From 04f8de21b397bd57750916b40ead411c65968845 Mon Sep 17 00:00:00 2001
From: purplerain <purplerain@secbsd.org>
Date: Mon, 5 Aug 2024 06:02:38 +0000
Subject: [PATCH] sync with OpenBSD -current

---
 distrib/sets/lists/man/mi                     |   1 +
 etc/etc.armv7/login.conf                      |   4 +-
 include/stdlib.h                              |   8 +-
 include/string.h                              |  15 +-
 lib/libc/net/htobe64.3                        |  10 +-
 lib/libc/stdlib/malloc.3                      |   8 +-
 lib/libc/string/memmem.3                      |   8 +-
 lib/libc/string/strlcpy.3                     |  15 +-
 lib/libc/sys/poll.2                           |  16 +-
 lib/libcrypto/x509/x509_vfy.c                 |  11 +-
 share/man/man4/Makefile                       |   5 +-
 share/man/man4/acpi.4                         |   6 +-
 share/man/man4/intelpmc.4                     |  44 ++++
 sys/arch/amd64/conf/GENERIC                   |   3 +-
 sys/arch/amd64/include/specialreg.h           |  12 +-
 sys/arch/arm64/arm64/intr.c                   |  31 +--
 sys/dev/acpi/acpi_x86.c                       |   8 +-
 sys/dev/acpi/acpivar.h                        |   6 +-
 sys/dev/acpi/files.acpi                       |   7 +-
 sys/dev/acpi/intelpmc.c                       | 220 ++++++++++++++++++
 sys/dev/fdt/qcpas.c                           | 179 +++++++++-----
 sys/dev/fdt/qcscm.c                           |  29 ++-
 sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c    |   2 +-
 sys/dev/pci/drm/amd/amdgpu/amdgpu_gmc.c       |   1 -
 sys/dev/pci/drm/amd/amdgpu/amdgpu_vm.c        |   9 +-
 sys/dev/pci/drm/amd/amdgpu/gmc_v9_0.c         |   2 +-
 sys/dev/pci/drm/amd/amdgpu/sdma_v5_2.c        |  12 +
 sys/dev/pci/drm/amd/amdgpu/smu_v13_0_10.c     |   2 +-
 .../pci/drm/amd/amdkfd/kfd_mqd_manager_v9.c   |   2 +-
 .../pci/drm/amd/display/dc/core/dc_surface.c  |   3 +-
 .../pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c    |   4 +-
 sys/dev/pci/drm/display/drm_dp_mst_topology.c |   4 +-
 sys/dev/pci/drm/i915/display/intel_dp.c       |   2 +
 .../drm/i915/display/intel_dp_link_training.c |  55 ++++-
 .../drm/i915/gt/intel_execlists_submission.c  |   6 +-
 sys/sys/device.h                              |   4 +-
 sys/sys/poll.h                                |   8 +-
 usr.bin/awk/FIXES                             |   9 +
 usr.bin/awk/b.c                               |  53 +++--
 usr.bin/awk/lib.c                             |   4 +-
 usr.bin/awk/main.c                            |   4 +-
 usr.bin/skey/skey.c                           |   5 +-
 usr.bin/tmux/cmd-parse.y                      |  19 +-
 usr.bin/tmux/mode-tree.c                      |   8 +-
 usr.bin/tmux/options-table.c                  |   4 +-
 usr.bin/tmux/tmux.1                           |   6 +-
 usr.bin/tmux/tmux.h                           |   4 +-
 usr.bin/tmux/tty.c                            |  32 ++-
 usr.bin/tmux/window-buffer.c                  |  19 +-
 usr.sbin/makefs/cd9660.c                      |   4 +-
 usr.sbin/radiusd/radiusd_bsdauth.8            |   6 +-
 usr.sbin/radiusd/radiusd_eap2mschap.8         |   9 +-
 usr.sbin/radiusd/radiusd_file.8               |   6 +-
 usr.sbin/radiusd/radiusd_ipcp.8               |   6 +-
 usr.sbin/radiusd/radiusd_radius.8             |   6 +-
 usr.sbin/radiusd/radiusd_standard.8           |   6 +-
 56 files changed, 733 insertions(+), 239 deletions(-)
 create mode 100644 share/man/man4/intelpmc.4
 create mode 100644 sys/dev/acpi/intelpmc.c

diff --git a/distrib/sets/lists/man/mi b/distrib/sets/lists/man/mi
index c250568ce..4405187cd 100644
--- a/distrib/sets/lists/man/mi
+++ b/distrib/sets/lists/man/mi
@@ -1581,6 +1581,7 @@
 ./usr/share/man/man4/inet.4
 ./usr/share/man/man4/inet6.4
 ./usr/share/man/man4/inphy.4
+./usr/share/man/man4/intelpmc.4
 ./usr/share/man/man4/iophy.4
 ./usr/share/man/man4/iosf.4
 ./usr/share/man/man4/ip.4
diff --git a/etc/etc.armv7/login.conf b/etc/etc.armv7/login.conf
index 289006aaf..879b625a9 100644
--- a/etc/etc.armv7/login.conf
+++ b/etc/etc.armv7/login.conf
@@ -1,4 +1,4 @@
-# $OpenBSD: login.conf,v 1.15 2023/12/11 19:52:40 kettenis Exp $
+# $OpenBSD: login.conf,v 1.16 2024/08/04 20:06:04 phessler Exp $
 
 #
 # Sample login.conf file.  See login.conf(5) for details.
@@ -92,7 +92,7 @@ authpf:\
 #
 pbuild:\
 	:datasize-max=infinity:\
-	:datasize-cur=1024M:\
+	:datasize-cur=1843M:\
 	:maxproc-max=1024:\
 	:maxproc-cur=256:\
 	:stacksize-cur=8M:\
diff --git a/include/stdlib.h b/include/stdlib.h
index d1292e6d4..2416bb395 100644
--- a/include/stdlib.h
+++ b/include/stdlib.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: stdlib.h,v 1.77 2024/03/01 21:30:40 millert Exp $	*/
+/*	$OpenBSD: stdlib.h,v 1.78 2024/08/03 20:09:24 guenther Exp $	*/
 /*	$NetBSD: stdlib.h,v 1.25 1995/12/27 21:19:08 jtc Exp $	*/
 
 /*-
@@ -116,7 +116,6 @@ void	freezero(void *, size_t)
 		 __attribute__ ((__bounded__(__buffer__,1,2)));
 void	*calloc_conceal(size_t, size_t);
 void	*malloc_conceal(size_t);
-void	*reallocarray(void *, size_t, size_t);
 void	*recallocarray(void *, size_t, size_t, size_t);
 #endif /* __BSD_VISIBLE */
 void	 qsort(void *, size_t, size_t, int (*)(const void *, const void *));
@@ -257,10 +256,11 @@ int     getsubopt(char **, char * const *, char **);
 #endif
 
 /*
- * The Open Group Base Specifications, post-Issue 7
+ * The Open Group Base Specifications, Issue 8
  */
-#if __BSD_VISIBLE
+#if __POSIX_VISIBLE >= 202405 || __BSD_VISIBLE
 int	mkostemp(char *, int);
+void	*reallocarray(void *, size_t, size_t);
 #endif
 
 #if __BSD_VISIBLE
diff --git a/include/string.h b/include/string.h
index 2ae8c62a2..dcda2dc94 100644
--- a/include/string.h
+++ b/include/string.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: string.h,v 1.33 2024/06/23 07:08:26 otto Exp $	*/
+/*	$OpenBSD: string.h,v 1.34 2024/08/03 20:13:23 guenther Exp $	*/
 /*	$NetBSD: string.h,v 1.6 1994/10/26 00:56:30 cgd Exp $	*/
 
 /*-
@@ -118,16 +118,19 @@ size_t	 strxfrm_l(char *__restrict, const char *__restrict, size_t, locale_t)
 		__attribute__ ((__bounded__(__string__,1,3)));
 #endif
 
+#if __POSIX_VISIBLE >= 202405 || __BSD_VISIBLE
+void	*memmem(const void *, size_t, const void *, size_t);
+size_t	 strlcat(char *__restrict, const char *__restrict, size_t)
+		__attribute__ ((__bounded__(__string__,1,3)));
+size_t	 strlcpy(char *__restrict, const char *__restrict, size_t)
+		__attribute__ ((__bounded__(__string__,1,3)));
+#endif
+
 #if __BSD_VISIBLE
 void	 explicit_bzero(void *, size_t)
 		__attribute__ ((__bounded__(__buffer__,1,2)));
-void	*memmem(const void *, size_t, const void *, size_t);
 void	*memrchr(const void *, int, size_t);
 char	*strcasestr(const char *, const char *);
-size_t	 strlcat(char *, const char *, size_t)
-		__attribute__ ((__bounded__(__string__,1,3)));
-size_t	 strlcpy(char *, const char *, size_t)
-		__attribute__ ((__bounded__(__string__,1,3)));
 void	 strmode(__mode_t, char *);
 char	*strsep(char **, const char *);
 int	 timingsafe_bcmp(const void *, const void *, size_t);
diff --git a/lib/libc/net/htobe64.3 b/lib/libc/net/htobe64.3
index 3e500897e..e41c9124c 100644
--- a/lib/libc/net/htobe64.3
+++ b/lib/libc/net/htobe64.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: htobe64.3,v 1.1 2019/08/30 18:33:17 deraadt Exp $
+.\"	$OpenBSD: htobe64.3,v 1.2 2024/08/03 23:06:56 guenther Exp $
 .\"
 .\" Copyright (c) 1983, 1991, 1993
 .\"	The Regents of the University of California.  All rights reserved.
@@ -27,7 +27,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: August 30 2019 $
+.Dd $Mdocdate: August 3 2024 $
 .Dt HTOBE64 3
 .Os
 .Sh NAME
@@ -141,8 +141,8 @@ The
 .Fn le32toh ,
 and
 .Fn le16toh
-functions are expected to conform to a future version of
-.St -p1003.1 .
+functions conform to
+.St -p1003.1-2024 .
 The other functions are extensions that should not be used
 when portability is required.
 .Sh HISTORY
@@ -156,8 +156,6 @@ The
 .Nm {src-order}{size}to{dst-order}
 functions appeared in
 .Ox 5.6 .
-A subset of them was submitted for standardization after
-.St -p1003.1-2008 .
 .Sh BUGS
 The perceived antagonism between
 .Sq host
diff --git a/lib/libc/stdlib/malloc.3 b/lib/libc/stdlib/malloc.3
index e5d9b5626..bea5575bf 100644
--- a/lib/libc/stdlib/malloc.3
+++ b/lib/libc/stdlib/malloc.3
@@ -30,9 +30,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"	$OpenBSD: malloc.3,v 1.141 2023/12/04 22:52:41 tb Exp $
+.\"	$OpenBSD: malloc.3,v 1.142 2024/08/03 20:09:24 guenther Exp $
 .\"
-.Dd $Mdocdate: December 4 2023 $
+.Dd $Mdocdate: August 3 2024 $
 .Dt MALLOC 3
 .Os
 .Sh NAME
@@ -722,6 +722,10 @@ The
 .Fn aligned_alloc
 function conforms to
 .St -isoC-2011 .
+The
+.Fn reallocarray
+function conforms to
+.St -p1003.1-2024 .
 .Pp
 If
 .Fa nmemb
diff --git a/lib/libc/string/memmem.3 b/lib/libc/string/memmem.3
index 3f1785908..de62d738d 100644
--- a/lib/libc/string/memmem.3
+++ b/lib/libc/string/memmem.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: memmem.3,v 1.3 2020/04/16 12:40:41 claudio Exp $
+.\"	$OpenBSD: memmem.3,v 1.4 2024/08/03 20:13:23 guenther Exp $
 .\"
 .\" Copyright (c) 2005 Pascal Gloor <pascal.gloor@spale.com>
 .\"
@@ -26,7 +26,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: April 16 2020 $
+.Dd $Mdocdate: August 3 2024 $
 .Dt MEMMEM 3
 .Os
 .Sh NAME
@@ -66,8 +66,10 @@ is returned.
 .Xr strchr 3 ,
 .Xr strstr 3
 .Sh STANDARDS
+The
 .Fn memmem
-is a GNU extension.
+function conforms to
+.St -p1003.1-2024 .
 .Sh HISTORY
 The
 .Fn memmem
diff --git a/lib/libc/string/strlcpy.3 b/lib/libc/string/strlcpy.3
index a14145e19..460728988 100644
--- a/lib/libc/string/strlcpy.3
+++ b/lib/libc/string/strlcpy.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: strlcpy.3,v 1.27 2019/01/25 00:19:25 millert Exp $
+.\"	$OpenBSD: strlcpy.3,v 1.28 2024/08/03 20:13:23 guenther Exp $
 .\"
 .\" Copyright (c) 1998, 2000 Todd C. Miller <millert@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: January 25 2019 $
+.Dd $Mdocdate: August 3 2024 $
 .Dt STRLCPY 3
 .Os
 .Sh NAME
@@ -24,9 +24,9 @@
 .Sh SYNOPSIS
 .In string.h
 .Ft size_t
-.Fn strlcpy "char *dst" "const char *src" "size_t dstsize"
+.Fn strlcpy "char * restrict dst" "const char * restrict src" "size_t dstsize"
 .Ft size_t
-.Fn strlcat "char *dst" "const char *src" "size_t dstsize"
+.Fn strlcat "char * restrict dst" "const char * restrict src" "size_t dstsize"
 .Sh DESCRIPTION
 The
 .Fn strlcpy
@@ -174,6 +174,13 @@ As a matter of fact, the first version of this manual page got it wrong.
 .Xr strncat 3 ,
 .Xr strncpy 3 ,
 .Xr wcslcpy 3
+.Sh STANDARDS
+The
+.Fn strlcat
+and
+.Fn strlcpy
+functions conform to
+.St -p1003.1-2024 .
 .Sh HISTORY
 .Fn strlcpy
 and
diff --git a/lib/libc/sys/poll.2 b/lib/libc/sys/poll.2
index c8e03f29e..1b77bd0ba 100644
--- a/lib/libc/sys/poll.2
+++ b/lib/libc/sys/poll.2
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: poll.2,v 1.40 2023/07/18 04:17:17 asou Exp $
+.\"	$OpenBSD: poll.2,v 1.41 2024/08/04 22:28:08 guenther Exp $
 .\"
 .\" Copyright (c) 1994 Jason R. Thorpe
 .\" All rights reserved.
@@ -28,7 +28,7 @@
 .\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\"
-.Dd $Mdocdate: July 18 2023 $
+.Dd $Mdocdate: August 4 2024 $
 .Dt POLL 2
 .Os
 .Sh NAME
@@ -40,7 +40,7 @@
 .Ft int
 .Fn poll "struct pollfd *fds" "nfds_t nfds" "int timeout"
 .Ft int
-.Fn ppoll "struct pollfd *fds" "nfds_t nfds" "const struct timespec *timeout" "const sigset_t *mask"
+.Fn ppoll "struct pollfd *fds" "nfds_t nfds" "const struct timespec * restrict timeout" "const sigset_t * restrict mask"
 .Sh DESCRIPTION
 .Fn poll
 provides a mechanism for multiplexing I/O across a set of file
@@ -325,12 +325,10 @@ The timeout passed was invalid.
 .Sh STANDARDS
 The
 .Fn poll
-function is compliant with the
-.St -p1003.1-2008
-specification.
-The
+and
 .Fn ppoll
-function is a Linux extension.
+functions conform to
+.St -p1003.1-2024 .
 .Sh HISTORY
 A
 .Fn poll
@@ -340,7 +338,7 @@ The
 .Fn ppoll
 function appeared in
 .Ox 5.4 .
-.Sh BUGS
+.Sh CAVEATS
 The
 .Dv POLLWRBAND
 flag is accepted but ignored by the kernel.
diff --git a/lib/libcrypto/x509/x509_vfy.c b/lib/libcrypto/x509/x509_vfy.c
index 501f5e571..4f597fa31 100644
--- a/lib/libcrypto/x509/x509_vfy.c
+++ b/lib/libcrypto/x509/x509_vfy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.c,v 1.143 2024/04/08 23:46:21 beck Exp $ */
+/* $OpenBSD: x509_vfy.c,v 1.144 2024/08/04 08:15:36 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -646,7 +646,7 @@ X509_verify_cert(X509_STORE_CTX *ctx)
 	x509_verify_ctx_free(vctx);
 
