_mask = VEGA10_UMD_PSTATE_MCLK_LEVEL;
-		hwmgr->pstate_sclk = table_info->vdd_dep_on_sclk->entries[VEGA10_UMD_PSTATE_GFXCLK_LEVEL].clk;
-		hwmgr->pstate_mclk = table_info->vdd_dep_on_mclk->entries[VEGA10_UMD_PSTATE_MCLK_LEVEL].clk;
 	}
 
 	if (level == AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK) {
@@ -4281,9 +4305,6 @@ static int vega10_dpm_force_dpm_level(struct pp_hwmgr *hwmgr,
 	uint32_t mclk_mask = 0;
 	uint32_t soc_mask = 0;
 
-	if (hwmgr->pstate_sclk == 0)
-		vega10_get_profiling_clk_mask(hwmgr, level, &sclk_mask, &mclk_mask, &soc_mask);
-
 	switch (level) {
 	case AMD_DPM_FORCED_LEVEL_HIGH:
 		ret = vega10_force_dpm_highest(hwmgr);
@@ -5221,6 +5242,9 @@ static int vega10_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
 {
 	struct vega10_hwmgr *data = hwmgr->backend;
 	PPTable_t *pp_table = &(data->smc_state_table.pp_table);
+	struct phm_ppt_v2_information *pp_table_info =
+		(struct phm_ppt_v2_information *)(hwmgr->pptable);
+	struct phm_tdp_table *tdp_table = pp_table_info->tdp_table;
 
 	memcpy(thermal_data, &SMU7ThermalWithDelayPolicy[0], sizeof(struct PP_TemperatureRange));
 
@@ -5237,6 +5261,13 @@ static int vega10_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
 	thermal_data->mem_emergency_max = (pp_table->ThbmLimit + CTF_OFFSET_HBM)*
 		PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
 
+	if (tdp_table->usSoftwareShutdownTemp > pp_table->ThotspotLimit &&
+	    tdp_table->usSoftwareShutdownTemp < VEGA10_THERMAL_MAXIMUM_ALERT_TEMP)
+		thermal_data->sw_ctf_threshold = tdp_table->usSoftwareShutdownTemp;
+	else
+		thermal_data->sw_ctf_threshold = VEGA10_THERMAL_MAXIMUM_ALERT_TEMP;
+	thermal_data->sw_ctf_threshold *= PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+
 	return 0;
 }
 
diff --git a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c
index 269ab3757..0bb537d3f 100644
--- a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c
+++ b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c
@@ -1026,6 +1026,25 @@ static int vega12_get_all_clock_ranges(struct pp_hwmgr *hwmgr)
 	return 0;
 }
 
+static void vega12_populate_umdpstate_clocks(struct pp_hwmgr *hwmgr)
+{
+	struct vega12_hwmgr *data = (struct vega12_hwmgr *)(hwmgr->backend);
+	struct vega12_single_dpm_table *gfx_dpm_table = &(data->dpm_table.gfx_table);
+	struct vega12_single_dpm_table *mem_dpm_table = &(data->dpm_table.mem_table);
+
+	if (gfx_dpm_table->count > VEGA12_UMD_PSTATE_GFXCLK_LEVEL &&
+	    mem_dpm_table->count > VEGA12_UMD_PSTATE_MCLK_LEVEL) {
+		hwmgr->pstate_sclk = gfx_dpm_table->dpm_levels[VEGA12_UMD_PSTATE_GFXCLK_LEVEL].value;
+		hwmgr->pstate_mclk = mem_dpm_table->dpm_levels[VEGA12_UMD_PSTATE_MCLK_LEVEL].value;
+	} else {
+		hwmgr->pstate_sclk = gfx_dpm_table->dpm_levels[0].value;
+		hwmgr->pstate_mclk = mem_dpm_table->dpm_levels[0].value;
+	}
+
+	hwmgr->pstate_sclk_peak = gfx_dpm_table->dpm_levels[gfx_dpm_table->count].value;
+	hwmgr->pstate_mclk_peak = mem_dpm_table->dpm_levels[mem_dpm_table->count].value;
+}
+
 static int vega12_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
 {
 	int tmp_result, result = 0;
@@ -1077,6 +1096,9 @@ static int vega12_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
 	PP_ASSERT_WITH_CODE(!result,
 			"Failed to setup default DPM tables!",
 			return result);
+
+	vega12_populate_umdpstate_clocks(hwmgr);
+
 	return result;
 }
 
@@ -2742,6 +2764,8 @@ static int vega12_notify_cac_buffer_info(struct pp_hwmgr *hwmgr,
 static int vega12_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
 		struct PP_TemperatureRange *thermal_data)
 {
+	struct phm_ppt_v3_information *pptable_information =
+		(struct phm_ppt_v3_information *)hwmgr->pptable;
 	struct vega12_hwmgr *data =
 			(struct vega12_hwmgr *)(hwmgr->backend);
 	PPTable_t *pp_table = &(data->smc_state_table.pp_table);
@@ -2760,6 +2784,8 @@ static int vega12_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
 		PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
 	thermal_data->mem_emergency_max = (pp_table->ThbmLimit + CTF_OFFSET_HBM)*
 		PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+	thermal_data->sw_ctf_threshold = pptable_information->us_software_shutdown_temp *
+		PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
 
 	return 0;
 }
diff --git a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
index 1705da11e..297d3cf38 100644
--- a/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
+++ b/sys/dev/pci/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
@@ -1555,26 +1555,23 @@ static int vega20_set_mclk_od(
 	return 0;
 }
 
-static int vega20_populate_umdpstate_clocks(
-		struct pp_hwmgr *hwmgr)
+static void vega20_populate_umdpstate_clocks(struct pp_hwmgr *hwmgr)
 {
 	struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend);
 	struct vega20_single_dpm_table *gfx_table = &(data->dpm_table.gfx_table);
 	struct vega20_single_dpm_table *mem_table = &(data->dpm_table.mem_table);
 
-	hwmgr->pstate_sclk = gfx_table->dpm_levels[0].value;
-	hwmgr->pstate_mclk = mem_table->dpm_levels[0].value;
-
 	if (gfx_table->count > VEGA20_UMD_PSTATE_GFXCLK_LEVEL &&
 	    mem_table->count > VEGA20_UMD_PSTATE_MCLK_LEVEL) {
 		hwmgr->pstate_sclk = gfx_table->dpm_levels[VEGA20_UMD_PSTATE_GFXCLK_LEVEL].value;
 		hwmgr->pstate_mclk = mem_table->dpm_levels[VEGA20_UMD_PSTATE_MCLK_LEVEL].value;
+	} else {
+		hwmgr->pstate_sclk = gfx_table->dpm_levels[0].value;
+		hwmgr->pstate_mclk = mem_table->dpm_levels[0].value;
 	}
 
-	hwmgr->pstate_sclk = hwmgr->pstate_sclk * 100;
-	hwmgr->pstate_mclk = hwmgr->pstate_mclk * 100;
-
-	return 0;
+	hwmgr->pstate_sclk_peak = gfx_table->dpm_levels[gfx_table->count - 1].value;
+	hwmgr->pstate_mclk_peak = mem_table->dpm_levels[mem_table->count - 1].value;
 }
 
 static int vega20_get_max_sustainable_clock(struct pp_hwmgr *hwmgr,
@@ -1753,10 +1750,7 @@ static int vega20_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
 			"[EnableDPMTasks] Failed to initialize odn settings!",
 			return result);
 
-	result = vega20_populate_umdpstate_clocks(hwmgr);
-	PP_ASSERT_WITH_CODE(!result,
-			"[EnableDPMTasks] Failed to populate umdpstate clocks!",
-			return result);
+	vega20_populate_umdpstate_clocks(hwmgr);
 
 	result = smum_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_GetPptLimit,
 			POWER_SOURCE_AC << 16, &hwmgr->default_power_limit);
@@ -4213,6 +4207,8 @@ static int vega20_notify_cac_buffer_info(struct pp_hwmgr *hwmgr,
 static int vega20_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
 		struct PP_TemperatureRange *thermal_data)
 {
+	struct phm_ppt_v3_information *pptable_information =
+		(struct phm_ppt_v3_information *)hwmgr->pptable;
 	struct vega20_hwmgr *data =
 			(struct vega20_hwmgr *)(hwmgr->backend);
 	PPTable_t *pp_table = &(data->smc_state_table.pp_table);
@@ -4231,6 +4227,8 @@ static int vega20_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
 		PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
 	thermal_data->mem_emergency_max = (pp_table->ThbmLimit + CTF_OFFSET_HBM)*
 		PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+	thermal_data->sw_ctf_threshold = pptable_information->us_software_shutdown_temp *
+		PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
 
 	return 0;
 }
diff --git a/sys/dev/pci/drm/amd/pm/powerplay/inc/hwmgr.h b/sys/dev/pci/drm/amd/pm/powerplay/inc/hwmgr.h
index bf29d9fc9..713c95725 100644
--- a/sys/dev/pci/drm/amd/pm/powerplay/inc/hwmgr.h
+++ b/sys/dev/pci/drm/amd/pm/powerplay/inc/hwmgr.h
@@ -809,6 +809,10 @@ struct pp_hwmgr {
 	uint32_t workload_prority[Workload_Policy_Max];
 	uint32_t workload_setting[Workload_Policy_Max];
 	bool gfxoff_state_changed_by_workload;
+	uint32_t pstate_sclk_peak;
+	uint32_t pstate_mclk_peak;
+
+	struct delayed_work swctf_delayed_work;
 };
 
 int hwmgr_early_init(struct pp_hwmgr *hwmgr);
diff --git a/sys/dev/pci/drm/amd/pm/powerplay/inc/power_state.h b/sys/dev/pci/drm/amd/pm/powerplay/inc/power_state.h
index a5f2227a3..0ffc23478 100644
--- a/sys/dev/pci/drm/amd/pm/powerplay/inc/power_state.h
+++ b/sys/dev/pci/drm/amd/pm/powerplay/inc/power_state.h
@@ -131,6 +131,7 @@ struct PP_TemperatureRange {
 	int mem_min;
 	int mem_crit_max;
 	int mem_emergency_max;
+	int sw_ctf_threshold;
 };
 
 struct PP_StateValidationBlock {
diff --git a/sys/dev/pci/drm/amd/pm/swsmu/amdgpu_smu.c b/sys/dev/pci/drm/amd/pm/swsmu/amdgpu_smu.c
index 65cad0056..f68365e8a 100644
--- a/sys/dev/pci/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/sys/dev/pci/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -24,6 +24,7 @@
 
 #include <linux/firmware.h>
 #include <linux/pci.h>
+#include <linux/reboot.h>
 
 #include "amdgpu.h"
 #include "amdgpu_smu.h"
@@ -1061,6 +1062,34 @@ static void smu_interrupt_work_fn(struct work_struct *work)
 		smu->ppt_funcs->interrupt_work(smu);
 }
 
+static void smu_swctf_delayed_work_handler(struct work_struct *work)
+{
+	struct smu_context *smu =
+		container_of(work, struct smu_context, swctf_delayed_work.work);
+	struct smu_temperature_range *range =
+				&smu->thermal_range;
+	struct amdgpu_device *adev = smu->adev;
+	uint32_t hotspot_tmp, size;
+
+	/*
+	 * If the hotspot temperature is confirmed as below SW CTF setting point
+	 * after the delay enforced, nothing will be done.
+	 * Otherwise, a graceful shutdown will be performed to prevent further damage.
+	 */
+	if (range->software_shutdown_temp &&
+	    smu->ppt_funcs->read_sensor &&
+	    !smu->ppt_funcs->read_sensor(smu,
+					 AMDGPU_PP_SENSOR_HOTSPOT_TEMP,
+					 &hotspot_tmp,
+					 &size) &&
+	    hotspot_tmp / 1000 < range->software_shutdown_temp)
+		return;
+
+	dev_emerg(adev->dev, "ERROR: GPU over temperature range(SW CTF) detected!\n");
+	dev_emerg(adev->dev, "ERROR: System is going to shutdown due to GPU SW CTF!\n");
+	orderly_poweroff(true);
+}
+
 static int smu_sw_init(void *handle)
 {
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
@@ -1109,6 +1138,9 @@ static int smu_sw_init(void *handle)
 		return ret;
 	}
 
+	INIT_DELAYED_WORK(&smu->swctf_delayed_work,
+			  smu_swctf_delayed_work_handler);
+
 	ret = smu_smc_table_sw_init(smu);
 	if (ret) {
 		dev_err(adev->dev, "Failed to sw init smc table!\n");
@@ -1581,6 +1613,8 @@ static int smu_smc_hw_cleanup(struct smu_context *smu)
 		return ret;
 	}
 
+	cancel_delayed_work_sync(&smu->swctf_delayed_work);
+
 	ret = smu_disable_dpms(smu);
 	if (ret) {
 		dev_err(adev->dev, "Fail to disable dpm features!\n");
@@ -2520,6 +2554,14 @@ static int smu_read_sensor(void *handle,
 		*((uint32_t *)data) = pstate_table->uclk_pstate.standard * 100;
 		*size = 4;
 		break;
+	case AMDGPU_PP_SENSOR_PEAK_PSTATE_SCLK:
+		*((uint32_t *)data) = pstate_table->gfxclk_pstate.peak * 100;
+		*size = 4;
+		break;
+	case AMDGPU_PP_SENSOR_PEAK_PSTATE_MCLK:
+		*((uint32_t *)data) = pstate_table->uclk_pstate.peak * 100;
+		*size = 4;
+		break;
 	case AMDGPU_PP_SENSOR_ENABLED_SMC_FEATURES_MASK:
 		ret = smu_feature_get_enabled_mask(smu, (uint64_t *)data);
 		*size = 8;
diff --git a/sys/dev/pci/drm/amd/pm/swsmu/inc/amdgpu_smu.h b/sys/dev/pci/drm/amd/pm/swsmu/inc/amdgpu_smu.h
index 1bb953c97..d070ce60f 100644
--- a/sys/dev/pci/drm/amd/pm/swsmu/inc/amdgpu_smu.h
+++ b/sys/dev/pci/drm/amd/pm/swsmu/inc/amdgpu_smu.h
@@ -573,6 +573,8 @@ struct smu_context
 	u32 debug_param_reg;
 	u32 debug_msg_reg;
 	u32 debug_resp_reg;
+
+	struct delayed_work		swctf_delayed_work;
 };
 
 struct i2c_adapter;
diff --git a/sys/dev/pci/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/sys/dev/pci/drm/amd/pm/swsmu/smu11/smu_v11_0.c
index efd7d1feb..6de309a4a 100644
--- a/sys/dev/pci/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+++ b/sys/dev/pci/drm/amd/pm/swsmu/smu11/smu_v11_0.c
@@ -1438,13 +1438,8 @@ static int smu_v11_0_irq_process(struct amdgpu_device *adev,
 	if (client_id == SOC15_IH_CLIENTID_THM) {
 		switch (src_id) {
 		case THM_11_0__SRCID__THM_DIG_THERM_L2H:
-			dev_emerg(adev->dev, "ERROR: GPU over temperature range(SW CTF) detected!\n");
-			/*
-			 * SW CTF just occurred.
-			 * Try to do a graceful shutdown to prevent further damage.
-			 */
-			dev_emerg(adev->dev, "ERROR: System is going to shutdown due to GPU SW CTF!\n");
-			orderly_poweroff(true);
+			schedule_delayed_work(&smu->swctf_delayed_work,
+					      msecs_to_jiffies(AMDGPU_SWCTF_EXTRA_DELAY));
 		break;
 		case THM_11_0__SRCID__THM_DIG_THERM_H2L:
 			dev_emerg(adev->dev, "ERROR: GPU under temperature range detected\n");
diff --git a/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index a2ad1a068..7a4c6aef0 100644
--- a/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -1386,13 +1386,8 @@ static int smu_v13_0_irq_process(struct amdgpu_device *adev,
 	if (client_id == SOC15_IH_CLIENTID_THM) {
 		switch (src_id) {
 		case THM_11_0__SRCID__THM_DIG_THERM_L2H:
-			dev_emerg(adev->dev, "ERROR: GPU over temperature range(SW CTF) detected!\n");
-			/*
-			 * SW CTF just occurred.
-			 * Try to do a graceful shutdown to prevent further damage.
-			 */
-			dev_emerg(adev->dev, "ERROR: System is going to shutdown due to GPU SW CTF!\n");
-			orderly_poweroff(true);
+			schedule_delayed_work(&smu->swctf_delayed_work,
+					      msecs_to_jiffies(AMDGPU_SWCTF_EXTRA_DELAY));
 			break;
 		case THM_11_0__SRCID__THM_DIG_THERM_H2L:
 			dev_emerg(adev->dev, "ERROR: GPU under temperature range detected\n");
diff --git a/sys/dev/pci/drm/dma-resv.c b/sys/dev/pci/drm/dma-resv.c
index 8461b4dde..d3f7c01f3 100644
--- a/sys/dev/pci/drm/dma-resv.c
+++ b/sys/dev/pci/drm/dma-resv.c
@@ -588,13 +588,12 @@ int dma_resv_get_fences(struct dma_resv *obj, enum dma_resv_usage usage,
 #else
 			nfences = kmalloc(count * sizeof(void *),
 						 GFP_KERNEL);
-			if (nfences != NULL && *fences != NULL)
+			if (nfences != NULL && *fences != NULL) {
 				memcpy(nfences, *fences,
 				    (count - 1) *  sizeof(void *));
-			if (nfences) {
 				kfree(*fences);
-				new_fences = nfences;
 			}
+			new_fences = nfences;
 #endif
 			if (count && !new_fences) {
 				kfree(*fences);
diff --git a/sys/dev/pci/drm/i915/display/intel_display.c b/sys/dev/pci/drm/i915/display/intel_display.c
index 887a9a5df..65de50781 100644
--- a/sys/dev/pci/drm/i915/display/intel_display.c
+++ b/sys/dev/pci/drm/i915/display/intel_display.c
@@ -7123,8 +7123,6 @@ static void intel_update_crtc(struct intel_atomic_state *state,
 
 	intel_fbc_update(state, crtc);
 
-	drm_WARN_ON(&i915->drm, !intel_display_power_is_enabled(i915, POWER_DOMAIN_DC_OFF));
-
 	if (!modeset &&
 	    (new_crtc_state->uapi.color_mgmt_changed ||
 	     new_crtc_state->update_pipe))
@@ -7501,28 +7499,8 @@ static void intel_atomic_commit_tail(struct intel_atomic_state *state)
 	drm_atomic_helper_wait_for_dependencies(&state->base);
 	drm_dp_mst_atomic_wait_for_dependencies(&state->base);
 
-	/*
-	 * During full modesets we write a lot of registers, wait
-	 * for PLLs, etc. Doing that while DC states are enabled
-	 * is not a good idea.
-	 *
-	 * During fastsets and other updates we also need to
-	 * disable DC states due to the following scenario:
-	 * 1. DC5 exit and PSR exit happen
-	 * 2. Some or all _noarm() registers are written
-	 * 3. Due to some long delay PSR is re-entered
-	 * 4. DC5 entry -> DMC saves the already written new
-	 *    _noarm() registers and the old not yet written
-	 *    _arm() registers
-	 * 5. DC5 exit -> DMC restores a mixture of old and
-	 *    new register values and arms the update
-	 * 6. PSR exit -> hardware latches a mixture of old and
-	 *    new register values -> corrupted frame, or worse
-	 * 7. New _arm() registers are finally written
-	 * 8. Hardware finally latches a complete set of new
-	 *    register values, and subsequent frames will be OK again
-	 */
-	wakeref = intel_display_power_get(dev_priv, POWER_DOMAIN_DC_OFF);
+	if (state->modeset)
+		wakeref = intel_display_power_get(dev_priv, POWER_DOMAIN_MODESET);
 
 	intel_atomic_prepare_plane_clear_colors(state);
 
@@ -7661,8 +7639,8 @@ static void intel_atomic_commit_tail(struct intel_atomic_state *state)
 		 * the culprit.
 		 */
 		intel_uncore_arm_unclaimed_mmio_detection(&dev_priv->uncore);
+		intel_display_power_put(dev_priv, POWER_DOMAIN_MODESET, wakeref);
 	}
-	intel_display_power_put(dev_priv, POWER_DOMAIN_DC_OFF, wakeref);
 	intel_runtime_pm_put(&dev_priv->runtime_pm, state->wakeref);
 
 	/*
diff --git a/sys/dev/pci/drm/i915/gt/gen8_engine_cs.c b/sys/dev/pci/drm/i915/gt/gen8_engine_cs.c
index e49fa6fa6..b2838732a 100644
--- a/sys/dev/pci/drm/i915/gt/gen8_engine_cs.c
+++ b/sys/dev/pci/drm/i915/gt/gen8_engine_cs.c
@@ -256,8 +256,8 @@ int gen12_emit_flush_rcs(struct i915_request *rq, u32 mode)
 
 		if (!HAS_FLAT_CCS(rq->engine->i915)) {
 			/* hsdes: 1809175790 */
-			cs = gen12_emit_aux_table_inv(rq->engine->gt,
-						      cs, GEN12_GFX_CCS_AUX_NV);
+			cs = gen12_emit_aux_table_inv(rq->engine->gt, cs,
+						      GEN12_CCS_AUX_INV);
 		}
 
 		*cs++ = preparser_disable(false);
@@ -317,10 +317,10 @@ int gen12_emit_flush_xcs(struct i915_request *rq, u32 mode)
 	if (aux_inv) { /* hsdes: 1809175790 */
 		if (rq->engine->class == VIDEO_DECODE_CLASS)
 			cs = gen12_emit_aux_table_inv(rq->engine->gt,
-						      cs, GEN12_VD0_AUX_NV);
+						      cs, GEN12_VD0_AUX_INV);
 		else
 			cs = gen12_emit_aux_table_inv(rq->engine->gt,
-						      cs, GEN12_VE0_AUX_NV);
+						      cs, GEN12_VE0_AUX_INV);
 	}
 
 	if (mode & EMIT_INVALIDATE)
diff --git a/sys/dev/pci/drm/i915/gt/intel_gt_regs.h b/sys/dev/pci/drm/i915/gt/intel_gt_regs.h
index 2275ee47d..dd006563c 100644
--- a/sys/dev/pci/drm/i915/gt/intel_gt_regs.h
+++ b/sys/dev/pci/drm/i915/gt/intel_gt_regs.h
@@ -301,9 +301,11 @@
 #define GEN8_PRIVATE_PAT_HI			_MMIO(0x40e0 + 4)
 #define GEN10_PAT_INDEX(index)			_MMIO(0x40e0 + (index) * 4)
 #define BSD_HWS_PGA_GEN7			_MMIO(0x4180)
-#define GEN12_GFX_CCS_AUX_NV			_MMIO(0x4208)
-#define GEN12_VD0_AUX_NV			_MMIO(0x4218)
-#define GEN12_VD1_AUX_NV			_MMIO(0x4228)
+
+#define GEN12_CCS_AUX_INV			_MMIO(0x4208)
+#define GEN12_VD0_AUX_INV			_MMIO(0x4218)
+#define GEN12_VE0_AUX_INV			_MMIO(0x4238)
+#define GEN12_BCS0_AUX_INV			_MMIO(0x4248)
 
