diff --git a/lib/libcrypto/objects/obj_dat.c b/lib/libcrypto/objects/obj_dat.c
index 170a6d58a..1719cc73e 100644
--- a/lib/libcrypto/objects/obj_dat.c
+++ b/lib/libcrypto/objects/obj_dat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: obj_dat.c,v 1.85 2024/01/24 14:05:10 jsing Exp $ */
+/* $OpenBSD: obj_dat.c,v 1.86 2024/02/26 15:00:30 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -440,7 +440,8 @@ const void *
 OBJ_bsearch_(const void *key, const void *base, int num, int size,
     int (*cmp)(const void *, const void *))
 {
-	return OBJ_bsearch_ex_(key, base, num, size, cmp, 0);
+	OBJerror(ERR_R_DISABLED);
+	return NULL;
 }
 LCRYPTO_ALIAS(OBJ_bsearch_);
 
@@ -448,33 +449,8 @@ const void *
 OBJ_bsearch_ex_(const void *key, const void *base_, int num, int size,
     int (*cmp)(const void *, const void *), int flags)
 {
-	const char *base = base_;
-	int l, h, i = 0, c = 0;
-	const char *p = NULL;
-
-	if (num == 0)
-		return (NULL);
-	l = 0;
-	h = num;
-	while (l < h) {
-		i = (l + h) / 2;
-		p = &(base[i * size]);
-		c = (*cmp)(key, p);
-		if (c < 0)
-			h = i;
-		else if (c > 0)
-			l = i + 1;
-		else
-			break;
-	}
-	if (c != 0 && !(flags & OBJ_BSEARCH_VALUE_ON_NOMATCH))
-		p = NULL;
-	else if (c == 0 && (flags & OBJ_BSEARCH_FIRST_VALUE_ON_MATCH)) {
-		while (i > 0 && (*cmp)(key, &(base[(i - 1) * size])) == 0)
-			i--;
-		p = &(base[i * size]);
-	}
-	return (p);
+	OBJerror(ERR_R_DISABLED);
+	return NULL;
 }
 
 /* Convert an object name into an ASN1_OBJECT
diff --git a/lib/libcrypto/stack/stack.c b/lib/libcrypto/stack/stack.c
index f5c568dc5..818e73844 100644
--- a/lib/libcrypto/stack/stack.c
+++ b/lib/libcrypto/stack/stack.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: stack.c,v 1.24 2024/01/13 16:32:53 tb Exp $ */
+/* $OpenBSD: stack.c,v 1.25 2024/02/26 15:00:30 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -195,6 +195,39 @@ sk_delete(_STACK *st, int loc)
 }
 LCRYPTO_ALIAS(sk_delete);
 
+static const void *
+obj_bsearch_ex(const void *key, const void *base_, int num, int size,
+    int (*cmp)(const void *, const void *), int flags)
+{
+	const char *base = base_;
+	int l, h, i = 0, c = 0;
+	const char *p = NULL;
+
+	if (num == 0)
+		return (NULL);
+	l = 0;
+	h = num;
+	while (l < h) {
+		i = (l + h) / 2;
+		p = &(base[i * size]);
+		c = (*cmp)(key, p);
+		if (c < 0)
+			h = i;
+		else if (c > 0)
+			l = i + 1;
+		else
+			break;
+	}
+	if (c != 0 && !(flags & OBJ_BSEARCH_VALUE_ON_NOMATCH))
+		p = NULL;
+	else if (c == 0 && (flags & OBJ_BSEARCH_FIRST_VALUE_ON_MATCH)) {
+		while (i > 0 && (*cmp)(key, &(base[(i - 1) * size])) == 0)
+			i--;
+		p = &(base[i * size]);
+	}
+	return (p);
+}
+
 static int
 internal_find(_STACK *st, void *data, int ret_val_options)
 {
@@ -213,7 +246,7 @@ internal_find(_STACK *st, void *data, int ret_val_options)
 	sk_sort(st);
 	if (data == NULL)
 		return (-1);
-	r = OBJ_bsearch_ex_(&data, st->data, st->num, sizeof(void *), st->comp,
+	r = obj_bsearch_ex(&data, st->data, st->num, sizeof(void *), st->comp,
 	    ret_val_options);
 	if (r == NULL)
 		return (-1);
diff --git a/lib/libpcap/pcap-filter.5 b/lib/libpcap/pcap-filter.5
index fae308365..dc39a259a 100644
--- a/lib/libpcap/pcap-filter.5
+++ b/lib/libpcap/pcap-filter.5
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: pcap-filter.5,v 1.12 2023/04/12 09:55:22 jsg Exp $
+.\"     $OpenBSD: pcap-filter.5,v 1.13 2024/02/26 06:49:38 jmc Exp $
 .\"
 .\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
 .\"	The Regents of the University of California.  All rights reserved.
@@ -20,7 +20,7 @@
 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 .\"
-.Dd $Mdocdate: April 12 2023 $
+.Dd $Mdocdate: February 26 2024 $
 .Dt PCAP-FILTER 5
 .Os
 .Sh NAME
@@ -662,7 +662,7 @@ and frame subtype matches the specified
 If the specified
 .Ar wlan_type
 is
-.Cm mgtv ,
+.Cm mgt ,
 then valid values for
 .Ar wlan_subtype
 are
diff --git a/sys/arch/amd64/amd64/acpi_wakecode.S b/sys/arch/amd64/amd64/acpi_wakecode.S
index ddcdc74c3..da4759766 100644
--- a/sys/arch/amd64/amd64/acpi_wakecode.S
+++ b/sys/arch/amd64/amd64/acpi_wakecode.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: acpi_wakecode.S,v 1.49 2022/12/01 00:26:15 guenther Exp $ */
+/* $OpenBSD: acpi_wakecode.S,v 1.50 2024/02/25 22:33:09 guenther Exp $ */
 /*
  * Copyright (c) 2001 Takanori Watanabe <takawata@jp.freebsd.org>
  * Copyright (c) 2001 Mitsuru IWASAKI <iwasaki@jp.freebsd.org>
@@ -267,8 +267,8 @@ _ACPI_TRMP_LABEL(.Lacpi_long_mode_trampoline)
 	wrmsr
 
 	movl	$MSR_CSTAR, %ecx
-	movl	.Lacpi_saved_cstar, %eax
-	movl	.Lacpi_saved_cstar+4, %edx
+	xorl	%eax, %eax
+	xorl	%edx, %edx
 	wrmsr
 
 	movl	$MSR_SFMASK, %ecx
@@ -691,8 +691,6 @@ _ACPI_TRMP_DATA_LABEL(.Lacpi_saved_star)
 	.quad 0
 _ACPI_TRMP_DATA_LABEL(.Lacpi_saved_lstar)
 	.quad 0
-_ACPI_TRMP_DATA_LABEL(.Lacpi_saved_cstar)
-	.quad 0
 _ACPI_TRMP_DATA_LABEL(.Lacpi_saved_sfmask)
 	.quad 0
 #if NLAPIC > 0
@@ -781,11 +779,6 @@ NENTRY(acpi_savecpu)
 	movl	%eax, .Lacpi_saved_star
 	movl	%edx, .Lacpi_saved_star+4
 
-	movl	$MSR_CSTAR, %ecx
-	rdmsr
-	movl	%eax, .Lacpi_saved_cstar
-	movl	%edx, .Lacpi_saved_cstar+4
-
 	movl	$MSR_LSTAR, %ecx
 	rdmsr
 	movl	%eax, .Lacpi_saved_lstar
diff --git a/sys/arch/amd64/amd64/cpu.c b/sys/arch/amd64/amd64/cpu.c
index d82b11801..ea0d55763 100644
--- a/sys/arch/amd64/amd64/cpu.c
+++ b/sys/arch/amd64/amd64/cpu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cpu.c,v 1.182 2024/02/24 17:00:05 deraadt Exp $	*/
+/*	$OpenBSD: cpu.c,v 1.183 2024/02/25 22:33:09 guenther Exp $	*/
 /* $NetBSD: cpu.c,v 1.1 2003/04/26 18:39:26 fvdl Exp $ */
 
 /*-
@@ -1184,10 +1184,10 @@ cpu_init_msrs(struct cpu_info *ci)
 {
 	wrmsr(MSR_STAR,
 	    ((uint64_t)GSEL(GCODE_SEL, SEL_KPL) << 32) |
-	    ((uint64_t)GSEL(GUCODE32_SEL, SEL_UPL) << 48));
+	    ((uint64_t)GSEL(GUDATA_SEL-1, SEL_UPL) << 48));
 	wrmsr(MSR_LSTAR, cpu_meltdown ? (uint64_t)Xsyscall_meltdown :
 	    (uint64_t)Xsyscall);
-	wrmsr(MSR_CSTAR, (uint64_t)Xsyscall32);
+	wrmsr(MSR_CSTAR, 0);
 	wrmsr(MSR_SFMASK, PSL_NT|PSL_T|PSL_I|PSL_C|PSL_D|PSL_AC);
 
 	wrmsr(MSR_FSBASE, 0);
diff --git a/sys/arch/amd64/amd64/locore.S b/sys/arch/amd64/amd64/locore.S
index 3ccdc2e0f..89f4f40fa 100644
--- a/sys/arch/amd64/amd64/locore.S
+++ b/sys/arch/amd64/amd64/locore.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: locore.S,v 1.145 2024/02/12 01:18:17 guenther Exp $	*/
+/*	$OpenBSD: locore.S,v 1.146 2024/02/25 22:33:09 guenther Exp $	*/
 /*	$NetBSD: locore.S,v 1.13 2004/03/25 18:33:17 drochner Exp $	*/
 
 /*
@@ -507,11 +507,6 @@ ENTRY(savectx)
 	lfence
 END(savectx)
 
-// XXX this should not behave like a nop
-IDTVEC(syscall32)
-	sysret		/* go away please */
-END(Xsyscall32)
-
 /*
  * syscall insn entry.
  * Enter here with interrupts blocked; %rcx contains the caller's
diff --git a/sys/arch/amd64/amd64/machdep.c b/sys/arch/amd64/amd64/machdep.c
index 9fa994bdc..f58e6c585 100644
--- a/sys/arch/amd64/amd64/machdep.c
+++ b/sys/arch/amd64/amd64/machdep.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: machdep.c,v 1.290 2024/02/03 16:21:22 deraadt Exp $	*/
+/*	$OpenBSD: machdep.c,v 1.291 2024/02/25 22:33:09 guenther Exp $	*/
 /*	$NetBSD: machdep.c,v 1.3 2003/05/07 22:58:18 fvdl Exp $	*/
 
 /*-
@@ -1744,9 +1744,6 @@ init_x86_64(paddr_t first_avail)
 	set_mem_segment(GDT_ADDR_MEM(cpu_info_primary.ci_gdt, GDATA_SEL), 0,
 	    0xfffff, SDT_MEMRWA, SEL_KPL, 1, 0, 1);
 
-	set_mem_segment(GDT_ADDR_MEM(cpu_info_primary.ci_gdt, GUCODE32_SEL), 0,
-	    atop(VM_MAXUSER_ADDRESS32) - 1, SDT_MEMERA, SEL_UPL, 1, 1, 0);
-
 	set_mem_segment(GDT_ADDR_MEM(cpu_info_primary.ci_gdt, GUDATA_SEL), 0,
 	    atop(VM_MAXUSER_ADDRESS) - 1, SDT_MEMRWA, SEL_UPL, 1, 0, 1);
 
diff --git a/sys/arch/amd64/amd64/vmm_machdep.c b/sys/arch/amd64/amd64/vmm_machdep.c
index 7cc375917..943797dde 100644
--- a/sys/arch/amd64/amd64/vmm_machdep.c
+++ b/sys/arch/amd64/amd64/vmm_machdep.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: vmm_machdep.c,v 1.18 2024/02/12 02:57:14 jsg Exp $ */
+/* $OpenBSD: vmm_machdep.c,v 1.19 2024/02/25 22:33:09 guenther Exp $ */
 /*
  * Copyright (c) 2014 Mike Larkin <mlarkin@openbsd.org>
  *
@@ -2734,7 +2734,7 @@ vcpu_reset_regs_vmx(struct vcpu *vcpu, struct vcpu_reg_state *vrs)
 	msr_store[2].vms_index = MSR_LSTAR;
 	msr_store[2].vms_data = rdmsr(MSR_LSTAR);
 	msr_store[3].vms_index = MSR_CSTAR;
-	msr_store[3].vms_data = rdmsr(MSR_CSTAR);
+	msr_store[3].vms_data = 0;
 	msr_store[4].vms_index = MSR_SFMASK;
 	msr_store[4].vms_data = rdmsr(MSR_SFMASK);
 	msr_store[5].vms_index = MSR_KERNELGSBASE;
diff --git a/sys/arch/amd64/amd64/vmm_support.S b/sys/arch/amd64/amd64/vmm_support.S
index 7b7d9f281..aadfb4a96 100644
--- a/sys/arch/amd64/amd64/vmm_support.S
+++ b/sys/arch/amd64/amd64/vmm_support.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vmm_support.S,v 1.24 2023/11/28 00:17:48 dv Exp $	*/
+/*	$OpenBSD: vmm_support.S,v 1.25 2024/02/25 22:33:09 guenther Exp $	*/
 /*
  * Copyright (c) 2014 Mike Larkin <mlarkin@openbsd.org>
  *
@@ -225,12 +225,6 @@ skip_init:
 	pushq	%rax
 	pushq	%rdx
 