 	/* if we succeed we have a chain in ctx->chain */
-	return (chain_count > 0 && ctx->chain != NULL);
+	return chain_count > 0 && ctx->chain != NULL;
 }
 LCRYPTO_ALIAS(X509_verify_cert);
 
@@ -1012,7 +1012,7 @@ check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify)
 	if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)
 		ptime = &ctx->param->check_time;
 	else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME)
-		return (1);
+		return 1;
 	else
 		ptime = NULL;
 
@@ -2298,7 +2298,7 @@ X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *leaf,
 	}
 
 	if (CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx,
-	    &(ctx->ex_data)) == 0) {
+	    &ctx->ex_data) == 0) {
 		X509error(ERR_R_MALLOC_FAILURE);
 		return 0;
 	}
@@ -2337,8 +2337,7 @@ X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx)
 		sk_X509_pop_free(ctx->chain, X509_free);
 		ctx->chain = NULL;
 	}
-	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX,
-	    ctx, &(ctx->ex_data));
+	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx, &ctx->ex_data);
 	memset(&ctx->ex_data, 0, sizeof(CRYPTO_EX_DATA));
 }
 LCRYPTO_ALIAS(X509_STORE_CTX_cleanup);
diff --git a/share/man/man4/Makefile b/share/man/man4/Makefile
index f4f3b8317..ffe533370 100644
--- a/share/man/man4/Makefile
+++ b/share/man/man4/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.848 2024/04/29 20:18:12 kn Exp $
+#	$OpenBSD: Makefile,v 1.849 2024/08/04 14:21:09 kettenis Exp $
 
 MAN=	aac.4 abcrtc.4 abl.4 ac97.4 acphy.4 acrtc.4 \
 	acpi.4 acpiac.4 acpials.4 acpiasus.4 acpibat.4 \
@@ -47,7 +47,8 @@ MAN=	aac.4 abcrtc.4 abl.4 ac97.4 acphy.4 acrtc.4 \
 	igc.4 iha.4 ihidev.4 iic.4 iicmux.4 ikbd.4 ims.4 imt.4 imxanatop.4 \
 	imxdog.4 imxesdhc.4 imxgpc.4 imxgpio.4 imxiic.4 imxpciephy.4 \
 	imxpwm.4 imxrtc.4 imxspi.4 imxsrc.4 imxtmu.4 imxuart.4 \
-	inet.4 inet6.4 inphy.4 iophy.4 iosf.4 ip.4 ip6.4 ipcomp.4 ipgphy.4 \
+	inet.4 inet6.4 inphy.4 intelpmc.4 \
+	iophy.4 iosf.4 ip.4 ip6.4 ipcomp.4 ipgphy.4 \
 	ipmi.4 ips.4 ipsec.4 ipw.4 isa.4 isagpio.4 isapnp.4 islrtc.4 \
 	it.4 itherm.4 iwi.4 iwn.4 iwm.4 iwx.4 ix.4 ixgb.4 ixl.4 \
 	jmb.4 jme.4 jmphy.4 \
diff --git a/share/man/man4/acpi.4 b/share/man/man4/acpi.4
index 4749ed365..b6b376df4 100644
--- a/share/man/man4/acpi.4
+++ b/share/man/man4/acpi.4
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: acpi.4,v 1.74 2024/04/09 20:18:37 mglocker Exp $
+.\"	$OpenBSD: acpi.4,v 1.75 2024/08/04 16:31:02 jmc Exp $
 .\"
 .\" Copyright (c) 2006 Alexander Yurchenko <grange@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: April 9 2024 $
+.Dd $Mdocdate: August 4 2024 $
 .Dt ACPI 4
 .Os
 .Sh NAME
@@ -122,6 +122,8 @@ Synopsys DesignWare I2C controller
 Intel Gemini Lake GPIO controller
 .It Xr imxiic 4
 i.MX onboard I2C controller
+.It Xr intelpmc 4
+Intel power management controller
 .It Xr iosf 4
 Intel OnChip System Fabric device
 .It Xr ipmi 4
diff --git a/share/man/man4/intelpmc.4 b/share/man/man4/intelpmc.4
new file mode 100644
index 000000000..b9a6378fc
--- /dev/null
+++ b/share/man/man4/intelpmc.4
@@ -0,0 +1,44 @@
+.\"	$OpenBSD: intelpmc.4,v 1.1 2024/08/04 14:21:09 kettenis Exp $
+.\"
+.\" Copyright (c) 2024 Mark Kettenis <kettenis@openbsd.org>
+.\"
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.Dd $Mdocdate: August 4 2024 $
+.Dt INTELPMC 4
+.Os
+.Sh NAME
+.Nm intelpmc
+.Nd Intel power management controller
+.Sh SYNOPSIS
+.Cd "intelpmc* at acpi?"
+.Sh DESCRIPTION
+The
+.Nm
+driver implements support for the power management controller found on
+Intel SoCs.
+It provides support for entering low power idle states of the SoC.
+.Sh SEE ALSO
+.Xr acpi 4 ,
+.Xr intro 4
+.Sh HISTORY
+The
+.Nm
+driver first appeared in
+.Ox 7.6 .
+.Sh AUTHORS
+.An -nosplit
+The
+.Nm
+driver was written by
+.An Mark Kettenis Aq Mt kettenis@openbsd.org .
diff --git a/sys/arch/amd64/conf/GENERIC b/sys/arch/amd64/conf/GENERIC
index 3a90d3527..b74f7cc4e 100644
--- a/sys/arch/amd64/conf/GENERIC
+++ b/sys/arch/amd64/conf/GENERIC
@@ -1,4 +1,4 @@
-#	$OpenBSD: GENERIC,v 1.523 2024/05/09 17:05:22 mglocker Exp $
+#	$OpenBSD: GENERIC,v 1.524 2024/08/04 11:05:18 kettenis Exp $
 #
 # For further information on compiling SecBSD kernels, see the config(8)
 # man page.
@@ -88,6 +88,7 @@ acpihid*	at acpi?
 ipmi0		at acpi? disable
 ccpmic*		at iic?
 tipmic*		at iic?
+intelpmc*	at acpi?
 
 efi0		at bios0
 mpbios0		at bios0
diff --git a/sys/arch/amd64/include/specialreg.h b/sys/arch/amd64/include/specialreg.h
index a8a7e492a..4208e2e13 100644
--- a/sys/arch/amd64/include/specialreg.h
+++ b/sys/arch/amd64/include/specialreg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: specialreg.h,v 1.115 2024/07/21 19:41:31 bluhm Exp $	*/
+/*	$OpenBSD: specialreg.h,v 1.116 2024/08/04 11:05:18 kettenis Exp $	*/
 /*	$NetBSD: specialreg.h,v 1.1 2003/04/26 18:39:48 fvdl Exp $	*/
 /*	$NetBSD: x86/specialreg.h,v 1.2 2003/04/25 21:54:30 fvdl Exp $	*/
 
@@ -624,6 +624,12 @@
 #define MSR_PERF_GLOBAL_CTRL	0x38f
 #define MSR_PERF_GLOBAL_CTR1_EN	(1ULL << 33)
 #define MSR_PERF_GLOBAL_CTR2_EN	(1ULL << 34)
+#define MSR_PKG_C3_RESIDENCY	0x3f8
+#define MSR_PKG_C6_RESIDENCY	0x3f9
+#define MSR_PKG_C7_RESIDENCY	0x3fa
+#define MSR_CORE_C3_RESIDENCY	0x3fc
+#define MSR_CORE_C6_RESIDENCY	0x3fd
+#define MSR_CORE_C7_RESIDENCY	0x3fe
 #define MSR_MC0_CTL		0x400
 #define MSR_MC0_STATUS		0x401
 #define MSR_MC0_ADDR		0x402
@@ -644,6 +650,10 @@
 #define MSR_MC3_STATUS		0x411
 #define MSR_MC3_ADDR		0x412
 #define MSR_MC3_MISC		0x413
+#define MSR_PKG_C2_RESIDENCY	0x60d
+#define MSR_PKG_C8_RESIDENCY	0x630
+#define MSR_PKG_C9_RESIDENCY	0x631
+#define MSR_PKG_C10_RESIDENCY	0x632
 #define MSR_U_CET		0x6a0
 #define MSR_CET_ENDBR_EN		(1 << 2)
 #define MSR_CET_NO_TRACK_EN		(1 << 4)
diff --git a/sys/arch/arm64/arm64/intr.c b/sys/arch/arm64/arm64/intr.c
index 9e69fd001..8e7d610bb 100644
--- a/sys/arch/arm64/arm64/intr.c
+++ b/sys/arch/arm64/arm64/intr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: intr.c,v 1.28 2024/05/26 13:37:31 kettenis Exp $ */
+/* $OpenBSD: intr.c,v 1.29 2024/08/04 12:01:18 kettenis Exp $ */
 /*
  * Copyright (c) 2011 Dale Rahn <drahn@openbsd.org>
  *
@@ -26,7 +26,7 @@
 
 #include <dev/ofw/openfirm.h>
 
-uint32_t arm_intr_get_parent(int);
+int arm_intr_get_parent(int);
 uint32_t arm_intr_map_msi(int, uint64_t *);
 
 void *arm_intr_prereg_establish_fdt(void *, int *, int, struct cpu_info *,
@@ -94,17 +94,21 @@ arm_cpu_fiq(void *frame)
 /*
  * Find the interrupt parent by walking up the tree.
  */
-uint32_t
+int
 arm_intr_get_parent(int node)
 {
-	uint32_t phandle = 0;
+	uint32_t phandle;
 