 #define GEN8_RTCR				_MMIO(0x4260)
 #define GEN8_M1TCR				_MMIO(0x4264)
@@ -311,14 +313,12 @@
 #define GEN8_BTCR				_MMIO(0x426c)
 #define GEN8_VTCR				_MMIO(0x4270)
 
-#define GEN12_VD2_AUX_NV			_MMIO(0x4298)
-#define GEN12_VD3_AUX_NV			_MMIO(0x42a8)
-#define GEN12_VE0_AUX_NV			_MMIO(0x4238)
-
 #define BLT_HWS_PGA_GEN7			_MMIO(0x4280)
 
-#define GEN12_VE1_AUX_NV			_MMIO(0x42b8)
+#define GEN12_VD2_AUX_INV			_MMIO(0x4298)
+#define GEN12_CCS0_AUX_INV			_MMIO(0x42c8)
 #define   AUX_INV				REG_BIT(0)
+
 #define VEBOX_HWS_PGA_GEN7			_MMIO(0x4380)
 
 #define GEN12_AUX_ERR_DBG			_MMIO(0x43f4)
diff --git a/sys/dev/pci/drm/i915/gt/intel_lrc.c b/sys/dev/pci/drm/i915/gt/intel_lrc.c
index c62235d4f..81ceb5ea6 100644
--- a/sys/dev/pci/drm/i915/gt/intel_lrc.c
+++ b/sys/dev/pci/drm/i915/gt/intel_lrc.c
@@ -1304,7 +1304,7 @@ gen12_emit_indirect_ctx_rcs(const struct intel_context *ce, u32 *cs)
 	/* hsdes: 1809175790 */
 	if (!HAS_FLAT_CCS(ce->engine->i915))
 		cs = gen12_emit_aux_table_inv(ce->engine->gt,
-					      cs, GEN12_GFX_CCS_AUX_NV);
+					      cs, GEN12_CCS_AUX_INV);
 
 	/* Wa_16014892111 */
 	if (IS_DG2(ce->engine->i915))
@@ -1331,10 +1331,10 @@ gen12_emit_indirect_ctx_xcs(const struct intel_context *ce, u32 *cs)
 	if (!HAS_FLAT_CCS(ce->engine->i915)) {
 		if (ce->engine->class == VIDEO_DECODE_CLASS)
 			cs = gen12_emit_aux_table_inv(ce->engine->gt,
-						      cs, GEN12_VD0_AUX_NV);
+						      cs, GEN12_VD0_AUX_INV);
 		else if (ce->engine->class == VIDEO_ENHANCEMENT_CLASS)
 			cs = gen12_emit_aux_table_inv(ce->engine->gt,
-						      cs, GEN12_VE0_AUX_NV);
+						      cs, GEN12_VE0_AUX_INV);
 	}
 
 	return cs;
diff --git a/sys/dev/pci/drm/i915/i915_active.c b/sys/dev/pci/drm/i915/i915_active.c
index de21524f9..96e3e84d3 100644
--- a/sys/dev/pci/drm/i915/i915_active.c
+++ b/sys/dev/pci/drm/i915/i915_active.c
@@ -461,8 +461,11 @@ int i915_active_add_request(struct i915_active *ref, struct i915_request *rq)
 		}
 	} while (unlikely(is_barrier(active)));
 
-	if (!__i915_active_fence_set(active, fence))
+	fence = __i915_active_fence_set(active, fence);
+	if (!fence)
 		__i915_active_acquire(ref);
+	else
+		dma_fence_put(fence);
 
 out:
 	i915_active_release(ref);
@@ -481,13 +484,9 @@ __i915_active_set_fence(struct i915_active *ref,
 		return NULL;
 	}
 
-	rcu_read_lock();
 	prev = __i915_active_fence_set(active, fence);
-	if (prev)
-		prev = dma_fence_get_rcu(prev);
-	else
+	if (!prev)
 		__i915_active_acquire(ref);
-	rcu_read_unlock();
 
 	return prev;
 }
@@ -1043,10 +1042,11 @@ void i915_request_add_active_barriers(struct i915_request *rq)
  *
  * Records the new @fence as the last active fence along its timeline in
  * this active tracker, moving the tracking callbacks from the previous
- * fence onto this one. Returns the previous fence (if not already completed),
- * which the caller must ensure is executed before the new fence. To ensure
- * that the order of fences within the timeline of the i915_active_fence is
- * understood, it should be locked by the caller.
+ * fence onto this one. Gets and returns a reference to the previous fence
+ * (if not already completed), which the caller must put after making sure
+ * that it is executed before the new fence. To ensure that the order of
+ * fences within the timeline of the i915_active_fence is understood, it
+ * should be locked by the caller.
  */
 struct dma_fence *
 __i915_active_fence_set(struct i915_active_fence *active,
@@ -1055,7 +1055,23 @@ __i915_active_fence_set(struct i915_active_fence *active,
 	struct dma_fence *prev;
 	unsigned long flags;
 
-	if (fence == rcu_access_pointer(active->fence))
+	/*
+	 * In case of fences embedded in i915_requests, their memory is
+	 * SLAB_FAILSAFE_BY_RCU, then it can be reused right after release
+	 * by new requests.  Then, there is a risk of passing back a pointer
+	 * to a new, completely unrelated fence that reuses the same memory
+	 * while tracked under a different active tracker.  Combined with i915
+	 * perf open/close operations that build await dependencies between
+	 * engine kernel context requests and user requests from different
+	 * timelines, this can lead to dependency loops and infinite waits.
+	 *
+	 * As a countermeasure, we try to get a reference to the active->fence
+	 * first, so if we succeed and pass it back to our user then it is not
+	 * released and potentially reused by an unrelated request before the
+	 * user has a chance to set up an await dependency on it.
+	 */
+	prev = i915_active_fence_get(active);
+	if (fence == prev)
 		return fence;
 
 	GEM_BUG_ON(test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags));
@@ -1064,27 +1080,56 @@ __i915_active_fence_set(struct i915_active_fence *active,
 	 * Consider that we have two threads arriving (A and B), with
 	 * C already resident as the active->fence.
 	 *
-	 * A does the xchg first, and so it sees C or NULL depending
-	 * on the timing of the interrupt handler. If it is NULL, the
-	 * previous fence must have been signaled and we know that
-	 * we are first on the timeline. If it is still present,
-	 * we acquire the lock on that fence and serialise with the interrupt
-	 * handler, in the process removing it from any future interrupt
-	 * callback. A will then wait on C before executing (if present).
-	 *
-	 * As B is second, it sees A as the previous fence and so waits for
-	 * it to complete its transition and takes over the occupancy for
-	 * itself -- remembering that it needs to wait on A before executing.
+	 * Both A and B have got a reference to C or NULL, depending on the
+	 * timing of the interrupt handler.  Let's assume that if A has got C
+	 * then it has locked C first (before B).
 	 *
 	 * Note the strong ordering of the timeline also provides consistent
 	 * nesting rules for the fence->lock; the inner lock is always the
 	 * older lock.
 	 */
 	spin_lock_irqsave(fence->lock, flags);
-	prev = xchg(__active_fence_slot(active), fence);
-	if (prev) {
-		GEM_BUG_ON(prev == fence);
+	if (prev)
 		spin_lock_nested(prev->lock, SINGLE_DEPTH_NESTING);
+
+	/*
+	 * A does the cmpxchg first, and so it sees C or NULL, as before, or
+	 * something else, depending on the timing of other threads and/or
+	 * interrupt handler.  If not the same as before then A unlocks C if
+	 * applicable and retries, starting from an attempt to get a new
+	 * active->fence.  Meanwhile, B follows the same path as A.
+	 * Once A succeeds with cmpxch, B fails again, retires, gets A from
+	 * active->fence, locks it as soon as A completes, and possibly
+	 * succeeds with cmpxchg.
+	 */
+	while (cmpxchg(__active_fence_slot(active), prev, fence) != prev) {
+		if (prev) {
+			spin_unlock(prev->lock);
+			dma_fence_put(prev);
+		}
+		spin_unlock_irqrestore(fence->lock, flags);
+
+		prev = i915_active_fence_get(active);
+		GEM_BUG_ON(prev == fence);
+
+		spin_lock_irqsave(fence->lock, flags);
+		if (prev)
+			spin_lock_nested(prev->lock, SINGLE_DEPTH_NESTING);
+	}
+
+	/*
+	 * If prev is NULL then the previous fence must have been signaled
+	 * and we know that we are first on the timeline.  If it is still
+	 * present then, having the lock on that fence already acquired, we
+	 * serialise with the interrupt handler, in the process of removing it
+	 * from any future interrupt callback.  A will then wait on C before
+	 * executing (if present).
+	 *
+	 * As B is second, it sees A as the previous fence and so waits for
+	 * it to complete its transition and takes over the occupancy for
+	 * itself -- remembering that it needs to wait on A before executing.
+	 */
+	if (prev) {
 		__list_del_entry(&active->cb.node);
 		spin_unlock(prev->lock); /* serialise with prev->cb_list */
 	}
@@ -1101,11 +1146,7 @@ int i915_active_fence_set(struct i915_active_fence *active,
 	int err = 0;
 
 	/* Must maintain timeline ordering wrt previous active requests */
-	rcu_read_lock();
 	fence = __i915_active_fence_set(active, &rq->fence);
-	if (fence) /* but the previous fence may not belong to that timeline! */
-		fence = dma_fence_get_rcu(fence);
-	rcu_read_unlock();
 	if (fence) {
 		err = i915_request_await_dma_fence(rq, fence);
 		dma_fence_put(fence);
diff --git a/sys/dev/pci/drm/i915/i915_request.c b/sys/dev/pci/drm/i915/i915_request.c
index d0728df72..1e37187e8 100644
--- a/sys/dev/pci/drm/i915/i915_request.c
+++ b/sys/dev/pci/drm/i915/i915_request.c
@@ -1728,6 +1728,11 @@ __i915_request_ensure_parallel_ordering(struct i915_request *rq,
 
 	request_to_parent(rq)->parallel.last_rq = i915_request_get(rq);
 
+	/*
+	 * Users have to put a reference potentially got by
+	 * __i915_active_fence_set() to the returned request
+	 * when no longer needed
+	 */
 	return to_request(__i915_active_fence_set(&timeline->last_request,
 						  &rq->fence));
 }
@@ -1774,6 +1779,10 @@ __i915_request_ensure_ordering(struct i915_request *rq,
 							 0);
 	}
 
+	/*
+	 * Users have to put the reference to prev potentially got
+	 * by __i915_active_fence_set() when no longer needed
+	 */
 	return prev;
 }
 
@@ -1817,6 +1826,8 @@ __i915_request_add_to_timeline(struct i915_request *rq)
 		prev = __i915_request_ensure_ordering(rq, timeline);
 	else
 		prev = __i915_request_ensure_parallel_ordering(rq, timeline);
+	if (prev)
+		i915_request_put(prev);
 
 	/*
 	 * Make sure that no request gazumped us - if it was allocated after
diff --git a/sys/dev/pci/drm/ttm/ttm_bo.c b/sys/dev/pci/drm/ttm/ttm_bo.c
index 7959f645a..b0ebb066c 100644
--- a/sys/dev/pci/drm/ttm/ttm_bo.c
+++ b/sys/dev/pci/drm/ttm/ttm_bo.c
@@ -552,7 +552,8 @@ static bool ttm_bo_evict_swapout_allowable(struct ttm_buffer_object *bo,
 
 	if (bo->pin_count) {
 		*locked = false;
-		*busy = false;
+		if (busy)
+			*busy = false;
 		return false;
 	}
 
diff --git a/sys/dev/pci/if_aq_pci.c b/sys/dev/pci/if_aq_pci.c
index 14391968b..6ad899ec1 100644
--- a/sys/dev/pci/if_aq_pci.c
+++ b/sys/dev/pci/if_aq_pci.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: if_aq_pci.c,v 1.22 2023/05/02 12:32:22 kettenis Exp $ */
+/* $OpenBSD: if_aq_pci.c,v 1.23 2023/08/15 08:27:30 miod Exp $ */
 /*	$NetBSD: if_aq.c,v 1.27 2021/06/16 00:21:18 riastradh Exp $	*/
 
 /*
@@ -175,7 +175,7 @@
 #define AQ_INTR_CTRL_IRQMODE_MSIX		2
 #define  AQ_INTR_CTRL_MULTIVEC			(1 << 2)
 #define  AQ_INTR_CTRL_RESET_DIS			(1 << 29)
-#define  AQ_INTR_CTRL_RESET_IRQ			(1 << 31)
+#define  AQ_INTR_CTRL_RESET_IRQ			(1U << 31)
 #define AQ_MBOXIF_POWER_GATING_CONTROL_REG	0x32a8
 
 #define FW_MPI_MBOX_ADDR_REG			0x0360
@@ -220,12 +220,12 @@
 #define  RPF_L2UC_MSW_MACADDR_HI		0xFFFF
 #define  RPF_L2UC_MSW_ACTION			0x70000
 #define  RPF_L2UC_MSW_TAG			0x03c00000
-#define  RPF_L2UC_MSW_EN			(1 << 31)
+#define  RPF_L2UC_MSW_EN			(1U << 31)
 #define AQ_HW_MAC_NUM				34
 
 /* RPF_MCAST_FILTER_REG[8] 0x5250-0x5270 */
 #define RPF_MCAST_FILTER_REG(i)			(0x5250 + (i) * 4)
-#define  RPF_MCAST_FILTER_EN			(1 << 31)
+#define  RPF_MCAST_FILTER_EN			(1U << 31)
 #define RPF_MCAST_FILTER_MASK_REG		0x5270
 #define  RPF_MCAST_FILTER_MASK_ALLMULTI		(1 << 14)
 
@@ -240,14 +240,14 @@
 
 /* RPF_ETHERTYPE_FILTER_REG[AQ_RINGS_NUM] 0x5300-0x5380 */
 #define RPF_ETHERTYPE_FILTER_REG(i)		(0x5300 + (i) * 4)
-#define  RPF_ETHERTYPE_FILTER_EN		(1 << 31)
+#define  RPF_ETHERTYPE_FILTER_EN		(1U << 31)
 
 /* RPF_L3_FILTER_REG[8] 0x5380-0x53a0 */
 #define RPF_L3_FILTER_REG(i)			(0x5380 + (i) * 4)
-#define  RPF_L3_FILTER_L4_EN			(1 << 31)
+#define  RPF_L3_FILTER_L4_EN			(1U << 31)
 
 #define RX_FLR_RSS_CONTROL1_REG			0x54c0
-#define  RX_FLR_RSS_CONTROL1_EN			(1 << 31)
+#define  RX_FLR_RSS_CONTROL1_EN			(1U << 31)
 
 #define RPF_RPB_RX_TC_UPT_REG                   0x54c4
 #define  RPF_RPB_RX_TC_UPT_MASK(i)              (0x00000007 << ((i) * 4))
@@ -278,7 +278,7 @@
 #define RPB_RXB_BUFSIZE_REG(i)			(0x5710 + (i) * 0x10)
 #define  RPB_RXB_BUFSIZE			0x1FF
 #define RPB_RXB_XOFF_REG(i)			(0x5714 + (i) * 0x10)
-#define  RPB_RXB_XOFF_EN			(1 << 31)
+#define  RPB_RXB_XOFF_EN			(1U << 31)
 #define  RPB_RXB_XOFF_THRESH_HI                 0x3FFF0000
 #define  RPB_RXB_XOFF_THRESH_LO                 0x3FFF
 
@@ -301,7 +301,7 @@
 #define  RX_DMA_DESC_RESET			(1 << 25)
 #define  RX_DMA_DESC_HEADER_SPLIT		(1 << 28)
 #define  RX_DMA_DESC_VLAN_STRIP			(1 << 29)
-#define  RX_DMA_DESC_EN				(1 << 31)
+#define  RX_DMA_DESC_EN				(1U << 31)
 #define RX_DMA_DESC_HEAD_PTR_REG(i)		(0x5b0c + (i) * 0x20)
 #define  RX_DMA_DESC_HEAD_PTR			0xFFF
 #define RX_DMA_DESC_TAIL_PTR_REG(i)		(0x5b10 + (i) * 0x20)
@@ -313,10 +313,10 @@
 #define  RX_DMA_DCAD_CPUID			0xFF
 #define  RX_DMA_DCAD_PAYLOAD_EN			(1 << 29)
 #define  RX_DMA_DCAD_HEADER_EN			(1 << 30)
-#define  RX_DMA_DCAD_DESC_EN			(1 << 31)
+#define  RX_DMA_DCAD_DESC_EN			(1U << 31)
 
 #define RX_DMA_DCA_REG				0x6180
-#define  RX_DMA_DCA_EN				(1 << 31)
+#define  RX_DMA_DCA_EN				(1U << 31)
 #define  RX_DMA_DCA_MODE			0xF
 
 #define TX_SYSCONTROL_REG			0x7000
@@ -328,7 +328,7 @@
 #define TPS_DESC_VM_ARB_MODE_REG		0x7300
 #define  TPS_DESC_VM_ARB_MODE			(1 << 0)
 #define TPS_DESC_RATE_REG			0x7310
-#define  TPS_DESC_RATE_TA_RST			(1 << 31)
+#define  TPS_DESC_RATE_TA_RST			(1U << 31)
 #define  TPS_DESC_RATE_LIM			0x7FF
 #define TPS_DESC_TC_ARB_MODE_REG		0x7200
 #define  TPS_DESC_TC_ARB_MODE			0x3
@@ -393,7 +393,7 @@
 #define  TDM_DCAD_CPUID_EN			0x80000000
 
 #define TDM_DCA_REG				0x8480
-#define  TDM_DCA_EN				(1 << 31)
+#define  TDM_DCA_EN				(1U << 31)
 #define  TDM_DCA_MODE				0xF
 
 #define TX_INTR_MODERATION_CTL_REG(i)		(0x8980 + (i) * 4)
@@ -418,7 +418,7 @@
 #define  AQ2_MIF_BOOT_CRASH_INIT		(1 << 27)
 #define  AQ2_MIF_BOOT_BOOT_CODE_FAILED		(1 << 28)
 #define  AQ2_MIF_BOOT_FW_INIT_FAILED		(1 << 29)
-#define  AQ2_MIF_BOOT_FW_INIT_COMP_SUCCESS	(1 << 31)
+#define  AQ2_MIF_BOOT_FW_INIT_COMP_SUCCESS	(1U << 31)
 
 /* AQ2 action resolver table */
 #define AQ2_ART_ACTION_ACT_SHIFT		8
diff --git a/sys/dev/pci/if_mcx.c b/sys/dev/pci/if_mcx.c
index dd30a6b83..cd6f78d41 100644
--- a/sys/dev/pci/if_mcx.c
+++ b/sys/dev/pci/if_mcx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_mcx.c,v 1.107 2023/06/06 01:40:04 dlg Exp $ */
+/*	$OpenBSD: if_mcx.c,v 1.108 2023/08/15 08:27:30 miod Exp $ */
 
 /*
  * Copyright (c) 2017 David Gwynne <dlg@openbsd.org>
@@ -149,8 +149,8 @@ CTASSERT(MCX_MAX_QUEUES * MCX_WQ_DOORBELL_STRIDE <
 #define MCX_CMDQ_DOORBELL		0x0018
 
 #define MCX_STATE			0x01fc
-#define MCX_STATE_MASK				(1 << 31)
-#define MCX_STATE_INITIALIZING			(1 << 31)
+#define MCX_STATE_MASK				(1U << 31)
+#define MCX_STATE_INITIALIZING			(1U << 31)
 #define MCX_STATE_READY				(0 << 31)
 #define MCX_STATE_INTERFACE_MASK		(0x3 << 24)
 #define MCX_STATE_INTERFACE_FULL_DRIVER		(0x0 << 24)
@@ -1405,7 +1405,7 @@ struct mcx_cmd_create_tir_mb_in {
 #define MCX_TIR_CTX_HASH_SEL_SPORT	(1 << 2)
 #define MCX_TIR_CTX_HASH_SEL_DPORT	(1 << 3)
 #define MCX_TIR_CTX_HASH_SEL_IPV4	(0 << 31)
-#define MCX_TIR_CTX_HASH_SEL_IPV6	(1 << 31)
+#define MCX_TIR_CTX_HASH_SEL_IPV6	(1U << 31)
 #define MCX_TIR_CTX_HASH_SEL_TCP	(0 << 30)
 #define MCX_TIR_CTX_HASH_SEL_UDP	(1 << 30)
 	uint32_t		cmd_rx_hash_sel_inner;
@@ -1675,7 +1675,7 @@ CTASSERT(sizeof(struct mcx_wq_ctx) == 0xC0);
 
 struct mcx_sq_ctx {
 	uint32_t		sq_flags;
-#define MCX_SQ_CTX_RLKEY			(1 << 31)
+#define MCX_SQ_CTX_RLKEY			(1U << 31)
 #define MCX_SQ_CTX_FRE_SHIFT			(1 << 29)
 #define MCX_SQ_CTX_FLUSH_IN_ERROR		(1 << 28)
 #define MCX_SQ_CTX_MIN_WQE_INLINE_SHIFT		24
@@ -1722,7 +1722,7 @@ struct mcx_sq_entry {
 	/* ethernet segment */
 	uint32_t		sqe_reserved1;
 	uint32_t		sqe_mss_csum;
-#define MCX_SQE_L4_CSUM				(1 << 31)
+#define MCX_SQE_L4_CSUM				(1U << 31)
 #define MCX_SQE_L3_CSUM				(1 << 30)
 	uint32_t		sqe_reserved2;
 	uint16_t		sqe_inline_header_size;
@@ -1789,7 +1789,7 @@ struct mcx_cmd_destroy_sq_out {
 
 struct mcx_rq_ctx {
 	uint32_t		rq_flags;
-#define MCX_RQ_CTX_RLKEY			(1 << 31)
+#define MCX_RQ_CTX_RLKEY			(1U << 31)
 #define MCX_RQ_CTX_VLAN_STRIP_DIS		(1 << 28)
 #define MCX_RQ_CTX_MEM_RQ_TYPE_SHIFT		24
 #define MCX_RQ_CTX_STATE_SHIFT			20
diff --git a/sys/dev/pci/igc_regs.h b/sys/dev/pci/igc_regs.h
index b3d4b8e7a..715b4b3ec 100644
--- a/sys/dev/pci/igc_regs.h
+++ b/sys/dev/pci/igc_regs.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: igc_regs.h,v 1.1 2021/10/31 14:52:57 patrick Exp $	*/
+/*	$OpenBSD: igc_regs.h,v 1.2 2023/08/15 08:27:30 miod Exp $	*/
 /*-
  * Copyright 2021 Intel Corp
  * Copyright 2021 Rubicon Communications, LLC (Netgate)
@@ -333,7 +333,7 @@
 /* ETQF register bit definitions */
 #define IGC_ETQF_FILTER_ENABLE	(1 << 26)
 #define IGC_ETQF_IMM_INT	(1 << 29)
-#define IGC_ETQF_QUEUE_ENABLE	(1 << 31)
+#define IGC_ETQF_QUEUE_ENABLE	(1U << 31)
 #define IGC_ETQF_QUEUE_SHIFT	16
 #define IGC_ETQF_QUEUE_MASK	0x00070000
 #define IGC_ETQF_ETYPE_MASK	0x0000FFFF
diff --git a/sys/dev/pci/ixgbe_type.h b/sys/dev/pci/ixgbe_type.h
index 4b4dcb737..edc569b94 100644
--- a/sys/dev/pci/ixgbe_type.h
+++ b/sys/dev/pci/ixgbe_type.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ixgbe_type.h,v 1.37 2023/05/18 08:22:37 jan Exp $	*/
+/*	$OpenBSD: ixgbe_type.h,v 1.38 2023/08/15 08:27:30 miod Exp $	*/
 
