diff --git a/distrib/sets/lists/comp/mi b/distrib/sets/lists/comp/mi
index b39a964ee..b828952e2 100644
--- a/distrib/sets/lists/comp/mi
+++ b/distrib/sets/lists/comp/mi
@@ -1959,7 +1959,6 @@
 ./usr/share/man/man3/EVP_sha3_224.3
 ./usr/share/man/man3/EVP_sm3.3
 ./usr/share/man/man3/EVP_sm4_cbc.3
-./usr/share/man/man3/EVP_whirlpool.3
 ./usr/share/man/man3/EXTENDED_KEY_USAGE_new.3
 ./usr/share/man/man3/GENERAL_NAME_new.3
 ./usr/share/man/man3/HMAC.3
diff --git a/lib/libc/stdio/fclose.3 b/lib/libc/stdio/fclose.3
index cedcaed15..91b22448d 100644
--- a/lib/libc/stdio/fclose.3
+++ b/lib/libc/stdio/fclose.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: fclose.3,v 1.10 2024/08/12 20:53:09 guenther Exp $
+.\"	$OpenBSD: fclose.3,v 1.11 2024/08/30 03:44:48 guenther Exp $
 .\"
 .\" Copyright (c) 1990, 1991, 1993
 .\"	The Regents of the University of California.  All rights reserved.
@@ -31,7 +31,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: August 12 2024 $
+.Dd $Mdocdate: August 30 2024 $
 .Dt FCLOSE 3
 .Os
 .Sh NAME
@@ -47,11 +47,8 @@ The
 function dissociates the named
 .Fa stream
 from its underlying file or set of functions.
-If the stream was being used for output then any buffered data is written
-first,
-while if the stream was being used for input then the underlying
-file position may be updated,
-as if via
+If the stream was being used for output, any buffered data is written
+first, using
 .Xr fflush 3 .
 .Sh RETURN VALUES
 Upon successful completion 0 is returned.
@@ -86,7 +83,7 @@ or
 The
 .Fn fclose
 function conforms to
-.St -p1003.1-2024 .
+.St -ansiC .
 .Sh HISTORY
 The
 .Fn fclose
diff --git a/lib/libc/stdio/fclose.c b/lib/libc/stdio/fclose.c
index 07026facc..6324a1164 100644
--- a/lib/libc/stdio/fclose.c
+++ b/lib/libc/stdio/fclose.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fclose.c,v 1.11 2024/08/12 20:53:09 guenther Exp $ */
+/*	$OpenBSD: fclose.c,v 1.12 2024/08/30 03:44:48 guenther Exp $ */
 /*-
  * Copyright (c) 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -47,7 +47,7 @@ fclose(FILE *fp)
 	}
 	FLOCKFILE(fp);
 	WCIO_FREE(fp);
-	r = __sflush(fp);
+	r = fp->_flags & __SWR ? __sflush(fp) : 0;
 	if (fp->_close != NULL && (*fp->_close)(fp->_cookie) < 0)
 		r = EOF;
 	if (fp->_flags & __SMBF)
diff --git a/lib/libc/stdio/fflush.3 b/lib/libc/stdio/fflush.3
index 0ce4579cf..7b9112acd 100644
--- a/lib/libc/stdio/fflush.3
+++ b/lib/libc/stdio/fflush.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: fflush.3,v 1.16 2024/08/13 05:52:09 jmc Exp $
+.\"	$OpenBSD: fflush.3,v 1.17 2024/08/30 03:44:48 guenther Exp $
 .\"
 .\" Copyright (c) 1990, 1991, 1993
 .\"	The Regents of the University of California.  All rights reserved.
@@ -31,7 +31,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: August 13 2024 $
+.Dd $Mdocdate: August 30 2024 $
 .Dt FFLUSH 3
 .Os
 .Sh NAME
@@ -84,9 +84,7 @@ For input streams this discards any input read from the underlying object
 but not yet obtained via
 .Xr getc 3 ;
 this includes any text pushed back via
-.Xr ungetc 3
-or
-.Xr ungetwc 3 .
+.Xr ungetc 3 .
 .Sh RETURN VALUES
 Upon successful completion 0 is returned.
 Otherwise,
@@ -98,7 +96,9 @@ is set to indicate the error.
 .Bl -tag -width Er
 .It Bq Er EBADF
 .Fa stream
-is not an open stream.
+is not an open stream or, in the case of
+.Fn fflush ,
+not a stream open for writing.
 .El
 .Pp
 The function
@@ -116,7 +116,7 @@ for any of the errors specified for the routine
 The
 .Fn fflush
 function conforms to
-.St -p1003.1-2024 .
+.St -ansiC .
 .Sh HISTORY
 A predecessor
 .Fn flush
diff --git a/lib/libc/stdio/fflush.c b/lib/libc/stdio/fflush.c
index 5888e2364..15b9523c5 100644
--- a/lib/libc/stdio/fflush.c
+++ b/lib/libc/stdio/fflush.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fflush.c,v 1.10 2024/08/12 20:53:09 guenther Exp $ */
+/*	$OpenBSD: fflush.c,v 1.11 2024/08/30 03:44:48 guenther Exp $ */
 /*-
  * Copyright (c) 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -33,7 +33,6 @@
 
 #include <errno.h>
 #include <stdio.h>
-#include <stdlib.h>
 #include "local.h"
 
 /* Flush a single file, or (if fp is NULL) all files.  */
@@ -45,7 +44,11 @@ fflush(FILE *fp)
 	if (fp == NULL)
 		return (_fwalk(__sflush_locked));
 	FLOCKFILE(fp);
-	r = __sflush(fp);
+	if ((fp->_flags & (__SWR | __SRW)) == 0) {
+		errno = EBADF;
+		r = EOF;
+	} else
+		r = __sflush(fp);
 	FUNLOCKFILE(fp);
 	return (r);
 }
@@ -55,51 +58,30 @@ int
 __sflush(FILE *fp)
 {
 	unsigned char *p;
-	fpos_t off;
 	int n, t;
 
 	t = fp->_flags;
-	if (t & __SWR) {
-		if ((p = fp->_bf._base) == NULL)
-			return (0);
+	if ((t & __SWR) == 0)
+		return (0);
 
-		n = fp->_p - p;		/* write this much */
+	if ((p = fp->_bf._base) == NULL)
+		return (0);
 
-		/*
-		 * Set these immediately to avoid problems with longjmp and to
-		 * allow exchange buffering (via setvbuf) in user write
-		 * function.
-		 */
-		fp->_p = p;
-		fp->_w = t & (__SLBF|__SNBF) ? 0 : fp->_bf._size;
+	n = fp->_p - p;		/* write this much */
 