-	while (node && !phandle) {
+	while (node) {
 		phandle = OF_getpropint(node, "interrupt-parent", 0);
+		if (phandle)
+			return OF_getnodebyphandle(phandle);
 		node = OF_parent(node);
+		if (OF_getpropbool(node, "interrupt-controller"))
+			return node;
 	}
 
-	return phandle;
+	return 0;
 }
 
 uint32_t
@@ -291,8 +295,6 @@ arm_intr_register_fdt(struct interrupt_controller *ic)
 
 	ic->ic_cells = OF_getpropint(ic->ic_node, "#interrupt-cells", 0);
 	ic->ic_phandle = OF_getpropint(ic->ic_node, "phandle", 0);
-	if (ic->ic_phandle == 0)
-		return;
 	KASSERT(ic->ic_cells <= MAX_INTERRUPT_CELLS);
 
 	LIST_INSERT_HEAD(&interrupt_controllers, ic, ic_list);
@@ -341,7 +343,8 @@ arm_intr_establish_fdt_idx_cpu(int node, int idx, int level, struct cpu_info *ci
     int (*func)(void *), void *cookie, char *name)
 {
 	struct interrupt_controller *ic;
-	int i, len, ncells, extended = 1;
+	int i, len, ncells, parent;
+	int extended = 1;
 	uint32_t *cell, *cells, phandle;
 	struct machine_intr_handle *ih;
 	void *val = NULL;
@@ -356,9 +359,9 @@ arm_intr_establish_fdt_idx_cpu(int node, int idx, int level, struct cpu_info *ci
 
 	/* Old style. */
 	if (!extended) {
-		phandle = arm_intr_get_parent(node);
+		parent = arm_intr_get_parent(node);
 		LIST_FOREACH(ic, &interrupt_controllers, ic_list) {
-			if (ic->ic_phandle == phandle)
+			if (ic->ic_node == parent)
 				break;
 		}
 
@@ -569,12 +572,12 @@ arm_intr_parent_establish_fdt(void *cookie, int *cell, int level,
 {
 	struct interrupt_controller *ic = cookie;
 	struct machine_intr_handle *ih;
-	uint32_t phandle;
+	int parent;
 	void *val;
 
-	phandle = arm_intr_get_parent(ic->ic_node);
+	parent = arm_intr_get_parent(ic->ic_node);
 	LIST_FOREACH(ic, &interrupt_controllers, ic_list) {
-		if (ic->ic_phandle == phandle)
+		if (ic->ic_node == parent)
 			break;
 	}
 	if (ic == NULL)
diff --git a/sys/dev/acpi/acpi_x86.c b/sys/dev/acpi/acpi_x86.c
index f9ac40b30..0863d406a 100644
--- a/sys/dev/acpi/acpi_x86.c
+++ b/sys/dev/acpi/acpi_x86.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: acpi_x86.c,v 1.22 2024/06/25 11:57:10 kettenis Exp $ */
+/* $OpenBSD: acpi_x86.c,v 1.23 2024/08/04 11:05:18 kettenis Exp $ */
 /*
  * Copyright (c) 2005 Thorsten Lockert <tholo@sigmasoft.com>
  * Copyright (c) 2005 Jordan Hargrave <jordan@openbsd.org>
@@ -104,9 +104,15 @@ gosleep(void *v)
 	acpi_disable_allgpes(sc);
 	acpi_enable_wakegpes(sc, sc->sc_state);
 
+	if (sc->sc_pmc_suspend)
+		sc->sc_pmc_suspend(sc->sc_pmc_cookie);
+
 	ret = acpi_sleep_cpu(sc, sc->sc_state);
 	acpi_resume_cpu(sc, sc->sc_state);
 
+	if (sc->sc_pmc_resume)
+		sc->sc_pmc_resume(sc->sc_pmc_cookie);
+
 	return ret;
 }
 
diff --git a/sys/dev/acpi/acpivar.h b/sys/dev/acpi/acpivar.h
index 46c2abf57..d1af26fa0 100644
--- a/sys/dev/acpi/acpivar.h
+++ b/sys/dev/acpi/acpivar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: acpivar.h,v 1.131 2024/06/30 00:29:36 jsg Exp $	*/
+/*	$OpenBSD: acpivar.h,v 1.132 2024/08/04 11:05:18 kettenis Exp $	*/
 /*
  * Copyright (c) 2005 Thorsten Lockert <tholo@sigmasoft.com>
  *
@@ -282,6 +282,10 @@ struct acpi_softc {
 	int			sc_flags;
 
 	int			sc_skip_processor;
+
+	void			(*sc_pmc_suspend)(void *);
+	void			(*sc_pmc_resume)(void *);
+	void			*sc_pmc_cookie;
 };
 
 extern struct acpi_softc *acpi_softc;
diff --git a/sys/dev/acpi/files.acpi b/sys/dev/acpi/files.acpi
index f664ac350..840e374a5 100644
--- a/sys/dev/acpi/files.acpi
+++ b/sys/dev/acpi/files.acpi
@@ -1,4 +1,4 @@
-#	$OpenBSD: files.acpi,v 1.70 2024/07/30 19:47:06 mglocker Exp $
+#	$OpenBSD: files.acpi,v 1.71 2024/08/04 11:05:18 kettenis Exp $
 #
 # Config file and device description for machine-independent ACPI code.
 # Included by ports that need it.
@@ -284,3 +284,8 @@ file	dev/acpi/ufshci_acpi.c		ufshci_acpi
 # Intel OnChip System Fabric
 attach	iosf at acpi with iosf_acpi
 file	dev/acpi/iosf_acpi.c		iosf_acpi
+
+# Intel Power Management Controller
+device	intelpmc
+attach	intelpmc at acpi
+file	dev/acpi/intelpmc.c		intelpmc
diff --git a/sys/dev/acpi/intelpmc.c b/sys/dev/acpi/intelpmc.c
new file mode 100644
index 000000000..7e06bc5f4
--- /dev/null
+++ b/sys/dev/acpi/intelpmc.c
@@ -0,0 +1,220 @@
+/*	$OpenBSD: intelpmc.c,v 1.1 2024/08/04 11:05:18 kettenis Exp $	*/
+/*
+ * Copyright (c) 2024 Mark Kettenis <kettenis@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/device.h>
+
+#include <machine/intr.h>
+#include <machine/bus.h>
+
+#include <dev/acpi/acpireg.h>
+#include <dev/acpi/acpivar.h>
+#include <dev/acpi/acpidev.h>
+#include <dev/acpi/amltypes.h>
+#include <dev/acpi/dsdt.h>
+
+#define INTELPMC_DEBUG
+
+/* Low Power S0 Idle DSM methods */
+#define ACPI_LPS0_ENUM_FUNCTIONS 	0
+#define ACPI_LPS0_GET_CONSTRAINTS	1
+#define ACPI_LPS0_SCREEN_OFF		3
+#define ACPI_LPS0_SCREEN_ON		4
+#define ACPI_LPS0_ENTRY			5
+#define ACPI_LPS0_EXIT			6
+
+struct intelpmc_softc {
+	struct device		sc_dev;
+	bus_space_tag_t		sc_iot;
+	bus_space_handle_t	sc_ioh;
+
+	struct acpi_softc	*sc_acpi;
+	struct aml_node		*sc_node;
+
+#ifdef INTELPMC_DEBUG
+	uint64_t		sc_c3[2];
+	uint64_t		sc_c6[2];
+	uint64_t		sc_c7[2];
+	uint64_t		sc_pc2[2];
+	uint64_t		sc_pc3[2];
+	uint64_t		sc_pc6[2];
+	uint64_t		sc_pc7[2];
+	uint64_t		sc_pc8[2];
+	uint64_t		sc_pc9[2];
+	uint64_t		sc_pc10[2];
+#endif
+};
+
+int	intelpmc_match(struct device *, void *, void *);
+void	intelpmc_attach(struct device *, struct device *, void *);
+int	intelpmc_activate(struct device *, int);
+
+const struct cfattach intelpmc_ca = {
+	sizeof (struct intelpmc_softc), intelpmc_match, intelpmc_attach,
+	NULL, intelpmc_activate
+};
+
+struct cfdriver intelpmc_cd = {
+	NULL, "intelpmc", DV_DULL
+};
+
+const char *intelpmc_hids[] = {
+	"INT33A1",
+	NULL
+};
+
+void	intelpmc_suspend(void *);
+void	intelpmc_resume(void *);
+
+int
+intelpmc_match(struct device *parent, void *match, void *aux)
+{
+	struct acpi_attach_args *aaa = aux;
+	struct cfdata *cf = match;
+
+	return acpi_matchhids(aaa, intelpmc_hids, cf->cf_driver->cd_name);
+}
+
+void
+intelpmc_attach(struct device *parent, struct device *self, void *aux)
+{
+	struct intelpmc_softc *sc = (struct intelpmc_softc *)self;
+	struct acpi_attach_args *aaa = aux;
+
+	sc->sc_acpi = (struct acpi_softc *)parent;
+	sc->sc_node = aaa->aaa_node;
+
+	printf(": %s\n", aaa->aaa_node->name);
+
+	sc->sc_acpi->sc_pmc_suspend = intelpmc_suspend;
+	sc->sc_acpi->sc_pmc_resume = intelpmc_resume;
+	sc->sc_acpi->sc_pmc_cookie = sc;
+}
+
+int
+intelpmc_activate(struct device *self, int act)
+{
+#ifdef INTELPMC_DEBUG
+	struct intelpmc_softc *sc = (struct intelpmc_softc *)self;
+
+	switch (act) {
+	case DVACT_RESUME:
+		printf("C3: %lld -> %lld\n", sc->sc_c3[0], sc->sc_c3[1]);
+		printf("C6: %lld -> %lld\n", sc->sc_c6[0], sc->sc_c6[1]);
+		printf("C7: %lld -> %lld\n", sc->sc_c7[0], sc->sc_c7[1]);
+		printf("PC2: %lld -> %lld\n", sc->sc_pc2[0], sc->sc_pc2[1]);
+		printf("PC3: %lld -> %lld\n", sc->sc_pc3[0], sc->sc_pc3[1]);
+		printf("PC6: %lld -> %lld\n", sc->sc_pc6[0], sc->sc_pc6[1]);
+		printf("PC7: %lld -> %lld\n", sc->sc_pc7[0], sc->sc_pc7[1]);
+		printf("PC8: %lld -> %lld\n", sc->sc_pc8[0], sc->sc_pc8[1]);
+		printf("PC9: %lld -> %lld\n", sc->sc_pc9[0], sc->sc_pc9[1]);
+		printf("PC10: %lld -> %lld\n", sc->sc_pc10[0], sc->sc_pc10[1]);
+		break;
+	}
+#endif
+
+	return 0;
+}
+
+int
+intelpmc_dsm(struct acpi_softc *sc, struct aml_node *node, int func)
+{
+	struct aml_value cmd[4];
+	struct aml_value res;
+
+	/* c4eb40a0-6cd2-11e2-bcfd-0800200c9a66 */
+	static uint8_t lps0_dsm_guid[] = {
+		0xA0, 0x40, 0xEB, 0xC4, 0xD2, 0x6C, 0xE2, 0x11,
+		0xBC, 0xFD, 0x08, 0x00, 0x20, 0x0C, 0x9A, 0x66,
+	};
+
+	bzero(&cmd, sizeof(cmd));
+	cmd[0].type = AML_OBJTYPE_BUFFER;
+	cmd[0].v_buffer = (uint8_t *)&lps0_dsm_guid;
+	cmd[0].length = sizeof(lps0_dsm_guid);
+	/* rev */
+	cmd[1].type = AML_OBJTYPE_INTEGER;
+	cmd[1].v_integer = 0;
+	cmd[1].length = 1;
+	/* func */
+	cmd[2].type = AML_OBJTYPE_INTEGER;
+	cmd[2].v_integer = func;
+	cmd[2].length = 1;
+	/* not used */
+	cmd[3].type = AML_OBJTYPE_PACKAGE;
+	cmd[3].length = 0;
+
+	if (aml_evalname(sc, node, "_DSM", 4, cmd, &res)) {
+		printf("%s: eval of _DSM at %s failed\n",
+		    sc->sc_dev.dv_xname, aml_nodename(node));
+		return 1;
+	}
+	aml_freevalue(&res);
+
+	return 0;
+}
+
+void
+intelpmc_suspend(void *cookie)
+{
+	struct intelpmc_softc *sc = cookie;
+
+	if (sc->sc_acpi->sc_state != ACPI_STATE_S0)
+		return;
+
+#ifdef INTELPMC_DEBUG
+	rdmsr_safe(MSR_CORE_C3_RESIDENCY, &sc->sc_c3[0]);
+	rdmsr_safe(MSR_CORE_C6_RESIDENCY, &sc->sc_c6[0]);
+	rdmsr_safe(MSR_CORE_C7_RESIDENCY, &sc->sc_c7[0]);
+	rdmsr_safe(MSR_PKG_C2_RESIDENCY, &sc->sc_pc2[0]);
+	rdmsr_safe(MSR_PKG_C3_RESIDENCY, &sc->sc_pc3[0]);
+	rdmsr_safe(MSR_PKG_C6_RESIDENCY, &sc->sc_pc6[0]);
+	rdmsr_safe(MSR_PKG_C7_RESIDENCY, &sc->sc_pc7[0]);
+	rdmsr_safe(MSR_PKG_C8_RESIDENCY, &sc->sc_pc8[0]);
+	rdmsr_safe(MSR_PKG_C9_RESIDENCY, &sc->sc_pc9[0]);
+	rdmsr_safe(MSR_PKG_C10_RESIDENCY, &sc->sc_pc10[0]);
+#endif
+
+	intelpmc_dsm(sc->sc_acpi, sc->sc_node, ACPI_LPS0_SCREEN_OFF);
+	intelpmc_dsm(sc->sc_acpi, sc->sc_node, ACPI_LPS0_ENTRY);
+}
+
+void
+intelpmc_resume(void *cookie)
+{
+	struct intelpmc_softc *sc = cookie;
+
+	if (sc->sc_acpi->sc_state != ACPI_STATE_S0)
+		return;
+
+	intelpmc_dsm(sc->sc_acpi, sc->sc_node, ACPI_LPS0_EXIT);
+	intelpmc_dsm(sc->sc_acpi, sc->sc_node, ACPI_LPS0_SCREEN_ON);
+
+#ifdef INTELPMC_DEBUG
+	rdmsr_safe(MSR_CORE_C3_RESIDENCY, &sc->sc_c3[1]);
+	rdmsr_safe(MSR_CORE_C6_RESIDENCY, &sc->sc_c6[1]);
+	rdmsr_safe(MSR_CORE_C7_RESIDENCY, &sc->sc_c7[1]);
+	rdmsr_safe(MSR_PKG_C2_RESIDENCY, &sc->sc_pc2[1]);
+	rdmsr_safe(MSR_PKG_C3_RESIDENCY, &sc->sc_pc3[1]);
+	rdmsr_safe(MSR_PKG_C6_RESIDENCY, &sc->sc_pc6[1]);
+	rdmsr_safe(MSR_PKG_C7_RESIDENCY, &sc->sc_pc7[1]);
+	rdmsr_safe(MSR_PKG_C8_RESIDENCY, &sc->sc_pc8[1]);
+	rdmsr_safe(MSR_PKG_C9_RESIDENCY, &sc->sc_pc9[1]);
+	rdmsr_safe(MSR_PKG_C10_RESIDENCY, &sc->sc_pc10[1]);
+#endif
+}
diff --git a/sys/dev/fdt/qcpas.c b/sys/dev/fdt/qcpas.c
index c943a7db8..6585f9e69 100644
--- a/sys/dev/fdt/qcpas.c
+++ b/sys/dev/fdt/qcpas.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qcpas.c,v 1.3 2024/07/25 20:21:40 kettenis Exp $	*/
+/*	$OpenBSD: qcpas.c,v 1.5 2024/08/04 20:10:38 mglocker Exp $	*/
 /*
  * Copyright (c) 2023 Patrick Wildt <patrick@blueri.se>
  *
@@ -36,6 +36,11 @@
 