 /******************************************************************************
   SPDX-License-Identifier: BSD-3-Clause
@@ -4454,7 +4454,7 @@ struct ixgbe_bypass_eeprom {
 #define IXGBE_KRM_LINK_CTRL_1_TETH_EEE_CAP_KR		(1 << 26)
 #define IXGBE_KRM_LINK_S1_MAC_AN_COMPLETE		(1 << 28)
 #define IXGBE_KRM_LINK_CTRL_1_TETH_AN_ENABLE		(1 << 29)
-#define IXGBE_KRM_LINK_CTRL_1_TETH_AN_RESTART		(1 << 31)
+#define IXGBE_KRM_LINK_CTRL_1_TETH_AN_RESTART		(1U << 31)
 
 #define IXGBE_KRM_AN_CNTL_1_SYM_PAUSE			(1 << 28)
 #define IXGBE_KRM_AN_CNTL_1_ASM_PAUSE			(1 << 29)
@@ -4484,7 +4484,7 @@ struct ixgbe_bypass_eeprom {
 #define IXGBE_KRM_TX_COEFF_CTRL_1_CMINUS1_OVRRD_EN	(1 << 1)
 #define IXGBE_KRM_TX_COEFF_CTRL_1_CPLUS1_OVRRD_EN	(1 << 2)
 #define IXGBE_KRM_TX_COEFF_CTRL_1_CZERO_EN		(1 << 3)
-#define IXGBE_KRM_TX_COEFF_CTRL_1_OVRRD_EN		(1 << 31)
+#define IXGBE_KRM_TX_COEFF_CTRL_1_OVRRD_EN		(1U << 31)
 
 #define IXGBE_SB_IOSF_INDIRECT_CTRL	0x00011144
 #define IXGBE_SB_IOSF_INDIRECT_DATA	0x00011148
diff --git a/sys/dev/pckbc/pckbd.c b/sys/dev/pckbc/pckbd.c
index 71ccf5147..50d523f39 100644
--- a/sys/dev/pckbc/pckbd.c
+++ b/sys/dev/pckbc/pckbd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pckbd.c,v 1.50 2023/07/25 10:00:44 miod Exp $ */
+/* $OpenBSD: pckbd.c,v 1.51 2023/08/13 21:54:02 miod Exp $ */
 /* $NetBSD: pckbd.c,v 1.24 2000/06/05 22:20:57 sommerfeld Exp $ */
 
 /*-
@@ -344,7 +344,7 @@ pckbdprobe(struct device *parent, void *match, void *aux)
 {
 	struct cfdata *cf = match;
 	struct pckbc_attach_args *pa = aux;
-	u_char cmd[1], resp[1];
+	u_char cmd[1], resp[2];
 	int res;
 
 	/*
@@ -363,10 +363,40 @@ pckbdprobe(struct device *parent, void *match, void *aux)
 	/* Reset the keyboard. */
 	cmd[0] = KBC_RESET;
 	res = pckbc_poll_cmd(pa->pa_tag, pa->pa_slot, cmd, 1, 1, resp, 1);
-	if (res) {
+	if (res != 0) {
 #ifdef DEBUG
 		printf("pckbdprobe: reset error %d\n", res);
 #endif
+	} else if (resp[0] != KBR_RSTDONE) {
+#ifdef DEBUG
+		printf("pckbdprobe: reset response 0x%x\n", resp[0]);
+#endif
+		res = EINVAL;
+	}
+#if defined(__i386__) || defined(__amd64__)
+	if (res) {
+		/*
+		 * The 8042 emulation on Chromebooks fails the reset
+		 * command but otherwise appears to work correctly.
+		 * Try a "get ID" command to give it a second chance.
+		 */
+		cmd[0] = KBC_GETID;
+		res = pckbc_poll_cmd(pa->pa_tag, pa->pa_slot,
+		    cmd, 1, 2, resp, 0);
+		if (res != 0) {
+#ifdef DEBUG
+			printf("pckbdprobe: getid error %d\n", res);
+#endif
+		} else if (resp[0] != 0xab || resp[1] != 0x83) {
+#ifdef DEBUG
+			printf("pckbdprobe: unexpected id 0x%x/0x%x\n",
+			    resp[0], resp[1]);
+#endif
+			res = EINVAL;
+		}
+	}
+#endif
+	if (res) {
 		/*
 		 * There is probably no keyboard connected.
 		 * Let the probe succeed if the keyboard is used
@@ -387,10 +417,6 @@ pckbdprobe(struct device *parent, void *match, void *aux)
 #endif
 		return (pckbd_is_console(pa->pa_tag, pa->pa_slot) ? 1 : 0);
 	}
-	if (resp[0] != KBR_RSTDONE) {
-		printf("pckbdprobe: reset response 0x%x\n", resp[0]);
-		return (0);
-	}
 
 	/*
 	 * Some keyboards seem to leave a second ack byte after the reset.
diff --git a/sys/dev/pckbc/pckbdreg.h b/sys/dev/pckbc/pckbdreg.h
index 6848f48f8..7acd4eb17 100644
--- a/sys/dev/pckbc/pckbdreg.h
+++ b/sys/dev/pckbc/pckbdreg.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: pckbdreg.h,v 1.2 2003/10/22 09:44:22 jmc Exp $ */
+/* $OpenBSD: pckbdreg.h,v 1.3 2023/08/13 21:54:02 miod Exp $ */
 /* $NetBSD: pckbdreg.h,v 1.2 1998/04/07 13:43:16 hannken Exp $ */
 
 /*
@@ -12,6 +12,7 @@
 #define	KBC_DISABLE	0xF5	/* as per KBC_SETDEFAULT, but also disable key scanning */
 #define	KBC_ENABLE	0xF4	/* enable key scanning */
 #define	KBC_TYPEMATIC	0xF3	/* set typematic rate and delay */
+#define	KBC_GETID	0xF2	/* get keyboard ID (not supported on AT kbd) */
 #define	KBC_SETTABLE	0xF0	/* set scancode translation table */
 #define	KBC_MODEIND	0xED	/* set mode indicators (i.e. LEDs) */
 #define	KBC_ECHO	0xEE	/* request an echo from the keyboard */
diff --git a/sys/dev/pckbc/pms.c b/sys/dev/pckbc/pms.c
index 42121347c..108d0f75d 100644
--- a/sys/dev/pckbc/pms.c
+++ b/sys/dev/pckbc/pms.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pms.c,v 1.97 2022/07/23 05:55:16 sdk Exp $ */
+/* $OpenBSD: pms.c,v 1.98 2023/08/16 20:53:47 bru Exp $ */
 /* $NetBSD: psm.c,v 1.11 2000/06/05 22:20:57 sommerfeld Exp $ */
 
 /*-
@@ -1075,7 +1075,11 @@ synaptics_get_hwinfo(struct pms_softc *sc)
 	hw->y_max = (max_coords ?
 	    SYNAPTICS_Y_LIMIT(max_coords) : SYNAPTICS_YMAX_BEZEL);
 
-	hw->contacts_max = SYNAPTICS_MAX_FINGERS;
+	if ((syn->capabilities & SYNAPTICS_CAP_MULTIFINGER) ||
+	    SYNAPTICS_SUPPORTS_AGM(syn->ext_capabilities))
+		hw->contacts_max = SYNAPTICS_MAX_FINGERS;
+	else
+		hw->contacts_max = 1;
 
 	syn->sec_buttons = 0;
 
diff --git a/sys/dev/usb/dwc2/dwc2_hw.h b/sys/dev/usb/dwc2/dwc2_hw.h
index a551c2db5..1853d80da 100644
--- a/sys/dev/usb/dwc2/dwc2_hw.h
+++ b/sys/dev/usb/dwc2/dwc2_hw.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dwc2_hw.h,v 1.4 2022/09/04 08:42:40 mglocker Exp $	*/
+/*	$OpenBSD: dwc2_hw.h,v 1.5 2023/08/15 08:27:30 miod Exp $	*/
 /*	$NetBSD: dwc2_hw.h,v 1.2 2013/09/25 06:19:22 skrll Exp $	*/
 
 /*
@@ -127,7 +127,7 @@
 #define GUSBCFG_TOUTCAL(_x)		((_x) << 0)
 
 #define GRSTCTL				HSOTG_REG(0x010)
-#define GRSTCTL_AHBIDLE			(1 << 31)
+#define GRSTCTL_AHBIDLE			(1U << 31)
 #define GRSTCTL_DMAREQ			(1 << 30)
 #define GRSTCTL_CSFTRST_DONE		(1 << 29)
 #define GRSTCTL_TXFNUM_MASK		(0x1f << 6)
@@ -143,7 +143,7 @@
 
 #define GINTSTS				HSOTG_REG(0x014)
 #define GINTMSK				HSOTG_REG(0x018)
-#define GINTSTS_WKUPINT			(1 << 31)
+#define GINTSTS_WKUPINT			(1U << 31)
 #define GINTSTS_SESSREQINT		(1 << 30)
 #define GINTSTS_DISCONNINT		(1 << 29)
 #define GINTSTS_CONIDSTSCHNG		(1 << 28)
@@ -219,7 +219,7 @@
 #define GNPTXSTS_NP_TXF_SPC_AVAIL_GET(_v)	(((_v) >> 0) & 0xffff)
 
 #define GI2CCTL				HSOTG_REG(0x0030)
-#define GI2CCTL_BSYDNE			(1 << 31)
+#define GI2CCTL_BSYDNE			(1U << 31)
 #define GI2CCTL_RW			(1 << 30)
 #define GI2CCTL_I2CDATSE0		(1 << 28)
 #define GI2CCTL_I2CDEVADDR_MASK		(0x3 << 26)
@@ -246,7 +246,7 @@
 #define GSNPSID_ID_MASK			0xffff0000
 
 #define GHWCFG2				HSOTG_REG(0x0048)
-#define GHWCFG2_OTG_ENABLE_IC_USB		(1 << 31)
+#define GHWCFG2_OTG_ENABLE_IC_USB		(1U << 31)
 #define GHWCFG2_DEV_TOKEN_Q_DEPTH_MASK		(0x1f << 26)
 #define GHWCFG2_DEV_TOKEN_Q_DEPTH_SHIFT		26
 #define GHWCFG2_HOST_PERIO_TX_Q_DEPTH_MASK	(0x3 << 24)
@@ -307,7 +307,7 @@
 #define GHWCFG3_XFER_SIZE_CNTR_WIDTH_SHIFT	0
 
 #define GHWCFG4				HSOTG_REG(0x0050)
-#define GHWCFG4_DESC_DMA_DYN			(1 << 31)
+#define GHWCFG4_DESC_DMA_DYN			(1U << 31)
 #define GHWCFG4_DESC_DMA			(1 << 30)
 #define GHWCFG4_NUM_IN_EPS_MASK			(0xf << 26)
 #define GHWCFG4_NUM_IN_EPS_SHIFT		26
@@ -336,7 +336,7 @@
 #define GHWCFG4_NUM_DEV_PERIO_IN_EP_SHIFT	0
 
 #define GLPMCFG				HSOTG_REG(0x0054)
-#define GLPMCFG_INVSELHSIC		(1 << 31)
+#define GLPMCFG_INVSELHSIC		(1U << 31)
 #define GLPMCFG_HSICCON			(1 << 30)
 #define GLPMCFG_RSTRSLPSTS		(1 << 29)
 #define GLPMCFG_ENBESL			(1 << 28)
@@ -554,7 +554,7 @@
 #define D0EPCTL_MPS_16			2
 #define D0EPCTL_MPS_8			3
 
-#define DXEPCTL_EPENA			(1 << 31)
+#define DXEPCTL_EPENA			(1U << 31)
 #define DXEPCTL_EPDIS			(1 << 30)
 #define DXEPCTL_SETD1PID		(1 << 29)
 #define DXEPCTL_SETODDFR		(1 << 29)
@@ -652,7 +652,7 @@
 #define DTXFSTS(_a)			HSOTG_REG(0x918 + ((_a) * 0x20))
 
 #define PCGCTL				HSOTG_REG(0x0e00)
-#define PCGCTL_IF_DEV_MODE		(1 << 31)
+#define PCGCTL_IF_DEV_MODE		(1U << 31)
 #define PCGCTL_P2HD_PRT_SPD_MASK	(0x3 << 29)
 #define PCGCTL_P2HD_PRT_SPD_SHIFT	29
 #define PCGCTL_P2HD_DEV_ENUM_SPD_MASK	(0x3 << 27)
@@ -688,7 +688,7 @@
 /* Host Mode Registers */
 
 #define HCFG				HSOTG_REG(0x0400)
-#define HCFG_MODECHTIMEN		(1 << 31)
+#define HCFG_MODECHTIMEN		(1U << 31)
 #define HCFG_PERSCHEDENA		(1 << 26)
 #define HCFG_FRLISTEN_MASK		(0x3 << 24)
 #define HCFG_FRLISTEN_SHIFT		24
@@ -724,7 +724,7 @@
 #define HFNUM_MAX_FRNUM			0x3fff
 
 #define HPTXSTS				HSOTG_REG(0x0410)
-#define TXSTS_QTOP_ODD			(1 << 31)
+#define TXSTS_QTOP_ODD			(1U << 31)
 #define TXSTS_QTOP_CHNEP_MASK		(0xf << 27)
 #define TXSTS_QTOP_CHNEP_SHIFT		27
 #define TXSTS_QTOP_TOKEN_MASK		(0x3 << 25)
@@ -761,7 +761,7 @@
 #define HPRT0_CONNSTS			(1 << 0)
 
 #define HCCHAR(_ch)			HSOTG_REG(0x0500 + 0x20 * (_ch))
-#define HCCHAR_CHENA			(1 << 31)
+#define HCCHAR_CHENA			(1U << 31)
 #define HCCHAR_CHDIS			(1 << 30)
 #define HCCHAR_ODDFRM			(1 << 29)
 #define HCCHAR_DEVADDR_MASK		(0x7f << 22)
@@ -778,7 +778,7 @@
 #define HCCHAR_MPS_SHIFT		0
 
 #define HCSPLT(_ch)			HSOTG_REG(0x0504 + 0x20 * (_ch))
-#define HCSPLT_SPLTENA			(1 << 31)
+#define HCSPLT_SPLTENA			(1U << 31)
 #define HCSPLT_COMPSPLT			(1 << 16)
 #define HCSPLT_XACTPOS_MASK		(0x3 << 14)
 #define HCSPLT_XACTPOS_SHIFT		14
@@ -810,7 +810,7 @@
 #define HCINTMSK_XFERCOMPL		(1 << 0)
 
 #define HCTSIZ(_ch)			HSOTG_REG(0x0510 + 0x20 * (_ch))
-#define TSIZ_DOPNG			(1 << 31)
+#define TSIZ_DOPNG			(1U << 31)
 #define TSIZ_SC_MC_PID_MASK		(0x3 << 29)
 #define TSIZ_SC_MC_PID_SHIFT		29
 #define TSIZ_SC_MC_PID_DATA0		0
@@ -850,7 +850,7 @@ struct dwc2_dma_desc {
 
 /* Host Mode DMA descriptor status quadlet */
 
-#define HOST_DMA_A			(1 << 31)
+#define HOST_DMA_A			(1U << 31)
 #define HOST_DMA_STS_MASK		(0x3 << 28)
 #define HOST_DMA_STS_SHIFT		28
 #define HOST_DMA_STS_PKTERR		(1 << 28)
diff --git a/sys/dev/usb/if_urereg.h b/sys/dev/usb/if_urereg.h
index 4d6153109..18aa96f76 100644
--- a/sys/dev/usb/if_urereg.h
+++ b/sys/dev/usb/if_urereg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_urereg.h,v 1.12 2023/05/06 08:07:10 kevlo Exp $	*/
+/*	$OpenBSD: if_urereg.h,v 1.13 2023/08/15 08:27:30 miod Exp $	*/
 /*-
  * Copyright (c) 2015, 2016, 2019 Kevin Lo <kevlo@openbsd.org>
  * All rights reserved.
@@ -567,11 +567,11 @@ struct ure_rxpkt {
 
 struct ure_txpkt {
 	uint32_t ure_pktlen;
-#define	URE_TXPKT_TX_FS		(1 << 31)
+#define	URE_TXPKT_TX_FS		(1U << 31)
 #define	URE_TXPKT_TX_LS		(1 << 30)
 #define	URE_TXPKT_LEN_MASK	0xffff
 	uint32_t ure_vlan;
-#define	URE_TXPKT_UDP		(1 << 31)
+#define	URE_TXPKT_UDP		(1U << 31)
 #define	URE_TXPKT_TCP		(1 << 30)
 #define	URE_TXPKT_IPV4		(1 << 29)
 #define	URE_TXPKT_IPV6		(1 << 28)
diff --git a/sys/dev/usb/uhidev.c b/sys/dev/usb/uhidev.c
index 26b5b0408..c0664fbf2 100644
--- a/sys/dev/usb/uhidev.c
+++ b/sys/dev/usb/uhidev.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uhidev.c,v 1.108 2022/05/20 05:03:45 anton Exp $	*/
+/*	$OpenBSD: uhidev.c,v 1.109 2023/08/12 20:47:06 miod Exp $	*/
 /*	$NetBSD: uhidev.c,v 1.14 2003/03/11 16:44:00 augustss Exp $	*/
 
 /*
@@ -139,6 +139,22 @@ uhidev_match(struct device *parent, void *match, void *aux)
 	return (UMATCH_IFACECLASS_GENERIC);
 }
 
+int
+uhidev_attach_repid(struct uhidev_softc *sc, struct uhidev_attach_arg *uha,
+    int repid)
+{
+	struct device *dev;
+
+	/* Could already be assigned by uhidev_set_report_dev(). */
+	if (sc->sc_subdevs[repid] != NULL)
+		return 0;
+
+	uha->reportid = repid;
+	dev = config_found_sm(&sc->sc_dev, uha, uhidevprint, NULL);
+	sc->sc_subdevs[repid] = (struct uhidev *)dev;
+	return 1;
+}
+
 void
 uhidev_attach(struct device *parent, struct device *self, void *aux)
 {
@@ -283,6 +299,35 @@ uhidev_attach(struct device *parent, struct device *self, void *aux)
 	free(uha.claimed, M_TEMP, nrepid);
 	uha.claimed = NULL;
 
+	/* Special case for Wacom tablets */
+	if (uha.uaa->vendor == USB_VENDOR_WACOM) {
+		int ndigitizers = 0;
+		/*
+		 * Get all the needed collections (only 3 seem to be of
+		 * interest currently).
+		 */
+		repid = hid_get_id_of_collection(desc, size,
+		    HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_STYLUS),
+		    HCOLL_PHYSICAL);
+		if (repid >= 0 && repid < nrepid)
+			ndigitizers += uhidev_attach_repid(sc, &uha, repid);
+		repid = hid_get_id_of_collection(desc, size,
+		    HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_TABLET_FKEYS),
+		    HCOLL_PHYSICAL);
+		if (repid >= 0 && repid < nrepid)
+			ndigitizers += uhidev_attach_repid(sc, &uha, repid);
+#ifdef notyet	/* not handled in hidms_wacom_setup() yet */
+		repid = hid_get_id_of_collection(desc, size,
+		    HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_WACOM_BATTERY),
+		    HCOLL_PHYSICAL);
+		if (repid >= 0 && repid < nrepid)
+			ndigitizers += uhidev_attach_repid(sc, &uha, repid);
+#endif
+
+		if (ndigitizers != 0)
+			return;
+	}
+
 	for (repid = 0; repid < nrepid; repid++) {
 		DPRINTF(("%s: try repid=%d\n", __func__, repid));
 		if (hid_report_size(desc, size, hid_input, repid) == 0 &&
@@ -290,13 +335,7 @@ uhidev_attach(struct device *parent, struct device *self, void *aux)
 		    hid_report_size(desc, size, hid_feature, repid) == 0)
 			continue;
 
-		/* Could already be assigned by uhidev_set_report_dev(). */
-		if (sc->sc_subdevs[repid] != NULL)
-			continue;
-
-		uha.reportid = repid;
-		dev = config_found_sm(self, &uha, uhidevprint, NULL);
-		sc->sc_subdevs[repid] = (struct uhidev *)dev;
+		uhidev_attach_repid(sc, &uha, repid);
 	}
 }
 
diff --git a/sys/dev/usb/usbdevs b/sys/dev/usb/usbdevs
index ec94e2bbf..f7b9f3426 100644
--- a/sys/dev/usb/usbdevs
+++ b/sys/dev/usb/usbdevs
@@ -1,4 +1,4 @@
-$OpenBSD: usbdevs,v 1.757 2023/06/12 11:26:24 jsg Exp $
+$OpenBSD: usbdevs,v 1.758 2023/08/12 20:43:49 miod Exp $
 /* $NetBSD: usbdevs,v 1.322 2003/05/10 17:47:14 hamajima Exp $ */
 