-		for (; n > 0; n -= t, p += t) {
-			t = (*fp->_write)(fp->_cookie, (char *)p, n);
-			if (t <= 0) {
-				fp->_flags |= __SERR;
-				return (EOF);
-			}
+	/*
+	 * Set these immediately to avoid problems with longjmp and to allow
+	 * exchange buffering (via setvbuf) in user write function.
+	 */
+	fp->_p = p;
+	fp->_w = t & (__SLBF|__SNBF) ? 0 : fp->_bf._size;
+
+	for (; n > 0; n -= t, p += t) {
+		t = (*fp->_write)(fp->_cookie, (char *)p, n);
+		if (t <= 0) {
+			fp->_flags |= __SERR;
+			return (EOF);
 		}
-	} else if ((t & __SRD) && !(t & __SEOF)) {
-		if (fp->_seek != __sseek || fp->_file < 0) {
-			errno = EBADF;
-			return EOF;
-		}
-
-		off = fp->_r;
-		if (HASUB(fp)) {
-			off += fp->_ur;
-			FREEUB(fp);
-		}
-		if (t & __SOFF) {
-			off = fp->_offset - off;
-			__sseek(fp->_cookie, off, SEEK_SET);
-		} else if (off != 0)
-			__sseek(fp->_cookie, -off, SEEK_CUR);
-
-		WCIO_FREE(fp);
-		fp->_p = fp->_bf._base;
-		fp->_r = 0;
 	}
 	return (0);
 }
diff --git a/lib/libc/stdio/freopen.c b/lib/libc/stdio/freopen.c
index bc6c22060..7cab8c74a 100644
--- a/lib/libc/stdio/freopen.c
+++ b/lib/libc/stdio/freopen.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: freopen.c,v 1.18 2024/08/12 20:53:09 guenther Exp $ */
+/*	$OpenBSD: freopen.c,v 1.19 2024/08/30 03:44:48 guenther Exp $ */
 /*-
  * Copyright (c) 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -75,8 +75,9 @@ freopen(const char *file, const char *mode, FILE *fp)
 		isopen = 0;
 		wantfd = -1;
 	} else {
-		/* flush the stream; POSIX, not ANSI, requires this. */
-		(void) __sflush(fp);
+		/* flush the stream; ANSI doesn't require this. */
+		if (fp->_flags & __SWR)
+			(void) __sflush(fp);
 		/* if close is NULL, closing is a no-op, hence pointless */
 		isopen = fp->_close != NULL;
 		if ((wantfd = fp->_file) < 0 && isopen) {
diff --git a/lib/libc/stdio/fseek.c b/lib/libc/stdio/fseek.c
index a65867d3f..82a0b4be5 100644
--- a/lib/libc/stdio/fseek.c
+++ b/lib/libc/stdio/fseek.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fseek.c,v 1.15 2024/08/12 20:53:09 guenther Exp $ */
+/*	$OpenBSD: fseek.c,v 1.16 2024/08/30 03:44:48 guenther Exp $ */
 /*-
  * Copyright (c) 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -116,8 +116,7 @@ fseeko(FILE *fp, off_t offset, int whence)
 	/*
 	 * Can only optimise if:
 	 *	reading (and not reading-and-writing);
-	 *	not unbuffered;
-	 *	not immediately after an fflush(); and
+	 *	not unbuffered; and
 	 *	this is a `regular' Unix file (and hence seekfn==__sseek).
 	 * We must check __NBF first, because it is possible to have __NBF
 	 * and __SOPT both set.
@@ -126,8 +125,6 @@ fseeko(FILE *fp, off_t offset, int whence)
 		__smakebuf(fp);
 	if (fp->_flags & (__SWR | __SRW | __SNBF | __SNPT))
 		goto dumb;
-	if (fp->_r == 0 && (fp->_p == NULL || fp->_p == fp->_bf._base))
-		goto dumb;
 	if ((fp->_flags & __SOPT) == 0) {
 		if (seekfn != __sseek ||
 		    fp->_file < 0 || fstat(fp->_file, &st) == -1 ||
@@ -231,7 +228,7 @@ fseeko(FILE *fp, off_t offset, int whence)
 	 * do it.  Allow the seek function to change fp->_bf._base.
 	 */
 dumb:
-	if (((fp->_flags & __SWR) && __sflush(fp)) ||
+	if (__sflush(fp) ||
 	    (*seekfn)(fp->_cookie, (fpos_t)offset, whence) == POS_ERR) {
 		FUNLOCKFILE(fp);
 		return (EOF);
diff --git a/lib/libc/stdio/ftell.c b/lib/libc/stdio/ftell.c
index 69e1f0d6e..743e70a86 100644
--- a/lib/libc/stdio/ftell.c
+++ b/lib/libc/stdio/ftell.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ftell.c,v 1.12 2024/08/12 20:53:09 guenther Exp $ */
+/*	$OpenBSD: ftell.c,v 1.13 2024/08/30 03:44:48 guenther Exp $ */
 /*-
  * Copyright (c) 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -55,8 +55,7 @@ ftello(FILE *fp)
 	 * adjust for buffered bytes.
 	 */
 	FLOCKFILE(fp);
-	if (fp->_flags & __SWR)
-		__sflush(fp);	/* may adjust seek offset on append stream */
+	__sflush(fp);		/* may adjust seek offset on append stream */
 	if (fp->_flags & __SOFF)
 		pos = fp->_offset;
 	else {
diff --git a/lib/libc/stdlib/exit.3 b/lib/libc/stdlib/exit.3
index 5e006e53f..22acade86 100644
--- a/lib/libc/stdlib/exit.3
+++ b/lib/libc/stdlib/exit.3
@@ -29,9 +29,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"	$OpenBSD: exit.3,v 1.17 2024/08/12 20:53:09 guenther Exp $
+.\"	$OpenBSD: exit.3,v 1.18 2024/08/30 03:44:48 guenther Exp $
 .\"
-.Dd $Mdocdate: August 12 2024 $
+.Dd $Mdocdate: August 30 2024 $
 .Dt EXIT 3
 .Os
 .Sh NAME
@@ -54,7 +54,9 @@ Call the functions registered with the
 .Xr atexit 3
 function, in the reverse order of their registration.
 .It
-Flush and close all open streams.
+Flush all open output streams.
+.It
+Close all open streams.
 .It
 Unlink all files created with the
 .Xr tmpfile 3
@@ -77,7 +79,6 @@ function never returns.
 .Sh SEE ALSO
 .Xr _exit 2 ,
 .Xr atexit 3 ,
-.Xr fflush 3 ,
 .Xr intro 3 ,
 .Xr sysexits 3 ,
 .Xr tmpfile 3
@@ -85,7 +86,7 @@ function never returns.
 The
 .Fn exit
 function conforms to
-.St -p1003.1-2024 .
+.St -isoC-99 .
 .Sh HISTORY
 An
 .Fn exit
diff --git a/lib/libcrypto/man/ERR_asprintf_error_data.3 b/lib/libcrypto/man/ERR_asprintf_error_data.3
index 67999e9cb..4291dea23 100644
--- a/lib/libcrypto/man/ERR_asprintf_error_data.3
+++ b/lib/libcrypto/man/ERR_asprintf_error_data.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ERR_asprintf_error_data.3,v 1.2 2017/02/21 07:15:21 jmc Exp $
+.\" $OpenBSD: ERR_asprintf_error_data.3,v 1.3 2024/08/29 20:23:21 tb Exp $
 .\"
 .\" Copyright (c) 2017 Bob Beck <beck@openbsd.org>
 .\"
@@ -13,7 +13,7 @@
 .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-.Dd $Mdocdate: February 21 2017 $
+.Dd $Mdocdate: August 29 2024 $
 .Dt ERR_ASPRINTF_ERROR_DATA 3
 .Os
 .Sh NAME
@@ -41,9 +41,9 @@ fails, the string "malloc failed" is associated instead.
 .Pp
 .Nm
 is intended to be used instead of the OpenSSL functions
-.Xr ERR_add_error_data 3
+.Fn ERR_add_error_data
 and
-.Xr ERR_add_error_vdata 3 .
+.Fn ERR_add_error_vdata .
 .Sh SEE ALSO
 .Xr ERR 3 ,
 .Xr ERR_put_error 3 ,
diff --git a/lib/libcrypto/man/ERR_put_error.3 b/lib/libcrypto/man/ERR_put_error.3
index 7eac5e415..37e1b4d1a 100644
--- a/lib/libcrypto/man/ERR_put_error.3
+++ b/lib/libcrypto/man/ERR_put_error.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ERR_put_error.3,v 1.10 2022/03/31 17:27:16 naddy Exp $
+.\"	$OpenBSD: ERR_put_error.3,v 1.11 2024/08/29 20:23:21 tb Exp $
 .\"	OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
 .\"
 .\" This file was written by Ulf Moeller <ulf@openssl.org>.
@@ -48,13 +48,11 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: March 31 2022 $
+.Dd $Mdocdate: August 29 2024 $
 .Dt ERR_PUT_ERROR 3
 .Os
 .Sh NAME
-.Nm ERR_put_error ,
-.Nm ERR_add_error_data ,
-.Nm ERR_add_error_vdata
+.Nm ERR_put_error
 .Nd record an OpenSSL error
 .Sh SYNOPSIS
 .In openssl/err.h
@@ -66,16 +64,6 @@
 .Fa "const char *file"
 .Fa "int line"
 .Fc
-.Ft void
-.Fo ERR_add_error_data
-.Fa "int num"
-.Fa ...
-.Fc
-.Ft void
-.Fo ERR_add_error_vdata
-.Fa "int num"
-.Fa "va_list arg"
-.Fc
 .Sh DESCRIPTION
 .Fn ERR_put_error
 adds an error code to the thread's error queue.
@@ -91,20 +79,6 @@ of
 .Fa file .
 This function is usually called by a macro.
 .Pp
-.Fn ERR_add_error_data
-associates the concatenation of its
-.Fa num
-string arguments with the error code added last.
-.Fn ERR_add_error_vdata
-is similar except the argument is a
-.Vt va_list .
-Use of
-.Fn ERR_add_error_data
-and
-.Fn ERR_add_error_vdata
-is deprecated inside of LibreSSL in favour of
-.Xr ERR_asprintf_error_data 3 .
-.Pp
 .Xr ERR_load_strings 3
 can be used to register error strings so that the application can
 generate human-readable error messages for the error code.
@@ -147,12 +121,5 @@ macro.
 .Xr ERR_load_strings 3
 .Sh HISTORY
 .Fn ERR_put_error
-first appeared in SSLeay 0.4.4.
-.Fn ERR_add_error_data
-first appeared in SSLeay 0.9.0.
-Both functions have been available since
+first appeared in SSLeay 0.4.4 and has been available since
 .Ox 2.4 .
-.Pp
-.Fn ERR_add_error_vdata
-first appeared in OpenSSL 1.0.1 and has been available since
-.Ox 5.3 .
diff --git a/lib/libcrypto/man/EVP_DigestInit.3 b/lib/libcrypto/man/EVP_DigestInit.3
index c82572500..e2fd6525a 100644
--- a/lib/libcrypto/man/EVP_DigestInit.3
+++ b/lib/libcrypto/man/EVP_DigestInit.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: EVP_DigestInit.3,v 1.34 2024/07/21 08:36:43 tb Exp $
+.\" $OpenBSD: EVP_DigestInit.3,v 1.35 2024/08/30 07:03:19 tb Exp $
 .\" full merge up to: OpenSSL 7f572e95 Dec 2 13:57:04 2015 +0000
 .\" selective merge up to: OpenSSL 24a535ea Sep 22 13:14:20 2020 +0100
 .\"
@@ -70,7 +70,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: July 21 2024 $
+.Dd $Mdocdate: August 30 2024 $
 .Dt EVP_DIGESTINIT 3
 .Os
 .Sh NAME
@@ -536,7 +536,6 @@ main(int argc, char *argv[])
 .Xr EVP_SignInit 3 ,
 .Xr EVP_sm3 3 ,
 .Xr EVP_VerifyInit 3 ,
-.Xr EVP_whirlpool 3 ,
 .Xr HMAC 3 ,
 .Xr OCSP_basic_sign 3 ,
 .Xr OCSP_request_sign 3 ,
diff --git a/lib/libcrypto/man/EVP_whirlpool.3 b/lib/libcrypto/man/EVP_whirlpool.3
deleted file mode 100644
index 29f85bc1a..000000000
--- a/lib/libcrypto/man/EVP_whirlpool.3
+++ /dev/null
@@ -1,83 +0,0 @@
-.\" $OpenBSD: EVP_whirlpool.3,v 1.1 2019/08/25 17:08:20 schwarze Exp $
-.\" full merge up to: OpenSSL bbda8ce9 Oct 31 15:43:01 2017 +0800
-.\"
-.\" This file was written by Ronald Tse <ronald.tse@ribose.com>.
-.\" Copyright (c) 2017 The OpenSSL Project.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\"
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\"
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in
-.\"    the documentation and/or other materials provided with the
-.\"    distribution.
-.\"
-.\" 3. All advertising materials mentioning features or use of this
-.\"    software must display the following acknowledgment:
-.\"    "This product includes software developed by the OpenSSL Project
-.\"    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
-.\"
-.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
-.\"    endorse or promote products derived from this software without
-.\"    prior written permission. For written permission, please contact
-.\"    openssl-core@openssl.org.
-.\"
-.\" 5. Products derived from this software may not be called "OpenSSL"
-.\"    nor may "OpenSSL" appear in their names without prior written
-.\"    permission of the OpenSSL Project.
-.\"
-.\" 6. Redistributions of any form whatsoever must retain the following
-.\"    acknowledgment:
-.\"    "This product includes software developed by the OpenSSL Project
-.\"    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
-.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
-.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
-.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-.\" OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.Dd $Mdocdate: August 25 2019 $
-.Dt EVP_WHIRLPOOL 3
-.Os
-.Sh NAME
-.Nm EVP_whirlpool
-.Nd WHIRLPOOL hash function for EVP
-.Sh SYNOPSIS
-.In openssl/evp.h
-.Ft const EVP_MD *
-.Fn EVP_whirlpool void
-.Sh DESCRIPTION
-WHIRLPOOL is a cryptographic hash function
-producing a message digest of 512 bits.
-.Sh RETURN VALUES
-.Fn EVP_whirlpool
-returns a pointer to a static
-.Vt EVP_MD
-object implementing the WHIRLPOOL hash function.
-.Sh SEE ALSO
-.Xr evp 3 ,
-.Xr EVP_DigestInit 3
-.Sh STANDARDS
-ISO/IEC 10118-3:2004
-.Sh HISTORY
-.Fn EVP_whirlpool
-first appeared in OpenSSL 1.0.0 and has been available since
-.Ox 4.9 .
-.Sh AUTHORS
-.An -nosplit
-The WHIRLPOOL algorithm was designed by
-.An Vincent Rijmen
-and
-.An Paulo S. L. M. Barreto .
diff --git a/lib/libcrypto/man/HMAC.3 b/lib/libcrypto/man/HMAC.3
index dc32a111b..a515014fc 100644
--- a/lib/libcrypto/man/HMAC.3
+++ b/lib/libcrypto/man/HMAC.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: HMAC.3,v 1.22 2024/07/21 08:36:43 tb Exp $
+.\" $OpenBSD: HMAC.3,v 1.23 2024/08/29 20:21:53 tb Exp $
 .\" full merge up to: OpenSSL crypto/hmac a528d4f0 Oct 27 13:40:11 2015 -0400
 .\" selective merge up to: OpenSSL man3/HMAC b3696a55 Sep 2 09:35:50 2017 -0400
 .\"
@@ -52,7 +52,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: July 21 2024 $
+.Dd $Mdocdate: August 29 2024 $
 .Dt HMAC 3
 .Os
 .Sh NAME
@@ -61,7 +61,6 @@
 .Nm HMAC_CTX_reset ,
 .Nm HMAC_CTX_free ,
 .Nm HMAC_Init_ex ,
-.Nm HMAC_Init ,
 .Nm HMAC_Update ,
 .Nm HMAC_Final ,
 .Nm HMAC_CTX_copy ,
@@ -100,13 +99,6 @@
 .Fa "ENGINE *engine"
 .Fc
 .Ft int
-.Fo HMAC_Init
-.Fa "HMAC_CTX *ctx"
-.Fa "const void *key"
-.Fa "int key_len"
-.Fa "const EVP_MD *md"
-.Fc
-.Ft int
 .Fo HMAC_Update
 .Fa "HMAC_CTX *ctx"
 .Fa "const unsigned char *data"
@@ -229,12 +221,6 @@ argument is always ignored and passing
 .Dv NULL
 is recommended.
 .Pp
-.Fn HMAC_Init
-is a deprecated wrapper around
-.Fn HMAC_Init_ex
-which performs no longer useful extra initialization in
-some circumstances.
-.Pp
 .Fn HMAC_Update
 can be called repeatedly with chunks of the message to be authenticated
 .Pq Fa len No bytes at Fa data .
@@ -302,7 +288,6 @@ or 0 on error.
 RFC 2104
 .Sh HISTORY
 .Fn HMAC ,
-.Fn HMAC_Init ,
 .Fn HMAC_Update ,
 .Fn HMAC_Final ,
 and
diff --git a/lib/libcrypto/man/Makefile b/lib/libcrypto/man/Makefile
index f2f23a073..11c990ebd 100644
--- a/lib/libcrypto/man/Makefile
+++ b/lib/libcrypto/man/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.291 2024/08/24 09:15:36 tb Exp $
+# $OpenBSD: Makefile,v 1.292 2024/08/29 20:25:13 tb Exp $
 
