diff --git a/distrib/sets/lists/base/mi b/distrib/sets/lists/base/mi
index 54385aa60..4dbee35a2 100644
--- a/distrib/sets/lists/base/mi
+++ b/distrib/sets/lists/base/mi
@@ -302,6 +302,10 @@
 ./etc/signify/secbsd-14-fw.pub
 ./etc/signify/secbsd-14-pkg.pub
 ./etc/signify/secbsd-14-syspatch.pub
+./etc/signify/secbsd-15-base.pub
+./etc/signify/secbsd-15-fw.pub
+./etc/signify/secbsd-15-pkg.pub
+./etc/signify/secbsd-145-syspatch.pub
 ./etc/skel
 ./etc/skel/.ssh
 ./etc/ssh
diff --git a/sys/dev/ic/qwx.c b/sys/dev/ic/qwx.c
index 4fb42aa2a..d891ed6a5 100644
--- a/sys/dev/ic/qwx.c
+++ b/sys/dev/ic/qwx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qwx.c,v 1.40 2024/02/15 16:29:45 stsp Exp $	*/
+/*	$OpenBSD: qwx.c,v 1.45 2024/02/16 22:46:07 phessler Exp $	*/
 
 /*
  * Copyright 2023 Stefan Sperling <stsp@openbsd.org>
@@ -186,10 +186,8 @@ qwx_init(struct ifnet *ifp)
 	sc->vdev_id_11d_scan = QWX_11D_INVALID_VDEV_ID;
 
 	error = qwx_core_init(sc);
-	if (error) {
-		printf(": failed to init core: %d\n", error);
+	if (error)
 		return error;
-	}
 
 	memset(&sc->qrtr_server, 0, sizeof(sc->qrtr_server));
 	sc->qrtr_server.node = QRTR_NODE_BCAST;
@@ -213,34 +211,31 @@ qwx_init(struct ifnet *ifp)
 	ieee80211_media_init(ifp, qwx_media_change, ieee80211_media_status);
 
 	if (sc->attached) {
-		/*
-		 * We are either going up for the first time or qwx_stop() ran
-		 * before us and has waited for any stale tasks to finish up.
-		 */
-		KASSERT(sc->task_refs.r_refs == 0);
+		/* Update MAC in case the upper layers changed it. */
+		IEEE80211_ADDR_COPY(ic->ic_myaddr,
+		    ((struct arpcom *)ifp)->ac_enaddr);
+	} else {
+		sc->attached = 1;
+
+		/* Configure initial MAC address. */
+		error = if_setlladdr(ifp, ic->ic_myaddr);
+		if (error)
+			printf("%s: could not set MAC address %s: %d\n",
+			    sc->sc_dev.dv_xname, ether_sprintf(ic->ic_myaddr),
+			    error);
+	}
+
+	if (ifp->if_flags & IFF_UP) {
 		refcnt_init(&sc->task_refs);
 
 		ifq_clr_oactive(&ifp->if_snd);
 		ifp->if_flags |= IFF_RUNNING;
 
-		/* Update MAC in case the upper layers changed it. */
-		IEEE80211_ADDR_COPY(ic->ic_myaddr,
-		    ((struct arpcom *)ifp)->ac_enaddr);
-
 		error = qwx_mac_start(sc);
 		if (error)
 			return error;
 
 		ieee80211_begin_scan(ifp);
-	} else {
-		sc->attached = 1;
-
-		/* Configure MAC address at boot-time. */
-		error = if_setlladdr(ifp, ic->ic_myaddr);
-		if (error)
-			printf("%s: could not set MAC address %s: %d\n",
-			    sc->sc_dev.dv_xname, ether_sprintf(ic->ic_myaddr),
-			    error);
 	}
 
 	return 0;
@@ -6818,6 +6813,9 @@ qwx_qmi_recv_wlanfw_request_mem_indication(struct qwx_softc *sc, struct mbuf *m,
 