 #include "apm.h"
 
+extern int qcscm_pas_init_image(uint32_t, paddr_t);
+extern int qcscm_pas_mem_setup(uint32_t, paddr_t, size_t);
+extern int qcscm_pas_auth_and_reset(uint32_t);
+extern int qcscm_pas_shutdown(uint32_t);
+
 #define MDT_TYPE_MASK				(7 << 24)
 #define MDT_TYPE_HASH				(2 << 24)
 #define MDT_RELOCATABLE				(1 << 27)
@@ -65,15 +70,17 @@ struct qcpas_softc {
 
 	void			*sc_ih[6];
 
-	paddr_t			sc_mem_phys;
-	size_t			sc_mem_size;
-	void			*sc_mem_region;
-	vaddr_t			sc_mem_reloc;
+	paddr_t			sc_mem_phys[2];
+	size_t			sc_mem_size[2];
+	void			*sc_mem_region[2];
+	vaddr_t			sc_mem_reloc[2];
 
 	uint32_t		sc_pas_id;
+	uint32_t		sc_dtb_pas_id;
+	uint32_t		sc_lite_pas_id;
 	char			*sc_load_state;
 
-	struct qcpas_dmamem	*sc_metadata;
+	struct qcpas_dmamem	*sc_metadata[2];
 
 	/* GLINK */
 	volatile uint32_t	*sc_tx_tail;
@@ -110,7 +117,7 @@ struct cfdriver qcpas_cd = {
 
 void	qcpas_mountroot(struct device *);
 int	qcpas_map_memory(struct qcpas_softc *);
-int	qcpas_mdt_init(struct qcpas_softc *, u_char *, size_t);
+int	qcpas_mdt_init(struct qcpas_softc *, int, u_char *, size_t);
 void	qcpas_glink_attach(struct qcpas_softc *, int);
 
 struct qcpas_dmamem *
@@ -130,7 +137,8 @@ qcpas_match(struct device *parent, void *match, void *aux)
 {
 	struct fdt_attach_args *faa = aux;
 
-	return OF_is_compatible(faa->fa_node, "qcom,sc8280xp-adsp-pas");
+	return OF_is_compatible(faa->fa_node, "qcom,sc8280xp-adsp-pas") ||
+	    OF_is_compatible(faa->fa_node, "qcom,x1e80100-adsp-pas");
 }
 
 void
@@ -164,6 +172,13 @@ qcpas_attach(struct device *parent, struct device *self, void *aux)
 		sc->sc_pas_id = 30;
 	}
 
+	if (OF_is_compatible(faa->fa_node, "qcom,x1e80100-adsp-pas")) {
+		sc->sc_pas_id = 1;
+		sc->sc_dtb_pas_id = 36;
+		sc->sc_lite_pas_id = 31;
+		sc->sc_load_state = "adsp";
+	}
+
 	qcpas_intr_establish(sc, 0, "wdog", qcpas_intr_wdog);
 	qcpas_intr_establish(sc, 1, "fatal", qcpas_intr_fatal);
 	qcpas_intr_establish(sc, 2, "ready", qcpas_intr_ready);
@@ -182,10 +197,11 @@ void
 qcpas_mountroot(struct device *self)
 {
 	struct qcpas_softc *sc = (struct qcpas_softc *)self;
-	char fwname[64];
-	size_t fwlen;
-	u_char *fw;
+	char fwname[128];
+	size_t fwlen, dtb_fwlen;
+	u_char *fw, *dtb_fw;
 	int node, ret;
+	int error;
 
 	if (qcpas_map_memory(sc) != 0)
 		return;
@@ -195,10 +211,32 @@ qcpas_mountroot(struct device *self)
 	OF_getprop(sc->sc_node, "firmware-name", fwname, sizeof(fwname));
 	fwname[sizeof(fwname) - 1] = '\0';
 
-	if (loadfirmware(fwname, &fw, &fwlen) != 0) {
-		printf("%s: failed to load %s\n",
-		    sc->sc_dev.dv_xname, fwname);
+	/* If we need a second firmware, make sure we have a name for it. */
+	if (sc->sc_dtb_pas_id && strlen(fwname) == sizeof(fwname) - 1)
 		return;
+
+	error = loadfirmware(fwname, &fw, &fwlen);
+	if (error) {
+		printf("%s: failed to load %s: %d\n",
+		    sc->sc_dev.dv_xname, fwname, error);
+		return;
+	}
+
+	if (sc->sc_lite_pas_id) {
+		if (qcscm_pas_shutdown(sc->sc_lite_pas_id)) {
+			printf("%s: failed to shutdown lite firmware\n",
+			    sc->sc_dev.dv_xname);
+		}
+	}
+
+	if (sc->sc_dtb_pas_id) {
+		error = loadfirmware(fwname + strlen(fwname) + 1,
+		    &dtb_fw, &dtb_fwlen);
+		if (error) {
+			printf("%s: failed to load %s: %d\n",
+			    sc->sc_dev.dv_xname, fwname, error);
+			return;
+		}
 	}
 
 	if (sc->sc_load_state) {
@@ -217,7 +255,12 @@ qcpas_mountroot(struct device *self)
 	power_domain_enable_all(sc->sc_node);
 	clock_enable(sc->sc_node, "xo");
 
-	ret = qcpas_mdt_init(sc, fw, fwlen);
+	if (sc->sc_dtb_pas_id) {
+		qcpas_mdt_init(sc, sc->sc_dtb_pas_id, dtb_fw, dtb_fwlen);
+		free(dtb_fw, M_DEVBUF, dtb_fwlen);
+	}
+
+	ret = qcpas_mdt_init(sc, sc->sc_pas_id, fw, fwlen);
 	free(fw, M_DEVBUF, fwlen);
 	if (ret != 0) {
 		printf("%s: failed to boot coprocessor\n",
@@ -233,44 +276,49 @@ qcpas_mountroot(struct device *self)
 int
 qcpas_map_memory(struct qcpas_softc *sc)
 {
-	uint32_t phandle, reg[4];
+	uint32_t memreg[2] = {};
+	uint32_t reg[4];
 	size_t off;
 	int node;
+	int i;
 
-	phandle = OF_getpropint(sc->sc_node, "memory-region", 0);
-	if (phandle == 0)
-		return EINVAL;
-	node = OF_getnodebyphandle(phandle);
-	if (node == 0)
-		return EINVAL;
-	if (OF_getpropintarray(node, "reg", reg, sizeof(reg)) != sizeof(reg))
+	OF_getpropintarray(sc->sc_node, "memory-region",
+	    memreg, sizeof(memreg));
+	if (memreg[0] == 0)
 		return EINVAL;
 
-	sc->sc_mem_phys = (uint64_t)reg[0] << 32 | reg[1];
-	KASSERT((sc->sc_mem_phys & PAGE_MASK) == 0);
-	sc->sc_mem_size = (uint64_t)reg[2] << 32 | reg[3];
-	KASSERT((sc->sc_mem_size & PAGE_MASK) == 0);
+	for (i = 0; i < nitems(memreg); i++) {
+		if (memreg[i] == 0)
+			break;
+		node = OF_getnodebyphandle(memreg[i]);
+		if (node == 0)
+			return EINVAL;
+		if (OF_getpropintarray(node, "reg", reg,
+		    sizeof(reg)) != sizeof(reg))
+			return EINVAL;
 
-	sc->sc_mem_region = km_alloc(sc->sc_mem_size, &kv_any, &kp_none,
-	    &kd_nowait);
-	if (!sc->sc_mem_region)
-		return ENOMEM;
+		sc->sc_mem_phys[i] = (uint64_t)reg[0] << 32 | reg[1];
+		KASSERT((sc->sc_mem_phys[i] & PAGE_MASK) == 0);
+		sc->sc_mem_size[i] = (uint64_t)reg[2] << 32 | reg[3];
+		KASSERT((sc->sc_mem_size[i] & PAGE_MASK) == 0);
 
-	for (off = 0; off < sc->sc_mem_size; off += PAGE_SIZE) {
-		pmap_kenter_cache((vaddr_t)sc->sc_mem_region + off,
-		    sc->sc_mem_phys + off, PROT_READ | PROT_WRITE,
-		    PMAP_CACHE_DEV_NGNRNE);
+		sc->sc_mem_region[i] = km_alloc(sc->sc_mem_size[i],
+		    &kv_any, &kp_none, &kd_nowait);
+		if (!sc->sc_mem_region[i])
+			return ENOMEM;
+
+		for (off = 0; off < sc->sc_mem_size[i]; off += PAGE_SIZE) {
+			pmap_kenter_cache((vaddr_t)sc->sc_mem_region[i] + off,
+			    sc->sc_mem_phys[i] + off, PROT_READ | PROT_WRITE,
+			    PMAP_CACHE_DEV_NGNRNE);
+		}
 	}
 
 	return 0;
 }
 
-extern int qcscm_pas_init_image(uint32_t, paddr_t);
-extern int qcscm_pas_mem_setup(uint32_t, paddr_t, size_t);
-extern int qcscm_pas_auth_and_reset(uint32_t);
-
 int
-qcpas_mdt_init(struct qcpas_softc *sc, u_char *fw, size_t fwlen)
+qcpas_mdt_init(struct qcpas_softc *sc, int pas_id, u_char *fw, size_t fwlen)
 {
 	Elf32_Ehdr *ehdr;
 	Elf32_Phdr *phdr;
@@ -278,6 +326,12 @@ qcpas_mdt_init(struct qcpas_softc *sc, u_char *fw, size_t fwlen)
 	int i, hashseg = 0, relocate = 0;
 	int error;
 	ssize_t off;
+	int idx;
+
+	if (pas_id == sc->sc_dtb_pas_id)
+		idx = 1;
+	else
+		idx = 0;
 
 	ehdr = (Elf32_Ehdr *)fw;
 	phdr = (Elf32_Phdr *)&ehdr[1];
@@ -306,17 +360,17 @@ qcpas_mdt_init(struct qcpas_softc *sc, u_char *fw, size_t fwlen)
 	if (!hashseg)
 		return EINVAL;
 