 .include <bsd.own.mk>
 
@@ -207,7 +207,6 @@ MAN=	\
 	EVP_sha3_224.3 \
 	EVP_sm3.3 \
 	EVP_sm4_cbc.3 \
-	EVP_whirlpool.3 \
 	EXTENDED_KEY_USAGE_new.3 \
 	GENERAL_NAME_new.3 \
 	HMAC.3 \
diff --git a/lib/libcrypto/man/X509_STORE_CTX_set_flags.3 b/lib/libcrypto/man/X509_STORE_CTX_set_flags.3
index db991bd52..04bb202ba 100644
--- a/lib/libcrypto/man/X509_STORE_CTX_set_flags.3
+++ b/lib/libcrypto/man/X509_STORE_CTX_set_flags.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: X509_STORE_CTX_set_flags.3,v 1.7 2024/01/12 19:28:02 tb Exp $
+.\" $OpenBSD: X509_STORE_CTX_set_flags.3,v 1.8 2024/08/29 20:21:10 tb Exp $
 .\" full merge up to: OpenSSL aae41f8c Jun 25 09:47:15 2015 +0100
 .\" selective merge up to: OpenSSL 24a535ea Sep 22 13:14:20 2020 +0100
 .\"
@@ -67,7 +67,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: January 12 2024 $
+.Dd $Mdocdate: August 29 2024 $
 .Dt X509_STORE_CTX_SET_FLAGS 3
 .Os
 .Sh NAME
@@ -324,13 +324,3 @@ It is therefore recommended to use
 and
 .Xr X509_VERIFY_PARAM_set_purpose 3
 instead.
-.Pp
-The confusingly named
-.Dv X509_TRUST_DEFAULT
-is less than
-.Dv X509_TRUST_MIN
-and different implementations treat it as valid or invalid
-when used as an associated trust or as a
-.Fa trust
-argument for
-.Fn X509_STORE_CTX_set_trust .
diff --git a/lib/libcrypto/man/evp.3 b/lib/libcrypto/man/evp.3
index aea8f051f..378255ad4 100644
--- a/lib/libcrypto/man/evp.3
+++ b/lib/libcrypto/man/evp.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: evp.3,v 1.31 2024/08/24 09:15:36 tb Exp $
+.\" $OpenBSD: evp.3,v 1.32 2024/08/30 07:03:19 tb Exp $
 .\" full merge up to: OpenSSL man7/evp 24a535ea Sep 22 13:14:20 2020 +0100
 .\"
 .\" This file was written by Ulf Moeller <ulf@openssl.org>,
@@ -51,7 +51,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: August 24 2024 $
+.Dd $Mdocdate: August 30 2024 $
 .Dt EVP 3
 .Os
 .Sh NAME
@@ -219,7 +219,6 @@ family of functions provides base64 encoding and decoding.
 .Xr EVP_sm3 3 ,
 .Xr EVP_sm4_cbc 3 ,
 .Xr EVP_VerifyInit 3 ,
-.Xr EVP_whirlpool 3 ,
 .Xr HMAC 3 ,
 .Xr OCSP_basic_sign 3 ,
 .Xr OCSP_request_sign 3 ,
diff --git a/regress/lib/libcrypto/free/freenull.c.head b/regress/lib/libcrypto/free/freenull.c.head
index 3a6aa8bc8..db652bfb0 100644
--- a/regress/lib/libcrypto/free/freenull.c.head
+++ b/regress/lib/libcrypto/free/freenull.c.head
@@ -1,10 +1,9 @@
-/*	$OpenBSD: freenull.c.head,v 1.9 2024/02/29 20:00:53 tb Exp $	*/
+/*	$OpenBSD: freenull.c.head,v 1.10 2024/08/30 05:00:38 tb Exp $	*/
 
 #include <openssl/asn1.h>
 #include <openssl/cmac.h>
 #include <openssl/cms.h>
 #include <openssl/comp.h>
-#include <openssl/conf_api.h>
 #include <openssl/ct.h>
 #include <openssl/engine.h>
 #ifndef OPENSSL_NO_GOST
diff --git a/regress/lib/libcrypto/free/freenull.c.tail b/regress/lib/libcrypto/free/freenull.c.tail
index 67bd3b74e..21b0bcf40 100644
--- a/regress/lib/libcrypto/free/freenull.c.tail
+++ b/regress/lib/libcrypto/free/freenull.c.tail
@@ -1,8 +1,6 @@
-/*	$OpenBSD: freenull.c.tail,v 1.3 2024/03/30 09:41:25 tb Exp $	*/
+/*	$OpenBSD: freenull.c.tail,v 1.4 2024/08/30 05:00:38 tb Exp $	*/
 