 	DNPRINTF(QWX_D_QMI, "%s\n", __func__);
 
+	if (!sc->expect_fwmem_req || sc->sc_req_mem_ind != NULL)
+		return;
+
 	/* This structure is too large for the stack. */
 	ind = malloc(sizeof(*ind), M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (ind == NULL)
@@ -7098,7 +7096,7 @@ qwx_qrtr_recv_msg(struct qwx_softc *sc, struct mbuf *m)
 		wakeup(&sc->qrtr_server);
 		break;
 	default:
-		printf("%s: unhandled qrtr type %u\n",
+		DPRINTF("%s: unhandled qrtr type %u\n",
 		    sc->sc_dev.dv_xname, type);
 		return;
 	}
@@ -7751,11 +7749,15 @@ qwx_qmi_mem_seg_send(struct qwx_softc *sc)
 		}
 	}
 
+	sc->expect_fwmem_req = 0;
+
 	ind = sc->sc_req_mem_ind;
 	mem_seg_len = le32toh(ind->mem_seg_len);
 	if (mem_seg_len > mem_seg_len_max) {
 		printf("%s: firmware requested too many memory segments: %u\n",
 		    sc->sc_dev.dv_xname, mem_seg_len);
+		free(sc->sc_req_mem_ind, M_DEVBUF, sizeof(*sc->sc_req_mem_ind));
+		sc->sc_req_mem_ind = NULL;
 		return -1;
 	}
 
@@ -7764,6 +7766,9 @@ qwx_qmi_mem_seg_send(struct qwx_softc *sc)
 		if (ind->mem_seg[i].size == 0) {
 			printf("%s: firmware requested zero-sized "
 			    "memory segment %u\n", sc->sc_dev.dv_xname, i);
+			free(sc->sc_req_mem_ind, M_DEVBUF,
+			    sizeof(*sc->sc_req_mem_ind));
+			sc->sc_req_mem_ind = NULL;
 			return -1;
 		}
 		total_size += le32toh(ind->mem_seg[i].size);
@@ -7847,8 +7852,10 @@ qwx_qmi_mem_seg_send(struct qwx_softc *sc)
 		}
 	}
 
-	if (mem_seg_len == 0)
-		return EBUSY;
+	if (mem_seg_len == 0) {
+		sc->expect_fwmem_req = 1;
+		return EBUSY; /* retry */
+	}
 
 	if (!sc->hw_params.fixed_fw_mem) {
 		while (!sc->fwmem_ready) {
@@ -13003,7 +13010,7 @@ qwx_wmi_tlv_op_rx(struct qwx_softc *sc, struct mbuf *m)
 		DPRINTF("%s: 0x%x: wlan freq avoid event\n", __func__, id);
 		break;
 	default:
-		printf("%s: unsupported event id 0x%x\n", __func__, id);
+		DPRINTF("%s: unsupported event id 0x%x\n", __func__, id);
 		break;
 	}
 
@@ -19057,11 +19064,13 @@ qwx_qmi_event_server_arrive(struct qwx_softc *sc)
 	int ret;
 
 	sc->fw_init_done = 0;
+	sc->expect_fwmem_req = 1;
 
 	ret = qwx_qmi_fw_ind_register_send(sc);
 	if (ret < 0) {
 		printf("%s: failed to send qmi firmware indication: %d\n",
 		    sc->sc_dev.dv_xname, ret);
+		sc->expect_fwmem_req = 0;
 		return ret;
 	}
 