 /*
@@ -4634,6 +4634,7 @@ product WACOM GRAPHIRE3_4X5	0x0013	Graphire3 4x5
 product WACOM GRAPHIRE4_4X5	0x0015	Graphire4 Classic A6
 product WACOM INTUOSA5		0x0021	Intuos A5
 product WACOM INTUOS_DRAW	0x033b	Intuos Draw (CTL-490)
+product WACOM INTUOS_S		0x0374	Intuos S (CTL-4100)
 product WACOM ONE_S		0x037a	One S (CTL-472)
 product WACOM ONE_M		0x037b	One M (CTL-672)
 product WACOM INTUOS_PRO_S	0x0392	Intuos Pro S
diff --git a/sys/dev/usb/usbdevs.h b/sys/dev/usb/usbdevs.h
index 1f562a8d7..9c5bede6b 100644
--- a/sys/dev/usb/usbdevs.h
+++ b/sys/dev/usb/usbdevs.h
@@ -1,10 +1,10 @@
-/*	$OpenBSD: usbdevs.h,v 1.769 2023/06/12 11:26:54 jsg Exp $	*/
+/*	$OpenBSD: usbdevs.h,v 1.770 2023/08/12 20:44:32 miod Exp $	*/
 
 /*
  * THIS FILE IS AUTOMATICALLY GENERATED.  DO NOT EDIT.
  *
  * generated from:
- *	OpenBSD: usbdevs,v 1.757 2023/06/12 11:26:24 jsg Exp 
+ *	OpenBSD: usbdevs,v 1.758 2023/08/12 20:43:49 miod Exp 
  */
 /* $NetBSD: usbdevs,v 1.322 2003/05/10 17:47:14 hamajima Exp $ */
 
@@ -4641,6 +4641,7 @@
 #define	USB_PRODUCT_WACOM_GRAPHIRE4_4X5	0x0015		/* Graphire4 Classic A6 */
 #define	USB_PRODUCT_WACOM_INTUOSA5	0x0021		/* Intuos A5 */
 #define	USB_PRODUCT_WACOM_INTUOS_DRAW	0x033b		/* Intuos Draw (CTL-490) */
+#define	USB_PRODUCT_WACOM_INTUOS_S	0x0374		/* Intuos S (CTL-4100) */
 #define	USB_PRODUCT_WACOM_ONE_S	0x037a		/* One S (CTL-472) */
 #define	USB_PRODUCT_WACOM_ONE_M	0x037b		/* One M (CTL-672) */
 #define	USB_PRODUCT_WACOM_INTUOS_PRO_S	0x0392		/* Intuos Pro S */
diff --git a/sys/dev/usb/usbdevs_data.h b/sys/dev/usb/usbdevs_data.h
index 8632a0c1c..56b1cfd43 100644
--- a/sys/dev/usb/usbdevs_data.h
+++ b/sys/dev/usb/usbdevs_data.h
@@ -1,10 +1,10 @@
-/*	$OpenBSD: usbdevs_data.h,v 1.763 2023/06/12 11:26:54 jsg Exp $	*/
+/*	$OpenBSD: usbdevs_data.h,v 1.764 2023/08/12 20:44:32 miod Exp $	*/
 
 /*
  * THIS FILE IS AUTOMATICALLY GENERATED.  DO NOT EDIT.
  *
  * generated from:
- *	OpenBSD: usbdevs,v 1.757 2023/06/12 11:26:24 jsg Exp 
+ *	OpenBSD: usbdevs,v 1.758 2023/08/12 20:43:49 miod Exp 
  */
 /* $NetBSD: usbdevs,v 1.322 2003/05/10 17:47:14 hamajima Exp $ */
 
@@ -11897,6 +11897,10 @@ const struct usb_known_product usb_known_products[] = {
 	    USB_VENDOR_WACOM, USB_PRODUCT_WACOM_INTUOS_DRAW,
 	    "Intuos Draw (CTL-490)",
 	},
+	{
+	    USB_VENDOR_WACOM, USB_PRODUCT_WACOM_INTUOS_S,
+	    "Intuos S (CTL-4100)",
+	},
 	{
 	    USB_VENDOR_WACOM, USB_PRODUCT_WACOM_ONE_S,
 	    "One S (CTL-472)",
diff --git a/sys/dev/usb/uwacom.c b/sys/dev/usb/uwacom.c
index f9af276a6..4fbc8f990 100644
--- a/sys/dev/usb/uwacom.c
+++ b/sys/dev/usb/uwacom.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uwacom.c,v 1.7 2022/10/08 06:53:06 mglocker Exp $	*/
+/*	$OpenBSD: uwacom.c,v 1.8 2023/08/12 20:47:06 miod Exp $	*/
 
 /*
  * Copyright (c) 2016 Frank Groeneveld <frank@frankgroeneveld.nl>
@@ -43,22 +43,25 @@ struct uwacom_softc {
 	struct hidms		sc_ms;
 	struct hid_location	sc_loc_tip_press;
 	int			sc_flags;
+	int			sc_x, sc_y, sc_z, sc_w;
+	int			sc_moved;
 };
 
 struct cfdriver uwacom_cd = {
 	NULL, "uwacom", DV_DULL
 };
 
-
 const struct usb_devno uwacom_devs[] = {
 	{ USB_VENDOR_WACOM, USB_PRODUCT_WACOM_INTUOS_DRAW },
 	{ USB_VENDOR_WACOM, USB_PRODUCT_WACOM_ONE_S },
-	{ USB_VENDOR_WACOM, USB_PRODUCT_WACOM_ONE_M }
+	{ USB_VENDOR_WACOM, USB_PRODUCT_WACOM_ONE_M },
+	{ USB_VENDOR_WACOM, USB_PRODUCT_WACOM_INTUOS_S }
 };
 
 int	uwacom_match(struct device *, void *, void *);
 void	uwacom_attach(struct device *, struct device *, void *);
 int	uwacom_detach(struct device *, int);
+void	uwacom_intr_legacy(struct uhidev *, void *, u_int);
 void	uwacom_intr(struct uhidev *, void *, u_int);
 int	uwacom_enable(void *);
 void	uwacom_disable(void *);
@@ -90,6 +93,9 @@ uwacom_match(struct device *parent, void *match, void *aux)
 
 	uhidev_get_report_desc(uha->parent, &desc, &size);
 
+	if (hid_is_collection(desc, size, uha->reportid,
+	    HID_USAGE2(HUP_WACOM | HUP_DIGITIZERS, HUD_DIGITIZER)))
+		return (UMATCH_IFACECLASS);
 	if (!hid_locate(desc, size, HID_USAGE2(HUP_WACOM, HUG_POINTER),
 	    uha->reportid, hid_input, NULL, NULL))
 		return (UMATCH_NONE);
@@ -104,10 +110,11 @@ uwacom_attach(struct device *parent, struct device *self, void *aux)
 	struct hidms *ms = &sc->sc_ms;
 	struct uhidev_attach_arg *uha = (struct uhidev_attach_arg *)aux;
 	struct usb_attach_arg *uaa = uha->uaa;
+	static uByte wacom_report_buf[2] = { 0x02, 0x02 };
 	int size, repid;
 	void *desc;
 
-	sc->sc_hdev.sc_intr = uwacom_intr;
+	sc->sc_hdev.sc_intr = uwacom_intr_legacy;
 	sc->sc_hdev.sc_parent = uha->parent;
 	sc->sc_hdev.sc_udev = uaa->device;
 	sc->sc_hdev.sc_report_id = uha->reportid;
@@ -141,20 +148,23 @@ uwacom_attach(struct device *parent, struct device *self, void *aux)
 	ms->sc_loc_btn[2].pos = 2;
 	ms->sc_loc_btn[2].size = 1;
 
-	if (uha->uaa->product == USB_PRODUCT_WACOM_ONE_S) {
-		static uByte reportbuf[2] = { 0x02, 0x02 };
-		uhidev_set_report(uha->parent, UHID_FEATURE_REPORT, 2,
-		    &reportbuf, 2);
-		ms->sc_tsscale.maxx = 15200;
-		ms->sc_tsscale.maxy = 9500;
-	}
-
-	if (uha->uaa->product == USB_PRODUCT_WACOM_INTUOS_DRAW) {
+	switch (uha->uaa->product) {
+	case USB_PRODUCT_WACOM_ONE_S:
+	case USB_PRODUCT_WACOM_INTUOS_S:
+		uhidev_set_report(uha->parent, UHID_FEATURE_REPORT,
+		    sc->sc_hdev.sc_report_id, &wacom_report_buf,
+		    sizeof(wacom_report_buf));
+		sc->sc_hdev.sc_intr = uwacom_intr;
+		hidms_setup((struct device *)sc, ms, HIDMS_WACOM_SETUP,
+		    repid, desc, size);
+		break;
+	case USB_PRODUCT_WACOM_INTUOS_DRAW:
 		sc->sc_flags = UWACOM_USE_PRESSURE | UWACOM_BIG_ENDIAN;
 		sc->sc_loc_tip_press.pos = 43;
 		sc->sc_loc_tip_press.size = 8;
 		ms->sc_tsscale.maxx = 7600;
 		ms->sc_tsscale.maxy = 4750;
+		break;
 	}
 
 	hidms_attach(ms, &uwacom_accessops);
@@ -170,7 +180,7 @@ uwacom_detach(struct device *self, int flags)
 }
 
 void
-uwacom_intr(struct uhidev *addr, void *buf, u_int len)
+uwacom_intr_legacy(struct uhidev *addr, void *buf, u_int len)
 {
 	struct uwacom_softc *sc = (struct uwacom_softc *)addr;
 	struct hidms *ms = &sc->sc_ms;
@@ -195,7 +205,7 @@ uwacom_intr(struct uhidev *addr, void *buf, u_int len)
 
 	for (i = 0; i < ms->sc_num_buttons; i++)
 		if (hid_get_data(data, len, &ms->sc_loc_btn[i]))
-			buttons |= (1 << i);
+			buttons |= 1 << i;
 
 	if (sc->sc_flags & UWACOM_USE_PRESSURE) {
 		pressure = hid_get_data(data, len, &sc->sc_loc_tip_press);
@@ -212,6 +222,63 @@ uwacom_intr(struct uhidev *addr, void *buf, u_int len)
 	}
 }
 
+void
+uwacom_intr(struct uhidev *addr, void *buf, u_int len)
+{
+	struct uwacom_softc *sc = (struct uwacom_softc *)addr;
+	struct hidms *ms = &sc->sc_ms;
+	u_int32_t buttons = 0;
+	uint8_t *data = (uint8_t *)buf;
+	int i, j, x, y, dx, dy, dz, dw, pressure, distance;
+
+	if (ms->sc_enabled == 0)
+		return;
+
+	x = hid_get_data(data, len, &ms->sc_loc_x);
+	y = hid_get_data(data, len, &ms->sc_loc_y);
+	pressure = hid_get_data(data, len, &ms->sc_loc_z);
+	distance = hid_get_data(data, len, &ms->sc_loc_w);
+
+	if (!sc->sc_moved) {
+		sc->sc_x = x;
+		sc->sc_y = y;
+		sc->sc_z = pressure;
+		sc->sc_w = distance;
+		sc->sc_moved = 1;
+	}
+
+	dx = sc->sc_x - x;
+	dy = sc->sc_y - y;
+	/* Clamp sensitivity to +/-127 */
+	dz = sc->sc_z / 32 - pressure / 32;
+	dw = sc->sc_w - distance;
+
+	sc->sc_x = x;
+	sc->sc_y = y;
+	sc->sc_z = pressure;
+	sc->sc_w = distance;
+
+	if (sc->sc_flags & UWACOM_BIG_ENDIAN) {
+		x = be16toh(x);
+		y = be16toh(y);
+	}
+
+	for (i = 0; i < ms->sc_num_stylus_buttons; i++)
+		if (hid_get_data(data, len, &ms->sc_loc_btn[i]))
+			buttons |= 1 << i;
+
+	for (j = 0; i < ms->sc_num_buttons; i++, j++)
+		if (hid_get_data(data, len, &ms->sc_loc_btn[i]))
+			buttons |= 1 << j;
+
+	if (x != 0 || y != 0 || pressure != 0 || distance != 0 ||
+	    buttons != ms->sc_buttons) {
+		wsmouse_motion(ms->sc_wsmousedev, -dx, dy, dz, dw);
+		wsmouse_buttons(ms->sc_wsmousedev, buttons);
+		wsmouse_input_sync(ms->sc_wsmousedev);
+	}
+}
+
 int
 uwacom_enable(void *v)
 {
diff --git a/sys/dev/wscons/wstpad.c b/sys/dev/wscons/wstpad.c
index c3735cf24..3a6e3104e 100644
--- a/sys/dev/wscons/wstpad.c
+++ b/sys/dev/wscons/wstpad.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wstpad.c,v 1.32 2023/07/02 21:44:04 bru Exp $ */
+/* $OpenBSD: wstpad.c,v 1.33 2023/08/15 08:27:30 miod Exp $ */
 
 /*
  * Copyright (c) 2015, 2016 Ulf Brosziewski
@@ -151,7 +151,7 @@ struct tpad_touch {
 #define WSTPAD_DISABLE		(1 << 7)
 #define WSTPAD_MTBUTTONS	(1 << 8)
 
-#define WSTPAD_MT		(1 << 31)
+#define WSTPAD_MT		(1U << 31)
 
 
 struct wstpad {
diff --git a/sys/kern/kern_clock.c b/sys/kern/kern_clock.c
index bcd3a9f24..06c0d5f4a 100644
--- a/sys/kern/kern_clock.c
+++ b/sys/kern/kern_clock.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_clock.c,v 1.111 2023/08/05 20:07:55 cheloha Exp $	*/
+/*	$OpenBSD: kern_clock.c,v 1.113 2023/08/12 13:19:28 miod Exp $	*/
 /*	$NetBSD: kern_clock.c,v 1.34 1996/06/09 04:51:03 briggs Exp $	*/
 
 /*-
@@ -111,10 +111,9 @@ initclocks(void)
 void
 hardclock(struct clockframe *frame)
 {
+#if defined(MULTIPROCESSOR) || defined(__hppa__) /* XXX */
 	struct cpu_info *ci = curcpu();
-
-	if (--ci->ci_schedstate.spc_rrticks <= 0)
-		roundrobin(ci);
+#endif
 
 #if NDT > 0
 	DT_ENTER(profile, NULL);
diff --git a/sys/kern/kern_clockintr.c b/sys/kern/kern_clockintr.c
index 5e80c2e20..6351a0bb2 100644
--- a/sys/kern/kern_clockintr.c
+++ b/sys/kern/kern_clockintr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kern_clockintr.c,v 1.30 2023/08/05 20:07:55 cheloha Exp $ */
+/* $OpenBSD: kern_clockintr.c,v 1.31 2023/08/11 22:02:50 cheloha Exp $ */
 /*
  * Copyright (c) 2003 Dale Rahn <drahn@openbsd.org>
  * Copyright (c) 2020 Mark Kettenis <kettenis@openbsd.org>
@@ -69,6 +69,7 @@ clockintr_init(u_int flags)
 
 	KASSERT(hz > 0 && hz <= 1000000000);
 	hardclock_period = 1000000000 / hz;
+	roundrobin_period = hardclock_period * 10;
 
 	KASSERT(stathz >= 1 && stathz <= 1000000000);
 
@@ -204,6 +205,11 @@ clockintr_cpu_init(const struct intrclock *ic)
 		clockintr_stagger(spc->spc_profclock, profclock_period,
 		    multiplier, MAXCPUS);
 	}
+	if (spc->spc_roundrobin->cl_expiration == 0) {
+		clockintr_stagger(spc->spc_roundrobin, hardclock_period,
+		    multiplier, MAXCPUS);
+	}
+	clockintr_advance(spc->spc_roundrobin, roundrobin_period);
 
 	if (reset_cq_intrclock)
 		SET(cq->cq_flags, CQ_INTRCLOCK);
diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c
index fabc238ce..a2933832b 100644
--- a/sys/kern/kern_event.c
+++ b/sys/kern/kern_event.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_event.c,v 1.196 2023/04/11 00:45:09 jsg Exp $	*/
+/*	$OpenBSD: kern_event.c,v 1.197 2023/08/13 08:29:28 visa Exp $	*/
 
 /*-
  * Copyright (c) 1999,2000,2001 Jonathan Lemon <jlemon@FreeBSD.org>
@@ -449,17 +449,61 @@ filt_proc(struct knote *kn, long hint)
 	return (kn->kn_fflags != 0);
 }
 
-static void
-filt_timer_timeout_add(struct knote *kn)
+#define NOTE_TIMER_UNITMASK \
+	(NOTE_SECONDS|NOTE_MSECONDS|NOTE_USECONDS|NOTE_NSECONDS)
+
+static int
+filt_timervalidate(int sfflags, int64_t sdata, struct timespec *ts)
 {
-	struct timeval tv;
+	if (sfflags & ~(NOTE_TIMER_UNITMASK | NOTE_ABSTIME))
+		return (EINVAL);
+
+	switch (sfflags & NOTE_TIMER_UNITMASK) {
+	case NOTE_SECONDS:
+		ts->tv_sec = sdata;
+		ts->tv_nsec = 0;
+		break;
+	case NOTE_MSECONDS:
+		ts->tv_sec = sdata / 1000;
+		ts->tv_nsec = (sdata % 1000) * 1000000;
+		break;
+	case NOTE_USECONDS:
+		ts->tv_sec = sdata / 1000000;
+		ts->tv_nsec = (sdata % 1000000) * 1000;
+		break;
+	case NOTE_NSECONDS:
+		ts->tv_sec = sdata / 1000000000;
+		ts->tv_nsec = sdata % 1000000000;
+		break;
+	default:
+		return (EINVAL);
+	}
+
+	return (0);
+}
+
+static void
+filt_timeradd(struct knote *kn, struct timespec *ts)
+{
+	struct timespec expiry, now;
 	struct timeout *to = kn->kn_hook;
 	int tticks;
 
-	tv.tv_sec = kn->kn_sdata / 1000;
-	tv.tv_usec = (kn->kn_sdata % 1000) * 1000;
-	tticks = tvtohz(&tv);
-	/* Remove extra tick from tvtohz() if timeout has fired before. */
+	if (kn->kn_sfflags & NOTE_ABSTIME) {
+		nanotime(&now);
+		if (timespeccmp(ts, &now, >)) {
+			timespecsub(ts, &now, &expiry);
+			/* XXX timeout_abs_ts with CLOCK_REALTIME */
+			timeout_add(to, tstohz(&expiry));
+		} else {
+			/* Expire immediately. */
+			filt_timerexpire(kn);
+		}
+		return;
+	}
+
+	tticks = tstohz(ts);
+	/* Remove extra tick from tstohz() if timeout has fired before. */
 	if (timeout_triggered(to))
 		tticks--;
 	timeout_add(to, (tticks > 0) ? tticks : 1);
@@ -468,6 +512,7 @@ filt_timer_timeout_add(struct knote *kn)
 void
 filt_timerexpire(void *knx)
 {
+	struct timespec ts;
 	struct knote *kn = knx;
 	struct kqueue *kq = kn->kn_kq;
 
@@ -476,28 +521,37 @@ filt_timerexpire(void *knx)
 	knote_activate(kn);
 	mtx_leave(&kq->kq_lock);
 
-	if ((kn->kn_flags & EV_ONESHOT) == 0)
-		filt_timer_timeout_add(kn);
+	if ((kn->kn_flags & EV_ONESHOT) == 0 &&
+	    (kn->kn_sfflags & NOTE_ABSTIME) == 0) {
+		(void)filt_timervalidate(kn->kn_sfflags, kn->kn_sdata, &ts);
+		filt_timeradd(kn, &ts);
+	}
 }
 
-
 /*
- * data contains amount of time to sleep, in milliseconds
+ * data contains amount of time to sleep
  */
 int
 filt_timerattach(struct knote *kn)
 {
+	struct timespec ts;
 	struct timeout *to;
+	int error;
+
+	error = filt_timervalidate(kn->kn_sfflags, kn->kn_sdata, &ts);
+	if (error != 0)
+		return (error);
 
 	if (kq_ntimeouts > kq_timeoutmax)
 		return (ENOMEM);
 	kq_ntimeouts++;
 
-	kn->kn_flags |= EV_CLEAR;	/* automatically set */
+	if ((kn->kn_sfflags & NOTE_ABSTIME) == 0)
+		kn->kn_flags |= EV_CLEAR;	/* automatically set */
 	to = malloc(sizeof(*to), M_KEVENT, M_WAITOK);
 	timeout_set(to, filt_timerexpire, kn);
 	kn->kn_hook = to;
-	filt_timer_timeout_add(kn);
+	filt_timeradd(kn, &ts);
 
 	return (0);
 }
@@ -516,8 +570,17 @@ filt_timerdetach(struct knote *kn)
 int
 filt_timermodify(struct kevent *kev, struct knote *kn)
 {
+	struct timespec ts;
 	struct kqueue *kq = kn->kn_kq;
 	struct timeout *to = kn->kn_hook;
+	int error;
+
+	error = filt_timervalidate(kev->fflags, kev->data, &ts);
+	if (error != 0) {
+		kev->flags |= EV_ERROR;
+		kev->data = error;
+		return (0);
+	}
 
 	/* Reset the timer. Any pending events are discarded. */
 
@@ -533,7 +596,7 @@ filt_timermodify(struct kevent *kev, struct knote *kn)
 	knote_assign(kev, kn);
 	/* Reinit timeout to invoke tick adjustment again. */
 	timeout_set(to, filt_timerexpire, kn);
-	filt_timer_timeout_add(kn);
+	filt_timeradd(kn, &ts);
 
 	return (0);
 }
diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c
index 657c5d78f..9c2f1b038 100644
--- a/sys/kern/kern_fork.c
+++ b/sys/kern/kern_fork.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_fork.c,v 1.248 2023/07/02 11:16:03 deraadt Exp $	*/
+/*	$OpenBSD: kern_fork.c,v 1.249 2023/08/14 08:33:24 mpi Exp $	*/
 /*	$NetBSD: kern_fork.c,v 1.29 1996/02/09 18:59:34 christos Exp $	*/
 
 /*
@@ -56,6 +56,7 @@
 #include <sys/ptrace.h>
 #include <sys/atomic.h>
 #include <sys/unistd.h>
+#include <sys/tracepoint.h>
 
 #include <sys/syscallargs.h>
 
@@ -316,6 +317,8 @@ fork_thread_start(struct proc *p, struct proc *parent, int flags)
 
 	SCHED_LOCK(s);
 	ci = sched_choosecpu_fork(parent, flags);
+	TRACEPOINT(sched, fork, p->p_tid + THREAD_PID_OFFSET,
+	    p->p_p->ps_pid, CPU_INFO_UNIT(ci));
 	setrunqueue(ci, p, p->p_usrpri);
 	SCHED_UNLOCK(s);
 }
diff --git a/sys/kern/kern_sched.c b/sys/kern/kern_sched.c
index 9a191b441..54902ded6 100644
--- a/sys/kern/kern_sched.c
+++ b/sys/kern/kern_sched.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sched.c,v 1.84 2023/08/05 20:07:55 cheloha Exp $	*/
+/*	$OpenBSD: kern_sched.c,v 1.86 2023/08/14 08:33:24 mpi Exp $	*/
 /*
  * Copyright (c) 2007, 2008 Artur Grabowski <art@openbsd.org>
  *
@@ -102,6 +102,12 @@ sched_init_cpu(struct cpu_info *ci)
 		if (spc->spc_profclock == NULL)
 			panic("%s: clockintr_establish profclock", __func__);
 	}
+	if (spc->spc_roundrobin == NULL) {
+		spc->spc_roundrobin = clockintr_establish(&ci->ci_queue,
+		    roundrobin);
+		if (spc->spc_roundrobin == NULL)
+			panic("%s: clockintr_establish roundrobin", __func__);
+	}
 
 	kthread_create_deferred(sched_kthreads_create, ci);
 