 	BIO_free_all(NULL);
-	NCONF_free_data(NULL);
-	_CONF_free_data(NULL);
 
 	sk_ASN1_OBJECT_pop_free(NULL, NULL);
 	sk_CONF_VALUE_pop_free(NULL, NULL);
diff --git a/share/man/man4/etherip.4 b/share/man/man4/etherip.4
index ad037d153..db6037354 100644
--- a/share/man/man4/etherip.4
+++ b/share/man/man4/etherip.4
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: etherip.4,v 1.6 2018/01/12 04:36:44 deraadt Exp $
+.\"	$OpenBSD: etherip.4,v 1.9 2024/08/30 09:39:07 dlg Exp $
 .\"
 .\" Copyright (c) 2015 YASUOKA Masahiko <yasuoka@openbsd.org>
 .\"
@@ -16,7 +16,7 @@
 .\"
 .\" The following requests are required for all man pages.
 .\"
-.Dd $Mdocdate: January 12 2018 $
+.Dd $Mdocdate: August 30 2024 $
 .Dt ETHERIP 4
 .Os
 .Sh NAME
@@ -27,8 +27,9 @@
 .Sh DESCRIPTION
 The
 .Nm
-interface is a pseudo-device for tunnelling Ethernet frames across IP[46]
-networks using RFC 3378 EtherIP encapsulation.
+driver provides point-to-point tunnel interfaces for carrying
+Ethernet frames across IPv4 and IPv6 networks using RFC 3378 EtherIP
+encapsulation.
 .Pp
 An
 .Nm
@@ -45,11 +46,6 @@ This can be done using
 command (which uses the
 .Dv SIOCSLIFPHYADDR
 ioctl).
-.Pp
-The
-.Nm
-interface must be made a member of a
-.Xr bridge 4 .
 The
 .Xr sysctl 2
 variable
@@ -57,115 +53,117 @@ variable
 must be set to 1, unless
 .Xr ipsec 4
 is being used to protect the traffic.
-Ethernet frames are then encapsulated and sent across the network
-to another
-.Xr bridge 4 ,
-which decapsulates the datagram and processes the resulting Ethernet
-frame as if it had originated on a normal Ethernet interface.
-This effectively allows a layer 2 network to be extended from one point to
-another, possibly through the Internet.
-This mechanism may be used in
-conjunction with IPsec by specifying the appropriate IPsec flows
-between the two bridges.
-To only protect the bridge traffic between
-the two bridges, the transport protocol 97 (etherip) selector may be
-used in
-.Xr ipsec.conf 5 .
-Otherwise, the Ethernet frames will be sent in the clear between the
-two bridges.
-.Sh EXAMPLES
-Given two physically separate Ethernet networks, a bridge can
-be used as follows to make them appear as the same local area network.
-If bridge1 on network1 has the external IP address 1.2.3.4 on em0,
-bridge2 on network2 has the external IP address 4.3.2.1 on em0, and
-both bridges have em1 on their internal network (network1 and network2,
-respectively), the following configuration can be used to bridge
-network1 and network2.
 .Pp
-First create the bridge interface,
-adding the encapsulation interface and internal Ethernet interface
-to the bridge interface:
+.Nm
+interfaces can configured as part of an Ethernet bridges such as
+.Xr veb 4 ,
+.Xr tpmr 4 ,
+and
+.Xr bridge 4
+to extend the connectivity of Ethernet networks across IP networks,
+possibly across the Internet.
+.Pp
+The EtherIP protocol does not provide any integrated security
+features.
+EtherIP should only be deployed on trusted private networks, or
+protected with IPsec to add authentication and encryption for
+confidentiality.
+IPsec is especially recommended when transporting EtherIP over the
+public Internet.
+EtherIP encapsulated packets may be protected with IPsec by specifying
+the appropriate IPsec flows between the two endpoints.
+To only protect the encapsulated EtherIP traffic between the tunnel
+enpoints the IP transport protocol 97 (etherip) selector may be used
+in
+.Xr ipsec.conf 5
+or
+.Xr iked.conf 5 .
+.Sh EXAMPLES
+Given two physically separate Ethernet networks,
+.Nm
+can be used as follows to make them appear as the same local area
+network.
+If host gw1 has the external IP address 192.0.2.10 and is connected
+to network1 on em1, and host gw2 has the external IP address
+198.51.100.14 and is connected to network2 on ix1, the following
+configuration can be used to bridge network1 and network2.
+.Pp
+First create the a bridge using a
+.Xr veb 4
+interface,
+adding the
+.Nm
+interface and internal Ethernet interface to the bridge.
+.Pp
+On gw1:
 .Bd -literal -offset indent
-# ifconfig bridge0 add etherip0 add em1
+gw1# ifconfig etherip0 create tunnel 192.0.2.10 198.51.100.14
+gw1# ifconfig veb0 create add etherip0 add em1
 .Ed
 .Pp
-Create and configure the etherip0 interface:
+On gw2:
 .Bd -literal -offset indent
-(on bridge 1) # ifconfig etherip0 tunnel 1.2.3.4 4.3.2.1
-(on bridge 2) # ifconfig etherip0 tunnel 4.3.2.1 1.2.3.4
+gw2# ifconfig etherip0 create tunnel 198.51.100.14 192.0.2.10
+gw2# ifconfig veb0 create add etherip0 add ix1
 .Ed
 .Pp
 Create Security Associations (SAs) between the external IP address of each
 bridge and matching ingress flows by using the following
 .Xr ipsec.conf 5
-file on bridge1:
+file on gw1:
 .Bd -literal -offset indent
-esp from 1.2.3.4 to 4.3.2.1 spi 0x4242:0x4243 \e
+esp from 198.51.100.14 to 192.0.2.10 spi 0x4242:0x4243 \e
         authkey file "auth1:auth2" enckey file "enc1:enc2"
-flow esp proto etherip from 1.2.3.4 to 4.3.2.1
+flow esp proto etherip from 198.51.100.14 to 192.0.2.10
 .Ed
 .Pp
 Now load these rules into the kernel by issuing the
 .Xr ipsecctl 8
 command:
 .Bd -literal -offset indent
-# ipsecctl -f ipsec.conf
+gw1# ipsecctl -f ipsec.conf
 .Ed
 .Pp
 Appropriate
 .Xr ipsec.conf 5
-for bridge2:
+for gw2:
 .Bd -literal -offset indent
-esp from 4.3.2.1 to 1.2.3.4 spi 0x4243:0x4242 \e
+esp from 198.51.100.14 to 192.0.2.10 spi 0x4243:0x4242 \e
         authkey file "auth2:auth1" enckey file "enc2:enc1"
-flow esp proto etherip from 4.3.2.1 to 1.2.3.4
+flow esp proto etherip from 198.51.100.14 to 192.0.2.10
 .Ed
 .Pp
 And load them:
 .Bd -literal -offset indent
-# ipsecctl -f ipsec.conf
+gw2# ipsecctl -f ipsec.conf
 .Ed
 .Pp
-To use dynamic (as opposed to static) keying,
-use this
-.Xr ipsec.conf 5
-on bridge1:
+Finally, bring all the interfaces up (if not already up).
+.Pp
+On gw1:
 .Bd -literal -offset indent
-ike esp proto etherip from 1.2.3.4 to 4.3.2.1
+gw1# ifconfig em1 up
+gw1# ifconfig etherip0 up
+gw1# ifconfig veb0 up
 .Ed
 .Pp
-And on bridge2:
+On gw2:
 .Bd -literal -offset indent
-ike esp proto etherip from 4.3.2.1 to 1.2.3.4
+gw1# ifconfig ix1 up
+gw1# ifconfig etherip0 up
+gw1# ifconfig veb0 up
 .Ed
-.Pp
-Bring up the internal interface (if not already up) and encapsulation
-interface:
-.Bd -literal -offset indent
-# ifconfig em1 up
-# ifconfig etherip0 up
-.Ed
-.Pp
-Finally, bring the bridge interface up and allow it to start processing
-frames:
-.Pp
-.Dl # ifconfig bridge0 up
-.Pp
-The internal interface on each bridge need not have an IP
-address: the bridge can function without it.
-.Pp
-Note:  It is possible to put the above commands in the
-.Xr hostname.if 5
-files, using the
-.Sq !\&
-operator.
 .Sh SEE ALSO
 .Xr sysctl 2 ,
 .Xr bridge 4 ,
 .Xr inet 4 ,
 .Xr inet6 4 ,
 .Xr ipsec 4 ,
+.Xr tpmr 4 ,
+.Xr veb 4 ,
 .Xr hostname.if 5 ,
+.Xr iked.conf 5 ,
+.Xr ipsec.conf 5 ,
 .Xr ifconfig 8 ,
 .Xr netstart 8
 .Sh STANDARDS
diff --git a/share/man/man4/sec.4 b/share/man/man4/sec.4
index c0a940c2b..79c86a6c8 100644
--- a/share/man/man4/sec.4
+++ b/share/man/man4/sec.4
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sec.4,v 1.2 2023/08/07 16:29:36 jmc Exp $
+.\" $OpenBSD: sec.4,v 1.3 2024/08/30 13:09:10 dlg Exp $
 .\"
 .\" Copyright (c) 2023 David Gwynne <dlg@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: August 7 2023 $
+.Dd $Mdocdate: August 30 2024 $
 .Dt SEC 4
 .Os
 .Sh NAME
@@ -46,6 +46,8 @@ and
 .Xr isakmpd 8
 (the latter via
 .Xr ipsecctl 8 ) .
+.\" These IPsec IKE daemons negotiate ESP tunnel mode between 0.0.0.0/0
+.\" and 0.0.0.0/0.
 .Pp
 .Nm
 interfaces can be created at runtime using the
@@ -57,6 +59,73 @@ configuration file for
 The interface itself can be configured with
 .Xr ifconfig 8 ;
 see its manual page for more information.
+.Sh EXAMPLES
+.Nm
+can be used to provide secure and confidential IP connectivity
+between sites over the public internet.
+For example, a cloud provider may provide connectivity between
+networks they host for a customer, and that customers own
+.Dq on premises
+networks using IPsec tunnels.
+.Ox
+can be set up on the customer side given the following parameters:
+.Pp
+.Bl -tag -width Customer-Gateway -offset indent -compact
+.It Pre-Shared Key
+7kA7evdkd50Q5YdCCF9t8eftgEgL4vk2
+.El
+.Pp
+Outside IP Addresses:
+.Bl -tag -width Customer-Gateway -offset indent -compact
+.It Customer Gateway
+192.0.2.8
+.It Provider Gateway
+198.51.100.14
+.El
+.Pp
+Inside IP Addresses:
+.Bl -tag -width Customer-Gateway -offset indent -compact
+.It Customer Gateway
+169.254.229.42/30
+.It Provider Gateway
+169.254.229.41/30
+.El
+.Pp
+A
+.Nm
+interface can be configured on the customer gateway:
+.Bd -literal -offset indent
+# ifconfig sec0 create
+# ifconfig sec0 tunnel 169.254.229.42/30 169.254.229.41
+# ifconfig sec0 up
+.Ed
+.Pp
+.Xr iked 8
+can be used for IKEv2 negotiation of the IPsec tunnel with the following
+.Xr iked.conf 5
+configuration:
+.Bd -literal -offset indent
+ikev2 "s2s" active \\
+	from any to any \\
+	local 192.0.2.8 peer 198.51.100.14 \\
+	psk "7kA7evdkd50Q5YdCCF9t8eftgEgL4vk2" \\
+	iface sec0
+.Ed
+.Pp
+Once
+.Xr iked 8
+is running with this configuration, communication between the
+customer and provider gateways is enabled.
+.Pp
+Routes to networks hosted by the provider can be added using the
+providers
+.Dq inside IP
+address as the gateway address, or negotiated using a dynamic routing
+protocol.
+Multiple
+.Nm
+interfaces may be configured to talk to separate provider gateways,
+providing redundancy or multiple paths between sites.
 .Sh SEE ALSO
 .Xr ipsec 4 ,
 .Xr netintro 4 ,
diff --git a/sys/arch/amd64/amd64/pmap.c b/sys/arch/amd64/amd64/pmap.c
index 413a69c52..cf8e59287 100644
--- a/sys/arch/amd64/amd64/pmap.c
+++ b/sys/arch/amd64/amd64/pmap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pmap.c,v 1.171 2024/08/08 15:57:22 dv Exp $	*/
+/*	$OpenBSD: pmap.c,v 1.172 2024/08/29 20:13:42 dv Exp $	*/
 /*	$NetBSD: pmap.c,v 1.3 2003/05/08 18:13:13 thorpej Exp $	*/
 