@@ -19069,12 +19078,14 @@ qwx_qmi_event_server_arrive(struct qwx_softc *sc)
 	if (ret < 0) {
 		printf("%s: failed to send qmi host cap: %d\n",
 		    sc->sc_dev.dv_xname, ret);
+		sc->expect_fwmem_req = 0;
 		return ret;
 	}
 
 	ret = qwx_qmi_mem_seg_send(sc);
 	if (ret == EBUSY)
 		ret = qwx_qmi_mem_seg_send(sc);
+	sc->expect_fwmem_req = 0;
 	if (ret) {
 		printf("%s: failed to send qmi memory segments: %d\n",
 		    sc->sc_dev.dv_xname, ret);
@@ -19120,10 +19131,8 @@ qwx_core_init(struct qwx_softc *sc)
 	}
 
 	error = sc->ops.power_up(sc);
-	if (error) {
-		printf("failed to power up :%d\n", error);
+	if (error)
 		qwx_qmi_deinit_service(sc);
-	}
 
 	return error;
 }
@@ -22274,8 +22283,17 @@ void
 qwx_init_task(void *arg)
 {
 	struct qwx_softc *sc = arg;
+	struct ifnet *ifp = &sc->sc_ic.ic_if;
+	int s = splnet();
+	rw_enter_write(&sc->ioctl_rwl);
 
-	printf("%s: %s not implemented\n", sc->sc_dev.dv_xname, __func__);
+	qwx_stop(ifp);
+
+	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == IFF_UP)
+		qwx_init(ifp);
+
+	rw_exit(&sc->ioctl_rwl);
+	splx(s);
 }
 
 void
diff --git a/sys/dev/ic/qwxvar.h b/sys/dev/ic/qwxvar.h
index a51a4d1e6..95d007071 100644
--- a/sys/dev/ic/qwxvar.h
+++ b/sys/dev/ic/qwxvar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qwxvar.h,v 1.19 2024/02/15 11:57:38 stsp Exp $	*/
+/*	$OpenBSD: qwxvar.h,v 1.20 2024/02/16 14:13:45 stsp Exp $	*/
 
 /*
  * Copyright (c) 2018-2019 The Linux Foundation.
@@ -1854,6 +1854,7 @@ struct qwx_softc {
 	struct qmi_response_type_v01	qmi_resp;
 
 	struct qwx_dmamem		*fwmem;
+	int				 expect_fwmem_req;
 	int				 fwmem_ready;
 	int				 fw_init_done;
 
diff --git a/sys/dev/pci/if_em.c b/sys/dev/pci/if_em.c
index b7f2006a2..6f89b3f07 100644
--- a/sys/dev/pci/if_em.c
+++ b/sys/dev/pci/if_em.c
@@ -31,7 +31,7 @@ POSSIBILITY OF SUCH DAMAGE.
 
 ***************************************************************************/
 
-/* $OpenBSD: if_em.c,v 1.373 2024/02/14 22:41:48 bluhm Exp $ */
+/* $OpenBSD: if_em.c,v 1.374 2024/02/16 22:30:54 mglocker Exp $ */
 /* $FreeBSD: if_em.c,v 1.46 2004/09/29 18:28:28 mlaier Exp $ */
 
 #include <dev/pci/if_em.h>
@@ -291,6 +291,8 @@ void em_receive_checksum(struct em_softc *, struct em_rx_desc *,
 			 struct mbuf *);
 u_int	em_transmit_checksum_setup(struct em_queue *, struct mbuf *, u_int,
 	    u_int32_t *, u_int32_t *);
+u_int	em_tso_setup(struct em_queue *, struct mbuf *, u_int, u_int32_t *,
+	    u_int32_t *);
 u_int	em_tx_ctx_setup(struct em_queue *, struct mbuf *, u_int, u_int32_t *,
 	    u_int32_t *);
 void em_iff(struct em_softc *);
@@ -1188,7 +1190,7 @@ em_flowstatus(struct em_softc *sc)
  *
  *  This routine maps the mbufs to tx descriptors.
  *
- *  return 0 on success, positive on failure
+ *  return 0 on failure, positive on success
  **********************************************************************/
 u_int
 em_encap(struct em_queue *que, struct mbuf *m)
@@ -1236,7 +1238,15 @@ em_encap(struct em_queue *que, struct mbuf *m)
 	}
 