-	/* XXX - unused? */
-	movq	$MSR_CSTAR, %rcx
-	rdmsr
-	pushq	%rax
-	pushq	%rdx
-
 	movq	$MSR_SFMASK, %rcx
 	rdmsr
 	pushq	%rax
@@ -483,9 +477,9 @@ restore_host:
 	movq	$MSR_SFMASK, %rcx
 	wrmsr
 
-	/* XXX - unused? */
-	popq	%rdx
-	popq	%rax
+	/* make sure guest doesn't bleed into host */
+	xorl	%edx, %edx
+	xorl	%eax, %eax
 	movq	$MSR_CSTAR, %rcx
 	wrmsr
 
@@ -584,12 +578,6 @@ ENTRY(svm_enter_guest)
 	pushq	%rax
 	pushq	%rdx
 
-	/* XXX - unused? */
-	movq	$MSR_CSTAR, %rcx
-	rdmsr
-	pushq	%rax
-	pushq	%rdx
-
 	movq	$MSR_SFMASK, %rcx
 	rdmsr
 	pushq	%rax
@@ -696,9 +684,9 @@ restore_host_svm:
 	movq	$MSR_SFMASK, %rcx
 	wrmsr
 
-	/* XXX - unused? */
-	popq	%rdx
-	popq	%rax
+	/* make sure guest doesn't bleed into host */
+	xorl	%edx, %edx
+	xorl	%eax, %eax
 	movq	$MSR_CSTAR, %rcx
 	wrmsr
 
diff --git a/sys/arch/amd64/include/segments.h b/sys/arch/amd64/include/segments.h
index d4dfa6f20..654a6af58 100644
--- a/sys/arch/amd64/include/segments.h
+++ b/sys/arch/amd64/include/segments.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: segments.h,v 1.16 2024/01/19 18:38:16 kettenis Exp $	*/
+/*	$OpenBSD: segments.h,v 1.17 2024/02/25 22:33:09 guenther Exp $	*/
 /*	$NetBSD: segments.h,v 1.1 2003/04/26 18:39:47 fvdl Exp $	*/
 
 /*-
@@ -247,16 +247,15 @@ void cpu_init_idt(void);
  * Then comes the predefined TSS descriptor.
  * There are NGDT_SYS of them.
  *
- * The particular order of the UCODE32, UDATA, and UCODE descriptors is
- * required by the syscall/sysret instructions.
+ * The particular order of the UDATA and UCODE descriptors is
+ * required by the sysretq instruction.
  */
 #define	GNULL_SEL	0	/* Null descriptor */
 #define	GCODE_SEL	1	/* Kernel code descriptor */
 #define	GDATA_SEL	2	/* Kernel data descriptor */
-#define	GUCODE32_SEL	3	/* User 32bit code descriptor (unused) */
-#define	GUDATA_SEL	4	/* User data descriptor */
-#define	GUCODE_SEL	5	/* User code descriptor */
-#define NGDT_MEM 6
+#define	GUDATA_SEL	3	/* User data descriptor */
+#define	GUCODE_SEL	4	/* User code descriptor */
+#define NGDT_MEM 5
 
 #define	GPROC0_SEL	0	/* common TSS */
 #define NGDT_SYS	1
diff --git a/sys/dev/fdt/dwpcie.c b/sys/dev/fdt/dwpcie.c
index 19e45ca20..384dc2507 100644
--- a/sys/dev/fdt/dwpcie.c
+++ b/sys/dev/fdt/dwpcie.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dwpcie.c,v 1.51 2024/02/03 10:37:26 kettenis Exp $	*/
+/*	$OpenBSD: dwpcie.c,v 1.52 2024/02/26 21:41:24 kettenis Exp $	*/
 /*
  * Copyright (c) 2018 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -733,10 +733,6 @@ dwpcie_attach_deferred(struct device *self)
 	if (OF_getproplen(sc->sc_node, "msi-map") > 0)
 		pba.pba_flags |= PCI_FLAGS_MSIVEC_ENABLED;
 
-	/* XXX No working MSI on RK3588 yet. */
-	if (OF_is_compatible(sc->sc_node, "rockchip,rk3588-pcie"))
-		pba.pba_flags &= ~PCI_FLAGS_MSI_ENABLED;
-
 	pci_dopm = 1;
 
 	config_found(self, &pba, NULL);
diff --git a/sys/dev/fdt/if_dwqe_fdt.c b/sys/dev/fdt/if_dwqe_fdt.c
index 7e6afaba3..1bdb8e081 100644
--- a/sys/dev/fdt/if_dwqe_fdt.c
+++ b/sys/dev/fdt/if_dwqe_fdt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_dwqe_fdt.c,v 1.17 2023/10/10 07:11:50 stsp Exp $	*/
+/*	$OpenBSD: if_dwqe_fdt.c,v 1.18 2024/02/26 18:57:50 kettenis Exp $	*/
 /*
  * Copyright (c) 2008, 2019 Mark Kettenis <kettenis@openbsd.org>
  * Copyright (c) 2017, 2022 Patrick Wildt <patrick@blueri.se>
@@ -73,6 +73,7 @@ void	dwqe_setup_jh7110(struct dwqe_softc *);
 void	dwqe_mii_statchg_jh7110(struct device *);
 void	dwqe_setup_rk3568(struct dwqe_fdt_softc *);
 void	dwqe_mii_statchg_rk3568(struct device *);
+void	dwqe_setup_rk3588(struct dwqe_fdt_softc *);
 void	dwqe_mii_statchg_rk3588(struct device *);
 
 const struct cfattach dwqe_fdt_ca = {
@@ -114,10 +115,12 @@ dwqe_fdt_attach(struct device *parent, struct device *self, void *aux)
 	/* Decide GMAC id through address */
 	switch (faa->fa_reg[0].addr) {
 	case 0xfe2a0000:	/* RK3568 */
+	case 0xfe1b0000:	/* RK3588 */
 	case 0x16030000:	/* JH7110 */
 		fsc->sc_gmac_id = 0;
 		break;
 	case 0xfe010000:	/* RK3568 */
+	case 0xfe1c0000:	/* RK3588 */
 	case 0x16040000:	/* JH7110 */
 		fsc->sc_gmac_id = 1;
 		break;
@@ -137,6 +140,8 @@ dwqe_fdt_attach(struct device *parent, struct device *self, void *aux)
 		sc->sc_phy_mode = DWQE_PHY_MODE_RGMII_TXID;
 	else if (strcmp(phy_mode, "rgmii-id") == 0)
 		sc->sc_phy_mode = DWQE_PHY_MODE_RGMII_ID;
+	else if (strcmp(phy_mode, "rmii") == 0)
+		sc->sc_phy_mode = DWQE_PHY_MODE_RMII;
 	else
 		sc->sc_phy_mode = DWQE_PHY_MODE_UNKNOWN;
 
@@ -162,11 +167,17 @@ dwqe_fdt_attach(struct device *parent, struct device *self, void *aux)
 	if (OF_is_compatible(faa->fa_node, "starfive,jh7110-dwmac")) {
 		clock_enable(faa->fa_node, "tx");
 		clock_enable(faa->fa_node, "gtx");
-	} else if (OF_is_compatible(faa->fa_node, "rockchip,rk3568-gmac")) {
-		clock_enable(faa->fa_node, "mac_clk_rx");
-		clock_enable(faa->fa_node, "mac_clk_tx");
+	} else if (OF_is_compatible(faa->fa_node, "rockchip,rk3568-gmac") ||
+	    OF_is_compatible(faa->fa_node, "rockchip,rk3588-gmac")) {
 		clock_enable(faa->fa_node, "aclk_mac");
 		clock_enable(faa->fa_node, "pclk_mac");
+		clock_enable(faa->fa_node, "mac_clk_tx");
+		clock_enable(faa->fa_node, "clk_mac_speed");
+		if (strcmp(phy_mode, "rmii") == 0) {
+			clock_enable(faa->fa_node, "mac_clk_rx");
+			clock_enable(faa->fa_node, "clk_mac_ref");
+			clock_enable(faa->fa_node, "clk_mac_refout");
+		}
 	}
 	delay(5000);
 
@@ -175,6 +186,8 @@ dwqe_fdt_attach(struct device *parent, struct device *self, void *aux)
 		dwqe_setup_jh7110(sc);
 	else if (OF_is_compatible(faa->fa_node, "rockchip,rk3568-gmac"))
 		dwqe_setup_rk3568(fsc);
+	else if (OF_is_compatible(faa->fa_node, "rockchip,rk3588-gmac"))
+		dwqe_setup_rk3588(fsc);
 
 	/* Power up PHY. */
 	phy_supply = OF_getpropint(faa->fa_node, "phy-supply", 0);
@@ -329,6 +342,26 @@ dwqe_reset_phy(struct dwqe_softc *sc, uint32_t phy)
 #define  RK3568_GMAC_TXCLK_DLY_SET(_v)		((1 << 0) << 16 | ((_v) << 0))
 #define  RK3568_GMAC_RXCLK_DLY_SET(_v)		((1 << 1) << 16 | ((_v) << 1))
 
+/* RK3588 registers */
+#define RK3588_GRF_GMAC_CON7		0x031c
+#define  RK3588_GMACx_RXCLK_DLY_ENA(id)		((1 << (2 * (id) + 3)) << 16 | (1 << (2 * (id) + 3)))
+#define  RK3588_GMACx_TXCLK_DLY_ENA(id)		((1 << (2 * (id) + 2)) << 16 | (1 << (2 * (id) + 2)))
+#define RK3588_GRF_GMAC_CON8		0x0320
+#define RK3588_GRF_GMAC_CON9		0x0324
+#define  RK3588_GMAC_CLK_RX_DL_CFG(val)		((0x7f << 8) << 16 | ((val) << 8))
+#define  RK3588_GMAC_CLK_TX_DL_CFG(val)		((0x7f << 0) << 16 | ((val) << 0))
+#define RK3588_PHP_GRF_GMAC_CON0	0x0008
+#define  RK3588_GMACx_PHY_INTF_SEL_RGMII(id)	((0x7 << (6 * (id) + 3)) << 16 | (0x1 << (6 * (id) + 3)))
+#define  RK3588_GMACx_PHY_INTF_SEL_RMII(id)	((0x7 << (6 * (id) + 3)) << 16 | (0x4 << (6 * (id) + 3)))
+#define RK3588_PHP_GRF_CLK_CON1		0x0070
+#define  RK3588_RMII_MODE_GMACx_RMII(id)	((0x1 << (5 * (id))) << 16 | (0x1 << (5 * (id))))
+#define  RK3588_RMII_MODE_GMACx_RGMII(id)	((0x1 << (5 * (id))) << 16 | (0x0 << (5 * (id))))
+#define  RK3588_MII_TX_CLK_SEL_RMII_2_5(id)	((0x3 << (5 * (id) + 2)) << 16 | (0x1 << (5 * (id) + 2)))
+#define  RK3588_MII_TX_CLK_SEL_RMII_25(id)	((0x3 << (5 * (id) + 2)) << 16 | (0x0 << (5 * (id) + 2)))
+#define  RK3588_MII_TX_CLK_SEL_RGMII_2_5(id)	((0x3 << (5 * (id) + 2)) << 16 | (0x2 << (5 * (id) + 2)))
+#define  RK3588_MII_TX_CLK_SEL_RGMII_25(id)	((0x3 << (5 * (id) + 2)) << 16 | (0x3 << (5 * (id) + 2)))
+#define  RK3588_MII_TX_CLK_SEL_RGMII_125(id)	((0x3 << (5 * (id) + 2)) << 16 | (0x0 << (5 * (id) + 2)))
+
 void	dwqe_mii_statchg_jh7110_task(void *);
 void	dwqe_mii_statchg_rk3568_task(void *);
 
@@ -410,7 +443,6 @@ void
 dwqe_setup_rk3568(struct dwqe_fdt_softc *fsc)
 {
 	struct dwqe_softc *sc = &fsc->sc_sc;
-	char phy_mode[32];
 	struct regmap *rm;
 	uint32_t grf;
 	int tx_delay, rx_delay;
@@ -421,30 +453,35 @@ dwqe_setup_rk3568(struct dwqe_fdt_softc *fsc)
 	if (rm == NULL)
 		return;
 