-	sc->sc_metadata = qcpas_dmamem_alloc(sc, phdr[0].p_filesz +
+	sc->sc_metadata[idx] = qcpas_dmamem_alloc(sc, phdr[0].p_filesz +
 	    phdr[hashseg].p_filesz, PAGE_SIZE);
-	if (sc->sc_metadata == NULL)
+	if (sc->sc_metadata[idx] == NULL)
 		return EINVAL;
 
-	memcpy(QCPAS_DMA_KVA(sc->sc_metadata), fw, phdr[0].p_filesz);
+	memcpy(QCPAS_DMA_KVA(sc->sc_metadata[idx]), fw, phdr[0].p_filesz);
 	if (phdr[0].p_filesz + phdr[hashseg].p_filesz == fwlen) {
-		memcpy(QCPAS_DMA_KVA(sc->sc_metadata) + phdr[0].p_filesz,
+		memcpy(QCPAS_DMA_KVA(sc->sc_metadata[idx]) + phdr[0].p_filesz,
 		    fw + phdr[0].p_filesz, phdr[hashseg].p_filesz);
 	} else if (phdr[hashseg].p_offset + phdr[hashseg].p_filesz <= fwlen) {
-		memcpy(QCPAS_DMA_KVA(sc->sc_metadata) + phdr[0].p_filesz,
+		memcpy(QCPAS_DMA_KVA(sc->sc_metadata[idx]) + phdr[0].p_filesz,
 		    fw + phdr[hashseg].p_offset, phdr[hashseg].p_filesz);
 	} else {
 		printf("%s: metadata split segment not supported\n",
@@ -326,36 +380,36 @@ qcpas_mdt_init(struct qcpas_softc *sc, u_char *fw, size_t fwlen)
 
 	membar_producer();
 
-	if (qcscm_pas_init_image(sc->sc_pas_id,
-	    QCPAS_DMA_DVA(sc->sc_metadata)) != 0) {
+	if (qcscm_pas_init_image(pas_id,
+	    QCPAS_DMA_DVA(sc->sc_metadata[idx])) != 0) {
 		printf("%s: init image failed\n", sc->sc_dev.dv_xname);
-		qcpas_dmamem_free(sc, sc->sc_metadata);
+		qcpas_dmamem_free(sc, sc->sc_metadata[idx]);
 		return EINVAL;
 	}
 
-	if (qcscm_pas_mem_setup(sc->sc_pas_id,
-	    sc->sc_mem_phys, maxpa - minpa) != 0) {
+	if (qcscm_pas_mem_setup(pas_id,
+	    sc->sc_mem_phys[idx], maxpa - minpa) != 0) {
 		printf("%s: mem setup failed\n", sc->sc_dev.dv_xname);
-		qcpas_dmamem_free(sc, sc->sc_metadata);
+		qcpas_dmamem_free(sc, sc->sc_metadata[idx]);
 		return EINVAL;
 	}
 
-	sc->sc_mem_reloc = relocate ? minpa : sc->sc_mem_phys;
+	sc->sc_mem_reloc[idx] = relocate ? minpa : sc->sc_mem_phys[idx];
 
 	for (i = 0; i < ehdr->e_phnum; i++) {
 		if ((phdr[i].p_flags & MDT_TYPE_MASK) == MDT_TYPE_HASH ||
 		    phdr[i].p_type != PT_LOAD || phdr[i].p_memsz == 0)
 			continue;
-		off = phdr[i].p_paddr - sc->sc_mem_reloc;
-		if (off < 0 || off + phdr[i].p_memsz > sc->sc_mem_size)
+		off = phdr[i].p_paddr - sc->sc_mem_reloc[idx];
+		if (off < 0 || off + phdr[i].p_memsz > sc->sc_mem_size[0])
 			return EINVAL;
 		if (phdr[i].p_filesz > phdr[i].p_memsz)
 			return EINVAL;
 
 		if (phdr[i].p_filesz && phdr[i].p_offset < fwlen &&
 		    phdr[i].p_offset + phdr[i].p_filesz <= fwlen) {
-			memcpy(sc->sc_mem_region + off, fw + phdr[i].p_offset,
-			    phdr[i].p_filesz);
+			memcpy(sc->sc_mem_region[idx] + off,
+			    fw + phdr[i].p_offset, phdr[i].p_filesz);
 		} else if (phdr[i].p_filesz) {
 			printf("%s: firmware split segment not supported\n",
 			    sc->sc_dev.dv_xname);
@@ -363,18 +417,21 @@ qcpas_mdt_init(struct qcpas_softc *sc, u_char *fw, size_t fwlen)
 		}
 
 		if (phdr[i].p_memsz > phdr[i].p_filesz)
-			memset(sc->sc_mem_region + off + phdr[i].p_filesz, 0,
-			    phdr[i].p_memsz - phdr[i].p_filesz);
+			memset(sc->sc_mem_region[idx] + off + phdr[i].p_filesz,
+			    0, phdr[i].p_memsz - phdr[i].p_filesz);
 	}
 
 	membar_producer();
 
-	if (qcscm_pas_auth_and_reset(sc->sc_pas_id) != 0) {
+	if (qcscm_pas_auth_and_reset(pas_id) != 0) {
 		printf("%s: auth and reset failed\n", sc->sc_dev.dv_xname);
-		qcpas_dmamem_free(sc, sc->sc_metadata);
+		qcpas_dmamem_free(sc, sc->sc_metadata[idx]);
 		return EINVAL;
 	}
 
+	if (pas_id == sc->sc_dtb_pas_id)
+		return 0;
+
 	error = tsleep_nsec(sc, PWAIT, "qcpas", SEC_TO_NSEC(5));
 	if (error) {
 		printf("%s: failed to receive ready signal\n",
@@ -1219,7 +1276,7 @@ qcpas_pmic_rtr_recv(void *cookie, uint8_t *buf, int len)
 			break;
 		case BATTMGR_OPCODE_BAT_INFO: {
 			struct battmgr_bat_info *bat;
-			if (len - sizeof(hdr) != sizeof(*bat)) {
+			if (len - sizeof(hdr) < sizeof(*bat)) {
 				printf("%s: invalid battgmr bat info\n",
 				    __func__);
 				return 0;
diff --git a/sys/dev/fdt/qcscm.c b/sys/dev/fdt/qcscm.c
index cb7d9d466..5aa411da7 100644
--- a/sys/dev/fdt/qcscm.c
+++ b/sys/dev/fdt/qcscm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: qcscm.c,v 1.8 2024/07/10 10:53:55 kettenis Exp $ */
+/* $OpenBSD: qcscm.c,v 1.9 2024/08/04 15:30:08 kettenis Exp $ */
 /*
  * Copyright (c) 2022 Patrick Wildt <patrick@blueri.se>
  *
@@ -922,6 +922,33 @@ qcscm_pas_auth_and_reset(uint32_t peripheral)
 	return ret;
 }
 
+int
+qcscm_pas_shutdown(uint32_t peripheral)
+{
+	struct qcscm_softc *sc = qcscm_sc;
+	uint64_t res[3];
+	uint64_t args[1];
+	uint32_t arginfo;
+	int ret;
+
+	if (sc == NULL)
+		return ENXIO;
+
+	arginfo = QCSCM_ARGINFO_NUM(nitems(args));
+	arginfo |= QCSCM_ARGINFO_TYPE(0, QCSCM_ARGINFO_TYPE_VAL);
+	args[0] = peripheral;
+
+	/* Make call into TEE */
+	ret = qcscm_smc_call(sc, ARM_SMCCC_OWNER_SIP, QCSCM_SVC_PIL,
+	    QCSCM_PIL_PAS_SHUTDOWN, arginfo, args, nitems(args), res);
+
+	/* If the call succeeded, check the response status */
+	if (ret == 0)
+		ret = res[0];
+
+	return ret;
+}
+
 /* DMA code */
 struct qcscm_dmamem *
 qcscm_dmamem_alloc(struct qcscm_softc *sc, bus_size_t size, bus_size_t align)
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c
index 7e894d9a7..81464ea3a 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c
@@ -5775,7 +5775,7 @@ int amdgpu_device_baco_exit(struct drm_device *dev)
 	    adev->nbio.funcs->enable_doorbell_interrupt)
 		adev->nbio.funcs->enable_doorbell_interrupt(adev, true);
 
-	if (amdgpu_passthrough(adev) &&
+	if (amdgpu_passthrough(adev) && adev->nbio.funcs &&
 	    adev->nbio.funcs->clear_doorbell_interrupt)
 		adev->nbio.funcs->clear_doorbell_interrupt(adev);
 
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_gmc.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_gmc.c
index 4b975ec9a..c37eb3ad5 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_gmc.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_gmc.c
@@ -650,7 +650,6 @@ void amdgpu_gmc_noretry_set(struct amdgpu_device *adev)
 	struct amdgpu_gmc *gmc = &adev->gmc;
 	uint32_t gc_ver = adev->ip_versions[GC_HWIP][0];
 	bool noretry_default = (gc_ver == IP_VERSION(9, 0, 1) ||
-				gc_ver == IP_VERSION(9, 3, 0) ||
 				gc_ver == IP_VERSION(9, 4, 0) ||
 				gc_ver == IP_VERSION(9, 4, 1) ||
 				gc_ver == IP_VERSION(9, 4, 2) ||
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm.c
index 3c57acff9..f9f4f531e 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm.c
@@ -478,7 +478,7 @@ uint64_t amdgpu_vm_generation(struct amdgpu_device *adev, struct amdgpu_vm *vm)
 	if (!vm)
 		return result;
 
-	result += vm->generation;
+	result += lower_32_bits(vm->generation);
 	/* Add one if the page tables will be re-generated on next CS */
 	if (drm_sched_entity_error(&vm->delayed))
 		++result;
@@ -503,13 +503,14 @@ int amdgpu_vm_validate_pt_bos(struct amdgpu_device *adev, struct amdgpu_vm *vm,
 			      int (*validate)(void *p, struct amdgpu_bo *bo),
 			      void *param)
 {
+	uint64_t new_vm_generation = amdgpu_vm_generation(adev, vm);
 	struct amdgpu_vm_bo_base *bo_base;
 	struct amdgpu_bo *shadow;
 	struct amdgpu_bo *bo;
 	int r;
 
-	if (drm_sched_entity_error(&vm->delayed)) {
-		++vm->generation;
+	if (vm->generation != new_vm_generation) {
+		vm->generation = new_vm_generation;
 		amdgpu_vm_bo_reset_state_machine(vm);
 		amdgpu_vm_fini_entities(vm);
 		r = amdgpu_vm_init_entities(adev, vm);
@@ -2265,7 +2266,7 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm,
 	vm->last_update = dma_fence_get_stub();
 	vm->last_unlocked = dma_fence_get_stub();
 	vm->last_tlb_flush = dma_fence_get_stub();
-	vm->generation = 0;
+	vm->generation = amdgpu_vm_generation(adev, NULL);
 
 	rw_init(&vm->eviction_lock, "avmev");
 	vm->evicting = false;
diff --git a/sys/dev/pci/drm/amd/amdgpu/gmc_v9_0.c b/sys/dev/pci/drm/amd/amdgpu/gmc_v9_0.c
index b53ac677b..77f085ea3 100644
--- a/sys/dev/pci/drm/amd/amdgpu/gmc_v9_0.c
+++ b/sys/dev/pci/drm/amd/amdgpu/gmc_v9_0.c
@@ -1956,7 +1956,7 @@ gmc_v9_0_init_sw_mem_ranges(struct amdgpu_device *adev,
 		break;
 	}
 