 	if (sc->hw.mac_type >= em_82575 && sc->hw.mac_type <= em_i210) {
-		used += em_tx_ctx_setup(que, m, head, &txd_upper, &txd_lower);
+		if (ISSET(m->m_pkthdr.csum_flags, M_TCP_TSO)) {
+			used += em_tso_setup(que, m, head, &txd_upper,
+			    &txd_lower);
+			if (!used)
+				return (used);
+		} else {
+			used += em_tx_ctx_setup(que, m, head, &txd_upper,
+			    &txd_lower);
+		}
 	} else if (sc->hw.mac_type >= em_82543) {
 		used += em_transmit_checksum_setup(que, m, head,
 		    &txd_upper, &txd_lower);
@@ -1569,6 +1579,21 @@ em_update_link_status(struct em_softc *sc)
 		ifp->if_link_state = link_state;
 		if_link_state_change(ifp);
 	}
+
+	/* Disable TSO for 10/100 speeds to avoid some hardware issues */
+	switch (sc->link_speed) {
+	case SPEED_10:
+	case SPEED_100:
+		if (sc->hw.mac_type >= em_82575 && sc->hw.mac_type <= em_i210) {
+			ifp->if_capabilities &= ~IFCAP_TSOv4;
+			ifp->if_capabilities &= ~IFCAP_TSOv6;
+		}
+		break;
+	case SPEED_1000:
+		if (sc->hw.mac_type >= em_82575 && sc->hw.mac_type <= em_i210)
+			ifp->if_capabilities |= IFCAP_TSOv4 | IFCAP_TSOv6;
+		break;
+	}
 }
 
 /*********************************************************************
@@ -1988,6 +2013,7 @@ em_setup_interface(struct em_softc *sc)
 	if (sc->hw.mac_type >= em_82575 && sc->hw.mac_type <= em_i210) {
 		ifp->if_capabilities |= IFCAP_CSUM_IPv4;
 		ifp->if_capabilities |= IFCAP_CSUM_TCPv6 | IFCAP_CSUM_UDPv6;
+		ifp->if_capabilities |= IFCAP_TSOv4 | IFCAP_TSOv6;
 	}
 
 	/*
@@ -2231,9 +2257,9 @@ em_setup_transmit_structures(struct em_softc *sc)
 
 		for (i = 0; i < sc->sc_tx_slots; i++) {
 			pkt = &que->tx.sc_tx_pkts_ring[i];
-			error = bus_dmamap_create(sc->sc_dmat, MAX_JUMBO_FRAME_SIZE,
+			error = bus_dmamap_create(sc->sc_dmat, EM_TSO_SIZE,
 			    EM_MAX_SCATTER / (sc->pcix_82544 ? 2 : 1),
-			    MAX_JUMBO_FRAME_SIZE, 0, BUS_DMA_NOWAIT, &pkt->pkt_map);
+			    EM_TSO_SEG_SIZE, 0, BUS_DMA_NOWAIT, &pkt->pkt_map);
 			if (error != 0) {
 				printf("%s: Unable to create TX DMA map\n",
 				    DEVNAME(sc));
@@ -2405,6 +2431,73 @@ em_free_transmit_structures(struct em_softc *sc)
 	}
 }
 