@@ -542,6 +548,9 @@ sched_steal_proc(struct cpu_info *self)
 	if (best == NULL)
 		return (NULL);
 
+	TRACEPOINT(sched, steal, best->p_tid + THREAD_PID_OFFSET,
+	    best->p_p->ps_pid, CPU_INFO_UNIT(self));
+
 	remrunqueue(best);
 	best->p_cpu = self;
 
diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c
index ad204e50d..b6a6ee1a8 100644
--- a/sys/kern/kern_sig.c
+++ b/sys/kern/kern_sig.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sig.c,v 1.310 2023/07/14 07:07:08 claudio Exp $	*/
+/*	$OpenBSD: kern_sig.c,v 1.313 2023/08/16 07:55:52 claudio Exp $	*/
 /*	$NetBSD: kern_sig.c,v 1.54 1996/04/22 01:38:32 christos Exp $	*/
 
 /*
@@ -1151,8 +1151,9 @@ ptsignal(struct proc *p, int signum, enum signal_type type)
 				atomic_clearbits_int(siglist, mask);
 			if (action == SIG_CATCH)
 				goto runfast;
-			if (p->p_wchan == NULL || p->p_flag & P_WSLEEP)
+			if (p->p_wchan == NULL)
 				goto run;
+			atomic_clearbits_int(&p->p_flag, P_WSLEEP);
 			p->p_stat = SSLEEP;
 			goto out;
 		}
@@ -1250,7 +1251,6 @@ cursig(struct proc *p, struct sigctx *sctx)
 {
 	struct process *pr = p->p_p;
 	int signum, mask, prop;
-	int dolock = (p->p_flag & P_SINTR) == 0;
 	sigset_t ps_siglist;
 	int s;
 
@@ -1293,11 +1293,9 @@ cursig(struct proc *p, struct sigctx *sctx)
 			single_thread_set(p, SINGLE_SUSPEND, 0);
 			pr->ps_xsig = signum;
 
-			if (dolock)
-				SCHED_LOCK(s);
+			SCHED_LOCK(s);
 			proc_stop(p, 1);
-			if (dolock)
-				SCHED_UNLOCK(s);
+			SCHED_UNLOCK(s);
 
 			/*
 			 * re-take the signal before releasing
@@ -1370,11 +1368,9 @@ cursig(struct proc *p, struct sigctx *sctx)
 				    prop & SA_TTYSTOP))
 					break;	/* == ignore */
 				pr->ps_xsig = signum;
-				if (dolock)
-					SCHED_LOCK(s);
+				SCHED_LOCK(s);
 				proc_stop(p, 1);
-				if (dolock)
-					SCHED_UNLOCK(s);
+				SCHED_UNLOCK(s);
 				break;
 			} else if (prop & SA_IGNORE) {
 				/*
@@ -1970,6 +1966,9 @@ userret(struct proc *p)
 	struct sigctx ctx;
 	int signum;
 
+	if (p->p_flag & P_SUSPSINGLE)
+		single_thread_check(p, 0);
+
 	/* send SIGPROF or SIGVTALRM if their timers interrupted this thread */
 	if (p->p_flag & P_PROFPEND) {
 		atomic_clearbits_int(&p->p_flag, P_PROFPEND);
@@ -2003,9 +2002,6 @@ userret(struct proc *p)
 			postsig(p, signum, &ctx);
 	}
 
-	if (p->p_flag & P_SUSPSINGLE)
-		single_thread_check(p, 0);
-
 	WITNESS_WARN(WARN_PANIC, NULL, "userret: returning");
 
 	p->p_cpu->ci_schedstate.spc_curpriority = p->p_usrpri;
@@ -2203,10 +2199,12 @@ single_thread_clear(struct proc *p, int flag)
 		 * it back into some sleep queue
 		 */
 		if (q->p_stat == SSTOP && (q->p_flag & flag) == 0) {
-			if (p->p_wchan == NULL || p->p_flag & P_WSLEEP)
+			if (q->p_wchan == NULL)
 				setrunnable(q);
-			else
+			else {
+				atomic_clearbits_int(&q->p_flag, P_WSLEEP);
 				q->p_stat = SSLEEP;
+			}
 		}
 	}
 	SCHED_UNLOCK(s);
diff --git a/sys/kern/kern_synch.c b/sys/kern/kern_synch.c
index cd1f4eafc..624bf52b2 100644
--- a/sys/kern/kern_synch.c
+++ b/sys/kern/kern_synch.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_synch.c,v 1.196 2023/08/10 20:44:52 claudio Exp $	*/
+/*	$OpenBSD: kern_synch.c,v 1.198 2023/08/16 07:55:52 claudio Exp $	*/
 /*	$NetBSD: kern_synch.c,v 1.37 1996/04/22 01:38:37 christos Exp $	*/
 
 /*
@@ -373,7 +373,6 @@ sleep_finish(int timo, int do_sleep)
 		timeout_add(&p->p_sleep_to, timo);
 	}
 
-	SCHED_LOCK(s);
 	if (catch != 0) {
 		/*
 		 * We put ourselves on the sleep queue and start our
@@ -390,6 +389,7 @@ sleep_finish(int timo, int do_sleep)
 		}
 	}
 
+	SCHED_LOCK(s);
 	/*
 	 * If the wakeup happens while going to sleep, p->p_wchan
 	 * will be NULL. In that case unwind immediately but still
@@ -520,7 +520,7 @@ unsleep(struct proc *p)
 	if (p->p_wchan != NULL) {
 		TAILQ_REMOVE(&slpque[LOOKUP(p->p_wchan)], p, p_runq);
 		p->p_wchan = NULL;
-		TRACEPOINT(sched, wakeup, p->p_tid + THREAD_PID_OFFSET,
+		TRACEPOINT(sched, unsleep, p->p_tid + THREAD_PID_OFFSET,
 		    p->p_p->ps_pid);
 	}
 }
diff --git a/sys/kern/sched_bsd.c b/sys/kern/sched_bsd.c
index d7ab05030..ae38ac60a 100644
--- a/sys/kern/sched_bsd.c
+++ b/sys/kern/sched_bsd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sched_bsd.c,v 1.79 2023/08/05 20:07:55 cheloha Exp $	*/
+/*	$OpenBSD: sched_bsd.c,v 1.81 2023/08/14 08:33:24 mpi Exp $	*/
 /*	$NetBSD: kern_synch.c,v 1.37 1996/04/22 01:38:37 christos Exp $	*/
 
 /*-
@@ -54,9 +54,8 @@
 #include <sys/ktrace.h>
 #endif
 
-
+uint32_t roundrobin_period;	/* [I] roundrobin period (ns) */
 int	lbolt;			/* once a second sleep address */
-int	rrticks_init;		/* # of hardclock ticks per roundrobin() */
 
 #ifdef MULTIPROCESSOR
 struct __mp_lock sched_lock;
@@ -69,21 +68,23 @@ uint32_t		decay_aftersleep(uint32_t, uint32_t);
  * Force switch among equal priority processes every 100ms.
  */
 void
-roundrobin(struct cpu_info *ci)
+roundrobin(struct clockintr *cl, void *cf)
 {
+	uint64_t count;
+	struct cpu_info *ci = curcpu();
 	struct schedstate_percpu *spc = &ci->ci_schedstate;
 
-	spc->spc_rrticks = rrticks_init;
+	count = clockintr_advance(cl, roundrobin_period);
 
 	if (ci->ci_curproc != NULL) {
-		if (spc->spc_schedflags & SPCF_SEENRR) {
+		if (spc->spc_schedflags & SPCF_SEENRR || count >= 2) {
 			/*
 			 * The process has already been through a roundrobin
 			 * without switching and may be hogging the CPU.
 			 * Indicate that the process should yield.
 			 */
 			atomic_setbits_int(&spc->spc_schedflags,
-			    SPCF_SHOULDYIELD);
+			    SPCF_SEENRR | SPCF_SHOULDYIELD);
 		} else {
 			atomic_setbits_int(&spc->spc_schedflags,
 			    SPCF_SEENRR);
@@ -461,6 +462,7 @@ setrunnable(struct proc *p)
 			atomic_setbits_int(&p->p_siglist, sigmask(pr->ps_xsig));
 		prio = p->p_usrpri;
 		unsleep(p);
+		setrunqueue(NULL, p, prio);
 		break;
 	case SSLEEP:
 		prio = p->p_slppri;
@@ -469,9 +471,11 @@ setrunnable(struct proc *p)
 		/* if not yet asleep, don't add to runqueue */
 		if (ISSET(p->p_flag, P_WSLEEP))
 			return;
+		setrunqueue(NULL, p, prio);
+		TRACEPOINT(sched, wakeup, p->p_tid + THREAD_PID_OFFSET,
+		    p->p_p->ps_pid, CPU_INFO_UNIT(p->p_cpu));
 		break;
 	}
-	setrunqueue(NULL, p, prio);
 	if (p->p_slptime > 1) {
 		uint32_t newcpu;
 
@@ -695,8 +699,6 @@ scheduler_start(void)
 	 * its job.
 	 */
 	timeout_set(&schedcpu_to, schedcpu, &schedcpu_to);
-
-	rrticks_init = hz / 10;
 	schedcpu(&schedcpu_to);
 
 #ifndef SMALL_KERNEL
diff --git a/sys/kern/sys_futex.c b/sys/kern/sys_futex.c
index 4aafc4f3f..1fd92e6d3 100644
--- a/sys/kern/sys_futex.c
+++ b/sys/kern/sys_futex.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sys_futex.c,v 1.21 2022/08/14 01:58:28 jsg Exp $ */
+/*	$OpenBSD: sys_futex.c,v 1.22 2023/08/14 07:42:34 miod Exp $ */
 
 /*
  * Copyright (c) 2016-2017 Martin Pieuchot
@@ -32,15 +32,6 @@
 
 #include <uvm/uvm.h>
 
-/*
- * Atomicity is only needed on MULTIPROCESSOR kernels.  Fall back on
- * copyin(9) until non-MULTIPROCESSOR architectures have a copyin32(9)
- * implementation.
- */
-#ifndef MULTIPROCESSOR
-#define copyin32(uaddr, kaddr)	copyin((uaddr), (kaddr), sizeof(uint32_t))
-#endif
-
 /*
  * Kernel representation of a futex.
  */
diff --git a/sys/lib/libz/deflate.c b/sys/lib/libz/deflate.c
index 2d7a265c0..4d623325c 100644
--- a/sys/lib/libz/deflate.c
+++ b/sys/lib/libz/deflate.c
@@ -175,6 +175,11 @@ local const config configuration_table[10] = {
  * bit values at the expense of memory usage). We slide even when level == 0 to
  * keep the hash table consistent if we switch back to level > 0 later.
  */
+#if defined(__has_feature)
+#  if __has_feature(memory_sanitizer)
+     __attribute__((no_sanitize("memory")))
+#  endif
+#endif
 local void slide_hash(deflate_state *s) {
     unsigned n, m;
     Posf *p;
diff --git a/sys/net/if_sec.c b/sys/net/if_sec.c
index d7be990a7..4c65efe36 100644
--- a/sys/net/if_sec.c
+++ b/sys/net/if_sec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_sec.c,v 1.5 2023/08/11 02:34:56 dlg Exp $ */
+/*	$OpenBSD: if_sec.c,v 1.7 2023/08/15 09:46:30 dlg Exp $ */
 
 /*
  * Copyright (c) 2022 The University of Queensland
@@ -72,6 +72,7 @@ struct sec_softc {
 	unsigned int			sc_up;
 
 	struct task			sc_send;
+	int				sc_txprio;
 
 	unsigned int			sc_unit;
 	SMR_SLIST_ENTRY(sec_softc)	sc_entry;
@@ -100,6 +101,7 @@ static void	sec_tdb_gc(void *);
 static struct if_clone sec_cloner =
     IF_CLONE_INITIALIZER("sec", sec_clone_create, sec_clone_destroy);
 
+static unsigned int		 sec_mix;
 static struct sec_bucket	 sec_map[256] __aligned(CACHELINESIZE);
 static struct tdb		*sec_tdbh[256] __aligned(CACHELINESIZE);
 
@@ -112,6 +114,7 @@ static struct mutex		 sec_tdb_gc_mtx =
 void
 secattach(int n)
 {
+	sec_mix = arc4random();
 	if_clone_attach(&sec_cloner);
 }
 
@@ -350,6 +353,7 @@ sec_send(void *arg)
 	struct tdb *tdb;
 	struct mbuf *m;
 	int error;
+	unsigned int flowid;
 
 	if (!ISSET(ifp->if_flags, IFF_RUNNING))
 		return;
@@ -358,6 +362,8 @@ sec_send(void *arg)
 	if (tdb == NULL)
 		goto purge;
 
+	flowid = sc->sc_unit ^ sec_mix;
+
 	NET_LOCK();
 	while ((m = ifq_dequeue(ifq)) != NULL) {
 		CLR(m->m_flags, M_BCAST|M_MCAST);
@@ -366,6 +372,16 @@ sec_send(void *arg)
 		pf_pkt_addr_changed(m);
 #endif
 
+#if NBPFILTER > 0
+		if (ifp->if_bpf)
+			bpf_mtap_af(ifp->if_bpf, m->m_pkthdr.ph_family, m,
+			    BPF_DIRECTION_OUT);
+#endif
+
+		m->m_pkthdr.pf.prio = sc->sc_txprio;
+		SET(m->m_pkthdr.csum_flags, M_FLOWID);
+		m->m_pkthdr.ph_flowid = flowid;
+
 		error = ipsp_process_packet(m, tdb,
 		    m->m_pkthdr.ph_family, /* already tunnelled? */ 0);
 		if (error != 0)
diff --git a/sys/sys/event.h b/sys/sys/event.h
index 05139cfe7..cc5a69e6a 100644
--- a/sys/sys/event.h
+++ b/sys/sys/event.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: event.h,v 1.69 2023/02/10 14:34:17 visa Exp $	*/
+/*	$OpenBSD: event.h,v 1.70 2023/08/13 08:29:28 visa Exp $	*/
 
 /*-
  * Copyright (c) 1999,2000,2001 Jonathan Lemon <jlemon@FreeBSD.org>
@@ -122,6 +122,13 @@ struct kevent {
 /* data/hint flags for EVFILT_DEVICE, shared with userspace */
 #define NOTE_CHANGE	0x00000001		/* device change event */
 
+/* additional flags for EVFILT_TIMER */
+#define NOTE_MSECONDS	0x00000000		/* data is milliseconds */
+#define NOTE_SECONDS	0x00000001		/* data is seconds */
+#define NOTE_USECONDS	0x00000002		/* data is microseconds */
+#define NOTE_NSECONDS	0x00000003		/* data is nanoseconds */
+#define NOTE_ABSTIME	0x00000010		/* timeout is absolute */
+
 /*
  * This is currently visible to userland to work around broken
  * programs which pull in <sys/proc.h> or <sys/selinfo.h>.
diff --git a/sys/sys/sched.h b/sys/sys/sched.h
index c63d96df3..9b4e2789c 100644
--- a/sys/sys/sched.h
+++ b/sys/sys/sched.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sched.h,v 1.60 2023/08/05 20:07:56 cheloha Exp $	*/
+/*	$OpenBSD: sched.h,v 1.61 2023/08/11 22:02:50 cheloha Exp $	*/
 /* $NetBSD: sched.h,v 1.2 1999/02/28 18:14:58 ross Exp $ */
 
 /*-
@@ -105,10 +105,10 @@ struct schedstate_percpu {
 	u_int spc_schedticks;		/* ticks for schedclock() */
 	u_int64_t spc_cp_time[CPUSTATES]; /* CPU state statistics */
 	u_char spc_curpriority;		/* usrpri of curproc */
-	int spc_rrticks;		/* ticks until roundrobin() */
 
 	struct clockintr *spc_itimer;	/* [o] itimer_update handle */
 	struct clockintr *spc_profclock; /* [o] profclock handle */
+	struct clockintr *spc_roundrobin; /* [o] roundrobin handle */
 
 	u_int spc_nrun;			/* procs on the run queues */
 
@@ -145,16 +145,16 @@ struct cpustats {
 #define NICE_WEIGHT 2			/* priorities per nice level */
 #define	ESTCPULIM(e) min((e), NICE_WEIGHT * PRIO_MAX - SCHED_PPQ)
 
+extern uint32_t roundrobin_period;
 extern int schedhz;			/* ideally: 16 */
-extern int rrticks_init;		/* ticks per roundrobin() */
 
 struct proc;
 void schedclock(struct proc *);
-struct cpu_info;
-void roundrobin(struct cpu_info *);
+void roundrobin(struct clockintr *, void *);
 void scheduler_start(void);
 void userret(struct proc *p);
 
+struct cpu_info;
 void sched_init_cpu(struct cpu_info *);
 void sched_idle(void *);
 void sched_exit(struct proc *);
diff --git a/sys/sys/videoio.h b/sys/sys/videoio.h
index a2b69bbe9..32d94092a 100644
--- a/sys/sys/videoio.h
+++ b/sys/sys/videoio.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: videoio.h,v 1.17 2020/11/20 05:27:29 mglocker Exp $	*/
+/*	$OpenBSD: videoio.h,v 1.18 2023/08/15 08:27:30 miod Exp $	*/
 /*
  *  Video for Linux Two header file
  *
@@ -1070,7 +1070,7 @@ enum v4l2_detect_md_mode {
 /*  Four-character-code (FOURCC) */
 #define v4l2_fourcc(a, b, c, d)\
 	((u_int32_t)(a) | ((u_int32_t)(b) << 8) | ((u_int32_t)(c) << 16) | ((u_int32_t)(d) << 24))
-#define v4l2_fourcc_be(a, b, c, d)	(v4l2_fourcc(a, b, c, d) | (1 << 31))
+#define v4l2_fourcc_be(a, b, c, d)	(v4l2_fourcc(a, b, c, d) | (1U << 31))
 
 /*
  *	E N U M S
diff --git a/sys/uvm/uvm_page.c b/sys/uvm/uvm_page.c
index 8bb23e37f..91b24cc1e 100644
--- a/sys/uvm/uvm_page.c
+++ b/sys/uvm/uvm_page.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_page.c,v 1.172 2023/05/13 09:24:59 mpi Exp $	*/
+/*	$OpenBSD: uvm_page.c,v 1.173 2023/08/12 07:22:56 mpi Exp $	*/
 /*	$NetBSD: uvm_page.c,v 1.44 2000/11/27 08:40:04 chs Exp $	*/
 
 /*
@@ -1219,10 +1219,15 @@ struct vm_page *
 uvm_pagelookup(struct uvm_object *obj, voff_t off)
 {
 	/* XXX if stack is too much, handroll */
-	struct vm_page pg;
+	struct vm_page p, *pg;
 
-	pg.offset = off;
-	return RBT_FIND(uvm_objtree, &obj->memt, &pg);
+	p.offset = off;
+	pg = RBT_FIND(uvm_objtree, &obj->memt, &p);
+
+	KASSERT(pg == NULL || obj->uo_npages != 0);
+	KASSERT(pg == NULL || (pg->pg_flags & PG_RELEASED) == 0 ||
+	    (pg->pg_flags & PG_BUSY) != 0);
+	return (pg);
 }
 
 /*
diff --git a/sys/uvm/uvm_pager.c b/sys/uvm/uvm_pager.c
index 60c0d79a1..3b3669789 100644
--- a/sys/uvm/uvm_pager.c
+++ b/sys/uvm/uvm_pager.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_pager.c,v 1.90 2023/05/13 09:24:59 mpi Exp $	*/
+/*	$OpenBSD: uvm_pager.c,v 1.91 2023/08/11 17:53:22 mpi Exp $	*/
 /*	$NetBSD: uvm_pager.c,v 1.36 2000/11/27 18:26:41 chs Exp $	*/
 
 /*
@@ -755,14 +755,12 @@ void
 uvm_aio_aiodone_pages(struct vm_page **pgs, int npages, boolean_t write,
     int error)
 {
-	struct uvm_object *uobj;
 	struct vm_page *pg;
 	struct rwlock *slock;
 	boolean_t swap;
 	int i, swslot;
 
 	slock = NULL;
-	uobj = NULL;
 	pg = pgs[0];
 	swap = (pg->uanon != NULL && pg->uobject == NULL) ||
 		(pg->pg_flags & PQ_AOBJ) != 0;
diff --git a/usr.bin/kdump/mksubr b/usr.bin/kdump/mksubr
index 6dd94c00a..2762a0d97 100644
--- a/usr.bin/kdump/mksubr
+++ b/usr.bin/kdump/mksubr
@@ -1,5 +1,5 @@
 #!/bin/sh
-# $OpenBSD: mksubr,v 1.39 2022/12/19 22:55:12 guenther Exp $
+# $OpenBSD: mksubr,v 1.40 2023/08/13 08:29:28 visa Exp $
 #
 # Copyright (c) 2006 David Kirchner <dpk@dpk.net>
 #
@@ -560,6 +560,29 @@ _EOF_
 		printf "\t\tif_print_or(fflags, %s, or);\n", $i }'
 cat <<_EOF_
 		break;
+	case EVFILT_TIMER:
+#define NOTE_TIMER_UNITMASK \
+    (NOTE_SECONDS|NOTE_MSECONDS|NOTE_USECONDS|NOTE_NSECONDS)
+		switch (fflags & NOTE_TIMER_UNITMASK) {
+		case NOTE_SECONDS:
+			printf("NOTE_SECONDS");
+			break;
+		case NOTE_MSECONDS:
+			printf("NOTE_MSECONDS");
+			break;
+		case NOTE_USECONDS:
+			printf("NOTE_USECONDS");
+			break;
+		case NOTE_NSECONDS:
+			printf("NOTE_NSECONDS");
+			break;
+		default:
+			printf("invalid");
+			break;
+		}
+		or = 1;
+		if_print_or(fflags, NOTE_ABSTIME, or);
+		break;
 	}
 	printf(">");
 }
diff --git a/usr.bin/nc/netcat.c b/usr.bin/nc/netcat.c
index c8f1cdd9f..54ddd0ffc 100644
--- a/usr.bin/nc/netcat.c
+++ b/usr.bin/nc/netcat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: netcat.c,v 1.225 2023/01/04 12:53:38 deraadt Exp $ */
+/* $OpenBSD: netcat.c,v 1.226 2023/08/14 08:07:27 tb Exp $ */
 /*
  * Copyright (c) 2001 Eric Jackson <ericj@monkey.org>
  * Copyright (c) 2015 Bob Beck.  All rights reserved.
@@ -1177,7 +1177,7 @@ readwrite(int net_fd, struct tls *tls_ctx)
 			pfd[POLL_NETIN].fd = -1;
 
 		if (pfd[POLL_NETOUT].revents & POLLHUP) {
-			if (Nflag)
+			if (pfd[POLL_NETOUT].fd != -1 && Nflag)
 				shutdown(pfd[POLL_NETOUT].fd, SHUT_WR);
 			pfd[POLL_NETOUT].fd = -1;
 		}
@@ -1256,7 +1256,7 @@ readwrite(int net_fd, struct tls *tls_ctx)
 			if (netinbufpos == BUFSIZE)
 				pfd[POLL_NETIN].events = 0;
 			/* handle telnet */
-			if (tflag)
+			if (pfd[POLL_NETIN].fd != -1 && tflag)
 				atelnet(pfd[POLL_NETIN].fd, netinbuf,
 				    netinbufpos);
 		}
@@ -1297,6 +1297,9 @@ drainbuf(int fd, unsigned char *buf, size_t *bufpos, struct tls *tls)
 	ssize_t n;
 	ssize_t adjust;
 