-	if (OF_getprop(sc->sc_node, "phy-mode",
-	    phy_mode, sizeof(phy_mode)) <= 0)
+	switch (sc->sc_phy_mode) {
+	case DWQE_PHY_MODE_RGMII:
+	case DWQE_PHY_MODE_RGMII_ID:
+	case DWQE_PHY_MODE_RGMII_RXID:
+	case DWQE_PHY_MODE_RGMII_TXID:
+		iface = RK3568_GMAC_PHY_INTF_SEL_RGMII;
+		break;
+	case DWQE_PHY_MODE_RMII:
+		iface = RK3568_GMAC_PHY_INTF_SEL_RMII;
+		break;
+	default:
 		return;
+	}
 
 	tx_delay = OF_getpropint(sc->sc_node, "tx_delay", 0x30);
 	rx_delay = OF_getpropint(sc->sc_node, "rx_delay", 0x10);
-
-	if (strcmp(phy_mode, "rgmii") == 0) {
-		iface = RK3568_GMAC_PHY_INTF_SEL_RGMII;
-	} else if (strcmp(phy_mode, "rgmii-id") == 0) {
-		iface = RK3568_GMAC_PHY_INTF_SEL_RGMII;
-		/* id is "internal delay" */
+	switch (sc->sc_phy_mode) {
+	case DWQE_PHY_MODE_RGMII_ID:
 		tx_delay = rx_delay = 0;
-	} else if (strcmp(phy_mode, "rgmii-rxid") == 0) {
-		iface = RK3568_GMAC_PHY_INTF_SEL_RGMII;
+		break;
+	case DWQE_PHY_MODE_RGMII_RXID:
 		rx_delay = 0;
-	} else if (strcmp(phy_mode, "rgmii-txid") == 0) {
-		iface = RK3568_GMAC_PHY_INTF_SEL_RGMII;
+		break;
+	case DWQE_PHY_MODE_RGMII_TXID:
 		tx_delay = 0;
-	} else if (strcmp(phy_mode, "rmii") == 0) {
-		iface = RK3568_GMAC_PHY_INTF_SEL_RMII;
-		tx_delay = rx_delay = 0;
-	} else
-		return;
+		break;
+	default:
+		break;
+	}
 
 	/* Program clock delay lines. */
 	regmap_write_4(rm, RK3568_GRF_GMACx_CON0(fsc->sc_gmac_id),
@@ -490,21 +527,99 @@ dwqe_mii_statchg_rk3568(struct device *self)
 }
 
 void
-dwqe_mii_statchg_rk3588(struct device *self)
+dwqe_setup_rk3588(struct dwqe_fdt_softc *fsc)
 {
-	struct dwqe_softc *sc = (void *)self;
-	struct ifnet *ifp = &sc->sc_ac.ac_if;
+	struct dwqe_softc *sc = &fsc->sc_sc;
 	struct regmap *rm;
-	uint32_t grf;
-	uint32_t gmac_clk_sel = 0;
-
-	dwqe_mii_statchg(self);
+	struct regmap *php_rm;
+	uint32_t grf, php_grf;
+	int tx_delay, rx_delay;
+	uint32_t iface, clk;
 
 	grf = OF_getpropint(sc->sc_node, "rockchip,grf", 0);
 	rm = regmap_byphandle(grf);
 	if (rm == NULL)
 		return;
 
+	php_grf = OF_getpropint(sc->sc_node, "rockchip,php-grf", 0);
+	php_rm = regmap_byphandle(php_grf);
+	if (php_rm == NULL)
+		return;
+
+	switch (sc->sc_phy_mode) {
+	case DWQE_PHY_MODE_RGMII:
+	case DWQE_PHY_MODE_RGMII_ID:
+	case DWQE_PHY_MODE_RGMII_RXID:
+	case DWQE_PHY_MODE_RGMII_TXID:
+		iface = RK3588_GMACx_PHY_INTF_SEL_RGMII(fsc->sc_gmac_id);
+		clk = RK3588_RMII_MODE_GMACx_RGMII(fsc->sc_gmac_id);
+		sc->sc_clk_sel_2_5 =
+		    RK3588_MII_TX_CLK_SEL_RGMII_2_5(fsc->sc_gmac_id);
+		sc->sc_clk_sel_25 =
+		    RK3588_MII_TX_CLK_SEL_RGMII_25(fsc->sc_gmac_id);
+		sc->sc_clk_sel_125 =
+		    RK3588_MII_TX_CLK_SEL_RGMII_125(fsc->sc_gmac_id);
+		break;
+	case DWQE_PHY_MODE_RMII:
+		iface = RK3588_GMACx_PHY_INTF_SEL_RMII(fsc->sc_gmac_id);
+		clk = RK3588_RMII_MODE_GMACx_RMII(fsc->sc_gmac_id);
+		sc->sc_clk_sel_2_5 =
+		    RK3588_MII_TX_CLK_SEL_RMII_2_5(fsc->sc_gmac_id);
+		sc->sc_clk_sel_25 =
+		    RK3588_MII_TX_CLK_SEL_RMII_25(fsc->sc_gmac_id);
+		break;
+	default:
+		return;
+	}
+
+	tx_delay = OF_getpropint(sc->sc_node, "tx_delay", 0x30);
+	rx_delay = OF_getpropint(sc->sc_node, "rx_delay", 0x10);
+	switch (sc->sc_phy_mode) {
+	case DWQE_PHY_MODE_RGMII_ID:
+		tx_delay = rx_delay = 0;
+		break;
+	case DWQE_PHY_MODE_RGMII_RXID:
+		rx_delay = 0;
+		break;
+	case DWQE_PHY_MODE_RGMII_TXID:
+		tx_delay = 0;
+		break;
+	default:
+		break;
+	}
+
+	/* Set interface and clock. */
+	regmap_write_4(php_rm, RK3588_PHP_GRF_GMAC_CON0, iface);
+	regmap_write_4(php_rm, RK3588_PHP_GRF_CLK_CON1, clk);
+
+	/* Enable clock delay. */
+	regmap_write_4(rm, RK3588_GRF_GMAC_CON7,
+	    RK3588_GMACx_TXCLK_DLY_ENA(fsc->sc_gmac_id) |
+	    RK3588_GMACx_RXCLK_DLY_ENA(fsc->sc_gmac_id));
+
+	/* Program clock delay lines. */
+	regmap_write_4(rm, fsc->sc_gmac_id == 1 ?
+	    RK3588_GRF_GMAC_CON9 : RK3588_GRF_GMAC_CON8,
+	    RK3588_GMAC_CLK_TX_DL_CFG(tx_delay) |
+	    RK3588_GMAC_CLK_RX_DL_CFG(rx_delay));
+}
+
+void
+dwqe_mii_statchg_rk3588(struct device *self)
+{
+	struct dwqe_softc *sc = (void *)self;
+	struct ifnet *ifp = &sc->sc_ac.ac_if;
+	struct regmap *php_rm;
+	uint32_t php_grf;
+	uint32_t gmac_clk_sel = 0;
+
+	dwqe_mii_statchg(self);
+
+	php_grf = OF_getpropint(sc->sc_node, "rockchip,php-grf", 0);
+	php_rm = regmap_byphandle(php_grf);
+	if (php_rm == NULL)
+		return;
+
 	switch (ifp->if_baudrate) {
 	case IF_Mbps(10):
 		gmac_clk_sel = sc->sc_clk_sel_2_5;
@@ -517,5 +632,5 @@ dwqe_mii_statchg_rk3588(struct device *self)
 		break;
 	}
 
-	regmap_write_4(rm, sc->sc_clk_sel, gmac_clk_sel);
+	regmap_write_4(php_rm, RK3588_PHP_GRF_CLK_CON1, gmac_clk_sel);
 }
diff --git a/sys/dev/fdt/rkclock.c b/sys/dev/fdt/rkclock.c
index 110c555db..3c141cfff 100644
--- a/sys/dev/fdt/rkclock.c
+++ b/sys/dev/fdt/rkclock.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rkclock.c,v 1.84 2023/11/26 13:47:45 kettenis Exp $	*/
+/*	$OpenBSD: rkclock.c,v 1.85 2024/02/26 18:54:25 kettenis Exp $	*/
 /*
  * Copyright (c) 2017, 2018 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -4107,6 +4107,11 @@ const struct rkclock rk3588_clocks[] = {
 		{ RK3588_CLK_GPU_SRC },
 		SET_PARENT
 	},
+	{
+		RK3588_CLK_GMAC_125M, RK3588_CRU_CLKSEL_CON(83),
+		SEL(15, 15), DIV(14, 8),
+		{ RK3588_PLL_GPLL, RK3588_PLL_CPLL }
+	},
 	{
 		RK3588_CCLK_SRC_SDIO, RK3588_CRU_CLKSEL_CON(172),
 		SEL(9, 8), DIV(7, 2),
@@ -4444,6 +4449,14 @@ rk3588_reset(void *cookie, uint32_t *cells, int on)
 	uint32_t bit, mask, reg;
 
 	switch (idx) {
+	case RK3588_SRST_A_GMAC0:
+		reg = RK3588_CRU_SOFTRST_CON(32);
+		bit = 10;
+		break;
+	case RK3588_SRST_A_GMAC1:
+		reg = RK3588_CRU_SOFTRST_CON(32);
+		bit = 11;
+		break;
 	case RK3588_SRST_PCIE0_POWER_UP:
 		reg = RK3588_CRU_SOFTRST_CON(32);
 		bit = 13;
diff --git a/sys/dev/fdt/rkclock_clocks.h b/sys/dev/fdt/rkclock_clocks.h
index 67f61e703..0c9bf1b23 100644
--- a/sys/dev/fdt/rkclock_clocks.h
+++ b/sys/dev/fdt/rkclock_clocks.h
@@ -458,6 +458,7 @@
 #define RK3588_ACLK_LOW_TOP_ROOT	258
 #define RK3588_CLK_GPU_SRC		261
 #define RK3588_CLK_GPU			262
+#define RK3588_CLK_GMAC_125M		310
 #define RK3588_CCLK_SRC_SDIO		395
 #define RK3588_ACLK_VOP_ROOT		600
 #define RK3588_ACLK_VOP			605
@@ -488,6 +489,8 @@
 #define RK3588_PLL_SPLL			1022
 #define RK3588_XIN24M			1023
 
+#define RK3588_SRST_A_GMAC0		291
+#define RK3588_SRST_A_GMAC1		292
 #define RK3588_SRST_PCIE0_POWER_UP	294
 #define RK3588_SRST_PCIE1_POWER_UP	295
 #define RK3588_SRST_PCIE2_POWER_UP	296
diff --git a/sys/dev/ic/dwqevar.h b/sys/dev/ic/dwqevar.h
index c4a8f138a..d7d32b1c0 100644
--- a/sys/dev/ic/dwqevar.h
+++ b/sys/dev/ic/dwqevar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dwqevar.h,v 1.10 2023/11/11 16:50:25 stsp Exp $	*/
+/*	$OpenBSD: dwqevar.h,v 1.11 2024/02/26 18:57:50 kettenis Exp $	*/
 /*
  * Copyright (c) 2008, 2019 Mark Kettenis <kettenis@openbsd.org>
  * Copyright (c) 2017, 2022 Patrick Wildt <patrick@blueri.se>
@@ -18,6 +18,7 @@
 
 enum dwqe_phy_mode {
 	DWQE_PHY_MODE_UNKNOWN,
+	DWQE_PHY_MODE_RMII,
 	DWQE_PHY_MODE_RGMII,
 	DWQE_PHY_MODE_RGMII_ID,
 	DWQE_PHY_MODE_RGMII_TXID,
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c
index 61a6748a6..7901aeb4d 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c
@@ -4249,7 +4249,6 @@ int amdgpu_device_suspend(struct drm_device *dev, bool fbcon)
 		drm_fb_helper_set_suspend_unlocked(adev_to_drm(adev)->fb_helper, true);
 
 	cancel_delayed_work_sync(&adev->delayed_init_work);
-	flush_delayed_work(&adev->gfx.gfx_off_delay_work);
 
 	amdgpu_ras_suspend(adev);
 