+u_int
+em_tso_setup(struct em_queue *que, struct mbuf *mp, u_int head,
+    u_int32_t *olinfo_status, u_int32_t *cmd_type_len)
+{
+	struct ether_extracted ext;
+	struct e1000_adv_tx_context_desc *TD;
+	uint32_t vlan_macip_lens = 0, type_tucmd_mlhl = 0, mss_l4len_idx = 0;
+
+	*olinfo_status = 0;
+	*cmd_type_len = 0;
+	TD = (struct e1000_adv_tx_context_desc *)&que->tx.sc_tx_desc_ring[head];
+
+#if NVLAN > 0
+	if (ISSET(mp->m_flags, M_VLANTAG)) {
+		uint32_t vtag = mp->m_pkthdr.ether_vtag;
+		vlan_macip_lens |= vtag << E1000_ADVTXD_VLAN_SHIFT;
+		*cmd_type_len |= E1000_ADVTXD_DCMD_VLE;
+	}
+#endif
+
+	ether_extract_headers(mp, &ext);
+	if (ext.tcp == NULL)
+		goto out;
+
+	vlan_macip_lens |= (sizeof(*ext.eh) << E1000_ADVTXD_MACLEN_SHIFT);
+
+	if (ext.ip4) {
+		type_tucmd_mlhl |= E1000_ADVTXD_TUCMD_IPV4;
+		*olinfo_status |= E1000_TXD_POPTS_IXSM << 8;
+#ifdef INET6
+	} else if (ext.ip6) {
+		type_tucmd_mlhl |= E1000_ADVTXD_TUCMD_IPV6;
+#endif
+	} else {
+		goto out;
+	}
+
+	*cmd_type_len |= E1000_ADVTXD_DTYP_DATA | E1000_ADVTXD_DCMD_IFCS;
+	*cmd_type_len |= E1000_ADVTXD_DCMD_DEXT | E1000_ADVTXD_DCMD_TSE;
+	*olinfo_status |= ext.paylen << E1000_ADVTXD_PAYLEN_SHIFT;
+	vlan_macip_lens |= ext.iphlen;
+	type_tucmd_mlhl |= E1000_ADVTXD_DCMD_DEXT | E1000_ADVTXD_DTYP_CTXT;
+
+	type_tucmd_mlhl |= E1000_ADVTXD_TUCMD_L4T_TCP;
+	*olinfo_status |= E1000_TXD_POPTS_TXSM << 8;
+
+	mss_l4len_idx |= mp->m_pkthdr.ph_mss << E1000_ADVTXD_MSS_SHIFT;
+	mss_l4len_idx |= ext.tcphlen << E1000_ADVTXD_L4LEN_SHIFT;
+	/* 82575 needs the queue index added */
+	if (que->sc->hw.mac_type == em_82575)
+		mss_l4len_idx |= (que->me & 0xff) << 4;
+
+	htolem32(&TD->vlan_macip_lens, vlan_macip_lens);
+	htolem32(&TD->type_tucmd_mlhl, type_tucmd_mlhl);
+	htolem32(&TD->u.seqnum_seed, 0);
+	htolem32(&TD->mss_l4len_idx, mss_l4len_idx);
+
+	tcpstat_add(tcps_outpkttso, (ext.paylen + mp->m_pkthdr.ph_mss - 1) /
+	    mp->m_pkthdr.ph_mss);
+
+	return 1;
+
+out:
+	tcpstat_inc(tcps_outbadtso);
+	return 0;
+}
+
 u_int
 em_tx_ctx_setup(struct em_queue *que, struct mbuf *mp, u_int head,
     u_int32_t *olinfo_status, u_int32_t *cmd_type_len)
diff --git a/sys/dev/pci/if_em_hw.h b/sys/dev/pci/if_em_hw.h
index 7aac3087d..f57882cac 100644
--- a/sys/dev/pci/if_em_hw.h
+++ b/sys/dev/pci/if_em_hw.h
@@ -31,7 +31,7 @@
 
 *******************************************************************************/
 
-/* $OpenBSD: if_em_hw.h,v 1.92 2024/01/28 18:42:58 mglocker Exp $ */
+/* $OpenBSD: if_em_hw.h,v 1.93 2024/02/16 22:30:54 mglocker Exp $ */
 /* $FreeBSD: if_em_hw.h,v 1.15 2005/05/26 23:32:02 tackerman Exp $ */
 