 /*
@@ -334,9 +334,11 @@ static int pmap_is_active(struct pmap *, struct cpu_info *);
 paddr_t pmap_map_ptes(struct pmap *);
 struct pv_entry *pmap_remove_pv(struct vm_page *, struct pmap *, vaddr_t);
 void pmap_do_remove(struct pmap *, vaddr_t, vaddr_t, int);
+#if NVMM > 0
 void pmap_remove_ept(struct pmap *, vaddr_t, vaddr_t);
 void pmap_do_remove_ept(struct pmap *, vaddr_t);
 int pmap_enter_ept(struct pmap *, vaddr_t, paddr_t, vm_prot_t);
+#endif /* NVMM > 0 */
 int pmap_remove_pte(struct pmap *, struct vm_page *, pt_entry_t *,
     vaddr_t, int, struct pv_entry **);
 void pmap_remove_ptes(struct pmap *, struct vm_page *, vaddr_t,
@@ -1783,9 +1785,11 @@ pmap_remove_pte(struct pmap *pmap, struct vm_page *ptp, pt_entry_t *pte,
 void
 pmap_remove(struct pmap *pmap, vaddr_t sva, vaddr_t eva)
 {
+#if NVMM > 0
 	if (pmap->pm_type == PMAP_TYPE_EPT)
 		pmap_remove_ept(pmap, sva, eva);
 	else
+#endif /* NVMM > 0 */
 		pmap_do_remove(pmap, sva, eva, PMAP_REMOVE_ALL);
 }
 
@@ -2415,13 +2419,43 @@ pmap_enter_special(vaddr_t va, paddr_t pa, vm_prot_t prot)
 	DPRINTF("%s: setting PTE[%lld] = 0x%llx\n", __func__, l1idx, pd[l1idx]);
 }
 
+#if NVMM > 0
+/*
+ * pmap_convert
+ *
+ * Converts 'pmap' to the new 'mode'.
+ *
+ * Parameters:
+ *  pmap: the pmap to convert
+ *  mode: the new mode (see pmap.h, PMAP_TYPE_xxx)
+ */
+void
+pmap_convert(struct pmap *pmap, int mode)
+{
+	pt_entry_t *pte;
+
+	mtx_enter(&pmap->pm_mtx);
+	pmap->pm_type = mode;
+
+	if (mode == PMAP_TYPE_EPT) {
+		/* Clear PML4 */
+		pte = (pt_entry_t *)pmap->pm_pdir;
+		memset(pte, 0, PAGE_SIZE);
+
+		/* Give back the meltdown pdir */
+		if (pmap->pm_pdir_intel != NULL) {
+			pool_put(&pmap_pdp_pool, pmap->pm_pdir_intel);
+			pmap->pm_pdir_intel = NULL;
+		}
+	}
+	mtx_leave(&pmap->pm_mtx);
+}
+
 void
 pmap_remove_ept(struct pmap *pmap, vaddr_t sgpa, vaddr_t egpa)
 {
 	vaddr_t v;
-#if NVMM > 0
 	struct vmx_invept_descriptor vid;
-#endif /* NVMM > 0 */
 
 	mtx_enter(&pmap->pm_mtx);
 
@@ -2430,7 +2464,6 @@ pmap_remove_ept(struct pmap *pmap, vaddr_t sgpa, vaddr_t egpa)
 	for (v = sgpa; v < egpa + PAGE_SIZE; v += PAGE_SIZE)
 		pmap_do_remove_ept(pmap, v);
 
-#if NVMM > 0
 	if (pmap->eptp != 0) {
 		memset(&vid, 0, sizeof(vid));
 		vid.vid_eptp = pmap->eptp;
@@ -2438,7 +2471,6 @@ pmap_remove_ept(struct pmap *pmap, vaddr_t sgpa, vaddr_t egpa)
 		    vid.vid_eptp);
 		invept(IA32_VMX_INVEPT_SINGLE_CTX, &vid);
 	}
-#endif /* NVMM > 0 */
 
 	mtx_leave(&pmap->pm_mtx);
 }
@@ -2702,6 +2734,7 @@ unlock:
 
 	return ret;
 }
+#endif /* NVMM > 0 */
 
 /*
  * pmap_enter: enter a mapping into a pmap
@@ -2723,8 +2756,10 @@ pmap_enter(struct pmap *pmap, vaddr_t va, paddr_t pa, vm_prot_t prot, int flags)
 	int error, shootself;
 	paddr_t scr3;
 
+#if NVMM > 0
 	if (pmap->pm_type == PMAP_TYPE_EPT)
 		return pmap_enter_ept(pmap, va, pa, prot);
+#endif /* NVMM > 0 */
 
 	KASSERT(!(wc && nocache));
 	pa &= PMAP_PA_MASK;
@@ -3147,37 +3182,6 @@ pmap_steal_memory(vsize_t size, vaddr_t *start, vaddr_t *end)
 	return (va);
 }
 
-/*
- * pmap_convert
- *
- * Converts 'pmap' to the new 'mode'.
- *
- * Parameters:
- *  pmap: the pmap to convert
- *  mode: the new mode (see pmap.h, PMAP_TYPE_xxx)
- */
-void
-pmap_convert(struct pmap *pmap, int mode)
-{
-	pt_entry_t *pte;
-
-	mtx_enter(&pmap->pm_mtx);
-	pmap->pm_type = mode;
-
-	if (mode == PMAP_TYPE_EPT) {
-		/* Clear PML4 */
-		pte = (pt_entry_t *)pmap->pm_pdir;
-		memset(pte, 0, PAGE_SIZE);
-
-		/* Give back the meltdown pdir */
-		if (pmap->pm_pdir_intel != NULL) {
-			pool_put(&pmap_pdp_pool, pmap->pm_pdir_intel);
-			pmap->pm_pdir_intel = NULL;
-		}
-	}
-	mtx_leave(&pmap->pm_mtx);
-}
-
 #ifdef MULTIPROCESSOR
 /*
  * Locking for tlb shootdown.
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_amdkfd.h b/sys/dev/pci/drm/amd/amdgpu/amdgpu_amdkfd.h
index 9306b3d60..3e166f2bb 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_amdkfd.h
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_amdkfd.h
@@ -303,6 +303,7 @@ int amdgpu_amdkfd_gpuvm_map_memory_to_gpu(struct amdgpu_device *adev,
 					  struct kgd_mem *mem, void *drm_priv);
 int amdgpu_amdkfd_gpuvm_unmap_memory_from_gpu(
 		struct amdgpu_device *adev, struct kgd_mem *mem, void *drm_priv);
+int amdgpu_amdkfd_gpuvm_dmaunmap_mem(struct kgd_mem *mem, void *drm_priv);
 int amdgpu_amdkfd_gpuvm_sync_memory(
 		struct amdgpu_device *adev, struct kgd_mem *mem, bool intr);
 int amdgpu_amdkfd_gpuvm_map_gtt_bo_to_kernel(struct kgd_mem *mem,
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index dc3fd9790..7f904612e 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -733,7 +733,7 @@ kfd_mem_dmaunmap_sg_bo(struct kgd_mem *mem,
 	enum dma_data_direction dir;
 
 	if (unlikely(!ttm->sg)) {
-		pr_err("SG Table of BO is UNEXPECTEDLY NULL");
+		pr_debug("SG Table of BO is NULL");
 		return;
 	}
 
@@ -1202,8 +1202,6 @@ static void unmap_bo_from_gpuvm(struct kgd_mem *mem,
 	amdgpu_vm_clear_freed(adev, vm, &bo_va->last_pt_update);
 
 	amdgpu_sync_fence(sync, bo_va->last_pt_update);
-
-	kfd_mem_dmaunmap_attachment(mem, entry);
 }
 
 static int update_gpuvm_pte(struct kgd_mem *mem,
@@ -1258,6 +1256,7 @@ static int map_bo_to_gpuvm(struct kgd_mem *mem,
 
 update_gpuvm_pte_failed:
 	unmap_bo_from_gpuvm(mem, entry, sync);
+	kfd_mem_dmaunmap_attachment(mem, entry);
 	return ret;
 }
 
@@ -1862,8 +1861,10 @@ int amdgpu_amdkfd_gpuvm_free_memory_of_gpu(
 		mem->va + bo_size * (1 + mem->aql_queue));
 