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_gfx.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_gfx.c
index a31ed41e6..435571881 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_gfx.c
@@ -704,8 +704,15 @@ void amdgpu_gfx_off_ctrl(struct amdgpu_device *adev, bool enable)
 
 		if (adev->gfx.gfx_off_req_count == 0 &&
 		    !adev->gfx.gfx_off_state) {
-			schedule_delayed_work(&adev->gfx.gfx_off_delay_work,
+			/* If going to s2idle, no need to wait */
+			if (adev->in_s0ix) {
+				if (!amdgpu_dpm_set_powergating_by_smu(adev,
+						AMD_IP_BLOCK_TYPE_GFX, true))
+					adev->gfx.gfx_off_state = true;
+			} else {
+				schedule_delayed_work(&adev->gfx.gfx_off_delay_work,
 					      delay);
+			}
 		}
 	} else {
 		if (adev->gfx.gfx_off_req_count == 0) {
diff --git a/sys/dev/pci/drm/amd/amdgpu/cik_ih.c b/sys/dev/pci/drm/amd/amdgpu/cik_ih.c
index 6f7c031dd..f24e34dc3 100644
--- a/sys/dev/pci/drm/amd/amdgpu/cik_ih.c
+++ b/sys/dev/pci/drm/amd/amdgpu/cik_ih.c
@@ -204,6 +204,12 @@ static u32 cik_ih_get_wptr(struct amdgpu_device *adev,
 		tmp = RREG32(mmIH_RB_CNTL);
 		tmp |= IH_RB_CNTL__WPTR_OVERFLOW_CLEAR_MASK;
 		WREG32(mmIH_RB_CNTL, tmp);
+
+		/* Unset the CLEAR_OVERFLOW bit immediately so new overflows
+		 * can be detected.
+		 */
+		tmp &= ~IH_RB_CNTL__WPTR_OVERFLOW_CLEAR_MASK;
+		WREG32(mmIH_RB_CNTL, tmp);
 	}
 	return (wptr & ih->ptr_mask);
 }
diff --git a/sys/dev/pci/drm/amd/amdgpu/cz_ih.c b/sys/dev/pci/drm/amd/amdgpu/cz_ih.c
index b8c47e0cf..c19681492 100644
--- a/sys/dev/pci/drm/amd/amdgpu/cz_ih.c
+++ b/sys/dev/pci/drm/amd/amdgpu/cz_ih.c
@@ -216,6 +216,11 @@ static u32 cz_ih_get_wptr(struct amdgpu_device *adev,
 	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
 	WREG32(mmIH_RB_CNTL, tmp);
 
+	/* Unset the CLEAR_OVERFLOW bit immediately so new overflows
+	 * can be detected.
+	 */
+	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
+	WREG32(mmIH_RB_CNTL, tmp);
 
 out:
 	return (wptr & ih->ptr_mask);
diff --git a/sys/dev/pci/drm/amd/amdgpu/gfx_v10_0.c b/sys/dev/pci/drm/amd/amdgpu/gfx_v10_0.c
index 8e9e70319..a0bf45202 100644
--- a/sys/dev/pci/drm/amd/amdgpu/gfx_v10_0.c
+++ b/sys/dev/pci/drm/amd/amdgpu/gfx_v10_0.c
@@ -4020,8 +4020,6 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device *adev)
 		err = 0;
 		adev->gfx.mec2_fw = NULL;
 	}
-	amdgpu_gfx_cp_init_microcode(adev, AMDGPU_UCODE_ID_CP_MEC2);
-	amdgpu_gfx_cp_init_microcode(adev, AMDGPU_UCODE_ID_CP_MEC2_JT);
 
 	gfx_v10_0_check_fw_write_wait(adev);
 out:
diff --git a/sys/dev/pci/drm/amd/amdgpu/iceland_ih.c b/sys/dev/pci/drm/amd/amdgpu/iceland_ih.c
index aecad530b..2c02ae698 100644
--- a/sys/dev/pci/drm/amd/amdgpu/iceland_ih.c
+++ b/sys/dev/pci/drm/amd/amdgpu/iceland_ih.c
@@ -215,6 +215,11 @@ static u32 iceland_ih_get_wptr(struct amdgpu_device *adev,
 	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
 	WREG32(mmIH_RB_CNTL, tmp);
 
+	/* Unset the CLEAR_OVERFLOW bit immediately so new overflows
+	 * can be detected.
+	 */
+	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
+	WREG32(mmIH_RB_CNTL, tmp);
 
 out:
 	return (wptr & ih->ptr_mask);
diff --git a/sys/dev/pci/drm/amd/amdgpu/ih_v6_0.c b/sys/dev/pci/drm/amd/amdgpu/ih_v6_0.c
index ec0c8f8b4..f432dc72d 100644
--- a/sys/dev/pci/drm/amd/amdgpu/ih_v6_0.c
+++ b/sys/dev/pci/drm/amd/amdgpu/ih_v6_0.c
@@ -418,6 +418,12 @@ static u32 ih_v6_0_get_wptr(struct amdgpu_device *adev,
 	tmp = RREG32_NO_KIQ(ih_regs->ih_rb_cntl);
 	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
 	WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
+
+	/* Unset the CLEAR_OVERFLOW bit immediately so new overflows
+	 * can be detected.
+	 */
+	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
+	WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
 out:
 	return (wptr & ih->ptr_mask);
 }
diff --git a/sys/dev/pci/drm/amd/amdgpu/ih_v6_1.c b/sys/dev/pci/drm/amd/amdgpu/ih_v6_1.c
index 8fb05eae3..b8da0fc29 100644
--- a/sys/dev/pci/drm/amd/amdgpu/ih_v6_1.c
+++ b/sys/dev/pci/drm/amd/amdgpu/ih_v6_1.c
@@ -418,6 +418,13 @@ static u32 ih_v6_1_get_wptr(struct amdgpu_device *adev,
 	tmp = RREG32_NO_KIQ(ih_regs->ih_rb_cntl);
 	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
 	WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
+
+	/* Unset the CLEAR_OVERFLOW bit immediately so new overflows
+	 * can be detected.
+	 */
+	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
+	WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
+
 out:
 	return (wptr & ih->ptr_mask);
 }
diff --git a/sys/dev/pci/drm/amd/amdgpu/navi10_ih.c b/sys/dev/pci/drm/amd/amdgpu/navi10_ih.c
index b6a8478da..737eff53f 100644
--- a/sys/dev/pci/drm/amd/amdgpu/navi10_ih.c
+++ b/sys/dev/pci/drm/amd/amdgpu/navi10_ih.c
@@ -442,6 +442,12 @@ static u32 navi10_ih_get_wptr(struct amdgpu_device *adev,
 	tmp = RREG32_NO_KIQ(ih_regs->ih_rb_cntl);
 	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
 	WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
+
+	/* Unset the CLEAR_OVERFLOW bit immediately so new overflows
+	 * can be detected.
+	 */
+	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
+	WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
 out:
 	return (wptr & ih->ptr_mask);
 }
diff --git a/sys/dev/pci/drm/amd/amdgpu/si_ih.c b/sys/dev/pci/drm/amd/amdgpu/si_ih.c
index 9a24f17a5..cada9f300 100644
--- a/sys/dev/pci/drm/amd/amdgpu/si_ih.c
+++ b/sys/dev/pci/drm/amd/amdgpu/si_ih.c
@@ -119,6 +119,12 @@ static u32 si_ih_get_wptr(struct amdgpu_device *adev,
 		tmp = RREG32(IH_RB_CNTL);
 		tmp |= IH_RB_CNTL__WPTR_OVERFLOW_CLEAR_MASK;
 		WREG32(IH_RB_CNTL, tmp);
+
+		/* Unset the CLEAR_OVERFLOW bit immediately so new overflows
+		 * can be detected.
+		 */
+		tmp &= ~IH_RB_CNTL__WPTR_OVERFLOW_CLEAR_MASK;
+		WREG32(IH_RB_CNTL, tmp);
 	}
 	return (wptr & ih->ptr_mask);
 }
diff --git a/sys/dev/pci/drm/amd/amdgpu/soc21.c b/sys/dev/pci/drm/amd/amdgpu/soc21.c
index 8b2ff2b28..5a77ab587 100644
--- a/sys/dev/pci/drm/amd/amdgpu/soc21.c
+++ b/sys/dev/pci/drm/amd/amdgpu/soc21.c
@@ -50,13 +50,13 @@ static const struct amd_ip_funcs soc21_common_ip_funcs;
 /* SOC21 */
 static const struct amdgpu_video_codec_info vcn_4_0_0_video_codecs_encode_array_vcn0[] = {
 	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)},
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 0)},
 	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_AV1, 8192, 4352, 0)},
 };
 
 static const struct amdgpu_video_codec_info vcn_4_0_0_video_codecs_encode_array_vcn1[] = {
 	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)},
-	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)},
+	{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 0)},
 };
 
 static const struct amdgpu_video_codecs vcn_4_0_0_video_codecs_encode_vcn0 = {
diff --git a/sys/dev/pci/drm/amd/amdgpu/tonga_ih.c b/sys/dev/pci/drm/amd/amdgpu/tonga_ih.c
index 917707bba..450b6e831 100644
--- a/sys/dev/pci/drm/amd/amdgpu/tonga_ih.c
+++ b/sys/dev/pci/drm/amd/amdgpu/tonga_ih.c
@@ -219,6 +219,12 @@ static u32 tonga_ih_get_wptr(struct amdgpu_device *adev,
 	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
 	WREG32(mmIH_RB_CNTL, tmp);
 
+	/* Unset the CLEAR_OVERFLOW bit immediately so new overflows
+	 * can be detected.
+	 */
+	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
+	WREG32(mmIH_RB_CNTL, tmp);
+
 out:
 	return (wptr & ih->ptr_mask);
 }
diff --git a/sys/dev/pci/drm/amd/amdgpu/vega10_ih.c b/sys/dev/pci/drm/amd/amdgpu/vega10_ih.c
index d364c6dd1..bf68e18e3 100644
--- a/sys/dev/pci/drm/amd/amdgpu/vega10_ih.c
+++ b/sys/dev/pci/drm/amd/amdgpu/vega10_ih.c
@@ -373,6 +373,12 @@ static u32 vega10_ih_get_wptr(struct amdgpu_device *adev,
 	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
 	WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
 
+	/* Unset the CLEAR_OVERFLOW bit immediately so new overflows
+	 * can be detected.
+	 */
+	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
+	WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
+
 out:
 	return (wptr & ih->ptr_mask);
 }
diff --git a/sys/dev/pci/drm/amd/amdgpu/vega20_ih.c b/sys/dev/pci/drm/amd/amdgpu/vega20_ih.c
index dbc995364..131e7b769 100644
--- a/sys/dev/pci/drm/amd/amdgpu/vega20_ih.c
+++ b/sys/dev/pci/drm/amd/amdgpu/vega20_ih.c
@@ -421,6 +421,12 @@ static u32 vega20_ih_get_wptr(struct amdgpu_device *adev,
 	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
 	WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
 
+	/* Unset the CLEAR_OVERFLOW bit immediately so new overflows
+	 * can be detected.
+	 */
+	tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
+	WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
+
 out:
 	return (wptr & ih->ptr_mask);
 }
diff --git a/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index c4e5c6ab0..9c2833b09 100644
--- a/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -6076,7 +6076,9 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
 		if (recalculate_timing) {
 			freesync_mode = get_highest_refresh_rate_mode(aconnector, false);
 			drm_mode_copy(&saved_mode, &mode);
+			saved_mode.picture_aspect_ratio = mode.picture_aspect_ratio;
 			drm_mode_copy(&mode, freesync_mode);
+			mode.picture_aspect_ratio = saved_mode.picture_aspect_ratio;
 		} else {
 			decide_crtc_timing_for_drm_display_mode(
 					&mode, preferred_mode, scale);
@@ -10364,11 +10366,13 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
 			goto fail;
 		}
 
-		ret = compute_mst_dsc_configs_for_state(state, dm_state->context, vars);
-		if (ret) {
-			DRM_DEBUG_DRIVER("compute_mst_dsc_configs_for_state() failed\n");
-			ret = -EINVAL;
-			goto fail;
+		if (dc_resource_is_dsc_encoding_supported(dc)) {
+			ret = compute_mst_dsc_configs_for_state(state, dm_state->context, vars);
+			if (ret) {
+				DRM_DEBUG_DRIVER("compute_mst_dsc_configs_for_state() failed\n");
+				ret = -EINVAL;
+				goto fail;
+			}
 		}
 
 		ret = dm_update_mst_vcpi_slots_for_dsc(state, dm_state->context, vars);
diff --git a/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_training.c b/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_training.c
index f575fafc7..cda3f7223 100644
--- a/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_training.c
+++ b/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_training.c
@@ -517,6 +517,7 @@ enum link_training_result dp_check_link_loss_status(
 {
 	enum link_training_result status = LINK_TRAINING_SUCCESS;
 	union lane_status lane_status;
+	union lane_align_status_updated dpcd_lane_status_updated;
 	uint8_t dpcd_buf[6] = {0};
 	uint32_t lane;
 
@@ -532,10 +533,12 @@ enum link_training_result dp_check_link_loss_status(
 		 * check lanes status
 		 */
 		lane_status.raw = dp_get_nibble_at_index(&dpcd_buf[2], lane);
+		dpcd_lane_status_updated.raw = dpcd_buf[4];
 
 		if (!lane_status.bits.CHANNEL_EQ_DONE_0 ||
 			!lane_status.bits.CR_DONE_0 ||
-			!lane_status.bits.SYMBOL_LOCKED_0) {
+			!lane_status.bits.SYMBOL_LOCKED_0 ||
+			!dp_is_interlane_aligned(dpcd_lane_status_updated)) {
 			/* if one of the channel equalization, clock
 			 * recovery or symbol lock is dropped
 			 * consider it as (link has been
diff --git a/sys/dev/pci/drm/drm_prime.c b/sys/dev/pci/drm/drm_prime.c
index d526e6104..25812a30d 100644
--- a/sys/dev/pci/drm/drm_prime.c
+++ b/sys/dev/pci/drm/drm_prime.c
@@ -849,7 +849,7 @@ struct sg_table *drm_prime_pages_to_sg(struct drm_device *dev,
 	if (max_segment == 0)
 		max_segment = UINT_MAX;
 	err = sg_alloc_table_from_pages_segment(sg, pages, nr_pages, 0,
-						nr_pages << PAGE_SHIFT,
+						(unsigned long)nr_pages << PAGE_SHIFT,
 						max_segment, GFP_KERNEL);
 	if (err) {
 		kfree(sg);
diff --git a/sys/dev/pci/if_iwx.c b/sys/dev/pci/if_iwx.c
index 2166d4715..a2ed6b9e6 100644
--- a/sys/dev/pci/if_iwx.c
+++ b/sys/dev/pci/if_iwx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_iwx.c,v 1.181 2024/02/16 11:44:52 stsp Exp $	*/
+/*	$OpenBSD: if_iwx.c,v 1.182 2024/02/26 18:00:09 stsp Exp $	*/
 