 /* if_em_hw.h
@@ -2150,6 +2150,7 @@ struct e1000_adv_tx_context_desc {
 #define E1000_ADVTXD_DCMD_IFCS	0x02000000 /* Insert FCS (Ethernet CRC) */
 #define E1000_ADVTXD_DCMD_DEXT	0x20000000 /* Descriptor extension (1=Adv) */
 #define E1000_ADVTXD_DCMD_VLE	0x40000000 /* VLAN pkt enable */
+#define E1000_ADVTXD_DCMD_TSE	0x80000000 /* TCP Seg enable */
 #define E1000_ADVTXD_PAYLEN_SHIFT	14 /* Adv desc PAYLEN shift */
 
 /* Adv Transmit Descriptor Config Masks */
@@ -2160,6 +2161,10 @@ struct e1000_adv_tx_context_desc {
 #define E1000_ADVTXD_TUCMD_L4T_UDP	0x00000000  /* L4 Packet TYPE of UDP */
 #define E1000_ADVTXD_TUCMD_L4T_TCP	0x00000800  /* L4 Packet TYPE of TCP */
 
+/* Req requires Markers and CRC */
+#define E1000_ADVTXD_L4LEN_SHIFT	8  /* Adv ctxt L4LEN shift */
+#define E1000_ADVTXD_MSS_SHIFT		16 /* Adv ctxt MSS shift */
+
 /* Multiple Receive Queue Control */
 #define E1000_MRQC_ENABLE_MASK              0x00000003
 #define E1000_MRQC_ENABLE_RSS_2Q            0x00000001
diff --git a/sys/dev/pci/if_iwm.c b/sys/dev/pci/if_iwm.c
index f3c38ff25..d5c3f68c2 100644
--- a/sys/dev/pci/if_iwm.c
+++ b/sys/dev/pci/if_iwm.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_iwm.c,v 1.413 2023/12/20 07:32:05 stsp Exp $	*/
+/*	$OpenBSD: if_iwm.c,v 1.414 2024/02/16 11:44:52 stsp Exp $	*/
 
 /*
  * Copyright (c) 2014, 2016 genua gmbh <info@genua.de>
@@ -8534,7 +8534,7 @@ iwm_scan(struct iwm_softc *sc)
 	 * The current mode might have been fixed during association.
 	 * Ensure all channels get scanned.
 	 */
-	if (IFM_MODE(ic->ic_media.ifm_cur->ifm_media) == IFM_AUTO)
+	if (IFM_SUBTYPE(ic->ic_media.ifm_cur->ifm_media) == IFM_AUTO)
 		ieee80211_setmode(ic, IEEE80211_MODE_AUTO);
 
 	sc->sc_flags |= IWM_FLAG_SCANNING;
diff --git a/sys/dev/pci/if_qwx_pci.c b/sys/dev/pci/if_qwx_pci.c
index 5e0bc0d17..5ce1905ba 100644
--- a/sys/dev/pci/if_qwx_pci.c
+++ b/sys/dev/pci/if_qwx_pci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_qwx_pci.c,v 1.8 2024/02/09 14:57:36 bluhm Exp $	*/
+/*	$OpenBSD: if_qwx_pci.c,v 1.10 2024/02/16 16:37:42 stsp Exp $	*/
 
 /*
  * Copyright 2023 Stefan Sperling <stsp@openbsd.org>
@@ -368,6 +368,7 @@ struct qwx_pci_softc {
 
 	struct qwx_mhi_newstate	 mhi_newstate;
 	struct task		 mhi_newstate_task;
+	struct taskq		*mhi_taskq;
 
 	/*
 	 * DMA memory for AMMS.bin firmware image.
@@ -1036,6 +1037,10 @@ unsupported_wcn6855_soc:
 	if (sc->sc_nswq == NULL)
 		goto err_ce_free;
 
+	psc->mhi_taskq = taskq_create("qwxmhi", 1, IPL_NET, 0);
+	if (psc->mhi_taskq == NULL)
+		goto err_ce_free;
+
 	qwx_pci_init_qmi_ce_config(sc);
 
 	error = qwx_pcic_config_irq(sc, pa);
@@ -1568,7 +1573,7 @@ qwx_pcic_ext_irq_disable(struct qwx_softc *sc)
 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
 		return;
 