+	if (fd == -1)
+		return -1;
+
 	if (tls) {
 		n = tls_write(tls, buf, *bufpos);
 		if (n == -1)
@@ -1323,6 +1326,9 @@ fillbuf(int fd, unsigned char *buf, size_t *bufpos, struct tls *tls)
 	size_t num = BUFSIZE - *bufpos;
 	ssize_t n;
 
+	if (fd == -1)
+		return -1;
+
 	if (tls) {
 		n = tls_read(tls, buf + *bufpos, num);
 		if (n == -1)
diff --git a/usr.bin/ssh/monitor.c b/usr.bin/ssh/monitor.c
index ca1d34eb5..8746a8e2c 100644
--- a/usr.bin/ssh/monitor.c
+++ b/usr.bin/ssh/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.236 2023/05/10 10:04:20 dtucker Exp $ */
+/* $OpenBSD: monitor.c,v 1.237 2023/08/16 16:14:11 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -279,6 +279,11 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
 				    auth_method, auth_submethod);
 			}
 		}
+		if (authctxt->failures > options.max_authtries) {
+			/* Shouldn't happen */
+			fatal_f("privsep child made too many authentication "
+			    "attempts");
+		}
 	}
 
 	if (!authctxt->valid)
diff --git a/usr.bin/ssh/ssh2.h b/usr.bin/ssh/ssh2.h
index 32ddae89b..288c39f69 100644
--- a/usr.bin/ssh/ssh2.h
+++ b/usr.bin/ssh/ssh2.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh2.h,v 1.19 2020/11/19 23:05:05 dtucker Exp $ */
+/* $OpenBSD: ssh2.h,v 1.20 2023/08/14 03:37:00 djm Exp $ */
 
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
@@ -85,6 +85,7 @@
 #define SSH2_MSG_SERVICE_REQUEST			5
 #define SSH2_MSG_SERVICE_ACCEPT				6
 #define SSH2_MSG_EXT_INFO				7
+#define SSH2_MSG_NEWCOMPRESS				8
 
 /* transport layer: alg negotiation */
 
diff --git a/usr.bin/tmux/cmd-display-menu.c b/usr.bin/tmux/cmd-display-menu.c
index d616d0c43..5f0a011e5 100644
--- a/usr.bin/tmux/cmd-display-menu.c
+++ b/usr.bin/tmux/cmd-display-menu.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cmd-display-menu.c,v 1.41 2023/08/08 08:08:47 nicm Exp $ */
+/* $OpenBSD: cmd-display-menu.c,v 1.42 2023/08/15 07:01:47 nicm Exp $ */
 
 /*
  * Copyright (c) 2019 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -39,11 +39,11 @@ const struct cmd_entry cmd_display_menu_entry = {
 	.name = "display-menu",
 	.alias = "menu",
 
-	.args = { "b:c:C:t:s:S:OT:x:y:", 1, -1, cmd_display_menu_args_parse },
+	.args = { "b:c:C:H:s:S:Ot:T:x:y:", 1, -1, cmd_display_menu_args_parse },
 	.usage = "[-O] [-b border-lines] [-c target-client] "
-		 "[-C starting-choice] [-s style] [-S border-style] "
-		 CMD_TARGET_PANE_USAGE "[-T title] [-x position] [-y position] "
-		 "name key command ...",
+		 "[-C starting-choice] [-H selected-style] [-s style] "
+		 "[-S border-style] " CMD_TARGET_PANE_USAGE "[-T title] "
+		 "[-x position] [-y position] name key command ...",
 
 	.target = { 't', CMD_FIND_PANE, 0 },
 
@@ -293,6 +293,7 @@ cmd_display_menu_exec(struct cmd *self, struct cmdq_item *item)
 	const char		*key, *name, *value;
 	const char		*style = args_get(args, 's');
 	const char		*border_style = args_get(args, 'S');
+	const char		*selected_style = args_get(args, 'H');
 	enum box_lines		 lines = BOX_LINES_DEFAULT;
 	char			*title, *cause;
 	int			 flags = 0, starting_choice = 0;
@@ -376,7 +377,7 @@ cmd_display_menu_exec(struct cmd *self, struct cmdq_item *item)
 	if (!event->m.valid)
 		flags |= MENU_NOMOUSE;
 	if (menu_display(menu, flags, starting_choice, item, px, py, tc, lines,
-	    style, border_style, target, NULL, NULL) != 0)
+	    style, selected_style, border_style, target, NULL, NULL) != 0)
 		return (CMD_RETURN_NORMAL);
 	return (CMD_RETURN_WAIT);
 }
diff --git a/usr.bin/tmux/key-bindings.c b/usr.bin/tmux/key-bindings.c
index 9d8522635..d2fa869ed 100644
--- a/usr.bin/tmux/key-bindings.c
+++ b/usr.bin/tmux/key-bindings.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: key-bindings.c,v 1.147 2023/02/02 09:06:44 nicm Exp $ */
+/* $OpenBSD: key-bindings.c,v 1.148 2023/08/15 09:51:48 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -466,9 +466,11 @@ key_bindings_init(void)
 
 		/* Mouse button 3 down on status left. */
 		"bind -n MouseDown3StatusLeft { display-menu -t= -xM -yW -T '#[align=centre]#{session_name}' " DEFAULT_SESSION_MENU " }",
+		"bind -n M-MouseDown3StatusLeft { display-menu -t= -xM -yW -T '#[align=centre]#{session_name}' " DEFAULT_SESSION_MENU " }",
 
 		/* Mouse button 3 down on status line. */
 		"bind -n MouseDown3Status { display-menu -t= -xW -yW -T '#[align=centre]#{window_index}:#{window_name}' " DEFAULT_WINDOW_MENU "}",
+		"bind -n M-MouseDown3Status { display-menu -t= -xW -yW -T '#[align=centre]#{window_index}:#{window_name}' " DEFAULT_WINDOW_MENU "}",
 
 		/* Mouse button 3 down on pane. */
 		"bind -n MouseDown3Pane { if -Ft= '#{||:#{mouse_any_flag},#{&&:#{pane_in_mode},#{?#{m/r:(copy|view)-mode,#{pane_mode}},0,1}}}' { select-pane -t=; send -M } { display-menu -t= -xM -yM -T '#[align=centre]#{pane_index} (#{pane_id})' " DEFAULT_PANE_MENU " } }",
diff --git a/usr.bin/tmux/menu.c b/usr.bin/tmux/menu.c
index 4b0622020..79ad009ff 100644
--- a/usr.bin/tmux/menu.c
+++ b/usr.bin/tmux/menu.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: menu.c,v 1.51 2023/08/08 08:08:47 nicm Exp $ */
+/* $OpenBSD: menu.c,v 1.52 2023/08/15 07:01:47 nicm Exp $ */
 
 /*
  * Copyright (c) 2019 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -29,6 +29,7 @@ struct menu_data {
 
 	struct grid_cell	 style;
 	struct grid_cell	 border_style;
+	struct grid_cell	 selected_style;
 	enum box_lines		 border_lines;
 
 	struct cmd_find_state	 fs;
@@ -201,7 +202,6 @@ menu_draw_cb(struct client *c, void *data,
 	struct menu		*menu = md->menu;
 	struct screen_write_ctx	 ctx;
 	u_int			 i, px = md->px, py = md->py;
-	struct grid_cell	 gc;
 
 	screen_write_start(&ctx, s);
 	screen_write_clearscreen(&ctx, 8);
@@ -210,10 +210,9 @@ menu_draw_cb(struct client *c, void *data,
 		screen_write_box(&ctx, menu->width + 4, menu->count + 2,
 		    md->border_lines, &md->border_style, menu->title);
 	}
-	style_apply(&gc, c->session->curw->window->options, "mode-style", NULL);
 
 	screen_write_menu(&ctx, menu, md->choice, md->border_lines,
-	    &md->style, &md->border_style, &gc);
+	    &md->style, &md->border_style, &md->selected_style);
 	screen_write_stop(&ctx);
 
 	for (i = 0; i < screen_size_y(&md->s); i++) {
@@ -438,16 +437,35 @@ chosen:
 	return (1);
 }
 
+static void
+menu_set_style(struct client *c, struct grid_cell *gc, const char *style,
+    const char *option)
+{
+	struct style	 sytmp;
+	struct options	*o = c->session->curw->window->options;
+
+	memcpy(gc, &grid_default_cell, sizeof *gc);
+	style_apply(gc, o, option, NULL);
+	if (style != NULL) {
+		style_set(&sytmp, &grid_default_cell);
+		if (style_parse(&sytmp, gc, style) == 0) {
+			gc->fg = sytmp.gc.fg;
+			gc->bg = sytmp.gc.bg;
+		}
+	}
+	gc->attr = 0;
+}
+
 struct menu_data *
 menu_prepare(struct menu *menu, int flags, int starting_choice,
     struct cmdq_item *item, u_int px, u_int py, struct client *c,
-    enum box_lines lines, const char *style, const char *border_style,
-    struct cmd_find_state *fs, menu_choice_cb cb, void *data)
+    enum box_lines lines, const char *style, const char *selected_style,
+    const char *border_style, struct cmd_find_state *fs, menu_choice_cb cb,
+    void *data)
 {
 	struct menu_data	*md;
 	int			 choice;
 	const char		*name;
-	struct style		 sytmp;
 	struct options		*o = c->session->curw->window->options;
 
 	if (c->tty.sx < menu->width + 4 || c->tty.sy < menu->count + 2)
@@ -465,27 +483,10 @@ menu_prepare(struct menu *menu, int flags, int starting_choice,
 	md->flags = flags;
 	md->border_lines = lines;
 
-	memcpy(&md->style, &grid_default_cell, sizeof md->style);
-	style_apply(&md->style, o, "menu-style", NULL);
-	if (style != NULL) {
-		style_set(&sytmp, &grid_default_cell);
-		if (style_parse(&sytmp, &md->style, style) == 0) {
-			md->style.fg = sytmp.gc.fg;
-			md->style.bg = sytmp.gc.bg;
-		}
-	}
-	md->style.attr = 0;
-
-	memcpy(&md->border_style, &grid_default_cell, sizeof md->border_style);
-	style_apply(&md->border_style, o, "menu-border-style", NULL);
-	if (border_style != NULL) {
-		style_set(&sytmp, &grid_default_cell);
-		if (style_parse(&sytmp, &md->border_style, border_style) == 0) {
-			md->border_style.fg = sytmp.gc.fg;
-			md->border_style.bg = sytmp.gc.bg;
-		}
-	}
-	md->border_style.attr = 0;
+	menu_set_style(c, &md->style, style, "menu-style");
+	menu_set_style(c, &md->selected_style, selected_style,
+	    "menu-selected-style");
+	menu_set_style(c, &md->border_style, border_style, "menu-border-style");
 
 	if (fs != NULL)
 		cmd_find_copy_state(&md->fs, fs);
@@ -539,13 +540,14 @@ menu_prepare(struct menu *menu, int flags, int starting_choice,
 int
 menu_display(struct menu *menu, int flags, int starting_choice,
     struct cmdq_item *item, u_int px, u_int py, struct client *c,
-    enum box_lines lines, const char *style, const char *border_style,
-    struct cmd_find_state *fs, menu_choice_cb cb, void *data)
+    enum box_lines lines, const char *style, const char *selected_style,
+    const char *border_style, struct cmd_find_state *fs, menu_choice_cb cb,
+    void *data)
 {
 	struct menu_data	*md;
 
 	md = menu_prepare(menu, flags, starting_choice, item, px, py, c, lines,
-	    style, border_style, fs, cb, data);
+	    style, selected_style, border_style, fs, cb, data);
 	if (md == NULL)
 		return (-1);
 	server_client_set_overlay(c, 0, NULL, menu_mode_cb, menu_draw_cb,
diff --git a/usr.bin/tmux/mode-tree.c b/usr.bin/tmux/mode-tree.c
index 08a5c294f..c1f3b5f53 100644
--- a/usr.bin/tmux/mode-tree.c
+++ b/usr.bin/tmux/mode-tree.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mode-tree.c,v 1.64 2023/08/08 08:08:47 nicm Exp $ */
+/* $OpenBSD: mode-tree.c,v 1.66 2023/08/15 07:01:47 nicm Exp $ */
 
 /*
  * Copyright (c) 2017 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -497,7 +497,7 @@ mode_tree_build(struct mode_tree_data *mtd)
 	mode_tree_clear_lines(mtd);
 	mode_tree_build_lines(mtd, &mtd->children, 0);
 
-	if (tag == UINT64_MAX)
+	if (mtd->line_list != NULL && tag == UINT64_MAX)
 		tag = mtd->line_list[mtd->current].item->tag;
 	mode_tree_set_current(mtd, tag);
 
@@ -963,7 +963,7 @@ mode_tree_display_menu(struct mode_tree_data *mtd, struct client *c, u_int x,
 	else
 		x = 0;
 	if (menu_display(menu, 0, 0, NULL, x, y, c, BOX_LINES_DEFAULT, NULL,
-	    NULL, NULL, mode_tree_menu_callback, mtm) != 0)
+	    NULL, NULL, NULL, mode_tree_menu_callback, mtm) != 0)
 		menu_free(menu);
 }
 
diff --git a/usr.bin/tmux/options-table.c b/usr.bin/tmux/options-table.c
index 211257f21..9b4638984 100644
--- a/usr.bin/tmux/options-table.c
+++ b/usr.bin/tmux/options-table.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: options-table.c,v 1.166 2023/08/08 08:08:47 nicm Exp $ */
+/* $OpenBSD: options-table.c,v 1.167 2023/08/15 07:01:47 nicm Exp $ */
 
 /*
  * Copyright (c) 2011 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -336,6 +336,15 @@ const struct options_table_entry options_table[] = {
 	  .text = "Default style of menu."
 	},
 
+	{ .name = "menu-selected-style",
+	  .type = OPTIONS_TABLE_STRING,
+	  .scope = OPTIONS_TABLE_WINDOW,
+	  .flags = OPTIONS_TABLE_IS_STYLE,
+	  .default_str = "bg=yellow,fg=black",
+	  .separator = ",",
+	  .text = "Default style of selected menu item."
+	},
+
 	{ .name = "menu-border-style",
 	  .type = OPTIONS_TABLE_STRING,
 	  .scope = OPTIONS_TABLE_WINDOW,
@@ -962,8 +971,8 @@ const struct options_table_entry options_table[] = {
 	{ .name = "mode-style",
 	  .type = OPTIONS_TABLE_STRING,
 	  .scope = OPTIONS_TABLE_WINDOW,
-	  .default_str = "bg=yellow,fg=black",
 	  .flags = OPTIONS_TABLE_IS_STYLE,
+	  .default_str = "bg=yellow,fg=black",
 	  .separator = ",",
 	  .text = "Style of indicators and highlighting in modes."
 	},
diff --git a/usr.bin/tmux/popup.c b/usr.bin/tmux/popup.c
index 35adb1b3c..e625506da 100644
--- a/usr.bin/tmux/popup.c
+++ b/usr.bin/tmux/popup.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: popup.c,v 1.51 2023/08/08 08:08:47 nicm Exp $ */
+/* $OpenBSD: popup.c,v 1.52 2023/08/15 07:01:47 nicm Exp $ */
 
 /*
  * Copyright (c) 2020 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -576,7 +576,7 @@ menu:
 	else
 		x = 0;
 	pd->md = menu_prepare(pd->menu, 0, 0, NULL, x, m->y, c,
-	    BOX_LINES_DEFAULT, NULL, NULL, NULL, popup_menu_done, pd);
+	    BOX_LINES_DEFAULT, NULL, NULL, NULL, NULL, popup_menu_done, pd);
 	c->flags |= CLIENT_REDRAWOVERLAY;
 
 out:
diff --git a/usr.bin/tmux/screen-write.c b/usr.bin/tmux/screen-write.c
index 8d98e0e99..a2883535f 100644
--- a/usr.bin/tmux/screen-write.c
+++ b/usr.bin/tmux/screen-write.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: screen-write.c,v 1.217 2023/08/08 08:08:47 nicm Exp $ */
+/* $OpenBSD: screen-write.c,v 1.218 2023/08/15 07:01:47 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -733,7 +733,7 @@ screen_write_menu(struct screen_write_ctx *ctx, struct menu *menu, int choice,
 			continue;
 		}
 
-		format_draw(ctx, gc, width, name, NULL, gc == choice_gc);
+		format_draw(ctx, gc, width, name, NULL, 0);
 		gc = &default_gc;
 	}
 
diff --git a/usr.bin/tmux/status.c b/usr.bin/tmux/status.c
index ce8c9f705..9e7aa2929 100644
--- a/usr.bin/tmux/status.c
+++ b/usr.bin/tmux/status.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: status.c,v 1.239 2023/08/08 08:08:47 nicm Exp $ */
+/* $OpenBSD: status.c,v 1.240 2023/08/15 07:01:47 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -1765,8 +1765,8 @@ status_prompt_complete_list_menu(struct client *c, char **list, u_int size,
 		offset = 0;
 
 	if (menu_display(menu, MENU_NOMOUSE|MENU_TAB, 0, NULL, offset, py, c,
-	    BOX_LINES_DEFAULT, NULL, NULL, NULL, status_prompt_menu_callback,
-	    spm) != 0) {
+	    BOX_LINES_DEFAULT, NULL, NULL, NULL, NULL,
+	    status_prompt_menu_callback, spm) != 0) {
 		menu_free(menu);
 		free(spm);
 		return (0);
@@ -1859,8 +1859,8 @@ status_prompt_complete_window_menu(struct client *c, struct session *s,
 		offset = 0;
 