 /*
  * Copyright (c) 2014, 2016 genua gmbh <info@genua.de>
@@ -6085,13 +6085,12 @@ iwx_tx_fill_cmd(struct iwx_softc *sc, struct iwx_node *in,
 	} else if (sc->sc_rate_n_flags_version >= 2)
 		rate_flags |= IWX_RATE_MCS_LEGACY_OFDM_MSK;
 
-	rval = (rs->rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL);
 	if (sc->sc_rate_n_flags_version >= 2) {
 		if (rate_flags & IWX_RATE_MCS_LEGACY_OFDM_MSK) {
-			rate_flags |= (iwx_fw_rateidx_ofdm(rval) &
+			rate_flags |= (iwx_fw_rateidx_ofdm(rinfo->rate) &
 			    IWX_RATE_LEGACY_RATE_MSK);
 		} else {
-			rate_flags |= (iwx_fw_rateidx_cck(rval) &
+			rate_flags |= (iwx_fw_rateidx_cck(rinfo->rate) &
 			    IWX_RATE_LEGACY_RATE_MSK);
 		}
 	} else
diff --git a/usr.sbin/dvmrpd/rde.c b/usr.sbin/dvmrpd/rde.c
index 22081a5c2..d2defcf9b 100644
--- a/usr.sbin/dvmrpd/rde.c
+++ b/usr.sbin/dvmrpd/rde.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde.c,v 1.32 2022/12/28 21:30:16 jmc Exp $ */
+/*	$OpenBSD: rde.c,v 1.33 2024/02/26 09:50:42 jsg Exp $ */
 
 /*
  * Copyright (c) 2004, 2005 Claudio Jeker <claudio@openbsd.org>
@@ -418,14 +418,13 @@ rde_group_list_find(struct iface *iface, struct in_addr group)
 void
 rde_group_list_remove(struct iface *iface, struct in_addr group)
 {
-	struct rde_group	*rg;
+	struct rde_group	*rg, *nrg;
 	struct rt_node		*rn;
 
 	if (TAILQ_EMPTY(&iface->rde_group_list))
 		fatalx("rde_group_list_remove: group does not exist");
 
-	for (rg = TAILQ_FIRST(&iface->rde_group_list); rg != NULL;
-	    rg = TAILQ_NEXT(rg, entry)) {
+	TAILQ_FOREACH_SAFE(rg, &iface->rde_group_list, entry, nrg) {
 		if (rg->rde_group.s_addr == group.s_addr) {
 			log_debug("group_list_remove: interface %s, group %s",
 			    iface->name, inet_ntoa(rg->rde_group));
diff --git a/usr.sbin/npppd/common/addr_range.c b/usr.sbin/npppd/common/addr_range.c
index 539a60fb5..d81e4b318 100644
--- a/usr.sbin/npppd/common/addr_range.c
+++ b/usr.sbin/npppd/common/addr_range.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: addr_range.c,v 1.6 2017/05/30 17:22:00 yasuoka Exp $ */
+/*	$OpenBSD: addr_range.c,v 1.7 2024/02/26 08:25:51 yasuoka Exp $ */
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
  * All rights reserved.
@@ -56,7 +56,7 @@
  * Author:
  *	Yasuoka Masahiko <yasuoka@iij.ad.jp>
  *
- * $Id: addr_range.c,v 1.6 2017/05/30 17:22:00 yasuoka Exp $
+ * $Id: addr_range.c,v 1.7 2024/02/26 08:25:51 yasuoka Exp $
  */
 #ifdef ADDR_RANGE_DEBUG
 #define IIJDEBUG
@@ -329,8 +329,7 @@ in_addr_range_list_add(struct in_addr_range **list, const char *str)
 	return 0;
 }
 
-static int bitmask2masklen(mask)
-	u_int32_t mask;
+static int bitmask2masklen(u_int32_t mask)
 {
     switch(mask) {
     case 0x00000000:  return  0;
diff --git a/usr.sbin/npppd/common/debugutil.c b/usr.sbin/npppd/common/debugutil.c
index 7f082abdb..33c1ce325 100644
--- a/usr.sbin/npppd/common/debugutil.c
+++ b/usr.sbin/npppd/common/debugutil.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: debugutil.c,v 1.6 2017/05/30 17:22:00 yasuoka Exp $ */
+/*	$OpenBSD: debugutil.c,v 1.7 2024/02/26 08:25:51 yasuoka Exp $ */
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
  * All rights reserved.
@@ -90,15 +90,13 @@ set_prio_idx_init()
 }
 
 void
-debug_set_debugfp(fp)
-	FILE *fp;
+debug_set_debugfp(FILE *fp)
 {
 	debugfp = fp;
 }
 
 void
-debug_use_syslog(b)
-	int b;
+debug_use_syslog(int b)
 {
 	if (b)
 		use_syslog = 1;
diff --git a/usr.sbin/npppd/common/hash.c b/usr.sbin/npppd/common/hash.c
index 7818b48c6..7f5faf199 100644
--- a/usr.sbin/npppd/common/hash.c
+++ b/usr.sbin/npppd/common/hash.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hash.c,v 1.5 2015/12/17 08:01:55 tb Exp $ */
+/*	$OpenBSD: hash.c,v 1.6 2024/02/26 08:25:51 yasuoka Exp $ */
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
  * All rights reserved.
@@ -36,10 +36,8 @@
  * NULL.
  */
 hash_table *
-hash_create(cmp_func, hash_func, hsz)
-	int (*cmp_func) (const void *, const void *);
-	uint32_t (*hash_func) (const void *, int);
-	int hsz;
+hash_create(int (*cmp_func) (const void *, const void *),
+    uint32_t (*hash_func) (const void *, int), int hsz)
 {
 	hash_table *htbl;
 
@@ -66,8 +64,7 @@ hash_create(cmp_func, hash_func, hsz)
  * NULL.
  */
 hash_link *
-hash_first(htbl)
-	hash_table *htbl;
+hash_first(hash_table *htbl)
 {
 	htbl->cur = 0;
 	htbl->bucket_cur = NULL;
@@ -79,8 +76,7 @@ hash_first(htbl)
  * NULL.
  */
 hash_link *
-hash_next(htbl)
-	hash_table *htbl;
+hash_next(hash_table *htbl)
 {
 	hash_link *hlink;
 
@@ -105,9 +101,7 @@ hash_next(htbl)
  * NULL
  */
 hash_link *
-hash_lookup(htbl, k)
-	hash_table *htbl;
-	const void *k;
+hash_lookup(hash_table *htbl, const void *k)
 {
 	int c;
 	hash_link *w;
@@ -125,10 +119,7 @@ hash_lookup(htbl, k)
  * Return 0 on success.  Return -1 on failure.
  */
 int
-hash_insert(htbl, k, i)
-	hash_table *htbl;
-	const void *k;
-	void *i;
+hash_insert(hash_table *htbl, const void *k, void *i)
 {
 	int c;
 	hash_link *n;
@@ -155,10 +146,7 @@ hash_insert(htbl, k, i)
  * on failure.
  */
 int
-hash_delete(htbl, k, memfree)
-	hash_table *htbl;
-	const void *k;
-	int memfree;
+hash_delete(hash_table *htbl, const void *k, int memfree)
 {
 	int i;
 	hash_link *b, *w;
@@ -194,9 +182,7 @@ hash_delete(htbl, k, memfree)
  * If memfree != 0 then free items.
  */
 void
-hash_delete_all(htbl, memfree)
-	hash_table *htbl;
-	int memfree;
+hash_delete_all(hash_table *htbl, int memfree)
 {
 	int i;
 	hash_link *w, *hl;
@@ -217,8 +203,7 @@ hash_delete_all(htbl, memfree)
 /* hash_free - Free hash table and all buckets.
  */
 void
-hash_free(htbl)
-	hash_table *htbl;
+hash_free(hash_table *htbl)
 {
 	if (htbl != NULL) {
 		free(htbl->bucket);
diff --git a/usr.sbin/npppd/common/recvfromto.c b/usr.sbin/npppd/common/recvfromto.c
index fa36f5e4b..a4161b470 100644
--- a/usr.sbin/npppd/common/recvfromto.c
+++ b/usr.sbin/npppd/common/recvfromto.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: recvfromto.c,v 1.6 2015/12/17 08:01:55 tb Exp $ */
+/*	$OpenBSD: recvfromto.c,v 1.7 2024/02/26 08:25:51 yasuoka Exp $ */
 /* adapted from ipsec-tools 0.6 src/racoon/sockmisc.c */
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -41,18 +41,9 @@
  * setsockopt() have already performed on socket.
  */
 int
-recvfromto_nat_t(s, buf, buflen, flags, from, fromlen, to, tolen,
-    ipsec, ipseclen)
-	int s;
-	void *buf;
-	size_t buflen;
-	int flags;
-	struct sockaddr *from;
-	u_int *fromlen;
-	struct sockaddr *to;
-	u_int *tolen;
-	void *ipsec;
-	u_int *ipseclen;
+recvfromto_nat_t(int s, void *buf, size_t buflen, int flags,
+    struct sockaddr *from, u_int *fromlen, struct sockaddr *to, u_int *tolen,
+    void *ipsec, u_int *ipseclen)
 {
 	int otolen;
 	u_int oipseclen = 0;
@@ -188,29 +179,16 @@ recvfromto_nat_t(s, buf, buflen, flags, from, fromlen, to, tolen,
 }
 
 int
-recvfromto(s, buf, buflen, flags, from, fromlen, to, tolen)
-	int s;
-	void *buf;
-	size_t buflen;
-	int flags;
-	struct sockaddr *from;
-	u_int *fromlen;
-	struct sockaddr *to;
-	u_int *tolen;
+recvfromto(int s, void *buf, size_t buflen, int flags, struct sockaddr *from,
+    u_int *fromlen, struct sockaddr *to, u_int *tolen)
 {
 	return recvfromto_nat_t(s, buf, buflen, flags, from, fromlen,
 	    to, tolen, NULL, NULL);
 }
 
 int
-sendto_nat_t(s, buf, buflen, flags, to, tolen, ipsec)
-	int s;
-	const void *buf;
-	size_t buflen;
-	int flags;
-	struct sockaddr *to;
-	u_int tolen;
-	void *ipsec;
+sendto_nat_t(int s, const void *buf, size_t buflen, int flags,
+    struct sockaddr *to, u_int tolen, void *ipsec)
 {
 #ifdef IP_IPSECFLOWINFO
 	if (ipsec) {
diff --git a/usr.sbin/npppd/l2tp/l2tp.h b/usr.sbin/npppd/l2tp/l2tp.h
index 8cb1777ed..b1b925c6e 100644
--- a/usr.sbin/npppd/l2tp/l2tp.h
+++ b/usr.sbin/npppd/l2tp/l2tp.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: l2tp.h,v 1.14 2021/03/29 03:54:39 yasuoka Exp $	*/
+/*	$OpenBSD: l2tp.h,v 1.15 2024/02/26 08:29:37 yasuoka Exp $	*/
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -30,7 +30,7 @@
 /*@file
  * header file for the L2TP module
  */
-/* $Id: l2tp.h,v 1.14 2021/03/29 03:54:39 yasuoka Exp $ */
+/* $Id: l2tp.h,v 1.15 2024/02/26 08:29:37 yasuoka Exp $ */
 
 /************************************************************************
  * Protocol Constants
@@ -405,7 +405,7 @@ typedef struct _l2tp_ctrl {
 	/** number of calls established */
 	int	ncalls;
 