-	printf("%s not implemented\n", __func__);
+	DPRINTF("%s not implemented\n", __func__);
 }
 
 void
@@ -1582,7 +1587,7 @@ qwx_pcic_ext_irq_enable(struct qwx_softc *sc)
 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
 		return;
 
-	printf("%s not implemented\n", __func__);
+	DPRINTF("%s not implemented\n", __func__);
 }
 
 void
@@ -2198,8 +2203,12 @@ int
 qwx_pci_power_up(struct qwx_softc *sc)
 {
 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
+	struct qwx_mhi_newstate *ns = &psc->mhi_newstate;
 	int error;
 
+	task_del(psc->mhi_taskq, &psc->mhi_newstate_task);
+	memset(ns, 0, sizeof(*ns));
+
 	psc->register_window = 0;
 	clear_bit(ATH11K_FLAG_DEVICE_INIT_DONE, sc->sc_flags);
 
@@ -2225,6 +2234,12 @@ qwx_pci_power_up(struct qwx_softc *sc)
 void
 qwx_pci_power_down(struct qwx_softc *sc)
 {
+	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
+	struct qwx_mhi_newstate *ns = &psc->mhi_newstate;
+
+	task_del(psc->mhi_taskq, &psc->mhi_newstate_task);
+	memset(ns, 0, sizeof(*ns));
+
 	/* restore aspm in case firmware bootup fails */
 	qwx_pci_aspm_restore(sc);
 
@@ -3059,19 +3074,6 @@ qwx_mhi_fw_load_handler(struct qwx_pci_softc *psc)
 		return ret;
 	}
 
-	while (psc->bhi_ee < MHI_EE_SBL) {
-		ret = tsleep_nsec(&psc->bhi_ee, 0, "qwxsbl",
-		    SEC_TO_NSEC(2));
-		if (ret)
-			break;
-	}
-	if (ret != 0) {
-		printf("%s: device failed to start secondary bootloader\n",
-		    sc->sc_dev.dv_xname);
-		free(data, M_DEVBUF, len);
-		return ret;
-	}
-
 	/* Now load the full image. */
 	ret = qwx_mhi_fw_load_bhie(psc, data, len);
 	if (ret != 0) {
@@ -3322,25 +3324,24 @@ qwx_mhi_fw_load_bhi(struct qwx_pci_softc *psc, uint8_t *data, size_t len)
 
 	/* Wait for completion. */
 	ret = 0;
-	while (status != MHI_BHI_STATUS_SUCCESS) {
-		ret = tsleep_nsec(&psc->bhi_off, 0, "qwxbhi",
-		    SEC_TO_NSEC(1));
+	while (status != MHI_BHI_STATUS_SUCCESS && psc->bhi_ee < MHI_EE_SBL) {
+		ret = tsleep_nsec(&psc->bhi_ee, 0, "qwxbhi", SEC_TO_NSEC(5));
 		if (ret)
 			break;
-
 		reg = qwx_pci_read(sc, psc->bhi_off + MHI_BHI_STATUS);
 		status = (reg & MHI_BHI_STATUS_MASK) >> MHI_BHI_STATUS_SHFT;
-		DNPRINTF(QWX_D_MHI, "%s: BHI status is 0x%x\n",
-		    __func__, status);
 	}
 
-	qwx_dmamem_free(sc->sc_dmat, data_adm);
-
 	if (ret) {
 		printf("%s: BHI load timeout\n", sc->sc_dev.dv_xname);
-		return ret;
+		reg = qwx_pci_read(sc, psc->bhi_off + MHI_BHI_STATUS);
+		status = (reg & MHI_BHI_STATUS_MASK) >> MHI_BHI_STATUS_SHFT;
+		DNPRINTF(QWX_D_MHI, "%s: BHI status is 0x%x EE is 0x%x\n",
+		    __func__, status, psc->bhi_ee);
 	}
-	return 0;
+
+	qwx_dmamem_free(sc->sc_dmat, data_adm);
+	return ret;
 }
 