-	size = adev->gmc.real_vram_size >> AMDGPU_GPU_PAGE_SHIFT;
+	size = (adev->gmc.real_vram_size + SZ_16M) >> AMDGPU_GPU_PAGE_SHIFT;
 	size /= adev->gmc.num_mem_partitions;
 
 	for (i = 0; i < adev->gmc.num_mem_partitions; ++i) {
diff --git a/sys/dev/pci/drm/amd/amdgpu/sdma_v5_2.c b/sys/dev/pci/drm/amd/amdgpu/sdma_v5_2.c
index ac3ae2131..61afab0d0 100644
--- a/sys/dev/pci/drm/amd/amdgpu/sdma_v5_2.c
+++ b/sys/dev/pci/drm/amd/amdgpu/sdma_v5_2.c
@@ -188,6 +188,14 @@ static void sdma_v5_2_ring_set_wptr(struct amdgpu_ring *ring)
 		DRM_DEBUG("calling WDOORBELL64(0x%08x, 0x%016llx)\n",
 				ring->doorbell_index, ring->wptr << 2);
 		WDOORBELL64(ring->doorbell_index, ring->wptr << 2);
+		/* SDMA seems to miss doorbells sometimes when powergating kicks in.
+		 * Updating the wptr directly will wake it. This is only safe because
+		 * we disallow gfxoff in begin_use() and then allow it again in end_use().
+		 */
+		WREG32(sdma_v5_2_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR),
+		       lower_32_bits(ring->wptr << 2));
+		WREG32(sdma_v5_2_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR_HI),
+		       upper_32_bits(ring->wptr << 2));
 	} else {
 		DRM_DEBUG("Not using doorbell -- "
 				"mmSDMA%i_GFX_RB_WPTR == 0x%08x "
@@ -1666,6 +1674,10 @@ static void sdma_v5_2_ring_begin_use(struct amdgpu_ring *ring)
 	 * but it shouldn't hurt for other parts since
 	 * this GFXOFF will be disallowed anyway when SDMA is
 	 * active, this just makes it explicit.
+	 * sdma_v5_2_ring_set_wptr() takes advantage of this
+	 * to update the wptr because sometimes SDMA seems to miss
+	 * doorbells when entering PG.  If you remove this, update
+	 * sdma_v5_2_ring_set_wptr() as well!
 	 */
 	amdgpu_gfx_off_ctrl(adev, false);
 }
diff --git a/sys/dev/pci/drm/amd/amdgpu/smu_v13_0_10.c b/sys/dev/pci/drm/amd/amdgpu/smu_v13_0_10.c
index ae29620b1..a7cef33a2 100644
--- a/sys/dev/pci/drm/amd/amdgpu/smu_v13_0_10.c
+++ b/sys/dev/pci/drm/amd/amdgpu/smu_v13_0_10.c
@@ -92,7 +92,7 @@ static int smu_v13_0_10_mode2_suspend_ip(struct amdgpu_device *adev)
 		adev->ip_blocks[i].status.hw = false;
 	}
 
-	return r;
+	return 0;
 }
 
 static int
diff --git a/sys/dev/pci/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/sys/dev/pci/drm/amd/amdkfd/kfd_mqd_manager_v9.c
index 42d881809..1ac66c533 100644
--- a/sys/dev/pci/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+++ b/sys/dev/pci/drm/amd/amdkfd/kfd_mqd_manager_v9.c
@@ -686,7 +686,7 @@ static void update_mqd_v9_4_3(struct mqd_manager *mm, void *mqd,
 		m = get_mqd(mqd + size * xcc);
 		update_mqd(mm, m, q, minfo);
 
-		update_cu_mask(mm, mqd, minfo, xcc);
+		update_cu_mask(mm, m, minfo, xcc);
 
 		if (q->format == KFD_QUEUE_FORMAT_AQL) {
 			switch (xcc) {
diff --git a/sys/dev/pci/drm/amd/display/dc/core/dc_surface.c b/sys/dev/pci/drm/amd/display/dc/core/dc_surface.c
index a80e45300..f4f3ca7aa 100644
--- a/sys/dev/pci/drm/amd/display/dc/core/dc_surface.c
+++ b/sys/dev/pci/drm/amd/display/dc/core/dc_surface.c
@@ -154,7 +154,8 @@ const struct dc_plane_status *dc_plane_get_status(
 		if (pipe_ctx->plane_state != plane_state)
 			continue;
 
-		pipe_ctx->plane_state->status.is_flip_pending = false;
+		if (pipe_ctx->plane_state)
+			pipe_ctx->plane_state->status.is_flip_pending = false;
 
 		break;
 	}
diff --git a/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index 8f9e44143..a6f04c7dd 100644
--- a/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -79,8 +79,8 @@ MODULE_FIRMWARE("amdgpu/smu_13_0_10.bin");
 #define PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD_MASK 0x00000070L
 #define PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD__SHIFT 0x4
 #define smnPCIE_LC_SPEED_CNTL			0x11140290
-#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK 0xC000
-#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT 0xE
+#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK 0xE0
+#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT 0x5
 
 static const int link_width[] = {0, 1, 2, 4, 8, 12, 16};
 
diff --git a/sys/dev/pci/drm/display/drm_dp_mst_topology.c b/sys/dev/pci/drm/display/drm_dp_mst_topology.c
index 778b59616..2b77d44f3 100644
--- a/sys/dev/pci/drm/display/drm_dp_mst_topology.c
+++ b/sys/dev/pci/drm/display/drm_dp_mst_topology.c
@@ -2933,7 +2933,7 @@ static int drm_dp_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
 
 	/* FIXME: Actually do some real error handling here */
 	ret = drm_dp_mst_wait_tx_reply(mstb, txmsg);
-	if (ret <= 0) {
+	if (ret < 0) {
 		drm_err(mgr->dev, "Sending link address failed with %d\n", ret);
 		goto out;
 	}
@@ -2985,7 +2985,7 @@ static int drm_dp_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
 	mutex_unlock(&mgr->lock);
 
 out:
-	if (ret <= 0)
+	if (ret < 0)
 		mstb->link_address_sent = false;
 	kfree(txmsg);
 	return ret < 0 ? ret : changed;
diff --git a/sys/dev/pci/drm/i915/display/intel_dp.c b/sys/dev/pci/drm/i915/display/intel_dp.c
index f80bd9f03..5386d3a6b 100644
--- a/sys/dev/pci/drm/i915/display/intel_dp.c
+++ b/sys/dev/pci/drm/i915/display/intel_dp.c
@@ -4374,6 +4374,8 @@ int intel_dp_retrain_link(struct intel_encoder *encoder,
 		    !intel_dp_mst_is_master_trans(crtc_state))
 			continue;
 
+		intel_dp->link_trained = false;
+
 		intel_dp_check_frl_training(intel_dp);
 		intel_dp_pcon_dsc_configure(intel_dp, crtc_state);
 		intel_dp_start_link_train(intel_dp, crtc_state);
diff --git a/sys/dev/pci/drm/i915/display/intel_dp_link_training.c b/sys/dev/pci/drm/i915/display/intel_dp_link_training.c
index a62bca622..eb5559e1a 100644
--- a/sys/dev/pci/drm/i915/display/intel_dp_link_training.c
+++ b/sys/dev/pci/drm/i915/display/intel_dp_link_training.c
@@ -114,10 +114,24 @@ intel_dp_set_lttpr_transparent_mode(struct intel_dp *intel_dp, bool enable)
 	return drm_dp_dpcd_write(&intel_dp->aux, DP_PHY_REPEATER_MODE, &val, 1) == 1;
 }
 
-static int intel_dp_init_lttpr(struct intel_dp *intel_dp, const u8 dpcd[DP_RECEIVER_CAP_SIZE])
+static bool intel_dp_lttpr_transparent_mode_enabled(struct intel_dp *intel_dp)
+{
+	return intel_dp->lttpr_common_caps[DP_PHY_REPEATER_MODE -
+					   DP_LT_TUNABLE_PHY_REPEATER_FIELD_DATA_STRUCTURE_REV] ==
+		DP_PHY_REPEATER_MODE_TRANSPARENT;
+}
+
+/*
+ * Read the LTTPR common capabilities and switch the LTTPR PHYs to
+ * non-transparent mode if this is supported. Preserve the
+ * transparent/non-transparent mode on an active link.
+ *
+ * Return the number of detected LTTPRs in non-transparent mode or 0 if the
+ * LTTPRs are in transparent mode or the detection failed.
+ */
+static int intel_dp_init_lttpr_phys(struct intel_dp *intel_dp, const u8 dpcd[DP_RECEIVER_CAP_SIZE])
 {
 	int lttpr_count;
-	int i;
 
 	if (!intel_dp_read_lttpr_common_caps(intel_dp, dpcd))
 		return 0;
@@ -131,6 +145,19 @@ static int intel_dp_init_lttpr(struct intel_dp *intel_dp, const u8 dpcd[DP_RECEI
 	if (lttpr_count == 0)
 		return 0;
 
+	/*
+	 * Don't change the mode on an active link, to prevent a loss of link
+	 * synchronization. See DP Standard v2.0 3.6.7. about the LTTPR
+	 * resetting its internal state when the mode is changed from
+	 * non-transparent to transparent.
+	 */
+	if (intel_dp->link_trained) {
+		if (lttpr_count < 0 || intel_dp_lttpr_transparent_mode_enabled(intel_dp))
+			goto out_reset_lttpr_count;
+
+		return lttpr_count;
+	}
+
 	/*
 	 * See DP Standard v2.0 3.6.6.1. about the explicit disabling of
 	 * non-transparent mode and the disable->enable non-transparent mode
@@ -151,11 +178,25 @@ static int intel_dp_init_lttpr(struct intel_dp *intel_dp, const u8 dpcd[DP_RECEI
 		       "Switching to LTTPR non-transparent LT mode failed, fall-back to transparent mode\n");
 
 		intel_dp_set_lttpr_transparent_mode(intel_dp, true);
-		intel_dp_reset_lttpr_count(intel_dp);
 
-		return 0;
+		goto out_reset_lttpr_count;
 	}
 
+	return lttpr_count;
+
+out_reset_lttpr_count:
+	intel_dp_reset_lttpr_count(intel_dp);
+
+	return 0;
+}
+
+static int intel_dp_init_lttpr(struct intel_dp *intel_dp, const u8 dpcd[DP_RECEIVER_CAP_SIZE])
+{
+	int lttpr_count;
+	int i;
+
+	lttpr_count = intel_dp_init_lttpr_phys(intel_dp, dpcd);
+
 	for (i = 0; i < lttpr_count; i++)
 		intel_dp_read_lttpr_phy_caps(intel_dp, dpcd, DP_PHY_LTTPR(i));
 
@@ -1353,10 +1394,10 @@ void intel_dp_start_link_train(struct intel_dp *intel_dp,
 {
 	struct drm_i915_private *i915 = dp_to_i915(intel_dp);
 	bool passed;
-
 	/*
-	 * TODO: Reiniting LTTPRs here won't be needed once proper connector
-	 * HW state readout is added.
+	 * Reinit the LTTPRs here to ensure that they are switched to
+	 * non-transparent mode. During an earlier LTTPR detection this
+	 * could've been prevented by an active link.
 	 */
 	int lttpr_count = intel_dp_init_lttpr_and_dprx_caps(intel_dp);
 
diff --git a/sys/dev/pci/drm/i915/gt/intel_execlists_submission.c b/sys/dev/pci/drm/i915/gt/intel_execlists_submission.c
index 8bb1609b1..6cee4690b 100644
--- a/sys/dev/pci/drm/i915/gt/intel_execlists_submission.c
+++ b/sys/dev/pci/drm/i915/gt/intel_execlists_submission.c
@@ -3320,11 +3320,7 @@ static void remove_from_engine(struct i915_request *rq)
 
 static bool can_preempt(struct intel_engine_cs *engine)
 {
-	if (GRAPHICS_VER(engine->i915) > 8)
-		return true;
-
-	/* GPGPU on bdw requires extra w/a; not implemented */
-	return engine->class != RENDER_CLASS;
+	return GRAPHICS_VER(engine->i915) > 8;
 }
 
 static void kick_execlists(const struct i915_request *rq, int prio)
diff --git a/sys/sys/device.h b/sys/sys/device.h
index 712bcb4e3..89ed62ebf 100644
--- a/sys/sys/device.h
+++ b/sys/sys/device.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: device.h,v 1.67 2024/05/28 09:40:40 kettenis Exp $	*/
+/*	$OpenBSD: device.h,v 1.68 2024/08/04 15:30:08 kettenis Exp $	*/
 /*	$NetBSD: device.h,v 1.15 1996/04/09 20:55:24 cgd Exp $	*/
 
 /*
@@ -231,7 +231,7 @@ void	device_register(struct device *, void *);
 void	device_register_wakeup(struct device *);
 
 int loadfirmware(const char *name, u_char **bufp, size_t *buflen);
-#define FIRMWARE_MAX	15*1024*1024
+#define FIRMWARE_MAX	24*1024*1024
 
 /* compatibility definitions */
 #define config_found(d, a, p)	config_found_sm((d), (a), (p), NULL)
diff --git a/sys/sys/poll.h b/sys/sys/poll.h
index 30daa17bc..f3e16e54f 100644
--- a/sys/sys/poll.h
+++ b/sys/sys/poll.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: poll.h,v 1.15 2016/06/07 06:12:37 deraadt Exp $ */
+/*	$OpenBSD: poll.h,v 1.16 2024/08/04 22:28:08 guenther Exp $ */
 
 /*
  * Copyright (c) 1996 Theo de Raadt
@@ -56,7 +56,7 @@ typedef unsigned int	nfds_t;
 #ifndef _KERNEL
 #include <sys/cdefs.h>
 
-#if __BSD_VISIBLE
+#if __POSIX_VISIBLE >= 202405 || __BSD_VISIBLE
 #include <sys/_types.h>
 
 #ifndef _SIGSET_T_DEFINED_
@@ -80,8 +80,8 @@ struct timespec {
 
 __BEGIN_DECLS
 int   poll(struct pollfd[], nfds_t, int);
-#if __BSD_VISIBLE
-int   ppoll(struct pollfd[], nfds_t, const struct timespec *, const sigset_t *);
+#if __POSIX_VISIBLE >= 202405 || __BSD_VISIBLE
+int   ppoll(struct pollfd[], nfds_t, const struct timespec * __restrict, const sigset_t * __restrict);
 #endif /* __BSD_VISIBLE */
 __END_DECLS
 #endif /* _KERNEL */
diff --git a/usr.bin/awk/FIXES b/usr.bin/awk/FIXES
index 5bfc3cada..ad8bce264 100644
--- a/usr.bin/awk/FIXES
+++ b/usr.bin/awk/FIXES
@@ -25,6 +25,15 @@ THIS SOFTWARE.
 This file lists all bug fixes, changes, etc., made since the 
 second edition of the AWK book was published in September 2023.
 