-	int /** use sequence number in L2TP Data Message? */
+	unsigned int /** use sequence number in L2TP Data Message? */
 	    data_use_seq:1,
 	    /** waiting to acknowledge HELLO? */
 	    hello_wait_ack:1;
diff --git a/usr.sbin/npppd/npppd/chap.c b/usr.sbin/npppd/npppd/chap.c
index 0d634a2bf..88c65a010 100644
--- a/usr.sbin/npppd/npppd/chap.c
+++ b/usr.sbin/npppd/npppd/chap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: chap.c,v 1.17 2021/03/29 03:54:39 yasuoka Exp $ */
+/*	$OpenBSD: chap.c,v 1.18 2024/02/26 08:47:28 yasuoka Exp $ */
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -36,7 +36,7 @@
  * </ul></p>
  */
 /* RFC 1994, 2433 */
-/* $Id: chap.c,v 1.17 2021/03/29 03:54:39 yasuoka Exp $ */
+/* $Id: chap.c,v 1.18 2024/02/26 08:47:28 yasuoka Exp $ */
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <sys/time.h>
@@ -862,6 +862,11 @@ chap_radius_response(void *context, RADIUS_PACKET *pkt, int flags,
 		reason="bad_authenticator";
 		goto auth_failed;
 	}
+	if ((flags & RADIUS_REQUEST_CHECK_MSG_AUTHENTICATOR_OK) == 0 &&
+	    (flags & RADIUS_REQUEST_CHECK_NO_MSG_AUTHENTICATOR) == 0) {
+		reason="bad_msg_authenticator";
+		goto auth_failed;
+	}
 	/*
 	 * Authentication OK
 	 */
diff --git a/usr.sbin/npppd/npppd/fsm.c b/usr.sbin/npppd/npppd/fsm.c
index 605b7887e..c5772d8c0 100644
--- a/usr.sbin/npppd/npppd/fsm.c
+++ b/usr.sbin/npppd/npppd/fsm.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fsm.c,v 1.10 2019/02/27 04:52:19 denis Exp $ */
+/*	$OpenBSD: fsm.c,v 1.11 2024/02/26 08:25:51 yasuoka Exp $ */
 
 /**@file
  * This file was adapted from NetBSD:/usr/src/usr.sbin/pppd/pppd/fsm.c
@@ -70,7 +70,7 @@ static const char rcsid[] = RCSID;
 #endif
 
 static void fsm_timeout(void *);
-static void fsm_rconfreq(fsm *, int, u_char *, int);
+static void fsm_rconfreq(fsm *, u_char, u_char *, int len);
 static void fsm_rconfack(fsm *, int, u_char *, int);
 static void fsm_rconfnakrej(fsm *, int, int, u_char *, int);
 static void fsm_rtermreq(fsm *, int, u_char *, int);
@@ -96,8 +96,7 @@ fsm_evtimer_timeout(int fd, short evtype, void *ctx)
  * Initialize fsm state.
  */
 void
-fsm_init(f)
-    fsm *f;
+fsm_init(fsm *f)
 {
     f->state = INITIAL;
     f->flags = 0;
@@ -116,8 +115,7 @@ fsm_init(f)
  * fsm_lowerup - The lower layer is up.
  */
 void
-fsm_lowerup(f)
-    fsm *f;
+fsm_lowerup(fsm *f)
 {
     switch( f->state ){
     case INITIAL:
@@ -146,8 +144,7 @@ fsm_lowerup(f)
  * Cancel all timeouts and inform upper layers.
  */
 void
-fsm_lowerdown(f)
-    fsm *f;
+fsm_lowerdown(fsm *f)
 {
     switch( f->state ){
     case CLOSED:
@@ -189,8 +186,7 @@ fsm_lowerdown(f)
  * fsm_open - Link is allowed to come up.
  */
 void
-fsm_open(f)
-    fsm *f;
+fsm_open(fsm *f)
 {
     switch( f->state ){
     case INITIAL:
@@ -230,9 +226,7 @@ fsm_open(f)
  * the CLOSED state.
  */
 void
-fsm_close(f, reason)
-    fsm *f;
-    const char *reason;
+fsm_close(fsm *f, const char *reason)
 {
     f->term_reason = (char *)reason;
     f->term_reason_len = (reason == NULL? 0: strlen(reason));
@@ -273,8 +267,7 @@ fsm_close(f, reason)
  * fsm_timeout - Timeout expired.
  */
 static void
-fsm_timeout(arg)
-    void *arg;
+fsm_timeout(void *arg)
 {
     fsm *f = (fsm *) arg;
 
@@ -326,10 +319,7 @@ fsm_timeout(arg)
  * fsm_input - Input packet.
  */
 void
-fsm_input(f, inpacket, l)
-    fsm *f;
-    u_char *inpacket;
-    int l;
+fsm_input(fsm *f, u_char *inpacket, int l)
 {
     u_char *inp;
     u_char code, id;
@@ -405,11 +395,7 @@ fsm_input(f, inpacket, l)
  * fsm_rconfreq - Receive Configure-Request.
  */
 static void
-fsm_rconfreq(f, id, inp, len)
-    fsm *f;
-    u_char id;
-    u_char *inp;
-    int len;
+fsm_rconfreq(fsm *f, u_char id, u_char *inp, int len)
 {
     int code, reject_if_disagree;
 
@@ -475,11 +461,7 @@ fsm_rconfreq(f, id, inp, len)
  * fsm_rconfack - Receive Configure-Ack.
  */
 static void
-fsm_rconfack(f, id, inp, len)
-    fsm *f;
-    int id;
-    u_char *inp;
-    int len;
+fsm_rconfack(fsm *f, int id, u_char *inp, int len)
 {
     if (id != f->reqid || f->seen_ack)		/* Expected id? */
 	return;					/* Nope, toss... */
@@ -532,11 +514,7 @@ fsm_rconfack(f, id, inp, len)
  * fsm_rconfnakrej - Receive Configure-Nak or Configure-Reject.
  */
 static void
-fsm_rconfnakrej(f, code, id, inp, len)
-    fsm *f;
-    int code, id;
-    u_char *inp;
-    int len;
+fsm_rconfnakrej(fsm *f, int code, int id, u_char *inp, int len)
 {
     int (*proc)(fsm *, u_char *, int);
     int ret;
@@ -590,11 +568,7 @@ fsm_rconfnakrej(f, code, id, inp, len)
  * fsm_rtermreq - Receive Terminate-Req.
  */
 static void
-fsm_rtermreq(f, id, p, len)
-    fsm *f;
-    int id;
-    u_char *p;
-    int len;
+fsm_rtermreq(fsm *f, int id, u_char *p, int len)
 {
     switch (f->state) {
     case ACKRCVD:
@@ -620,8 +594,7 @@ fsm_rtermreq(f, id, p, len)
  * fsm_rtermack - Receive Terminate-Ack.
  */
 static void
-fsm_rtermack(f)
-    fsm *f;
+fsm_rtermack(fsm *f)
 {
     switch (f->state) {
     case CLOSING:
@@ -655,10 +628,7 @@ fsm_rtermack(f)
  * fsm_rcoderej - Receive an Code-Reject.
  */
 static void
-fsm_rcoderej(f, inp, len)
-    fsm *f;
-    u_char *inp;
-    int len;
+fsm_rcoderej(fsm *f, u_char *inp, int len)
 {
     u_char code, id;
 
@@ -683,8 +653,7 @@ fsm_rcoderej(f, inp, len)
  * Treat this as a catastrophic error (RXJ-).
  */
 void
-fsm_protreject(f)
-    fsm *f;
+fsm_protreject(fsm *f)
 {
     switch( f->state ){
     case CLOSING:
@@ -733,9 +702,7 @@ fsm_protreject(f)
  * fsm_sconfreq - Send a Configure-Request.
  */
 static void
-fsm_sconfreq(f, retransmit)
-    fsm *f;
-    int retransmit;
+fsm_sconfreq(fsm *f, int retransmit)
 {
     u_char *outp;
     int cilen;
@@ -783,11 +750,7 @@ fsm_sconfreq(f, retransmit)
  * Used for all packets sent to our peer by this module.
  */
 void
-fsm_sdata(f, code, id, data, datalen)
-    fsm *f;
-    u_char code, id;
-    u_char *data;
-    int datalen;
+fsm_sdata(fsm *f, u_char code, u_char id, u_char *data, int datalen)
 {
     ppp_output(f->ppp, f->protocol, code, id, data, datalen);
 }
diff --git a/usr.sbin/npppd/npppd/fsm.h b/usr.sbin/npppd/npppd/fsm.h
index a35b06b26..f8185644d 100644
--- a/usr.sbin/npppd/npppd/fsm.h
+++ b/usr.sbin/npppd/npppd/fsm.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fsm.h,v 1.6 2017/05/30 17:22:00 yasuoka Exp $ */
+/*	$OpenBSD: fsm.h,v 1.7 2024/02/26 08:25:51 yasuoka Exp $ */
 /*	$NetBSD: fsm.h,v 1.10 2000/09/23 22:39:35 christos Exp $	*/
 
 /*
@@ -158,7 +158,7 @@ void fsm_open(fsm *);
 void fsm_close(fsm *, const char *);
 void fsm_input(fsm *, u_char *, int);
 void fsm_protreject(fsm *);
-void fsm_sdata(fsm *, int, int, u_char *, int);
+void fsm_sdata(fsm *, u_char, u_char, u_char *, int);
 void fsm_log(fsm *, uint32_t, const char *, ...) __attribute__((__format__ (__printf__, 3, 4)));
 
 
diff --git a/usr.sbin/npppd/npppd/npppd_auth.c b/usr.sbin/npppd/npppd/npppd_auth.c
index 1bc3e2c72..4169eb756 100644
--- a/usr.sbin/npppd/npppd/npppd_auth.c
+++ b/usr.sbin/npppd/npppd/npppd_auth.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: npppd_auth.c,v 1.22 2021/03/29 03:54:39 yasuoka Exp $ */
+/*	$OpenBSD: npppd_auth.c,v 1.23 2024/02/26 10:42:05 yasuoka Exp $ */
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -26,7 +26,7 @@
  * SUCH DAMAGE.
  */
 /**@file authentication realm */
-/* $Id: npppd_auth.c,v 1.22 2021/03/29 03:54:39 yasuoka Exp $ */
+/* $Id: npppd_auth.c,v 1.23 2024/02/26 10:42:05 yasuoka Exp $ */
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/socket.h>
@@ -49,6 +49,7 @@
 #include "net_utils.h"
 
 #include "npppd_auth_local.h"
+#include "npppd_radius.h"
 
 /**
  * Create a npppd_auth_base object.
@@ -597,6 +598,11 @@ npppd_auth_radius_reload(npppd_auth_base *base, struct authconf *auth)
 	    "server%s.",
 	    nauth, (nauth > 1)? "s" : "", nacct, (nacct > 1)? "s" : "");
 
+	if (nacct > 0 && _this->rad_acct_on == 0) {
+		radius_acct_on(base->npppd, _this->rad_acct_setting);
+		_this->rad_acct_on = 1;
+	}
+
 	return 0;
 }
 
diff --git a/usr.sbin/npppd/npppd/npppd_auth_local.h b/usr.sbin/npppd/npppd/npppd_auth_local.h
index 2ae55d2ab..686333dc8 100644
--- a/usr.sbin/npppd/npppd/npppd_auth_local.h
+++ b/usr.sbin/npppd/npppd/npppd_auth_local.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: npppd_auth_local.h,v 1.8 2017/08/11 16:41:47 goda Exp $ */
+/*	$OpenBSD: npppd_auth_local.h,v 1.9 2024/02/26 10:42:05 yasuoka Exp $ */
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -70,6 +70,9 @@ struct _npppd_auth_radius {
 
 	/** RADIUS accounting server setting */
 	radius_req_setting *rad_acct_setting;
+
+	/** Whether RADIUS accounting-on is noticed */
+	int rad_acct_on;
 };
 #endif
 
diff --git a/usr.sbin/npppd/npppd/npppd_iface.h b/usr.sbin/npppd/npppd/npppd_iface.h
index 04f86dd1f..8ebf7d7bf 100644
--- a/usr.sbin/npppd/npppd/npppd_iface.h
+++ b/usr.sbin/npppd/npppd/npppd_iface.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: npppd_iface.h,v 1.7 2015/12/05 16:10:31 yasuoka Exp $ */
+/*	$OpenBSD: npppd_iface.h,v 1.8 2024/02/26 08:29:37 yasuoka Exp $ */
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -29,31 +29,31 @@
 #define NPPPD_IFACE_H 1
 
 typedef struct _npppd_iface {
- 	/** base of npppd structure */
+	/** base of npppd structure */
 	void	*npppd;
- 	/** interface name */
+	/** interface name */
 	char	ifname[IFNAMSIZ];
- 	/** file descriptor for device file */
+	/** file descriptor for device file */
 	int	devf;
 
- 	/** assigned IPv4 address */
+	/** assigned IPv4 address */
 	struct in_addr	ip4addr;
- 	/** for event(3)  */
+	/** for event(3)  */
 	struct event	ev;
 
 	struct ipcpconf *ipcpconf;
 
- 	int	/**
- 		 * whether set IP address as npppd_iface's work or not.
- 		 * <p>if 0, npppd_iface only refers IP address already set.</p>
- 		 */
- 		set_ip4addr:1,
+	unsigned int	/**
+		 * whether set IP address as npppd_iface's work or not.
+		 * <p>if 0, npppd_iface only refers IP address already set.</p>
+		 */
+		set_ip4addr:1,
 		/** set if using pppx(4) rather than tun(4) */
 		using_pppx:1,
 		/** is initialized */
-  		initialized:1,
+		initialized:1,
 		/** is started */
-  		started:1;
+		started:1;
 } npppd_iface;
 