 	if (menu_display(menu, MENU_NOMOUSE|MENU_TAB, 0, NULL, offset, py, c,
-	    BOX_LINES_DEFAULT, NULL, NULL, NULL, status_prompt_menu_callback,
-	    spm) != 0) {
+	    BOX_LINES_DEFAULT, NULL, NULL, NULL, NULL,
+	    status_prompt_menu_callback, spm) != 0) {
 		menu_free(menu);
 		free(spm);
 		return (NULL);
diff --git a/usr.bin/tmux/tmux.1 b/usr.bin/tmux/tmux.1
index 6a2277917..1e43c29a1 100644
--- a/usr.bin/tmux/tmux.1
+++ b/usr.bin/tmux/tmux.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: tmux.1,v 1.926 2023/08/08 08:21:30 nicm Exp $
+.\" $OpenBSD: tmux.1,v 1.927 2023/08/15 07:01:47 nicm Exp $
 .\"
 .\" Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
 .\"
@@ -14,7 +14,7 @@
 .\" IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
 .\" OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: August 8 2023 $
+.Dd $Mdocdate: August 15 2023 $
 .Dt TMUX 1
 .Os
 .Sh NAME
@@ -4096,6 +4096,13 @@ See the
 section on how to specify
 .Ar style .
 Attributes are ignored.
+.It Ic menu-selected-style Ar style
+Set the selected menu item style.
+See the
+.Sx STYLES
+section on how to specify
+.Ar style .
+Attributes are ignored.
 .It Ic menu-border-style Ar style
 Set the menu border style.
 See the
@@ -4108,7 +4115,7 @@ Set the type of characters used for drawing menu borders.
 See
 .Ic popup-border-lines
 for possible values for
-.Ar type .
+.Ar border-lines .
 .It Ic message-command-style Ar style
 Set status line message command style.
 This is used for the command prompt with
@@ -6064,10 +6071,11 @@ the default is
 .Op Fl O
 .Op Fl b Ar border-lines
 .Op Fl c Ar target-client
+.Op Fl C Ar starting-choice
+.Op Fl H Ar selected-style
 .Op Fl s Ar style
 .Op Fl S Ar border-style
 .Op Fl t Ar target-pane
-.Op Fl C Ar starting-choice
 .Op Fl T Ar title
 .Op Fl x Ar position
 .Op Fl y Ar position
@@ -6101,6 +6109,10 @@ See
 for possible values for
 .Ar border-lines .
 .Pp
+.Fl H
+sets the style for the selected menu item (see
+.Sx STYLES ) .
+.Pp
 .Fl s
 sets the style for the menu and
 .Fl S
diff --git a/usr.bin/tmux/tmux.h b/usr.bin/tmux/tmux.h
index 78df276b2..0ee5813e0 100644
--- a/usr.bin/tmux/tmux.h
+++ b/usr.bin/tmux/tmux.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tmux.h,v 1.1204 2023/08/08 08:21:30 nicm Exp $ */
+/* $OpenBSD: tmux.h,v 1.1205 2023/08/15 07:01:47 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -3308,12 +3308,12 @@ void		 menu_add_item(struct menu *, const struct menu_item *,
 void		 menu_free(struct menu *);
 struct menu_data *menu_prepare(struct menu *, int, int, struct cmdq_item *,
 		    u_int, u_int, struct client *, enum box_lines, const char *,
-		    const char *, struct cmd_find_state *, menu_choice_cb,
-		    void *);
+		    const char *, const char *, struct cmd_find_state *,
+		    menu_choice_cb, void *);
 int		 menu_display(struct menu *, int, int, struct cmdq_item *,
 		    u_int, u_int, struct client *, enum box_lines, const char *,
-		    const char *, struct cmd_find_state *, menu_choice_cb,
-		    void *);
+		    const char *, const char *, struct cmd_find_state *,
+		    menu_choice_cb, void *);
 struct screen	*menu_mode_cb(struct client *, void *, u_int *, u_int *);
 void		 menu_check_cb(struct client *, void *, u_int, u_int, u_int,
 		    struct overlay_ranges *);
diff --git a/usr.bin/unifdef/unifdef.1 b/usr.bin/unifdef/unifdef.1
index 9c1ebf78d..160981327 100644
--- a/usr.bin/unifdef/unifdef.1
+++ b/usr.bin/unifdef/unifdef.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: unifdef.1,v 1.30 2022/02/18 10:24:33 jsg Exp $
+.\"	$OpenBSD: unifdef.1,v 1.31 2023/08/13 02:20:23 jsg Exp $
 .\" Copyright (c) 1985, 1991, 1993
 .\"	The Regents of the University of California.  All rights reserved.
 .\" Copyright (c) 2002 - 2013 Tony Finch <dot@dotat.at>.  All rights reserved.
@@ -30,7 +30,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: February 18 2022 $
+.Dd $Mdocdate: August 13 2023 $
 .Dt UNIFDEF 1
 .Os
 .Sh NAME
@@ -449,7 +449,7 @@ The unifdef home page is
 The
 .Nm
 command appeared in
-.Bx 2.9 .
+.Bx 4.1c .
 .Tn ANSI\~C
 support was added in
 .Fx 4.7 .
diff --git a/usr.sbin/bgpd/bgpd.c b/usr.sbin/bgpd/bgpd.c
index 1d72bd8a2..1131e152b 100644
--- a/usr.sbin/bgpd/bgpd.c
+++ b/usr.sbin/bgpd/bgpd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bgpd.c,v 1.258 2023/04/19 07:12:22 claudio Exp $ */
+/*	$OpenBSD: bgpd.c,v 1.259 2023/08/16 08:26:35 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -722,9 +722,6 @@ send_config(struct bgpd_config *conf)
 		if (imsg_compose(ibuf_rtr, IMSG_RECONF_ASPA_TAS, 0, 0,
 		    -1, aspa->tas, sizeof(*aspa->tas) * aspa->num) == -1)
 			return (-1);
-		if (imsg_compose(ibuf_rtr, IMSG_RECONF_ASPA_TAS_AID,
-		    0, 0, -1, aspa->tas_aid, aspa->num) == -1)
-			return (-1);
 		if (imsg_compose(ibuf_rtr, IMSG_RECONF_ASPA_DONE, 0, 0, -1,
 		    NULL, 0) == -1)
 			return -1;
diff --git a/usr.sbin/bgpd/bgpd.conf.5 b/usr.sbin/bgpd/bgpd.conf.5
index b4dd58f67..b007b31aa 100644
--- a/usr.sbin/bgpd/bgpd.conf.5
+++ b/usr.sbin/bgpd/bgpd.conf.5
@@ -1,4 +1,4 @@
-.\" $OpenBSD: bgpd.conf.5,v 1.235 2023/04/20 12:44:28 claudio Exp $
+.\" $OpenBSD: bgpd.conf.5,v 1.236 2023/08/16 08:38:40 job Exp $
 .\"
 .\" Copyright (c) 2004 Claudio Jeker <claudio@openbsd.org>
 .\" Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -16,7 +16,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: April 20 2023 $
+.Dd $Mdocdate: August 16 2023 $
 .Dt BGPD.CONF 5
 .Os
 .Sh NAME
@@ -453,7 +453,6 @@ rules.
 .Ic { Ic customer-as Ar as-number
 .Op Ic expires Ar seconds
 .Ic provider-as Ic { Ar as-number
-.Op Ic inet Ns | Ns Ic inet6
 .Ic ... Ic } ... Ic }
 .Xc
 The
@@ -466,7 +465,7 @@ and the ASPA Validation State (AVS) is set.
 .Ic expires
 can be set to the seconds since Epoch until when this VAP is valid.
 .Bd -literal -offset indent
-roa-set {
+aspa-set {
 	customer-as 64511 provider-as { 64496 65496 }
 	customer-as 64496 provider-as { 65496 64544 }
 }
diff --git a/usr.sbin/bgpd/bgpd.h b/usr.sbin/bgpd/bgpd.h
index 181746b7a..985ab7915 100644
--- a/usr.sbin/bgpd/bgpd.h
+++ b/usr.sbin/bgpd/bgpd.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bgpd.h,v 1.475 2023/04/20 15:44:45 claudio Exp $ */
+/*	$OpenBSD: bgpd.h,v 1.476 2023/08/16 08:26:35 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -642,7 +642,6 @@ enum imsg_type {
 	IMSG_RECONF_ROA_ITEM,
 	IMSG_RECONF_ASPA,
 	IMSG_RECONF_ASPA_TAS,
-	IMSG_RECONF_ASPA_TAS_AID,
 	IMSG_RECONF_ASPA_DONE,
 	IMSG_RECONF_ASPA_PREP,
 	IMSG_RECONF_RTR_CONFIG,
@@ -1270,10 +1269,8 @@ struct aspa_set {
 	uint32_t			 as;
 	uint32_t			 num;
 	uint32_t			 *tas;
-	uint8_t				 *tas_aid;
 	RB_ENTRY(aspa_set)		 entry;
 };
-#define TAS_AID_SIZE(n)	(((n) + 15) / 16 * sizeof(uint32_t))
 
 struct aspa_prep {
 	size_t				datasize;
diff --git a/usr.sbin/bgpd/config.c b/usr.sbin/bgpd/config.c
index 00f2379df..057dc8634 100644
--- a/usr.sbin/bgpd/config.c
+++ b/usr.sbin/bgpd/config.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: config.c,v 1.107 2023/04/18 12:11:27 claudio Exp $ */
+/*	$OpenBSD: config.c,v 1.108 2023/08/16 08:26:35 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004, 2005 Henning Brauer <henning@openbsd.org>
@@ -224,7 +224,6 @@ free_aspa(struct aspa_set *aspa)
 	if (aspa == NULL)
 		return;
 	free(aspa->tas);
-	free(aspa->tas_aid);
 	free(aspa);
 }
 
diff --git a/usr.sbin/bgpd/parse.y b/usr.sbin/bgpd/parse.y
index b6a182040..235eedf30 100644
--- a/usr.sbin/bgpd/parse.y
+++ b/usr.sbin/bgpd/parse.y
@@ -1,4 +1,4 @@
-/*	$OpenBSD: parse.y,v 1.454 2023/04/28 13:23:52 claudio Exp $ */
+/*	$OpenBSD: parse.y,v 1.455 2023/08/16 08:26:35 claudio Exp $ */
 
 /*
  * Copyright (c) 2002, 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -134,7 +134,6 @@ struct aspa_tas_l {
 	struct aspa_tas_l	*next;
 	uint32_t		 as;
 	uint32_t		 num;
-	uint8_t			 aid;
 };
 
 struct flowspec_context {
@@ -667,14 +666,12 @@ aspa_tas	: as4number_any {
 			if (($$ = calloc(1, sizeof(*$$))) == NULL)
 				fatal(NULL);
 			$$->as = $1;
-			$$->aid = AID_UNSPEC;
 			$$->num = 1;
 		}
 		| as4number_any af {
 			if (($$ = calloc(1, sizeof(*$$))) == NULL)
 				fatal(NULL);
 			$$->as = $1;
-			$$->aid = $2;
 			$$->num = 1;
 		}
 		;
@@ -5448,7 +5445,6 @@ merge_aspa_set(uint32_t as, struct aspa_tas_l *tas, time_t expires)
 {
 	struct aspa_set	*aspa, needle = { .as = as };
 	uint32_t i, num, *newtas;
-	uint8_t *newtasaid = NULL;
 
 	aspa = RB_FIND(aspa_tree, &conf->aspa, &needle);
 	if (aspa == NULL) {
@@ -5471,25 +5467,14 @@ merge_aspa_set(uint32_t as, struct aspa_tas_l *tas, time_t expires)
 		yyerror("out of memory");
 		return -1;
 	}
-	newtasaid = recallocarray(aspa->tas_aid, aspa->num, num, 1);
-	if (newtasaid == NULL) {
-		free(newtas);
-		yyerror("out of memory");
-		return -1;
-	}
-
 	/* fill starting at the end since the tas list is reversed */
 	if (num > 0) {
-		for (i = num - 1; tas; tas = tas->next, i--) {
+		for (i = num - 1; tas; tas = tas->next, i--)
 			newtas[i] = tas->as;
-			if (tas->aid != AID_UNSPEC)
-				newtasaid[i] = tas->aid;
-		}
 	}
 
 	aspa->num = num;
 	aspa->tas = newtas;
-	aspa->tas_aid = newtasaid;
 	/* take the longest expiry time, same logic as for ROA entries */
 	if (aspa->expires != 0 && expires != 0 && expires > aspa->expires)
 		aspa->expires = expires;
diff --git a/usr.sbin/bgpd/printconf.c b/usr.sbin/bgpd/printconf.c
index 32be9d820..57dc8aeb0 100644
--- a/usr.sbin/bgpd/printconf.c
+++ b/usr.sbin/bgpd/printconf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: printconf.c,v 1.167 2023/04/28 13:23:52 claudio Exp $	*/
+/*	$OpenBSD: printconf.c,v 1.168 2023/08/16 08:26:35 claudio Exp $	*/
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -723,11 +723,8 @@ print_aspa(struct aspa_tree *a)
 		if (aspa->expires != 0)
 			printf(" expires %lld", (long long)aspa->expires);
 		printf(" provider-as { ");
-		for (i = 0; i < aspa->num; i++) {
+		for (i = 0; i < aspa->num; i++)
 			printf("%s ", log_as(aspa->tas[i]));
-			if (aspa->tas_aid[i] != AID_UNSPEC)
-				printf("%s ", print_af(aspa->tas_aid[i]));
-		}
 		printf("}");
 	}
 	printf("\n}\n\n");
diff --git a/usr.sbin/bgpd/rde.c b/usr.sbin/bgpd/rde.c
index b575e9398..dc6a318f7 100644
--- a/usr.sbin/bgpd/rde.c
+++ b/usr.sbin/bgpd/rde.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde.c,v 1.609 2023/08/04 09:20:12 claudio Exp $ */
+/*	$OpenBSD: rde.c,v 1.610 2023/08/16 08:26:35 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -1319,23 +1319,11 @@ rde_dispatch_imsg_rtr(struct imsgbuf *ibuf)
 			memcpy(aspa->tas, imsg.data,
 			    aspa->num * sizeof(uint32_t));
 			break;
-		case IMSG_RECONF_ASPA_TAS_AID:
-			if (aspa == NULL)
-				fatalx("unexpected IMSG_RECONF_ASPA_TAS_AID");
-			if (imsg.hdr.len - IMSG_HEADER_SIZE !=
-			    TAS_AID_SIZE(aspa->num))
-				fatalx("IMSG_RECONF_ASPA_TAS_AID bad len");
-			aspa->tas_aid = malloc(TAS_AID_SIZE(aspa->num));
-			if (aspa->tas_aid == NULL)
-				fatal("IMSG_RECONF_ASPA_TAS_AID");
-			memcpy(aspa->tas_aid, imsg.data,
-			    TAS_AID_SIZE(aspa->num));
-			break;
 		case IMSG_RECONF_ASPA_DONE:
 			if (aspa_new == NULL)
 				fatalx("unexpected IMSG_RECONF_ASPA");
 			aspa_add_set(aspa_new, aspa->as, aspa->tas,
-			    aspa->num, (void *)aspa->tas_aid);
+			    aspa->num);
 			free_aspa(aspa);
 			aspa = NULL;
 			break;
@@ -2729,20 +2717,10 @@ rde_aspa_validity(struct rde_peer *peer, struct rde_aspath *asp, uint8_t aid)
 	if (peer->role == ROLE_NONE)
 		return ASPA_UNKNOWN;
 
-	switch (aid) {
-	case AID_INET:
-		if (peer->role == ROLE_CUSTOMER)
-			return asp->aspa_state.downup_v4;
-		else
-			return asp->aspa_state.onlyup_v4;
-	case AID_INET6:
-		if (peer->role == ROLE_CUSTOMER)
-			return asp->aspa_state.downup_v6;
-		else
-			return asp->aspa_state.onlyup_v6;
-	default:
-		return ASPA_NEVER_KNOWN;	/* not reachable */
-	}
+	if (peer->role == ROLE_CUSTOMER)
+		return asp->aspa_state.downup;
+	else
+		return asp->aspa_state.onlyup;
 }
 
 /*
diff --git a/usr.sbin/bgpd/rde.h b/usr.sbin/bgpd/rde.h
index d2e885077..c700aca75 100644
--- a/usr.sbin/bgpd/rde.h
+++ b/usr.sbin/bgpd/rde.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde.h,v 1.295 2023/07/12 14:45:43 claudio Exp $ */
+/*	$OpenBSD: rde.h,v 1.296 2023/08/16 08:26:35 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Claudio Jeker <claudio@openbsd.org> and
@@ -108,10 +108,8 @@ struct rde_peer {
 
 struct rde_aspa;
 struct rde_aspa_state {
-	uint8_t		onlyup_v4;
-	uint8_t		downup_v4;
-	uint8_t		onlyup_v6;
-	uint8_t		downup_v6;
+	uint8_t		onlyup;
+	uint8_t		downup;
 };
 
 #define AS_SET			1
@@ -714,7 +712,7 @@ void		 aspa_validation(struct rde_aspa *, struct aspath *,
 		    struct rde_aspa_state *);
 struct rde_aspa	*aspa_table_prep(uint32_t, size_t);
 void		 aspa_add_set(struct rde_aspa *, uint32_t, const uint32_t *,
-		    uint32_t, const uint32_t *);
+		    uint32_t);
 void		 aspa_table_free(struct rde_aspa *);
 void		 aspa_table_stats(const struct rde_aspa *,
 		    struct ctl_show_set *);
diff --git a/usr.sbin/bgpd/rde_aspa.c b/usr.sbin/bgpd/rde_aspa.c
index da1746adf..233b97d94 100644
--- a/usr.sbin/bgpd/rde_aspa.c
+++ b/usr.sbin/bgpd/rde_aspa.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde_aspa.c,v 1.4 2023/04/20 15:44:45 claudio Exp $ */
+/*	$OpenBSD: rde_aspa.c,v 1.5 2023/08/16 08:26:35 claudio Exp $ */
 
 /*
  * Copyright (c) 2022 Claudio Jeker <claudio@openbsd.org>
@@ -23,18 +23,16 @@
 #include "bgpd.h"
 #include "rde.h"
 
-#define	UNKNOWN		0x0
-#define	NOT_PROVIDER	0x1
-#define	PROVIDER	0x2
-
-#define	CP(x, y)	(x | (y << 4))
-#define	CP_GET(x, i)	((x >> (i * 4)) & 0xf)
+enum cp_state {
+	UNKNOWN,
+	NOT_PROVIDER,
+	PROVIDER,
+};
 
 struct rde_aspa_set {
 	uint32_t		 as;
 	uint32_t		 num;
 	uint32_t		*pas;
-	uint32_t		*pas_aid;
 	int			 next;
 };
 
@@ -110,11 +108,9 @@ aspa_lookup(struct rde_aspa *ra, uint32_t asnum)
  * Returns UNKNOWN if cas is not in the ra table or the aid is out of range.
  * Returns PROVIDER if pas is registered for cas for the specified aid.
  * Retruns NOT_PROVIDER otherwise.
- * The returned value includes the result for both IPv4 and IPv6 and needs
- * to be looked at with CP_GET.
  * This function is called very frequently and needs to be fast.
  */
-static uint8_t
+static enum cp_state
 aspa_cp_lookup(struct rde_aspa *ra, uint32_t cas, uint32_t pas)
 {
 	struct rde_aspa_set *aspa;
@@ -122,17 +118,17 @@ aspa_cp_lookup(struct rde_aspa *ra, uint32_t cas, uint32_t pas)
 
 	aspa = aspa_lookup(ra, cas);
 	if (aspa == NULL)
-		return CP(UNKNOWN, UNKNOWN);
+		return UNKNOWN;
 
 	if (aspa->num < 16) {
 		for (i = 0; i < aspa->num; i++) {
 			if (aspa->pas[i] == pas)
 				break;
 			if (aspa->pas[i] > pas)
-				return CP(NOT_PROVIDER, NOT_PROVIDER);
+				return NOT_PROVIDER;
 		}
 		if (i == aspa->num)
-			return CP(NOT_PROVIDER, NOT_PROVIDER);
+			return NOT_PROVIDER;
 	} else {
 		uint32_t lim, x;
 		for (i = 0, lim = aspa->num; lim != 0; lim /= 2) {
@@ -150,21 +146,10 @@ aspa_cp_lookup(struct rde_aspa *ra, uint32_t cas, uint32_t pas)
 			}
 		}
 		if (lim == 0)
-			return CP(NOT_PROVIDER, NOT_PROVIDER);
+			return NOT_PROVIDER;
 	}
 
-	if (aspa->pas_aid == NULL)
-		return CP(PROVIDER, PROVIDER);
-	switch (aspa->pas_aid[i / 16] >> ((i % 16) * 2) & 0x3) {
-	case 0x1:
-		return CP(PROVIDER, NOT_PROVIDER);
-	case 0x2:
-		return CP(NOT_PROVIDER, PROVIDER);
-	case 0x3:
-		return CP(PROVIDER, PROVIDER);
-	default:
-		fatalx("impossible state in aspa_cp_lookup");
-	}
+	return PROVIDER;
 }
 
 /*
@@ -184,14 +169,12 @@ static int
 aspa_check_aspath(struct rde_aspa *ra, struct aspath *a, struct aspa_state *s)
 {
 	uint8_t		*seg;
-	int		 afi;
 	uint32_t	 as, prevas = 0;
 	uint16_t	 len, seg_size;
-	uint8_t		 i, r, seg_type, seg_len;
+	uint8_t		 i, seg_type, seg_len;
 
 	/* the neighbor-as itself is by definition valid */
-	s[0].ndown_p = 1;
-	s[1].ndown_p = 1;
+	s->ndown_p = 1;
 
 	/*
 	 * Walk aspath and validate if necessary both up- and down-ramp.
@@ -213,8 +196,7 @@ aspa_check_aspath(struct rde_aspa *ra, struct aspath *a, struct aspa_state *s)
 			if (as == prevas)
 				continue; /* skip prepends */
 
-			s[0].nhops++;
-			s[1].nhops++;
+			s->nhops++;
 			if (prevas == 0) {
 				prevas = as; /* skip left-most AS */
 				continue;
@@ -226,22 +208,19 @@ aspa_check_aspath(struct rde_aspa *ra, struct aspath *a, struct aspa_state *s)
 			 * node and the right-most provider node
 			 * for which all nodes before are valid.
 			 */
-			r = aspa_cp_lookup(ra, prevas, as);
-			for (afi = 0; afi < 2; afi++) {
-				switch (CP_GET(r, afi)) {
-				case UNKNOWN:
-					if (s[afi].ndown_u == 0)
-						s[afi].ndown_u = s[afi].nhops;
-					break;
-				case PROVIDER:
-					if (s[afi].ndown_p + 1 == s[afi].nhops)
-						s[afi].ndown_p = s[afi].nhops;
-					break;
-				case NOT_PROVIDER:
-					if (s[afi].ndown_np == 0)
-						s[afi].ndown_np = s[afi].nhops;
-					break;
-				}
+			switch (aspa_cp_lookup(ra, prevas, as)) {
+			case UNKNOWN:
+				if (s->ndown_u == 0)
+					s->ndown_u = s->nhops;
+				break;
+			case PROVIDER:
+				if (s->ndown_p + 1 == s->nhops)
+					s->ndown_p = s->nhops;
+				break;
+			case NOT_PROVIDER:
+				if (s->ndown_np == 0)
+					s->ndown_np = s->nhops;
+				break;
 			}
 
 			/*
@@ -252,32 +231,27 @@ aspa_check_aspath(struct rde_aspa *ra, struct aspath *a, struct aspa_state *s)
 			 * We recorde the nhops value of prevas,
 			 * that's why the use of nhops - 1.
 			 */
-			r = aspa_cp_lookup(ra, as, prevas);
-			for (afi = 0; afi < 2; afi++) {
-				switch (CP_GET(r, afi)) {
-				case UNKNOWN:
-					s[afi].nup_p = 0;
-					s[afi].nup_u = s[afi].nhops - 1;
-					break;
-				case PROVIDER:
-					if (s[afi].nup_p == 0)
-						s[afi].nup_p = s[afi].nhops - 1;
-					break;
-				case NOT_PROVIDER:
-					s[afi].nup_p = 0;
-					s[afi].nup_np = s[afi].nhops - 1;
-					break;
-				}
+			switch (aspa_cp_lookup(ra, as, prevas)) {
+			case UNKNOWN:
+				s->nup_p = 0;
+				s->nup_u = s->nhops - 1;
+				break;
+			case PROVIDER:
+				if (s->nup_p == 0)
+					s->nup_p = s->nhops - 1;
+				break;
+			case NOT_PROVIDER:
+				s->nup_p = 0;
+				s->nup_np = s->nhops - 1;
+				break;
 			}
 			prevas = as;
 		}
 	}
 
 	/* the source-as itself is by definition valid */
-	if (s[0].nup_p == 0)
-		s[0].nup_p = s[0].nhops;
-	if (s[1].nup_p == 0)
-		s[1].nup_p = s[1].nhops;
+	if (s->nup_p == 0)
+		s->nup_p = s->nhops;
 	return 0;
 }
 
@@ -324,34 +298,33 @@ aspa_check_finalize(struct aspa_state *state, uint8_t *onlyup, uint8_t *downup)
 /*
  * Validate an aspath against the aspa_set *ra.
  * Returns ASPA_VALID if the aspath is valid, ASPA_UNKNOWN if the
- * aspath contains hops with unknown relation and invalid for
+ * aspath contains hops with unknown relation and ASPA_INVALID for
  * empty aspaths, aspath with AS_SET and aspaths that fail validation.
  */
 void
 aspa_validation(struct rde_aspa *ra, struct aspath *a,
     struct rde_aspa_state *vstate)
 {
-	struct aspa_state state[2] = { 0 };
+	struct aspa_state state = { 0 };
 
 	/* no aspa table, evrything is unknown */
 	if (ra == NULL) {
-		memset(vstate, ASPA_UNKNOWN, 4);
+		memset(vstate, ASPA_UNKNOWN, sizeof(*vstate));
 		return;
 	}
 
 	/* empty ASPATHs are always invalid */
 	if (aspath_length(a) == 0) {
-		memset(vstate, ASPA_INVALID, 4);
+		memset(vstate, ASPA_INVALID, sizeof(*vstate));
 		return;
 	}
 
-	if (aspa_check_aspath(ra, a, state) == -1) {
-		memset(vstate, ASPA_INVALID, 4);
+	if (aspa_check_aspath(ra, a, &state) == -1) {
+		memset(vstate, ASPA_INVALID, sizeof(*vstate));
 		return;
 	}
 