+Jul 28, 2024
+	Fixed readcsvrec resize segfault when reading csv records longer
+	than 8k. Thanks to Ozan Yigit.
+	mktime() added to bsd-features branch. Thanks to Todd Miller.
+
+Jun 23, 2024
+	Fix signal for system-status test. Thanks to Tim van der Molen.
+	Rewrite if-else chain as switch. Thanks to Andrew Sukach.
+
 May 27, 2024
 	Spelling fixes and removal of unneeded prototypes and extern.
 	Thanks to Jonathan Gray.
diff --git a/usr.bin/awk/b.c b/usr.bin/awk/b.c
index 53a36d27b..8b5ef83b2 100644
--- a/usr.bin/awk/b.c
+++ b/usr.bin/awk/b.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: b.c,v 1.53 2024/06/03 00:55:05 millert Exp $	*/
+/*	$OpenBSD: b.c,v 1.54 2024/08/03 21:12:16 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -372,36 +372,49 @@ int quoted(const uschar **pp)	/* pick up next thing after a \\ */
 
 /* BUG: should advance by utf-8 char even if makes no sense */
 
-	if ((c = *p++) == 't') {
+	switch ((c = *p++)) {
+	case 't':
 		c = '\t';
-	} else if (c == 'n') {
+		break;
+	case 'n':
 		c = '\n';
-	} else if (c == 'f') {
+		break;
+	case 'f':
 		c = '\f';
-	} else if (c == 'r') {
+		break;
+	case 'r':
 		c = '\r';
-	} else if (c == 'b') {
+		break;
+	case 'b':
 		c = '\b';
-	} else if (c == 'v') {
+		break;
+	case 'v':
 		c = '\v';
-	} else if (c == 'a') {
+		break;
+	case 'a':
 		c = '\a';
-	} else if (c == '\\') {
+		break;
+	case '\\':
 		c = '\\';
-	} else if (c == 'x') {	/* 2 hex digits follow */
-		c = hexstr(&p, 2);	/* this adds a null if number is invalid */
-	} else if (c == 'u') {	/* unicode char number up to 8 hex digits */
+		break;
+	case 'x': /* 2 hex digits follow */
+		c = hexstr(&p, 2); /* this adds a null if number is invalid */
+		break;
+	case 'u': /* unicode char number up to 8 hex digits */
 		c = hexstr(&p, 8);
-	} else if (isoctdigit(c)) {	/* \d \dd \ddd */
-		int n = c - '0';
-		if (isoctdigit(*p)) {
-			n = 8 * n + *p++ - '0';
-			if (isoctdigit(*p))
+		break;
+	default:
+		if (isoctdigit(c)) { /* \d \dd \ddd */
+			int n = c - '0';
+			if (isoctdigit(*p)) {
 				n = 8 * n + *p++ - '0';
+				if (isoctdigit(*p))
+					n = 8 * n + *p++ - '0';
+			}
+			c = n;
 		}
-		c = n;
-	} /* else */
-		/* c = c; */
+	}
+
 	*pp = p;
 	return c;
 }
diff --git a/usr.bin/awk/lib.c b/usr.bin/awk/lib.c
index 8ddd935e8..88201c529 100644
--- a/usr.bin/awk/lib.c
+++ b/usr.bin/awk/lib.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lib.c,v 1.58 2024/06/03 00:55:05 millert Exp $	*/
+/*	$OpenBSD: lib.c,v 1.59 2024/08/03 21:12:16 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -228,7 +228,7 @@ int readrec(char **pbuf, int *pbufsize, FILE *inf, bool newflag)	/* read one rec
 	char *rs = getsval(rsloc);
 
 	if (CSV) {
-		c = readcsvrec(pbuf, pbufsize, inf, newflag);
+		c = readcsvrec(&buf, &bufsize, inf, newflag);
 		isrec = (c == EOF && rr == buf) ? false : true;
 	} else if (*rs && rs[1]) {
 		bool found;
diff --git a/usr.bin/awk/main.c b/usr.bin/awk/main.c
index 5c4241d5a..584ece4d8 100644
--- a/usr.bin/awk/main.c
+++ b/usr.bin/awk/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.71 2024/06/03 00:58:04 millert Exp $	*/
+/*	$OpenBSD: main.c,v 1.72 2024/08/03 21:12:16 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -23,7 +23,7 @@ ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
 THIS SOFTWARE.
 ****************************************************************/
 
-const char	*version = "version 20240527";
+const char	*version = "version 20240728";
 
 #define DEBUG
 #include <stdio.h>
diff --git a/usr.bin/skey/skey.c b/usr.bin/skey/skey.c
index 4197b6978..642e1cac7 100644
--- a/usr.bin/skey/skey.c
+++ b/usr.bin/skey/skey.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: skey.c,v 1.35 2019/01/25 00:19:26 millert Exp $	*/
+/*	$OpenBSD: skey.c,v 1.36 2024/08/03 22:00:31 millert Exp $	*/
 /*
  * OpenBSD S/Key (skey.c)
  *
@@ -60,7 +60,8 @@ main(int argc, char *argv[])
 			case 'n':
 				if (++i == argc)
 					usage();
-				cnt = strtonum(argv[i], 1, SKEY_MAX_SEQ -1, &errstr);
+				cnt = strtonum(argv[i], 1, SKEY_MAX_SEQ + 1,
+				    &errstr);
 				if (errstr)
 					usage();
 				break;
diff --git a/usr.bin/tmux/cmd-parse.y b/usr.bin/tmux/cmd-parse.y
index 8140b5b58..6565d2d27 100644
--- a/usr.bin/tmux/cmd-parse.y
+++ b/usr.bin/tmux/cmd-parse.y
@@ -1,4 +1,4 @@
-/* $OpenBSD: cmd-parse.y,v 1.50 2023/03/15 08:15:39 nicm Exp $ */
+/* $OpenBSD: cmd-parse.y,v 1.51 2024/08/04 09:42:23 nicm Exp $ */
 
 /*
  * Copyright (c) 2019 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -1273,6 +1273,16 @@ yylex(void)
 			continue;
 		}
 
+		if (ch == '\r') {
+			/*
+			 * Treat \r\n as \n.
+			 */
+			ch = yylex_getc();
+			if (ch != '\n') {
+				yylex_ungetc(ch);
+				ch = '\r';
+			}
+		}
 		if (ch == '\n') {
 			/*
 			 * End of line. Update the line number.
@@ -1619,6 +1629,13 @@ yylex_token(int ch)
 			log_debug("%s: end at EOF", __func__);
 			break;
 		}
+		if (state == NONE && ch == '\r') {
+			ch = yylex_getc();
+			if (ch != '\n') {
+				yylex_ungetc(ch);
+				ch = '\r';
+			}
+		}
 		if (state == NONE && ch == '\n') {
 			log_debug("%s: end at EOL", __func__);
 			break;
diff --git a/usr.bin/tmux/mode-tree.c b/usr.bin/tmux/mode-tree.c
index 49fe2b7cf..8c6260242 100644
--- a/usr.bin/tmux/mode-tree.c
+++ b/usr.bin/tmux/mode-tree.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mode-tree.c,v 1.67 2024/05/24 12:39:06 nicm Exp $ */
+/* $OpenBSD: mode-tree.c,v 1.68 2024/08/04 08:53:43 nicm Exp $ */
 
 /*
  * Copyright (c) 2017 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -261,19 +261,21 @@ mode_tree_up(struct mode_tree_data *mtd, int wrap)
 	}
 }
 
-void
+int
 mode_tree_down(struct mode_tree_data *mtd, int wrap)
 {
 	if (mtd->current == mtd->line_size - 1) {
 		if (wrap) {
 			mtd->current = 0;
 			mtd->offset = 0;
-		}
+		} else
+			return (0);
 	} else {
 		mtd->current++;
 		if (mtd->current > mtd->offset + mtd->height - 1)
 			mtd->offset++;
 	}
+	return (1);
 }
 
 void *
diff --git a/usr.bin/tmux/options-table.c b/usr.bin/tmux/options-table.c
index 760fadf61..f1e856092 100644
--- a/usr.bin/tmux/options-table.c
+++ b/usr.bin/tmux/options-table.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: options-table.c,v 1.174 2024/05/14 09:32:37 nicm Exp $ */
+/* $OpenBSD: options-table.c,v 1.175 2024/08/04 09:35:30 nicm Exp $ */
 
 /*
  * Copyright (c) 2011 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -398,7 +398,7 @@ const struct options_table_entry options_table[] = {
 	  .type = OPTIONS_TABLE_STRING,
 	  .scope = OPTIONS_TABLE_SERVER,
 	  .flags = OPTIONS_TABLE_IS_ARRAY,
-	  .default_str = "",
+	  .default_str = "linux*:AX@",
 	  .separator = ",",
 	  .text = "List of terminal capabilities overrides."
 	},
diff --git a/usr.bin/tmux/tmux.1 b/usr.bin/tmux/tmux.1
index 351208a70..11ac32c62 100644
--- a/usr.bin/tmux/tmux.1
+++ b/usr.bin/tmux/tmux.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: tmux.1,v 1.946 2024/06/24 08:30:50 nicm Exp $
+.\" $OpenBSD: tmux.1,v 1.947 2024/08/04 09:01:18 nicm Exp $
 .\"
 .\" Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
 .\"
@@ -14,7 +14,7 @@
 .\" IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
 .\" OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 24 2024 $
+.Dd $Mdocdate: August 4 2024 $
 .Dt TMUX 1
 .Os
 .Sh NAME
@@ -1357,8 +1357,8 @@ specified multiple times.
 .Op Fl B Ar name:what:format
 .Op Fl C Ar size
 .Op Fl f Ar flags
-.Op Fl r Ar pane:report
 .Op Fl l Op Ar target-pane
+.Op Fl r Ar pane:report
 .Op Fl t Ar target-client
 .Op Ar adjustment
 .Xc
diff --git a/usr.bin/tmux/tmux.h b/usr.bin/tmux/tmux.h
index cc6c014b5..a1ffc50b3 100644
--- a/usr.bin/tmux/tmux.h
+++ b/usr.bin/tmux/tmux.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tmux.h,v 1.1219 2024/07/12 11:21:18 nicm Exp $ */
+/* $OpenBSD: tmux.h,v 1.1220 2024/08/04 08:53:43 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -3138,7 +3138,7 @@ int	 mode_tree_set_current(struct mode_tree_data *, uint64_t);
 void	 mode_tree_each_tagged(struct mode_tree_data *, mode_tree_each_cb,
 	     struct client *, key_code, int);
 void	 mode_tree_up(struct mode_tree_data *, int);
-void	 mode_tree_down(struct mode_tree_data *, int);
+int	 mode_tree_down(struct mode_tree_data *, int);
 struct mode_tree_data *mode_tree_start(struct window_pane *, struct args *,
 	     mode_tree_build_cb, mode_tree_draw_cb, mode_tree_search_cb,
 	     mode_tree_menu_cb, mode_tree_height_cb, mode_tree_key_cb, void *,
diff --git a/usr.bin/tmux/tty.c b/usr.bin/tmux/tty.c
index 3e1120c1f..51dd9378e 100644
--- a/usr.bin/tmux/tty.c
+++ b/usr.bin/tmux/tty.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tty.c,v 1.436 2024/05/14 10:11:09 nicm Exp $ */
+/* $OpenBSD: tty.c,v 1.438 2024/08/04 09:42:23 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -2656,7 +2656,6 @@ static void
 tty_colours(struct tty *tty, const struct grid_cell *gc)
 {
 	struct grid_cell	*tc = &tty->cell;
-	int			 have_ax;
 