 	/* Remove from VM internal data structures */
-	list_for_each_entry_safe(entry, tmp, &mem->attachments, list)
+	list_for_each_entry_safe(entry, tmp, &mem->attachments, list) {
+		kfd_mem_dmaunmap_attachment(mem, entry);
 		kfd_mem_detach(entry);
+	}
 
 	ret = unreserve_bo_and_vms(&ctx, false, false);
 
@@ -2037,6 +2038,37 @@ out:
 	return ret;
 }
 
+int amdgpu_amdkfd_gpuvm_dmaunmap_mem(struct kgd_mem *mem, void *drm_priv)
+{
+	struct kfd_mem_attachment *entry;
+	struct amdgpu_vm *vm;
+	int ret;
+
+	vm = drm_priv_to_vm(drm_priv);
+
+	mutex_lock(&mem->lock);
+
+	ret = amdgpu_bo_reserve(mem->bo, true);
+	if (ret)
+		goto out;
+
+	list_for_each_entry(entry, &mem->attachments, list) {
+		if (entry->bo_va->base.vm != vm)
+			continue;
+		if (entry->bo_va->base.bo->tbo.ttm &&
+		    !entry->bo_va->base.bo->tbo.ttm->sg)
+			continue;
+
+		kfd_mem_dmaunmap_attachment(mem, entry);
+	}
+
+	amdgpu_bo_unreserve(mem->bo);
+out:
+	mutex_unlock(&mem->lock);
+
+	return ret;
+}
+
 int amdgpu_amdkfd_gpuvm_unmap_memory_from_gpu(
 		struct amdgpu_device *adev, struct kgd_mem *mem, void *drm_priv)
 {
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
index 96fc6e50d..f7bd2ba29 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
@@ -1059,6 +1059,9 @@ static int amdgpu_cs_patch_ibs(struct amdgpu_cs_parser *p,
 			r = amdgpu_ring_parse_cs(ring, p, job, ib);
 			if (r)
 				return r;
+
+			if (ib->sa_bo)
+				ib->gpu_addr =  amdgpu_sa_bo_gpu_addr(ib->sa_bo);
 		} else {
 			ib->ptr = (uint32_t *)kptr;
 			r = amdgpu_ring_patch_cs_in_place(ring, p, job, ib);
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_ctx.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_ctx.c
index 5bd66da8b..1e476a723 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_ctx.c
@@ -684,16 +684,24 @@ int amdgpu_ctx_ioctl(struct drm_device *dev, void *data,
 
 	switch (args->in.op) {
 	case AMDGPU_CTX_OP_ALLOC_CTX:
+		if (args->in.flags)
+			return -EINVAL;
 		r = amdgpu_ctx_alloc(adev, fpriv, filp, priority, &id);
 		args->out.alloc.ctx_id = id;
 		break;
 	case AMDGPU_CTX_OP_FREE_CTX:
+		if (args->in.flags)
+			return -EINVAL;
 		r = amdgpu_ctx_free(fpriv, id);
 		break;
 	case AMDGPU_CTX_OP_QUERY_STATE:
+		if (args->in.flags)
+			return -EINVAL;
 		r = amdgpu_ctx_query(adev, fpriv, id, &args->out);
 		break;
 	case AMDGPU_CTX_OP_QUERY_STATE2:
+		if (args->in.flags)
+			return -EINVAL;
 		r = amdgpu_ctx_query2(adev, fpriv, id, &args->out);
 		break;
 	case AMDGPU_CTX_OP_GET_STABLE_PSTATE:
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_psp_ta.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_psp_ta.c
index 8e8afbd23..9aff579c6 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_psp_ta.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_psp_ta.c
@@ -166,6 +166,9 @@ static ssize_t ta_if_load_debugfs_write(struct file *fp, const char *buf, size_t
 	if (ret)
 		return -EFAULT;
 
+	if (ta_bin_len > PSP_1_MEG)
+		return -EINVAL;
+
 	copy_pos += sizeof(uint32_t);
 
 	ta_bin = kzalloc(ta_bin_len, GFP_KERNEL);
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vcn.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vcn.c
index 4e8e3d3fa..032eca438 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vcn.c
@@ -135,6 +135,10 @@ int amdgpu_vcn_sw_init(struct amdgpu_device *adev)
 		}
 	}
 
+	/* from vcn4 and above, only unified queue is used */
+	adev->vcn.using_unified_queue =
+		adev->ip_versions[UVD_HWIP][0] >= IP_VERSION(4, 0, 0);
+
 	hdr = (const struct common_firmware_header *)adev->vcn.fw->data;
 	adev->vcn.fw_version = le32_to_cpu(hdr->ucode_version);
 
@@ -259,18 +263,6 @@ int amdgpu_vcn_sw_fini(struct amdgpu_device *adev)
 	return 0;
 }
 
-/* from vcn4 and above, only unified queue is used */
-static bool amdgpu_vcn_using_unified_queue(struct amdgpu_ring *ring)
-{
-	struct amdgpu_device *adev = ring->adev;
-	bool ret = false;
-
-	if (adev->ip_versions[UVD_HWIP][0] >= IP_VERSION(4, 0, 0))
-		ret = true;
-
-	return ret;
-}
-
 bool amdgpu_vcn_is_disabled_vcn(struct amdgpu_device *adev, enum vcn_ring_type type, uint32_t vcn_instance)
 {
 	bool ret = false;
@@ -380,7 +372,9 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct *work)
 		for (i = 0; i < adev->vcn.num_enc_rings; ++i)
 			fence[j] += amdgpu_fence_count_emitted(&adev->vcn.inst[j].ring_enc[i]);
 
-		if (adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG)	{
+		/* Only set DPG pause for VCN3 or below, VCN4 and above will be handled by FW */
+		if (adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG &&
+		    !adev->vcn.using_unified_queue) {
 			struct dpg_pause_state new_state;
 
 			if (fence[j] ||
@@ -426,7 +420,9 @@ void amdgpu_vcn_ring_begin_use(struct amdgpu_ring *ring)
 	amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCN,
 	       AMD_PG_STATE_UNGATE);
 
-	if (adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG)	{
+	/* Only set DPG pause for VCN3 or below, VCN4 and above will be handled by FW */
+	if (adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG &&
+	    !adev->vcn.using_unified_queue) {
 		struct dpg_pause_state new_state;
 
 		if (ring->funcs->type == AMDGPU_RING_TYPE_VCN_ENC) {
@@ -452,8 +448,12 @@ void amdgpu_vcn_ring_begin_use(struct amdgpu_ring *ring)
 
 void amdgpu_vcn_ring_end_use(struct amdgpu_ring *ring)
 {
+	struct amdgpu_device *adev = ring->adev;
+
+	/* Only set DPG pause for VCN3 or below, VCN4 and above will be handled by FW */
 	if (ring->adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG &&
-		ring->funcs->type == AMDGPU_RING_TYPE_VCN_ENC)
+	    ring->funcs->type == AMDGPU_RING_TYPE_VCN_ENC &&
+	    !adev->vcn.using_unified_queue)
 		atomic_dec(&ring->adev->vcn.inst[ring->me].dpg_enc_submission_cnt);
 
 	atomic_dec(&ring->adev->vcn.total_submission_cnt);
@@ -707,12 +707,11 @@ static int amdgpu_vcn_dec_sw_send_msg(struct amdgpu_ring *ring,
 	struct amdgpu_job *job;
 	struct amdgpu_ib *ib;
 	uint64_t addr = AMDGPU_GPU_PAGE_ALIGN(ib_msg->gpu_addr);
-	bool sq = amdgpu_vcn_using_unified_queue(ring);
 	uint32_t *ib_checksum;
 	uint32_t ib_pack_in_dw;
 	int i, r;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		ib_size_dw += 8;
 
 	r = amdgpu_job_alloc_with_ib(ring->adev, NULL, NULL,
@@ -725,7 +724,7 @@ static int amdgpu_vcn_dec_sw_send_msg(struct amdgpu_ring *ring,
 	ib->length_dw = 0;
 
 	/* single queue headers */
-	if (sq) {
+	if (adev->vcn.using_unified_queue) {
 		ib_pack_in_dw = sizeof(struct amdgpu_vcn_decode_buffer) / sizeof(uint32_t)
 						+ 4 + 2; /* engine info + decoding ib in dw */
 		ib_checksum = amdgpu_vcn_unified_ring_ib_header(ib, ib_pack_in_dw, false);
@@ -744,7 +743,7 @@ static int amdgpu_vcn_dec_sw_send_msg(struct amdgpu_ring *ring,
 	for (i = ib->length_dw; i < ib_size_dw; ++i)
 		ib->ptr[i] = 0x0;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		amdgpu_vcn_unified_ring_ib_checksum(&ib_checksum, ib_pack_in_dw);
 
 	r = amdgpu_job_submit_direct(job, ring, &f);
@@ -834,15 +833,15 @@ static int amdgpu_vcn_enc_get_create_msg(struct amdgpu_ring *ring, uint32_t hand
 					 struct dma_fence **fence)
 {
 	unsigned int ib_size_dw = 16;
+	struct amdgpu_device *adev = ring->adev;
 	struct amdgpu_job *job;
 	struct amdgpu_ib *ib;
 	struct dma_fence *f = NULL;
 	uint32_t *ib_checksum = NULL;
 	uint64_t addr;
-	bool sq = amdgpu_vcn_using_unified_queue(ring);
 	int i, r;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		ib_size_dw += 8;
 
 	r = amdgpu_job_alloc_with_ib(ring->adev, NULL, NULL,
@@ -856,7 +855,7 @@ static int amdgpu_vcn_enc_get_create_msg(struct amdgpu_ring *ring, uint32_t hand
 
 	ib->length_dw = 0;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		ib_checksum = amdgpu_vcn_unified_ring_ib_header(ib, 0x11, true);
 
 	ib->ptr[ib->length_dw++] = 0x00000018;
@@ -878,7 +877,7 @@ static int amdgpu_vcn_enc_get_create_msg(struct amdgpu_ring *ring, uint32_t hand
 	for (i = ib->length_dw; i < ib_size_dw; ++i)
 		ib->ptr[i] = 0x0;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		amdgpu_vcn_unified_ring_ib_checksum(&ib_checksum, 0x11);
 