 int
@@ -3631,6 +3632,7 @@ qwx_mhi_state_change(void *arg)
 	struct qwx_pci_softc *psc = arg;
 	struct qwx_softc *sc = &psc->sc_sc;
 	struct qwx_mhi_newstate *ns = &psc->mhi_newstate;
+	int s = splnet();
 
 	while (ns->tail != ns->cur) {
 		int mhi_state = ns->queue[ns->tail].mhi_state;
@@ -3720,6 +3722,8 @@ qwx_mhi_state_change(void *arg)
 		ns->tail = (ns->tail + 1) % nitems(ns->queue);
 		ns->queued--;
 	}
+
+	splx(s);
 }
 
 void
@@ -3736,7 +3740,7 @@ qwx_mhi_queue_state_change(struct qwx_pci_softc *psc, int ee, int mhi_state)
 	ns->queue[ns->cur].mhi_state = mhi_state;
 	ns->queued++;
 	ns->cur = (ns->cur + 1) % nitems(ns->queue);
-	task_add(systq, &psc->mhi_newstate_task);
+	task_add(psc->mhi_taskq, &psc->mhi_newstate_task);
 }
 
 void
@@ -3745,7 +3749,8 @@ qwx_pci_intr_ctrl_event_mhi(struct qwx_pci_softc *psc, uint32_t mhi_state)
 	DNPRINTF(QWX_D_MHI, "%s: MHI state change 0x%x -> 0x%x\n", __func__,
 	    psc->mhi_state, mhi_state);
 
-	qwx_mhi_queue_state_change(psc, -1, mhi_state);
+	if (psc->mhi_state != mhi_state)
+		qwx_mhi_queue_state_change(psc, -1, mhi_state);
 }
 
 void
@@ -3754,7 +3759,8 @@ qwx_pci_intr_ctrl_event_ee(struct qwx_pci_softc *psc, uint32_t ee)
 	DNPRINTF(QWX_D_MHI, "%s: EE change 0x%x to 0x%x\n", __func__,
 	    psc->bhi_ee, ee);
 
-	qwx_mhi_queue_state_change(psc, ee, -1);
+	if (psc->bhi_ee != ee)
+		qwx_mhi_queue_state_change(psc, ee, -1);
 }
 
 void
@@ -4158,14 +4164,13 @@ qwx_pci_intr(void *arg)
 
 		if (psc->bhi_ee != ee)
 			new_ee = ee;
-		if (state < MHI_STATE_M0 && psc->mhi_state != state)
+
+		if (psc->mhi_state != state)
 			new_mhi_state = state;
 
 		if (new_ee != -1 || new_mhi_state != -1)
 			qwx_mhi_queue_state_change(psc, new_ee, new_mhi_state);
 
-		/* Wake thread loading second stage bootloader. */
-		wakeup(&psc->bhi_off);
 		ret = 1;
 	}
 
diff --git a/usr.sbin/tcpdump/print-bgp.c b/usr.sbin/tcpdump/print-bgp.c
index ab203a460..b399c2e6b 100644
--- a/usr.sbin/tcpdump/print-bgp.c
+++ b/usr.sbin/tcpdump/print-bgp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: print-bgp.c,v 1.32 2022/05/25 16:21:11 claudio Exp $	*/
+/*	$OpenBSD: print-bgp.c,v 1.33 2024/02/17 14:53:29 job Exp $	*/
 
 /*
  * Copyright (C) 1999 WIDE Project.
@@ -211,6 +211,7 @@ static const char *bgpnotify_major[] = {
 	"OPEN Message Error", "UPDATE Message Error",
 	"Hold Timer Expired", "Finite State Machine Error",
 	"Cease", "ROUTE_REFRESH Message Error",
+	"Send Hold Timer Expired",
 };
 #define bgp_notify_major(x) \
 	num_or_str(bgpnotify_major, \