 	/* No changes? Nothing is necessary. */
 	if (gc->fg == tc->fg && gc->bg == tc->bg && gc->us == tc->us)
@@ -2670,28 +2669,18 @@ tty_colours(struct tty *tty, const struct grid_cell *gc)
 	 */
 	if (COLOUR_DEFAULT(gc->fg) || COLOUR_DEFAULT(gc->bg)) {
 		/*
-		 * If don't have AX but do have op, send sgr0 (op can't
-		 * actually be used because it is sometimes the same as sgr0
-		 * and sometimes isn't). This resets both colours to default.
-		 *
+		 * If don't have AX, send sgr0. This resets both colours to default.
 		 * Otherwise, try to set the default colour only as needed.
 		 */
-		have_ax = tty_term_flag(tty->term, TTYC_AX);
-		if (!have_ax && tty_term_has(tty->term, TTYC_OP))
+		if (!tty_term_flag(tty->term, TTYC_AX))
 			tty_reset(tty);
 		else {
 			if (COLOUR_DEFAULT(gc->fg) && !COLOUR_DEFAULT(tc->fg)) {
-				if (have_ax)
-					tty_puts(tty, "\033[39m");
-				else if (tc->fg != 7)
-					tty_putcode_i(tty, TTYC_SETAF, 7);
+				tty_puts(tty, "\033[39m");
 				tc->fg = gc->fg;
 			}
 			if (COLOUR_DEFAULT(gc->bg) && !COLOUR_DEFAULT(tc->bg)) {
-				if (have_ax)
-					tty_puts(tty, "\033[49m");
-				else if (tc->bg != 0)
-					tty_putcode_i(tty, TTYC_SETAB, 0);
+				tty_puts(tty, "\033[49m");
 				tc->bg = gc->bg;
 			}
 		}
@@ -2703,7 +2692,7 @@ tty_colours(struct tty *tty, const struct grid_cell *gc)
 
 	/*
 	 * Set the background colour. This must come after the foreground as
-	 * tty_colour_fg() can call tty_reset().
+	 * tty_colours_fg() can call tty_reset().
 	 */
 	if (!COLOUR_DEFAULT(gc->bg) && gc->bg != tc->bg)
 		tty_colours_bg(tty, gc);
@@ -2851,6 +2840,15 @@ tty_colours_fg(struct tty *tty, const struct grid_cell *gc)
 	struct grid_cell	*tc = &tty->cell;
 	char			 s[32];
 
+	/*
+	 * If the current colour is an aixterm bright colour and the new is not,
+	 * reset because some terminals do not clear bright correctly.
+	 */
+	if (tty->cell.fg >= 90 &&
+	    tty->cell.bg <= 97 &&
+	    (gc->fg < 90 || gc->fg > 97))
+		tty_reset(tty);
+
 	/* Is this a 24-bit or 256-colour colour? */
 	if (gc->fg & COLOUR_FLAG_RGB || gc->fg & COLOUR_FLAG_256) {
 		if (tty_try_colour(tty, gc->fg, "38") == 0)
diff --git a/usr.bin/tmux/window-buffer.c b/usr.bin/tmux/window-buffer.c
index c677c646f..185faf9eb 100644
--- a/usr.bin/tmux/window-buffer.c
+++ b/usr.bin/tmux/window-buffer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: window-buffer.c,v 1.38 2024/03/21 11:32:49 nicm Exp $ */
+/* $OpenBSD: window-buffer.c,v 1.40 2024/08/04 08:53:43 nicm Exp $ */
 
 /*
  * Copyright (c) 2017 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -408,8 +408,17 @@ window_buffer_do_delete(void *modedata, void *itemdata,
 	struct window_buffer_itemdata	*item = itemdata;
 	struct paste_buffer		*pb;
 
-	if (item == mode_tree_get_current(data->data))
-		mode_tree_down(data->data, 0);
+	if (item == mode_tree_get_current(data->data) &&
+	    !mode_tree_down(data->data, 0)) {
+		/*
+		 *If we were unable to select the item further down we are at
+		 * the end of the list. Move one element up instead, to make
+		 * sure that we preserve a valid selection or we risk having
+		 * the tree build logic reset it to the first item.
+		 */
+		mode_tree_up(data->data, 0);
+	}
+
 	if ((pb = paste_get_name(item->name)) != NULL)
 		paste_free(pb);
 }
@@ -508,7 +517,7 @@ window_buffer_key(struct window_mode_entry *wme, struct client *c,
 	struct window_buffer_itemdata	*item;
 	int				 finished;
 
-	if (paste_get_top(NULL) == NULL) {
+	if (paste_is_empty()) {
 		finished = 1;
 		goto out;
 	}
@@ -541,7 +550,7 @@ window_buffer_key(struct window_mode_entry *wme, struct client *c,
 	}
 
 out:
-	if (finished || paste_get_top(NULL) == NULL)
+	if (finished || paste_is_empty())
 		window_pane_reset_mode(wp);
 	else {
 		mode_tree_draw(mtd);
diff --git a/usr.sbin/makefs/cd9660.c b/usr.sbin/makefs/cd9660.c
index 9fbcc5d0d..457f0709b 100644
--- a/usr.sbin/makefs/cd9660.c
+++ b/usr.sbin/makefs/cd9660.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cd9660.c,v 1.23 2022/01/11 05:34:32 jsg Exp $	*/
+/*	$OpenBSD: cd9660.c,v 1.24 2024/08/03 22:23:32 millert Exp $	*/
 /*	$NetBSD: cd9660.c,v 1.53 2016/11/25 23:02:44 christos Exp $	*/
 
 /*
@@ -218,7 +218,7 @@ cd9660_set_defaults(iso9660_disk *diskStructure)
 	memset(diskStructure->primaryDescriptor.abstract_file_id, 0x20,37);
 	memset(diskStructure->primaryDescriptor.bibliographic_file_id, 0x20,37);
 
-	strlcpy(diskStructure->primaryDescriptor.system_id,"NetBSD", sizeof(diskStructure->primaryDescriptor.system_id));
+	strlcpy(diskStructure->primaryDescriptor.system_id,"SecBSD", sizeof(diskStructure->primaryDescriptor.system_id));
 
 	cd9660_defaults_set = 1;
 
diff --git a/usr.sbin/radiusd/radiusd_bsdauth.8 b/usr.sbin/radiusd/radiusd_bsdauth.8
index 3c37a7030..d7238845f 100644
--- a/usr.sbin/radiusd/radiusd_bsdauth.8
+++ b/usr.sbin/radiusd/radiusd_bsdauth.8
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: radiusd_bsdauth.8,v 1.2 2024/07/04 05:25:14 jmc Exp $
+.\"	$OpenBSD: radiusd_bsdauth.8,v 1.3 2024/08/04 03:56:57 yasuoka Exp $
 .\"
 .\" Copyright (c) 2014 Esdenera Networks GmbH
 .\" Copyright (c) 2014, 2024 Internet Initiative Japan Inc.
@@ -17,7 +17,7 @@
 .\"
 .\" The following requests are required for all man pages.
 .\"
-.Dd $Mdocdate: July 4 2024 $
+.Dd $Mdocdate: August 4 2024 $
 .Dt RADIUSD_BSDAUTH 8
 .Os
 .Sh NAME
@@ -57,5 +57,5 @@ module executable.
 .Sh HISTORY
 The
 .Nm
-daemon first appeared in
+module first appeared in
 .Ox 5.8 .
diff --git a/usr.sbin/radiusd/radiusd_eap2mschap.8 b/usr.sbin/radiusd/radiusd_eap2mschap.8
index 554153a85..3bd9f3cdb 100644
--- a/usr.sbin/radiusd/radiusd_eap2mschap.8
+++ b/usr.sbin/radiusd/radiusd_eap2mschap.8
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: radiusd_eap2mschap.8,v 1.2 2024/07/14 18:09:05 jmc Exp $
+.\"	$OpenBSD: radiusd_eap2mschap.8,v 1.4 2024/08/04 05:18:28 jmc Exp $
 .\"
 .\" Copyright (c) 2024 Internet Initiative Japan Inc.
 .\"
@@ -16,7 +16,7 @@
 .\"
 .\" The following requests are required for all man pages.
 .\"
-.Dd $Mdocdate: July 14 2024 $
+.Dd $Mdocdate: August 4 2024 $
 .Dt RADIUSD_EAP2MSCHAP 8
 .Os
 .Sh NAME
@@ -78,9 +78,10 @@ authenticate * by file
 .Sh SEE ALSO
 .Xr authenticate 3 ,
 .Xr radiusd.conf 5 ,
-.Xr radiusd 8
+.Xr radiusd 8 ,
+.Xr radiusd_file 8
 .Sh HISTORY
 The
 .Nm
-daemon first appeared in
+module first appeared in
 .Ox 7.6 .
diff --git a/usr.sbin/radiusd/radiusd_file.8 b/usr.sbin/radiusd/radiusd_file.8
index 758933522..7e7cb7262 100644
--- a/usr.sbin/radiusd/radiusd_file.8
+++ b/usr.sbin/radiusd/radiusd_file.8
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: radiusd_file.8,v 1.2 2024/07/14 18:11:18 jmc Exp $
+.\"	$OpenBSD: radiusd_file.8,v 1.3 2024/08/04 03:56:57 yasuoka Exp $
 .\"
 .\" Copyright (c) 2024 YASUOKA Masahiko <yasuoka@yasuoka.net>
 .\"
@@ -17,7 +17,7 @@
 .\" The following requests are required for all man pages.
 .\"
 .\" Remove `\&' from the line below.
-.Dd $Mdocdate: July 14 2024 $
+.Dd $Mdocdate: August 4 2024 $
 .Dt RADIUSD_FILE 8
 .Os
 .Sh NAME
@@ -58,5 +58,5 @@ module executable.
 .Sh HISTORY
 The
 .Nm
-daemon first appeared in
+module first appeared in
 .Ox 7.6 .
diff --git a/usr.sbin/radiusd/radiusd_ipcp.8 b/usr.sbin/radiusd/radiusd_ipcp.8
index 28d9a8317..2647ad13a 100644
--- a/usr.sbin/radiusd/radiusd_ipcp.8
+++ b/usr.sbin/radiusd/radiusd_ipcp.8
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: radiusd_ipcp.8,v 1.4 2024/07/11 14:14:56 yasuoka Exp $
+.\"	$OpenBSD: radiusd_ipcp.8,v 1.5 2024/08/04 03:56:57 yasuoka Exp $
 .\"
 .\" Copyright (c) 2024 Internet Initiative Japan Inc.
 .\"
@@ -16,7 +16,7 @@
 .\"
 .\" The following requests are required for all man pages.
 .\"
-.Dd $Mdocdate: July 11 2024 $
+.Dd $Mdocdate: August 4 2024 $
 .Dt RADIUSD_IPCP 8
 .Os
 .Sh NAME
@@ -191,5 +191,5 @@ radius dae client 127.0.0.1 secret "SECRET3"
 .Sh HISTORY
 The
 .Nm
-daemon first appeared in
+module first appeared in
 .Ox 7.6 .
diff --git a/usr.sbin/radiusd/radiusd_radius.8 b/usr.sbin/radiusd/radiusd_radius.8
index 2ab83faf1..53a6105b2 100644
--- a/usr.sbin/radiusd/radiusd_radius.8
+++ b/usr.sbin/radiusd/radiusd_radius.8
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: radiusd_radius.8,v 1.1 2024/07/02 00:00:12 yasuoka Exp $
+.\"	$OpenBSD: radiusd_radius.8,v 1.2 2024/08/04 03:56:57 yasuoka Exp $
 .\"
 .\" Copyright (c) 2014 Esdenera Networks GmbH
 .\" Copyright (c) 2014, 2024 Internet Initiative Japan Inc.
@@ -17,7 +17,7 @@
 .\"
 .\" The following requests are required for all man pages.
 .\"
-.Dd $Mdocdate: July 2 2024 $
+.Dd $Mdocdate: August 4 2024 $
 .Dt RADIUSD_RADIUS 8
 .Os
 .Sh NAME
@@ -80,5 +80,5 @@ module executable.
 .Sh HISTORY
 The
 .Nm
-daemon first appeared in
+module first appeared in
 .Ox 5.8 .
diff --git a/usr.sbin/radiusd/radiusd_standard.8 b/usr.sbin/radiusd/radiusd_standard.8
index 85f440ad5..c62f63f77 100644
--- a/usr.sbin/radiusd/radiusd_standard.8
+++ b/usr.sbin/radiusd/radiusd_standard.8
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: radiusd_standard.8,v 1.3 2024/07/04 05:27:20 jmc Exp $
+.\"	$OpenBSD: radiusd_standard.8,v 1.4 2024/08/04 03:56:57 yasuoka Exp $
 .\"
 .\" Copyright (c) 2014 Esdenera Networks GmbH
 .\" Copyright (c) 2014, 2024 Internet Initiative Japan Inc.
@@ -17,7 +17,7 @@
 .\"
 .\" The following requests are required for all man pages.
 .\"
-.Dd $Mdocdate: July 4 2024 $
+.Dd $Mdocdate: August 4 2024 $
 .Dt RADIUSD_STANDARD 8
 .Os
 .Sh NAME
@@ -73,5 +73,5 @@ module executable.
 .Sh HISTORY
 The
 .Nm
-daemon first appeared in
+module first appeared in
 .Ox 5.8 .