 	r = amdgpu_job_submit_direct(job, ring, &f);
@@ -901,15 +900,15 @@ static int amdgpu_vcn_enc_get_destroy_msg(struct amdgpu_ring *ring, uint32_t han
 					  struct dma_fence **fence)
 {
 	unsigned int ib_size_dw = 16;
+	struct amdgpu_device *adev = ring->adev;
 	struct amdgpu_job *job;
 	struct amdgpu_ib *ib;
 	struct dma_fence *f = NULL;
 	uint32_t *ib_checksum = NULL;
 	uint64_t addr;
-	bool sq = amdgpu_vcn_using_unified_queue(ring);
 	int i, r;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		ib_size_dw += 8;
 
 	r = amdgpu_job_alloc_with_ib(ring->adev, NULL, NULL,
@@ -923,7 +922,7 @@ static int amdgpu_vcn_enc_get_destroy_msg(struct amdgpu_ring *ring, uint32_t han
 
 	ib->length_dw = 0;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		ib_checksum = amdgpu_vcn_unified_ring_ib_header(ib, 0x11, true);
 
 	ib->ptr[ib->length_dw++] = 0x00000018;
@@ -945,7 +944,7 @@ static int amdgpu_vcn_enc_get_destroy_msg(struct amdgpu_ring *ring, uint32_t han
 	for (i = ib->length_dw; i < ib_size_dw; ++i)
 		ib->ptr[i] = 0x0;
 
-	if (sq)
+	if (adev->vcn.using_unified_queue)
 		amdgpu_vcn_unified_ring_ib_checksum(&ib_checksum, 0x11);
 
 	r = amdgpu_job_submit_direct(job, ring, &f);
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vcn.h b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vcn.h
index 20fb7ee49..160c24a16 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vcn.h
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vcn.h
@@ -284,6 +284,7 @@ struct amdgpu_vcn {
 
 	uint16_t inst_mask;
 	uint8_t	num_inst_per_aid;
+	bool using_unified_queue;
 };
 
 struct amdgpu_fw_shared_rb_ptrs_struct {
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm_pt.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm_pt.c
index 8da974096..8c5e7d094 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm_pt.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm_pt.c
@@ -766,11 +766,15 @@ int amdgpu_vm_pde_update(struct amdgpu_vm_update_params *params,
 			 struct amdgpu_vm_bo_base *entry)
 {
 	struct amdgpu_vm_bo_base *parent = amdgpu_vm_pt_parent(entry);
-	struct amdgpu_bo *bo = parent->bo, *pbo;
+	struct amdgpu_bo *bo, *pbo;
 	struct amdgpu_vm *vm = params->vm;
 	uint64_t pde, pt, flags;
 	unsigned int level;
 
+	if (WARN_ON(!parent))
+		return -EINVAL;
+
+	bo = parent->bo;
 	for (level = 0, pbo = bo->parent; pbo; ++level)
 		pbo = pbo->parent;
 
diff --git a/sys/dev/pci/drm/amd/amdgpu/gfx_v10_0.c b/sys/dev/pci/drm/amd/amdgpu/gfx_v10_0.c
index 744fd26c2..699e1829f 100644
--- a/sys/dev/pci/drm/amd/amdgpu/gfx_v10_0.c
+++ b/sys/dev/pci/drm/amd/amdgpu/gfx_v10_0.c
@@ -7892,22 +7892,15 @@ static int gfx_v10_0_update_gfx_clock_gating(struct amdgpu_device *adev,
 static void gfx_v10_0_update_spm_vmid_internal(struct amdgpu_device *adev,
 					       unsigned int vmid)
 {
-	u32 reg, data;
+	u32 data;
 
 	/* not for *_SOC15 */
-	reg = SOC15_REG_OFFSET(GC, 0, mmRLC_SPM_MC_CNTL);
-	if (amdgpu_sriov_is_pp_one_vf(adev))
-		data = RREG32_NO_KIQ(reg);
-	else
-		data = RREG32_SOC15(GC, 0, mmRLC_SPM_MC_CNTL);
+	data = RREG32_SOC15_NO_KIQ(GC, 0, mmRLC_SPM_MC_CNTL);
 
 	data &= ~RLC_SPM_MC_CNTL__RLC_SPM_VMID_MASK;
 	data |= (vmid & RLC_SPM_MC_CNTL__RLC_SPM_VMID_MASK) << RLC_SPM_MC_CNTL__RLC_SPM_VMID__SHIFT;
 
-	if (amdgpu_sriov_is_pp_one_vf(adev))
-		WREG32_SOC15_NO_KIQ(GC, 0, mmRLC_SPM_MC_CNTL, data);
-	else
-		WREG32_SOC15(GC, 0, mmRLC_SPM_MC_CNTL, data);
+	WREG32_SOC15_NO_KIQ(GC, 0, mmRLC_SPM_MC_CNTL, data);
 }
 
 static void gfx_v10_0_update_spm_vmid(struct amdgpu_device *adev, unsigned int vmid)
diff --git a/sys/dev/pci/drm/amd/amdgpu/gfx_v11_0.c b/sys/dev/pci/drm/amd/amdgpu/gfx_v11_0.c
index 01bac8d94..38d8e6d83 100644
--- a/sys/dev/pci/drm/amd/amdgpu/gfx_v11_0.c
+++ b/sys/dev/pci/drm/amd/amdgpu/gfx_v11_0.c
@@ -4961,23 +4961,16 @@ static int gfx_v11_0_update_gfx_clock_gating(struct amdgpu_device *adev,
 
 static void gfx_v11_0_update_spm_vmid(struct amdgpu_device *adev, unsigned vmid)
 {
-	u32 reg, data;
+	u32 data;
 
 	amdgpu_gfx_off_ctrl(adev, false);
 
-	reg = SOC15_REG_OFFSET(GC, 0, regRLC_SPM_MC_CNTL);
-	if (amdgpu_sriov_is_pp_one_vf(adev))
-		data = RREG32_NO_KIQ(reg);
-	else
-		data = RREG32(reg);
+	data = RREG32_SOC15_NO_KIQ(GC, 0, regRLC_SPM_MC_CNTL);
 
 	data &= ~RLC_SPM_MC_CNTL__RLC_SPM_VMID_MASK;
 	data |= (vmid & RLC_SPM_MC_CNTL__RLC_SPM_VMID_MASK) << RLC_SPM_MC_CNTL__RLC_SPM_VMID__SHIFT;
 
-	if (amdgpu_sriov_is_pp_one_vf(adev))
-		WREG32_SOC15_NO_KIQ(GC, 0, regRLC_SPM_MC_CNTL, data);
-	else
-		WREG32_SOC15(GC, 0, regRLC_SPM_MC_CNTL, data);
+	WREG32_SOC15_NO_KIQ(GC, 0, regRLC_SPM_MC_CNTL, data);
 
 	amdgpu_gfx_off_ctrl(adev, true);
 }
diff --git a/sys/dev/pci/drm/amd/amdgpu/imu_v11_0.c b/sys/dev/pci/drm/amd/amdgpu/imu_v11_0.c
index b9022db9b..1c565cb3e 100644
--- a/sys/dev/pci/drm/amd/amdgpu/imu_v11_0.c
+++ b/sys/dev/pci/drm/amd/amdgpu/imu_v11_0.c
@@ -39,7 +39,7 @@ MODULE_FIRMWARE("amdgpu/gc_11_0_4_imu.bin");
 
 static int imu_v11_0_init_microcode(struct amdgpu_device *adev)
 {
-	char fw_name[40];
+	char fw_name[45];
 	char ucode_prefix[30];
 	int err;
 	const struct imu_firmware_header_v1_0 *imu_hdr;
diff --git a/sys/dev/pci/drm/amd/amdgpu/jpeg_v2_0.c b/sys/dev/pci/drm/amd/amdgpu/jpeg_v2_0.c
index d3fd39d4c..7e5bb35dd 100644
--- a/sys/dev/pci/drm/amd/amdgpu/jpeg_v2_0.c
+++ b/sys/dev/pci/drm/amd/amdgpu/jpeg_v2_0.c
@@ -543,11 +543,11 @@ void jpeg_v2_0_dec_ring_emit_ib(struct amdgpu_ring *ring,
 
 	amdgpu_ring_write(ring, PACKETJ(mmUVD_LMI_JRBC_IB_VMID_INTERNAL_OFFSET,
 		0, 0, PACKETJ_TYPE0));
-	amdgpu_ring_write(ring, (vmid | (vmid << 4)));
+	amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
 
 	amdgpu_ring_write(ring, PACKETJ(mmUVD_LMI_JPEG_VMID_INTERNAL_OFFSET,
 		0, 0, PACKETJ_TYPE0));
-	amdgpu_ring_write(ring, (vmid | (vmid << 4)));
+	amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
 
 	amdgpu_ring_write(ring,	PACKETJ(mmUVD_LMI_JRBC_IB_64BIT_BAR_LOW_INTERNAL_OFFSET,
 		0, 0, PACKETJ_TYPE0));
diff --git a/sys/dev/pci/drm/amd/amdgpu/jpeg_v4_0_3.c b/sys/dev/pci/drm/amd/amdgpu/jpeg_v4_0_3.c
index 4e540d1b7..df839bdbe 100644
--- a/sys/dev/pci/drm/amd/amdgpu/jpeg_v4_0_3.c
+++ b/sys/dev/pci/drm/amd/amdgpu/jpeg_v4_0_3.c
@@ -23,6 +23,7 @@
 