 /** whether interface IP address is usable or not */
diff --git a/usr.sbin/npppd/npppd/npppd_local.h b/usr.sbin/npppd/npppd/npppd_local.h
index 06331759e..37205b65f 100644
--- a/usr.sbin/npppd/npppd/npppd_local.h
+++ b/usr.sbin/npppd/npppd/npppd_local.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: npppd_local.h,v 1.17 2017/08/12 11:20:34 goda Exp $ */
+/*	$OpenBSD: npppd_local.h,v 1.18 2024/02/26 08:29:37 yasuoka Exp $ */
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -85,7 +85,7 @@ struct _npppd_pool {
 	struct sockaddr_npppd *addrs;
 	/** list of addresses dynamically allocated */
 	slist 		dyna_addrs;
-	int		/** whether initialized or not */
+	unsigned int	/** whether initialized or not */
 			initialized:1,
 			/** whether in use or not */
 			running:1;
diff --git a/usr.sbin/npppd/npppd/npppd_radius.c b/usr.sbin/npppd/npppd/npppd_radius.c
index d8f72e1e4..640e9a440 100644
--- a/usr.sbin/npppd/npppd/npppd_radius.c
+++ b/usr.sbin/npppd/npppd/npppd_radius.c
@@ -1,4 +1,4 @@
-/* $Id: npppd_radius.c,v 1.8 2015/07/23 09:04:06 yasuoka Exp $ */
+/* $Id: npppd_radius.c,v 1.10 2024/02/26 10:42:05 yasuoka Exp $ */
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
  * All rights reserved.
@@ -62,6 +62,7 @@
 static int l2tp_put_tunnel_attributes(RADIUS_PACKET *, void *);
 static int pptp_put_tunnel_attributes(RADIUS_PACKET *, void *);
 static int radius_acct_request(npppd *, npppd_ppp *, int );
+static void radius_acct_on_cb(void *, RADIUS_PACKET *, int, RADIUS_REQUEST_CTX);
 static void npppd_ppp_radius_acct_reqcb(void *, RADIUS_PACKET *, int, RADIUS_REQUEST_CTX);
 
 /***********************************************************************
@@ -217,6 +218,9 @@ radius_acct_request(npppd *pppd, npppd_ppp *ppp, int stop)
 	ATTR_INT32(RADIUS_TYPE_NAS_PORT, ppp->id);
 	    /* npppd has no physical / virtual ports in design. */
 
+	/* RFC 2865  5.32. NAS-Identifier */
+	ATTR_STR(RADIUS_TYPE_NAS_IDENTIFIER, "npppd");
+
 	/* RFC 2865 5.31. Calling-Station-Id */
 	if (ppp->calling_number[0] != '\0')
 		ATTR_STR(RADIUS_TYPE_CALLING_STATION_ID, ppp->calling_number);
@@ -301,9 +305,6 @@ radius_acct_request(npppd *pppd, npppd_ppp *ppp, int stop)
 		    ppp->obytes >> 32);
 	}
 
-	radius_set_accounting_request_authenticator(radpkt,
-	    radius_get_server_secret(radctx));
-
 	/* Send the request */
 	radius_request(radctx, radpkt);
 
@@ -320,6 +321,54 @@ fail:
 	return -1;
 }
 
+void
+radius_acct_on(npppd *pppd, radius_req_setting *rad_setting)
+{
+	RADIUS_REQUEST_CTX radctx = NULL;
+	RADIUS_PACKET *radpkt = NULL;
+
+	if (!radius_req_setting_has_server(rad_setting))
+		return;
+	if ((radpkt = radius_new_request_packet(RADIUS_CODE_ACCOUNTING_REQUEST))
+	    == NULL)
+		goto fail;
+
+	if (radius_prepare(rad_setting, NULL, &radctx, radius_acct_on_cb) != 0)
+		goto fail;
+
+	/*
+	 * RFC 2865 "5.4.  NAS-IP-Address" or RFC 3162 "2.1. NAS-IPv6-Address"
+	 */
+	if (radius_prepare_nas_address(rad_setting, radpkt) != 0)
+		goto fail;
+
+	/* RFC 2865 "5.41. NAS-Port-Type" */
+	ATTR_INT32(RADIUS_TYPE_NAS_PORT_TYPE, RADIUS_NAS_PORT_TYPE_VIRTUAL);
+
+	/* RFC 2866  5.1. Acct-Status-Type */
+	ATTR_INT32(RADIUS_TYPE_ACCT_STATUS_TYPE, RADIUS_ACCT_STATUS_TYPE_ACCT_ON);
+	/* RFC 2865  5.32. NAS-Identifier */
+	ATTR_STR(RADIUS_TYPE_NAS_IDENTIFIER, "npppd");
+
+	/* Send the request */
+	radius_request(radctx, radpkt);
+
+	return;
+ fail:
+	if (radctx != NULL)
+		radius_cancel_request(radctx);
+	if (radpkt != NULL)
+		radius_delete_packet(radpkt);
+}
+
+static void
+radius_acct_on_cb(void *context, RADIUS_PACKET *pkt, int flags,
+    RADIUS_REQUEST_CTX ctx)
+{
+	if ((flags & (RADIUS_REQUEST_TIMEOUT | RADIUS_REQUEST_ERROR)) != 0)
+		radius_request_failover(ctx);
+}
+
 #ifdef USE_NPPPD_PPTP
 #include "pptp.h"
 #endif
diff --git a/usr.sbin/npppd/npppd/npppd_radius.h b/usr.sbin/npppd/npppd/npppd_radius.h
index e9b7d7436..a1334545e 100644
--- a/usr.sbin/npppd/npppd/npppd_radius.h
+++ b/usr.sbin/npppd/npppd/npppd_radius.h
@@ -9,6 +9,7 @@ void  ppp_proccess_radius_framed_ip (npppd_ppp *, RADIUS_PACKET *);
 int   ppp_set_radius_attrs_for_authreq (npppd_ppp *, radius_req_setting *, RADIUS_PACKET *);
 void  npppd_ppp_radius_acct_start (npppd *, npppd_ppp *);
 void  npppd_ppp_radius_acct_stop (npppd *, npppd_ppp *);
+void  radius_acct_on(npppd *, radius_req_setting *);
 
 #ifdef __cplusplus
 }
diff --git a/usr.sbin/npppd/npppd/pap.c b/usr.sbin/npppd/npppd/pap.c
index 5aa55e373..b9b2f334f 100644
--- a/usr.sbin/npppd/npppd/pap.c
+++ b/usr.sbin/npppd/npppd/pap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pap.c,v 1.12 2021/03/29 03:54:39 yasuoka Exp $ */
+/*	$OpenBSD: pap.c,v 1.13 2024/02/26 08:47:28 yasuoka Exp $ */
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
-/* $Id: pap.c,v 1.12 2021/03/29 03:54:39 yasuoka Exp $ */
+/* $Id: pap.c,v 1.13 2024/02/26 08:47:28 yasuoka Exp $ */
 /**@file
  * This file provides Password Authentication Protocol (PAP) handlers.
  * @author Yasuoka Masahiko
@@ -501,6 +501,11 @@ pap_radius_response(void *context, RADIUS_PACKET *pkt, int flags,
 		reason="bad_authenticator";
 		goto auth_failed;
 	}
+	if ((flags & RADIUS_REQUEST_CHECK_MSG_AUTHENTICATOR_OK) == 0 &&
+	    (flags & RADIUS_REQUEST_CHECK_NO_MSG_AUTHENTICATOR) == 0) {
+		reason="bad_authenticator";
+		goto auth_failed;
+	}
 	/* Authentication succeeded */
 	pap_response(_this, 1, DEFAULT_SUCCESS_MESSAGE);
 	ppp_process_radius_framed_ip(_this->ppp, pkt);
diff --git a/usr.sbin/npppd/npppd/ppp.c b/usr.sbin/npppd/npppd/ppp.c
index 7fedb53ac..64716acc9 100644
--- a/usr.sbin/npppd/npppd/ppp.c
+++ b/usr.sbin/npppd/npppd/ppp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ppp.c,v 1.30 2021/03/29 03:54:39 yasuoka Exp $ */
+/*	$OpenBSD: ppp.c,v 1.31 2024/02/26 10:42:05 yasuoka Exp $ */
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
-/* $Id: ppp.c,v 1.30 2021/03/29 03:54:39 yasuoka Exp $ */
+/* $Id: ppp.c,v 1.31 2024/02/26 10:42:05 yasuoka Exp $ */
 /**@file
  * This file provides PPP(Point-to-Point Protocol, RFC 1661) and
  * {@link :: _npppd_ppp PPP instance} related functions.
@@ -1094,6 +1094,11 @@ ppp_set_radius_attrs_for_authreq(npppd_ppp *_this,
 	if (radius_prepare_nas_address(rad_setting, radpkt) != 0)
 		goto fail;
 
+	/* RFC 2865  5.32. NAS-Identifier */
+	if (radius_put_string_attr(radpkt, RADIUS_TYPE_NAS_IDENTIFIER, "npppd")
+	    != 0)
+		goto fail;
+
 	/* RFC 2865 "5.6. Service-Type" */
 	if (radius_put_uint32_attr(radpkt, RADIUS_TYPE_SERVICE_TYPE,
 	    RADIUS_SERVICE_TYPE_FRAMED) != 0)
diff --git a/usr.sbin/npppd/npppd/radius_req.c b/usr.sbin/npppd/npppd/radius_req.c
index b60ac79ac..de6edf2b0 100644
--- a/usr.sbin/npppd/npppd/radius_req.c
+++ b/usr.sbin/npppd/npppd/radius_req.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: radius_req.c,v 1.11 2015/12/05 18:43:36 mmcc Exp $ */
+/*	$OpenBSD: radius_req.c,v 1.12 2024/02/26 08:47:28 yasuoka Exp $ */
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -28,7 +28,7 @@
 /**@file
  * This file provides functions for RADIUS request using radius(3) and event(3).
  * @author	Yasuoka Masahiko
- * $Id: radius_req.c,v 1.11 2015/12/05 18:43:36 mmcc Exp $
+ * $Id: radius_req.c,v 1.12 2024/02/26 08:47:28 yasuoka Exp $
  */
 #include <sys/types.h>
 #include <sys/time.h>
@@ -68,7 +68,7 @@ struct overlapped {
 	radius_req_setting	*setting;
 };
 
-static int   radius_request0 (struct overlapped *, int);
+static int   radius_request0(struct overlapped *);
 static int   radius_prepare_socket(struct overlapped *);
 static void  radius_request_io_event (int, short, void *);
 static void  radius_on_response(RADIUS_REQUEST_CTX, RADIUS_PACKET *, int, int);
@@ -107,7 +107,7 @@ radius_request(RADIUS_REQUEST_CTX ctx, RADIUS_PACKET *pkt)
 	if (radius_get_uint32_attr(pkt, RADIUS_TYPE_ACCT_DELAY_TIME, &ival)
 	    == 0)
 		lap->acct_delay_time = 1;
-	radius_request0(lap, 0);
+	radius_request0(lap);
 }
 
 /**
@@ -207,7 +207,7 @@ radius_request_failover(RADIUS_REQUEST_CTX ctx)
 	if (radius_prepare_socket(lap) != 0)
 		return -1;
 
-	if (radius_request0(lap, 1) != 0)
+	if (radius_request0(lap) != 0)
 		return -1;
 
 	lap->failovers++;
@@ -359,7 +359,7 @@ radius_get_server_address(RADIUS_REQUEST_CTX ctx)
 }
 
 static int
-radius_request0(struct overlapped *lap, int new_message)
+radius_request0(struct overlapped *lap)
 {
 	struct timeval tv0;
 