-	aspa_check_finalize(state, &vstate->onlyup_v4, &vstate->downup_v4);
-	aspa_check_finalize(state + 1, &vstate->onlyup_v6, &vstate->downup_v6);
+	aspa_check_finalize(&state, &vstate->onlyup, &vstate->downup);
 }
 
 /*
@@ -402,7 +375,7 @@ aspa_table_prep(uint32_t entries, size_t datasize)
  */
 void
 aspa_add_set(struct rde_aspa *ra, uint32_t cas, const uint32_t *pas,
-    uint32_t pascnt, const uint32_t *pas_aid)
+    uint32_t pascnt)
 {
 	struct rde_aspa_set *aspa;
 	uint32_t h, i;
@@ -441,18 +414,6 @@ aspa_add_set(struct rde_aspa *ra, uint32_t cas, const uint32_t *pas,
 	aspa->pas = ra->data + ra->curdata;
 	for (i = 0; i < pascnt; i++)
 		ra->data[ra->curdata++] = pas[i];
-
-	/* nobody in their right mind has per afi specific data */
-	if (pas_aid != NULL) {
-		/* 2 bits per entry rounded to next uint32_t */
-		if (ra->maxdata - ra->curdata <
-		    TAS_AID_SIZE(pascnt) / sizeof(ra->data[0]))
-			fatalx("aspa set data overflow");
-
-		aspa->pas_aid = ra->data + ra->curdata;
-		memcpy(aspa->pas_aid, pas_aid, TAS_AID_SIZE(pascnt));
-		ra->curdata += TAS_AID_SIZE(pascnt) / sizeof(ra->data[0]);
-	}
 }
 
 void
@@ -476,7 +437,7 @@ aspa_table_stats(const struct rde_aspa *ra, struct ctl_show_set *cset)
 }
 
 /*
- * Return true if the two rde_aspa tables are contain the same data.
+ * Return true if the two rde_aspa tables contain the same data.
  */
 int
 aspa_table_equal(const struct rde_aspa *ra, const struct rde_aspa *rb)
diff --git a/usr.sbin/bgpd/rtr.c b/usr.sbin/bgpd/rtr.c
index e02b09bd8..407bac6f4 100644
--- a/usr.sbin/bgpd/rtr.c
+++ b/usr.sbin/bgpd/rtr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtr.c,v 1.15 2023/05/05 10:48:16 claudio Exp $ */
+/*	$OpenBSD: rtr.c,v 1.16 2023/08/16 08:26:35 claudio Exp $ */
 
 /*
  * Copyright (c) 2020 Claudio Jeker <claudio@openbsd.org>
@@ -129,45 +129,32 @@ rtr_roa_insert(struct roa_tree *rt, struct roa *in)
 
 /*
  * Add an asnum to the aspa_set. The aspa_set is sorted by asnum.
- * The aid is altered to AID_UNSPEC (match for both v4 and v6) if
- * the current aid and the one passed do not match.
  */
 static void
-aspa_set_entry(struct aspa_set *aspa, uint32_t asnum, uint8_t aid)
+aspa_set_entry(struct aspa_set *aspa, uint32_t asnum)
 {
 	uint32_t i, num, *newtas;
-	uint8_t *newtasaid;
-
-	if (aid != AID_UNSPEC && aid != AID_INET && aid != AID_INET6)
-		fatalx("aspa set with invalid AFI %s", aid2str(aid));
 
 	for (i = 0; i < aspa->num; i++) {
 		if (asnum < aspa->tas[i])
 			break;
-		if (asnum == aspa->tas[i]) {
-			if (aspa->tas_aid[i] != aid)
-				aspa->tas_aid[i] = AID_UNSPEC;
+		if (asnum == aspa->tas[i])
 			return;
-		}
 	}
 
 	num = aspa->num + 1;
 	newtas = recallocarray(aspa->tas, aspa->num, num, sizeof(uint32_t));
-	newtasaid = recallocarray(aspa->tas_aid, aspa->num, num, 1);
-	if (newtas == NULL || newtasaid == NULL)
+	if (newtas == NULL)
 		fatal("aspa_set merge");
 
 	if (i < aspa->num) {
 		memmove(newtas + i + 1, newtas + i,
 		    (aspa->num - i) * sizeof(uint32_t));
-		memmove(newtasaid + i + 1, newtasaid + i, (aspa->num - i));
 	}
 	newtas[i] = asnum;
-	newtasaid[i] = aid;
 
 	aspa->num = num;
 	aspa->tas = newtas;
-	aspa->tas_aid = newtasaid;
 }
 
 /*
@@ -188,7 +175,7 @@ rtr_aspa_insert(struct aspa_tree *at, struct aspa_set *mergeset)
 	}
 
 	for (i = 0; i < mergeset->num; i++)
-		aspa_set_entry(aspa, mergeset->tas[i], mergeset->tas_aid[i]);
+		aspa_set_entry(aspa, mergeset->tas[i]);
 }
 
 void
@@ -398,16 +385,6 @@ rtr_dispatch_imsg_parent(struct imsgbuf *ibuf)
 			memcpy(aspa->tas, imsg.data,
 			    aspa->num * sizeof(*aspa->tas));
 			break;
-		case IMSG_RECONF_ASPA_TAS_AID:
-			if (aspa == NULL)
-				fatalx("unexpected IMSG_RECONF_ASPA_TAS_ID");
-			if (imsg.hdr.len - IMSG_HEADER_SIZE != aspa->num)
-				fatalx("IMSG_RECONF_ASPA_TAS_AID bad len");
-			aspa->tas_aid = malloc(aspa->num);
-			if (aspa->tas_aid == NULL)
-				fatal("aspa tas aid alloc");
-			memcpy(aspa->tas_aid, imsg.data, aspa->num);
-			break;
 		case IMSG_RECONF_ASPA_DONE:
 			if (aspa == NULL)
 				fatalx("unexpected IMSG_RECONF_ASPA_DONE");
@@ -503,53 +480,9 @@ rtr_imsg_compose(int type, uint32_t id, pid_t pid, void *data, size_t datalen)
  * if no extra aid masks are needed.
  */
 static size_t
-rtr_aspa_set_prep(struct aspa_set *aspa)
+rtr_aspa_set_size(struct aspa_set *aspa)
 {
-	uint32_t i, mask = 0;
-	uint8_t *tas_aid;
-	int needafi = 0;
-	size_t s;
-
-	s = aspa->num * sizeof(uint32_t);
-
-	if ((tas_aid = malloc(TAS_AID_SIZE(aspa->num))) == NULL)
-		fatal("tas_aid alloc");
-
-	for (i = 0; i < aspa->num; i++) {
-		switch (aspa->tas_aid[i]) {
-		case AID_INET:
-			needafi = 1;
-			mask |= 0x1 << ((i % 16) * 2);
-			break;
-		case AID_INET6:
-			needafi = 1;
-			mask |= 0x2 << ((i % 16) * 2);
-			break;
-		default:
-			mask |= 0x3 << ((i % 16) * 2);
-			break;
-		}
-		if (i % 16 == 15) {
-			memcpy(tas_aid + (i / 16) * sizeof(mask), &mask,
-			    sizeof(mask));
-			mask = 0;
-		}
-	}
-
-	free(aspa->tas_aid);
-	aspa->tas_aid = NULL;
-
-	if (!needafi) {
-		free(tas_aid);
-	} else {
-		if (aspa->num % 16 != 0)
-			memcpy(tas_aid + (aspa->num / 16) * sizeof(mask),
-			    &mask, sizeof(mask));
-		aspa->tas_aid = tas_aid;
-		s += TAS_AID_SIZE(aspa->num);
-	}
-
-	return s;
+	return aspa->num * sizeof(uint32_t);
 }
 
 /*
@@ -588,7 +521,7 @@ rtr_recalc(void)
 	rtr_aspa_merge(&at);
 
 	RB_FOREACH(aspa, aspa_tree, &at) {
-		ap.datasize += rtr_aspa_set_prep(aspa);
+		ap.datasize += rtr_aspa_set_size(aspa);
 		ap.entries++;
 	}
 
@@ -605,9 +538,6 @@ rtr_recalc(void)
 		    &as, sizeof(as));
 		imsg_compose(ibuf_rde, IMSG_RECONF_ASPA_TAS, 0, 0, -1,
 		    aspa->tas, aspa->num * sizeof(*aspa->tas));
-		if (aspa->tas_aid)
-			imsg_compose(ibuf_rde, IMSG_RECONF_ASPA_TAS_AID, 0, 0,
-			    -1, aspa->tas_aid, TAS_AID_SIZE(aspa->num));
 		imsg_compose(ibuf_rde, IMSG_RECONF_ASPA_DONE, 0, 0, -1,
 		    NULL, 0);
 	}
diff --git a/usr.sbin/bgpd/rtr_proto.c b/usr.sbin/bgpd/rtr_proto.c
index bfa74c47b..2b7b1b78f 100644
--- a/usr.sbin/bgpd/rtr_proto.c
+++ b/usr.sbin/bgpd/rtr_proto.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtr_proto.c,v 1.16 2023/03/28 12:15:23 claudio Exp $ */
+/*	$OpenBSD: rtr_proto.c,v 1.17 2023/08/16 08:26:35 claudio Exp $ */
 
 /*
  * Copyright (c) 2020 Claudio Jeker <claudio@openbsd.org>
@@ -150,8 +150,8 @@ struct rtr_session {
 	TAILQ_ENTRY(rtr_session)	entry;
 	char				descr[PEER_DESCR_LEN];
 	struct roa_tree			roa_set;
-	struct aspa_tree		aspa_v4;
-	struct aspa_tree		aspa_v6;
+	struct aspa_tree		aspa;
+	struct aspa_tree		aspa_oldv6;
 	struct ibuf_read		r;
 	struct msgbuf			w;
 	struct timer_head		timers;
@@ -224,8 +224,8 @@ rtr_reset_cache(struct rtr_session *rs)
 	rs->session_id = -1;
 	timer_stop(&rs->timers, Timer_Rtr_Expire);
 	free_roatree(&rs->roa_set);
-	free_aspatree(&rs->aspa_v4);
-	free_aspatree(&rs->aspa_v6);
+	free_aspatree(&rs->aspa);
+	free_aspatree(&rs->aspa_oldv6);
 }
 
 static struct ibuf *
@@ -627,7 +627,6 @@ rtr_parse_aspa(struct rtr_session *rs, uint8_t *buf, size_t len)
 	struct aspa_set *aspa, *a;
 	size_t offset;
 	uint16_t cnt, i;
-	uint8_t aid;
 
 	memcpy(&rtr_aspa, buf + sizeof(struct rtr_header), sizeof(rtr_aspa));
 	offset = sizeof(struct rtr_header) + sizeof(rtr_aspa);
@@ -647,11 +646,9 @@ rtr_parse_aspa(struct rtr_session *rs, uint8_t *buf, size_t len)
 	}
 
 	if (rtr_aspa.afi_flags & FLAG_AFI_V6) {
-		aid = AID_INET6;
-		aspatree = &rs->aspa_v6;
+		aspatree = &rs->aspa_oldv6;
 	} else {
-		aid = AID_INET;
-		aspatree = &rs->aspa_v4;
+		aspatree = &rs->aspa;
 	}
 
 	/* create aspa_set entry from the rtr aspa pdu */
@@ -664,8 +661,7 @@ rtr_parse_aspa(struct rtr_session *rs, uint8_t *buf, size_t len)
 	aspa->as = ntohl(rtr_aspa.cas);
 	aspa->num = cnt;
 	if (cnt > 0) {
-		if ((aspa->tas = calloc(cnt, sizeof(uint32_t))) == NULL ||
-		    (aspa->tas_aid = calloc(cnt, 1)) == NULL) {
+		if ((aspa->tas = calloc(cnt, sizeof(uint32_t))) == NULL) {
 			free_aspa(aspa);
 			log_warn("rtr %s: received %s",
 			    log_rtr(rs), log_rtr_type(ASPA));
@@ -678,7 +674,6 @@ rtr_parse_aspa(struct rtr_session *rs, uint8_t *buf, size_t len)
 			memcpy(&tas, buf + offset + i * sizeof(tas),
 			    sizeof(tas));
 			aspa->tas[i] = ntohl(tas);
-			aspa->tas_aid[i] = aid;
 		}
 	}
 
@@ -1245,8 +1240,8 @@ rtr_new(uint32_t id, char *descr)
 		fatal("RTR session %s", descr);
 
 	RB_INIT(&rs->roa_set);
-	RB_INIT(&rs->aspa_v4);
-	RB_INIT(&rs->aspa_v6);
+	RB_INIT(&rs->aspa);
+	RB_INIT(&rs->aspa_oldv6);
 	TAILQ_INIT(&rs->timers);
 	msgbuf_init(&rs->w);
 
@@ -1359,9 +1354,9 @@ rtr_aspa_merge(struct aspa_tree *at)
 	struct aspa_set *aspa;
 
 	TAILQ_FOREACH(rs, &rtrs, entry) {
-		RB_FOREACH(aspa, aspa_tree, &rs->aspa_v4)
+		RB_FOREACH(aspa, aspa_tree, &rs->aspa)
 			rtr_aspa_insert(at, aspa);
-		RB_FOREACH(aspa, aspa_tree, &rs->aspa_v6)
+		RB_FOREACH(aspa, aspa_tree, &rs->aspa_oldv6)
 			rtr_aspa_insert(at, aspa);
 	}
 }
diff --git a/usr.sbin/btrace/bt_parse.y b/usr.sbin/btrace/bt_parse.y
index 12bfdef95..959f6e4a4 100644
--- a/usr.sbin/btrace/bt_parse.y
+++ b/usr.sbin/btrace/bt_parse.y
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bt_parse.y,v 1.49 2022/12/28 21:30:16 jmc Exp $	*/
+/*	$OpenBSD: bt_parse.y,v 1.50 2023/08/13 13:19:23 dv Exp $	*/
 
 /*
  * Copyright (c) 2019-2021 Martin Pieuchot <mpi@openbsd.org>
@@ -115,7 +115,7 @@ static int pflag;
 %token	<v.i>		ERROR ENDFILT
 %token	<v.i>		OP_EQ OP_NE OP_LE OP_LT OP_GE OP_GT OP_LAND OP_LOR
 /* Builtins */
-%token	<v.i>		BUILTIN BEGIN END HZ IF
+%token	<v.i>		BUILTIN BEGIN END HZ IF STR
 /* Functions and Map operators */
 %token  <v.i>		F_DELETE F_PRINT
 %token	<v.i>		MFUNC FUNC0 FUNC1 FUNCN OP1 OP2 OP4 MOP0 MOP1
@@ -127,7 +127,7 @@ static int pflag;
 %type	<v.probe>	plist probe pname
 %type	<v.filter>	filter
 %type	<v.stmt>	action stmt stmtblck stmtlist block
-%type	<v.arg>		pat vargs mentry mpat pargs staticv
+%type	<v.arg>		vargs mentry mpat pargs staticv
 %type	<v.arg>		expr term fterm variable factor func
 %%
 
@@ -169,11 +169,7 @@ mentry	: gvar '[' vargs ']'		{ $$ = bm_find($1, $3); }
 	;
 
 mpat	: MOP0 '(' ')'			{ $$ = ba_new(NULL, $1); }
-	| MOP1 '(' pat ')'		{ $$ = ba_new($3, $1); }
-	| pat
-	;
-
-pat	: CSTRING			{ $$ = ba_new($1, B_AT_STR); }
+	| MOP1 '(' expr ')'		{ $$ = ba_new($3, $1); }
 	| expr
 	;
 
@@ -226,15 +222,15 @@ factor : '(' expr ')'		{ $$ = $2; }
 	;
 
 func	: STR '(' staticv ')'		{ $$ = ba_new($3, B_AT_FN_STR); }
-	| STR '(' staticv ',' pat ')'	{ $$ = ba_op(B_AT_FN_STR, $3, $5); }
+	| STR '(' staticv ',' expr ')'	{ $$ = ba_op(B_AT_FN_STR, $3, $5); }
 	;
 
-vargs	: pat
-	| vargs ',' pat			{ $$ = ba_append($1, $3); }
+vargs	: expr
+	| vargs ',' expr		{ $$ = ba_append($1, $3); }
 	;
 
 pargs	: expr
-	| gvar ',' pat			{ $$ = ba_append(bg_find($1), $3); }
+	| gvar ',' expr			{ $$ = ba_append(bg_find($1), $3); }
 	;
 
 NL	: /* empty */
@@ -242,17 +238,17 @@ NL	: /* empty */
 	;
 
 stmt	: ';' NL			{ $$ = NULL; }
-	| gvar '=' pat			{ $$ = bg_store($1, $3); }
-	| lvar '=' pat			{ $$ = bl_store($1, $3); }
+	| gvar '=' expr			{ $$ = bg_store($1, $3); }
+	| lvar '=' expr			{ $$ = bl_store($1, $3); }
 	| gvar '[' vargs ']' '=' mpat	{ $$ = bm_insert($1, $3, $6); }
 	| FUNCN '(' vargs ')'		{ $$ = bs_new($1, $3, NULL); }
-	| FUNC1 '(' pat ')'		{ $$ = bs_new($1, $3, NULL); }
+	| FUNC1 '(' expr ')'		{ $$ = bs_new($1, $3, NULL); }
 	| MFUNC '(' variable ')'	{ $$ = bs_new($1, $3, NULL); }
 	| FUNC0 '(' ')'			{ $$ = bs_new($1, NULL, NULL); }
 	| F_DELETE '(' mentry ')'	{ $$ = bm_op($1, $3, NULL); }
 	| F_PRINT '(' pargs ')'		{ $$ = bs_new($1, $3, NULL); }
-	| gvar '=' OP1 '(' pat ')'	{ $$ = bh_inc($1, $5, NULL); }
-	| gvar '=' OP4 '(' pat ',' vargs ')'	{ $$ = bh_inc($1, $5, $7); }
+	| gvar '=' OP1 '(' expr ')'	{ $$ = bh_inc($1, $5, NULL); }
+	| gvar '=' OP4 '(' expr ',' vargs ')'	{ $$ = bh_inc($1, $5, $7); }
 	;
 
 stmtblck: IF '(' expr ')' block			{ $$ = bt_new($3, $5); }
diff --git a/usr.sbin/btrace/btrace.c b/usr.sbin/btrace/btrace.c
index 25333f985..45e485b6c 100644
--- a/usr.sbin/btrace/btrace.c
+++ b/usr.sbin/btrace/btrace.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: btrace.c,v 1.71 2023/06/27 14:17:00 claudio Exp $ */
+/*	$OpenBSD: btrace.c,v 1.74 2023/08/16 13:07:11 dv Exp $ */
 
 /*
  * Copyright (c) 2019 - 2021 Martin Pieuchot <mpi@openbsd.org>
@@ -1028,6 +1028,14 @@ stmt_store(struct bt_stmt *bs, struct dt_evt *dtev)
 		bv->bv_value = ba;
 		bv->bv_type = B_VT_LONG;
 		break;
+	case B_AT_BI_PID:
+		bv->bv_value = ba_new((long)dtev->dtev_pid, B_AT_LONG);
+		bv->bv_type = B_VT_LONG;
+		break;
+	case B_AT_BI_TID:
+		bv->bv_value = ba_new((long)dtev->dtev_tid, B_AT_LONG);
+		bv->bv_type = B_VT_LONG;
+		break;
 	case B_AT_BI_NSECS:
 		bv->bv_value = ba_new(builtin_nsecs(dtev), B_AT_LONG);
 		bv->bv_type = B_VT_LONG;
diff --git a/usr.sbin/btrace/map.c b/usr.sbin/btrace/map.c
index be416e226..ab773dbd8 100644
--- a/usr.sbin/btrace/map.c
+++ b/usr.sbin/btrace/map.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: map.c,v 1.21 2023/06/27 14:17:00 claudio Exp $ */
+/*	$OpenBSD: map.c,v 1.22 2023/08/13 09:48:27 mpi Exp $ */
 
 /*
  * Copyright (c) 2020 Martin Pieuchot <mpi@openbsd.org>
@@ -134,10 +134,10 @@ map_insert(struct map *map, const char *key, struct bt_arg *bval,
 	mep = mget(map, key);
 	switch (bval->ba_type) {
 	case B_AT_STR:
-	case B_AT_LONG:
 		free(mep->mval);
-		mep->mval = bval;
+		mep->mval = ba_new(ba2str(bval, dtev), B_AT_LONG);
 		break;
+	case B_AT_LONG:
 	case B_AT_BI_PID:
 	case B_AT_BI_TID:
 	case B_AT_BI_CPU:
diff --git a/usr.sbin/rpki-client/cms.c b/usr.sbin/rpki-client/cms.c
index 43d0537fa..2cc93bc0d 100644
--- a/usr.sbin/rpki-client/cms.c
+++ b/usr.sbin/rpki-client/cms.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cms.c,v 1.38 2023/06/29 10:28:25 tb Exp $ */
+/*	$OpenBSD: cms.c,v 1.39 2023/08/14 08:25:26 tb Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -100,6 +100,7 @@ cms_parse_validate_internal(X509 **xp, const char *fn, const unsigned char *der,
 	const ASN1_OBJECT		*obj, *octype;
 	ASN1_OCTET_STRING		*kid = NULL;
 	CMS_ContentInfo			*cms;
+	long				 version;
 	STACK_OF(X509)			*certs = NULL;
 	STACK_OF(X509_CRL)		*crls;
 	STACK_OF(CMS_SignerInfo)	*sinfos;
@@ -142,7 +143,6 @@ cms_parse_validate_internal(X509 **xp, const char *fn, const unsigned char *der,
 	}
 
 	/* RFC 6488 section 3 verify the CMS */
-	/* the version of SignedData and SignerInfos can't be verified */
 
 	/* Should only return NULL if cms is not of type SignedData. */
 	if ((sinfos = CMS_get0_SignerInfos(cms)) == NULL) {
@@ -161,6 +161,23 @@ cms_parse_validate_internal(X509 **xp, const char *fn, const unsigned char *der,
 	}
 	si = sk_CMS_SignerInfo_value(sinfos, 0);
 
+	if (!CMS_get_version(cms, &version)) {
+		warnx("%s: Failed to retrieve SignedData version", fn);
+		goto out;
+	}
+	if (version != 3) {
+		warnx("%s: SignedData version %ld != 3", fn, version);
+		goto out;
+	}
+	if (!CMS_SignerInfo_get_version(si, &version)) {
+		warnx("%s: Failed to retrieve SignerInfo version", fn);
+		goto out;
+	}
+	if (version != 3) {
+		warnx("%s: SignerInfo version %ld != 3", fn, version);
+		goto out;
+	}
+
 	nattrs = CMS_signed_get_attr_count(si);
 	if (nattrs <= 0) {
 		warnx("%s: RFC 6488: error extracting signedAttrs", fn);