@@ -378,16 +378,16 @@ radius_request0(struct overlapped *lap, int new_message)
 		else {
 			timespecsub(&curr, &lap->req_time, &delta);
 			if (radius_set_uint32_attr(lap->pkt,
-			    RADIUS_TYPE_ACCT_DELAY_TIME, delta.tv_sec) == 0) {
+			    RADIUS_TYPE_ACCT_DELAY_TIME, delta.tv_sec) == 0)
 				radius_update_id(lap->pkt);
-				new_message = 1;
-			}
 		}
 	}
-	if (new_message) {
+	if (radius_get_code(lap->pkt) == RADIUS_CODE_ACCOUNTING_REQUEST)
 		radius_set_accounting_request_authenticator(lap->pkt,
 		    radius_get_server_secret(lap));
-	}
+	else
+		radius_put_message_authenticator(lap->pkt,
+		    radius_get_server_secret(lap));
 
 	lap->ntry--;
 	if (radius_send(lap->socket, lap->pkt, 0) != 0) {
@@ -440,12 +440,17 @@ radius_request_io_event(int fd, short evmask, void *context)
 			}
 			flags |= RADIUS_REQUEST_ERROR;
 		} else if (lap->secret[0] == '\0') {
-			flags |= RADIUS_REQUEST_CHECK_AUTHENTICATOR_NO_CHECK;
+			flags |= RADIUS_REQUEST_CHECK_AUTHENTICATOR_NO_CHECK
+			    | RADIUS_REQUEST_CHECK_MSG_AUTHENTICATOR_NO_CHECK;
 		} else {
 			radius_set_request_packet(respkt, lap->pkt);
 			if (!radius_check_response_authenticator(respkt,
 			    lap->secret))
 				flags |= RADIUS_REQUEST_CHECK_AUTHENTICATOR_OK;
+			if (!radius_has_attr(respkt, RADIUS_TYPE_MESSAGE_AUTHENTICATOR))
+				flags |= RADIUS_REQUEST_CHECK_NO_MSG_AUTHENTICATOR;
+			else if (radius_check_message_authenticator(respkt, lap->secret) == 0)
+				flags |= RADIUS_REQUEST_CHECK_MSG_AUTHENTICATOR_OK;
 		}
 		radius_on_response(lap, respkt, flags, 0);
 		radius_delete_packet(respkt);
@@ -453,7 +458,7 @@ radius_request_io_event(int fd, short evmask, void *context)
 		if (lap->ntry > 0) {
 			RADIUS_REQ_DBG((LOG_DEBUG,
 			    "%s() timed out retry", __func__));
-			radius_request0(lap, 0);
+			radius_request0(lap);
 			return;
 		}
 		RADIUS_REQ_DBG((LOG_DEBUG, "%s() timed out", __func__));
diff --git a/usr.sbin/npppd/npppd/radius_req.h b/usr.sbin/npppd/npppd/radius_req.h
index bd4dd0aa5..4287c172f 100644
--- a/usr.sbin/npppd/npppd/radius_req.h
+++ b/usr.sbin/npppd/npppd/radius_req.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: radius_req.h,v 1.7 2015/07/23 09:04:06 yasuoka Exp $ */
+/*	$OpenBSD: radius_req.h,v 1.8 2024/02/26 08:47:28 yasuoka Exp $ */
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -51,6 +51,15 @@
 /** authenticator is not checked */
 #define	RADIUS_REQUEST_CHECK_AUTHENTICATOR_NO_CHECK	0x0020
 
+/** no message authenticator */
+#define	RADIUS_REQUEST_CHECK_NO_MSG_AUTHENTICATOR	0x0040
+
+/** has valid message authenticator */
+#define	RADIUS_REQUEST_CHECK_MSG_AUTHENTICATOR_OK	0x0080
+
+/** message authenticator is not checked*/
+#define	RADIUS_REQUEST_CHECK_MSG_AUTHENTICATOR_NO_CHECK	0x0100
+
 /** type for context to handle RADIUS request / response */
 typedef void * RADIUS_REQUEST_CTX;
 
diff --git a/usr.sbin/npppd/pptp/pptp.h b/usr.sbin/npppd/pptp/pptp.h
index e8df825f1..275da34f5 100644
--- a/usr.sbin/npppd/pptp/pptp.h
+++ b/usr.sbin/npppd/pptp/pptp.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pptp.h,v 1.11 2021/03/29 03:54:40 yasuoka Exp $	*/
+/*	$OpenBSD: pptp.h,v 1.12 2024/02/26 08:29:37 yasuoka Exp $	*/
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -288,7 +288,7 @@ typedef struct _pptp_ctrl {
 	time_t	last_rcv_ctrl;	/* timestamp of latest ctrl message received */
 	uint32_t	echo_seq; /* identifier of Echo Request */
 
-	int16_t		/* flags : processing I/O events */
+	uint16_t	/* flags : processing I/O events */
 			on_io_event:1,
 			reserved:15;
 } pptp_ctrl;
diff --git a/usr.sbin/rpki-client/extern.h b/usr.sbin/rpki-client/extern.h
index ebaede115..a27dd2123 100644
--- a/usr.sbin/rpki-client/extern.h
+++ b/usr.sbin/rpki-client/extern.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: extern.h,v 1.209 2024/02/22 21:00:26 tb Exp $ */
+/*	$OpenBSD: extern.h,v 1.210 2024/02/26 15:40:33 job Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -622,6 +622,7 @@ struct repostats {
 	uint32_t	 extra_files;	/* number of superfluous files */
 	uint32_t	 del_extra_files;/* number of removed extra files */
 	uint32_t	 del_dirs;	/* number of dirs removed in cleanup */
+	uint32_t	 new_files;	/* moved from DIR_TEMP to DIR_VALID */
 	struct timespec	 sync_time;	/* time to sync repo */
 };
 
@@ -850,6 +851,7 @@ struct repo	*repo_byid(unsigned int);
 int		 repo_queued(struct repo *, struct entity *);
 void		 repo_cleanup(struct filepath_tree *, int);
 int		 repo_check_timeout(int);
+void		 repostats_new_files_inc(struct repo *, const char *);
 void		 repo_stat_inc(struct repo *, int, enum rtype, enum stype);
 void		 repo_tal_stats_collect(void (*)(const struct repo *,
 		    const struct repotalstats *, void *), int, void *);
diff --git a/usr.sbin/rpki-client/main.c b/usr.sbin/rpki-client/main.c
index 933494a25..231ddd821 100644
--- a/usr.sbin/rpki-client/main.c
+++ b/usr.sbin/rpki-client/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.251 2024/02/22 12:49:42 job Exp $ */
+/*	$OpenBSD: main.c,v 1.252 2024/02/26 15:40:33 job Exp $ */
 /*
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -597,6 +597,7 @@ entity_process(struct ibuf *b, struct stats *st, struct vrp_tree *tree,
 
 	rp = repo_byid(id);
 	repo_stat_inc(rp, talid, type, STYPE_OK);
+	repostats_new_files_inc(rp, file);
 	switch (type) {
 	case RTYPE_TAL:
 		st->tals++;
@@ -786,6 +787,7 @@ sum_repostats(const struct repo *rp, const struct repostats *in, void *arg)
 	out->extra_files += in->extra_files;
 	out->del_extra_files += in->del_extra_files;
 	out->del_dirs += in->del_dirs;
+	out->new_files += in->new_files;
 	timespecadd(&in->sync_time, &out->sync_time, &out->sync_time);
 }
 
@@ -1487,6 +1489,8 @@ main(int argc, char *argv[])
 	printf("Ghostbuster records: %u\n", stats.repo_tal_stats.gbrs);
 	printf("Trust Anchor Keys: %u\n", stats.repo_tal_stats.taks);
 	printf("Repositories: %u\n", stats.repos);
+	printf("New files moved into validated cache: %u\n",
+	    stats.repo_stats.new_files);
 	printf("Cleanup: removed %u files, %u directories\n"
 	    "Repository cleanup: kept %u and removed %u superfluous files\n",
 	    stats.repo_stats.del_files, stats.repo_stats.del_dirs,
diff --git a/usr.sbin/rpki-client/output-json.c b/usr.sbin/rpki-client/output-json.c
index 8ff1e7f62..f19a49c5e 100644
--- a/usr.sbin/rpki-client/output-json.c
+++ b/usr.sbin/rpki-client/output-json.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: output-json.c,v 1.43 2024/02/22 12:49:42 job Exp $ */
+/*	$OpenBSD: output-json.c,v 1.44 2024/02/26 15:40:33 job Exp $ */
 /*
  * Copyright (c) 2019 Claudio Jeker <claudio@openbsd.org>
  *
@@ -76,6 +76,7 @@ outputheader_json(struct stats *st)
 	json_do_int("uniquevsps", st->repo_tal_stats.vsps_uniqs);
 	json_do_int("vaps", st->repo_tal_stats.vaps);
 	json_do_int("uniquevaps", st->repo_tal_stats.vaps_uniqs);
+	json_do_int("cachedir_new_files", st->repo_stats.new_files);
 	json_do_int("cachedir_del_files", st->repo_stats.del_files);
 	json_do_int("cachedir_del_dirs", st->repo_stats.del_dirs);
 	json_do_int("cachedir_superfluous_files", st->repo_stats.extra_files);
diff --git a/usr.sbin/rpki-client/output-ometric.c b/usr.sbin/rpki-client/output-ometric.c
index b2775e159..c6d9f5869 100644
--- a/usr.sbin/rpki-client/output-ometric.c
+++ b/usr.sbin/rpki-client/output-ometric.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: output-ometric.c,v 1.8 2024/02/22 12:49:42 job Exp $ */
+/*	$OpenBSD: output-ometric.c,v 1.9 2024/02/26 15:40:33 job Exp $ */
 /*
  * Copyright (c) 2022 Claudio Jeker <claudio@openbsd.org>
  *
@@ -141,6 +141,8 @@ repo_stats(const struct repo *rp, const struct repostats *in, void *arg)
 	ol = olabels_new(keys, values);
 	ometric_set_timespec(rpki_repo_duration, &in->sync_time, ol);
 
+	ometric_set_int_with_labels(rpki_repo_obj, in->new_files,
+	    OKV("type", "state"), OKV("files", "new"), ol);
 	ometric_set_int_with_labels(rpki_repo_obj, in->del_files,
 	    OKV("type", "state"), OKV("files", "deleted"), ol);
 	ometric_set_int_with_labels(rpki_repo_obj, in->extra_files,
diff --git a/usr.sbin/rpki-client/print.c b/usr.sbin/rpki-client/print.c
index bb92910c1..9ef44b736 100644
--- a/usr.sbin/rpki-client/print.c
+++ b/usr.sbin/rpki-client/print.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: print.c,v 1.51 2024/02/22 19:29:55 tb Exp $ */
+/*	$OpenBSD: print.c,v 1.52 2024/02/26 10:02:37 job Exp $ */
 /*
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -734,6 +734,7 @@ takey_print(char *name, const struct takey *t)
 			json_do_string("uri", t->uris[i]);
 		json_do_end();
 		json_do_string("spki", spki);
+		json_do_end();
 	} else {
 		printf("TAL derived from the '%s' Trust Anchor Key:\n\n", name);
 
diff --git a/usr.sbin/rpki-client/repo.c b/usr.sbin/rpki-client/repo.c
index 60354de7f..77967f4ac 100644
--- a/usr.sbin/rpki-client/repo.c
+++ b/usr.sbin/rpki-client/repo.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: repo.c,v 1.53 2024/02/22 12:49:42 job Exp $ */
+/*	$OpenBSD: repo.c,v 1.54 2024/02/26 15:40:33 job Exp $ */
 /*
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -1403,6 +1403,18 @@ repo_check_timeout(int timeout)
 	return timeout;
 }
 
+/*
+ * Update repo-specific stats when files are going to be moved
+ * from DIR_TEMP to DIR_VALID.
+ */
+void
+repostats_new_files_inc(struct repo *rp, const char *file)
+{
+	if (strncmp(file, ".rsync/", strlen(".rsync/")) == 0 ||
+	    strncmp(file, ".rrdp/", strlen(".rrdp/")) == 0)
+		rp->repostats.new_files++;
+}
+
 /*
  * Update stats object of repository depending on rtype and subtype.
  */
diff --git a/usr.sbin/rpki-client/rsync.c b/usr.sbin/rpki-client/rsync.c
index 808a9207a..ca838e08f 100644
--- a/usr.sbin/rpki-client/rsync.c
+++ b/usr.sbin/rpki-client/rsync.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rsync.c,v 1.48 2023/11/24 14:05:47 job Exp $ */
+/*	$OpenBSD: rsync.c,v 1.49 2024/02/26 20:37:27 job Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -159,6 +159,7 @@ exec_rsync(const char *prog, const char *bind_addr, char *uri, char *dst,
 		args[i++] = "--include=*.roa";
 		args[i++] = "--include=*.asa";
 		args[i++] = "--include=*.tak";
+		args[i++] = "--include=*.spl";
 		args[i++] = "--exclude=*";
 		if (bind_addr != NULL) {
 			args[i++] = "--address";
diff --git a/usr.sbin/tcpdump/tcpdump.8 b/usr.sbin/tcpdump/tcpdump.8
index e457cf375..d89a056c3 100644
--- a/usr.sbin/tcpdump/tcpdump.8
+++ b/usr.sbin/tcpdump/tcpdump.8
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: tcpdump.8,v 1.115 2023/04/12 09:55:22 jsg Exp $
+.\"	$OpenBSD: tcpdump.8,v 1.116 2024/02/26 06:49:38 jmc Exp $
 .\"
 .\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996
 .\"	The Regents of the University of California.  All rights reserved.
@@ -19,7 +19,7 @@
 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 .\"
-.Dd $Mdocdate: April 12 2023 $
+.Dd $Mdocdate: February 26 2024 $
 .Dt TCPDUMP 8
 .Os
 .Sh NAME
@@ -958,7 +958,7 @@ and frame subtype matches the specified
 If the specified
 .Ar wlan_type
 is
-.Cm mgtv ,
+.Cm mgt ,
 then valid values for
 .Ar wlan_subtype
 are