 #include "amdgpu.h"
 #include "amdgpu_jpeg.h"
+#include "amdgpu_cs.h"
 #include "soc15.h"
 #include "soc15d.h"
 #include "jpeg_v4_0_3.h"
@@ -769,11 +770,15 @@ static void jpeg_v4_0_3_dec_ring_emit_ib(struct amdgpu_ring *ring,
 
 	amdgpu_ring_write(ring, PACKETJ(regUVD_LMI_JRBC_IB_VMID_INTERNAL_OFFSET,
 		0, 0, PACKETJ_TYPE0));
-	amdgpu_ring_write(ring, (vmid | (vmid << 4)));
+
+	if (ring->funcs->parse_cs)
+		amdgpu_ring_write(ring, 0);
+	else
+		amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
 
 	amdgpu_ring_write(ring, PACKETJ(regUVD_LMI_JPEG_VMID_INTERNAL_OFFSET,
 		0, 0, PACKETJ_TYPE0));
-	amdgpu_ring_write(ring, (vmid | (vmid << 4)));
+	amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
 
 	amdgpu_ring_write(ring,	PACKETJ(regUVD_LMI_JRBC_IB_64BIT_BAR_LOW_INTERNAL_OFFSET,
 		0, 0, PACKETJ_TYPE0));
@@ -1052,6 +1057,7 @@ static const struct amdgpu_ring_funcs jpeg_v4_0_3_dec_ring_vm_funcs = {
 	.get_rptr = jpeg_v4_0_3_dec_ring_get_rptr,
 	.get_wptr = jpeg_v4_0_3_dec_ring_get_wptr,
 	.set_wptr = jpeg_v4_0_3_dec_ring_set_wptr,
+	.parse_cs = jpeg_v4_0_3_dec_ring_parse_cs,
 	.emit_frame_size =
 		SOC15_FLUSH_GPU_TLB_NUM_WREG * 6 +
 		SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 8 +
@@ -1216,3 +1222,56 @@ static void jpeg_v4_0_3_set_ras_funcs(struct amdgpu_device *adev)
 {
 	adev->jpeg.ras = &jpeg_v4_0_3_ras;
 }
+
+/**
+ * jpeg_v4_0_3_dec_ring_parse_cs - command submission parser
+ *
+ * @parser: Command submission parser context
+ * @job: the job to parse
+ * @ib: the IB to parse
+ *
+ * Parse the command stream, return -EINVAL for invalid packet,
+ * 0 otherwise
+ */
+int jpeg_v4_0_3_dec_ring_parse_cs(struct amdgpu_cs_parser *parser,
+			     struct amdgpu_job *job,
+			     struct amdgpu_ib *ib)
+{
+	uint32_t i, reg, res, cond, type;
+	struct amdgpu_device *adev = parser->adev;
+
+	for (i = 0; i < ib->length_dw ; i += 2) {
+		reg  = CP_PACKETJ_GET_REG(ib->ptr[i]);
+		res  = CP_PACKETJ_GET_RES(ib->ptr[i]);
+		cond = CP_PACKETJ_GET_COND(ib->ptr[i]);
+		type = CP_PACKETJ_GET_TYPE(ib->ptr[i]);
+
+		if (res) /* only support 0 at the moment */
+			return -EINVAL;
+
+		switch (type) {
+		case PACKETJ_TYPE0:
+			if (cond != PACKETJ_CONDITION_CHECK0 || reg < JPEG_REG_RANGE_START || reg > JPEG_REG_RANGE_END) {
+				dev_err(adev->dev, "Invalid packet [0x%08x]!\n", ib->ptr[i]);
+				return -EINVAL;
+			}
+			break;
+		case PACKETJ_TYPE3:
+			if (cond != PACKETJ_CONDITION_CHECK3 || reg < JPEG_REG_RANGE_START || reg > JPEG_REG_RANGE_END) {
+				dev_err(adev->dev, "Invalid packet [0x%08x]!\n", ib->ptr[i]);
+				return -EINVAL;
+			}
+			break;
+		case PACKETJ_TYPE6:
+			if (ib->ptr[i] == CP_PACKETJ_NOP)
+				continue;
+			dev_err(adev->dev, "Invalid packet [0x%08x]!\n", ib->ptr[i]);
+			return -EINVAL;
+		default:
+			dev_err(adev->dev, "Unknown packet type %d !\n", type);
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
diff --git a/sys/dev/pci/drm/amd/amdgpu/jpeg_v4_0_3.h b/sys/dev/pci/drm/amd/amdgpu/jpeg_v4_0_3.h
index 22483dc66..9598eda9d 100644
--- a/sys/dev/pci/drm/amd/amdgpu/jpeg_v4_0_3.h
+++ b/sys/dev/pci/drm/amd/amdgpu/jpeg_v4_0_3.h
@@ -46,6 +46,12 @@
 
 #define JRBC_DEC_EXTERNAL_REG_WRITE_ADDR				0x18000
 
+#define JPEG_REG_RANGE_START						0x4000
+#define JPEG_REG_RANGE_END						0x41c2
+
 extern const struct amdgpu_ip_block_version jpeg_v4_0_3_ip_block;
 
+int jpeg_v4_0_3_dec_ring_parse_cs(struct amdgpu_cs_parser *parser,
+				  struct amdgpu_job *job,
+				  struct amdgpu_ib *ib);
 #endif /* __JPEG_V4_0_3_H__ */
diff --git a/sys/dev/pci/drm/amd/amdgpu/soc15d.h b/sys/dev/pci/drm/amd/amdgpu/soc15d.h
index 2357ff393..e74e1983d 100644
--- a/sys/dev/pci/drm/amd/amdgpu/soc15d.h
+++ b/sys/dev/pci/drm/amd/amdgpu/soc15d.h
@@ -76,6 +76,12 @@
 			 ((cond & 0xF) << 24) |				\
 			 ((type & 0xF) << 28))
 
+#define CP_PACKETJ_NOP		0x60000000
+#define CP_PACKETJ_GET_REG(x)  ((x) & 0x3FFFF)
+#define CP_PACKETJ_GET_RES(x)  (((x) >> 18) & 0x3F)
+#define CP_PACKETJ_GET_COND(x) (((x) >> 24) & 0xF)
+#define CP_PACKETJ_GET_TYPE(x) (((x) >> 28) & 0xF)
+
 /* Packet 3 types */
 #define	PACKET3_NOP					0x10
 #define	PACKET3_SET_BASE				0x11
diff --git a/sys/dev/pci/drm/amd/amdkfd/kfd_chardev.c b/sys/dev/pci/drm/amd/amdkfd/kfd_chardev.c
index 010e4af4e..bf9c3dead 100644
--- a/sys/dev/pci/drm/amd/amdkfd/kfd_chardev.c
+++ b/sys/dev/pci/drm/amd/amdkfd/kfd_chardev.c
@@ -1432,17 +1432,23 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep,
 			goto sync_memory_failed;
 		}
 	}
+
+	/* Flush TLBs after waiting for the page table updates to complete */
+	for (i = 0; i < args->n_devices; i++) {
+		peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]);
+		if (WARN_ON_ONCE(!peer_pdd))
+			continue;
+		if (flush_tlb)
+			kfd_flush_tlb(peer_pdd, TLB_FLUSH_HEAVYWEIGHT);
+
+		/* Remove dma mapping after tlb flush to avoid IO_PAGE_FAULT */
+		err = amdgpu_amdkfd_gpuvm_dmaunmap_mem(mem, peer_pdd->drm_priv);
+		if (err)
+			goto sync_memory_failed;
+	}
+
 	mutex_unlock(&p->mutex);
 
-	if (flush_tlb) {
-		/* Flush TLBs after waiting for the page table updates to complete */
-		for (i = 0; i < args->n_devices; i++) {
-			peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]);
-			if (WARN_ON_ONCE(!peer_pdd))
-				continue;
-			kfd_flush_tlb(peer_pdd, TLB_FLUSH_HEAVYWEIGHT);
-		}
-	}
 	kfree(devices_arr);
 
 	return 0;
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index e3f4d497d..ff38a85c4 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -3521,7 +3521,7 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
 						(int)hubp->curs_attr.width || pos_cpy.x
 						<= (int)hubp->curs_attr.width +
 						pipe_ctx->plane_state->src_rect.x) {
-						pos_cpy.x = temp_x + viewport_width;
+						pos_cpy.x = 2 * viewport_width - temp_x;
 					}
 				}
 			} else {
@@ -3614,7 +3614,7 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
 						(int)hubp->curs_attr.width || pos_cpy.x
 						<= (int)hubp->curs_attr.width +
 						pipe_ctx->plane_state->src_rect.x) {
-						pos_cpy.x = 2 * viewport_width - temp_x;
+						pos_cpy.x = temp_x + viewport_width;
 					}
 				}
 			} else {
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn321/dcn321_resource.c b/sys/dev/pci/drm/amd/display/dc/dcn321/dcn321_resource.c
index 8d73cceb4..aa4c64eec 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn321/dcn321_resource.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn321/dcn321_resource.c
@@ -1756,6 +1756,9 @@ static bool dcn321_resource_construct(
 	dc->caps.color.mpc.ogam_rom_caps.hlg = 0;
 	dc->caps.color.mpc.ocsc = 1;
 
+	/* Use pipe context based otg sync logic */
+	dc->config.use_pipe_ctx_sync_logic = true;
+
 	dc->config.dc_mode_clk_limit_support = true;
 	/* read VBIOS LTTPR caps */
 	{
diff --git a/sys/dev/pci/drm/amd/pm/amdgpu_pm.c b/sys/dev/pci/drm/amd/pm/amdgpu_pm.c
index 842a59297..aeffed6af 100644
--- a/sys/dev/pci/drm/amd/pm/amdgpu_pm.c
+++ b/sys/dev/pci/drm/amd/pm/amdgpu_pm.c
@@ -1473,9 +1473,9 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev,
 	return -EINVAL;
 }
 
-static unsigned int amdgpu_hwmon_get_sensor_generic(struct amdgpu_device *adev,
-						    enum amd_pp_sensors sensor,
-						    void *query)
+static int amdgpu_hwmon_get_sensor_generic(struct amdgpu_device *adev,
+					   enum amd_pp_sensors sensor,
+					   void *query)
 {
 	int r, size = sizeof(uint32_t);
 
@@ -2789,8 +2789,8 @@ static ssize_t amdgpu_hwmon_show_vddnb_label(struct device *dev,
 	return sysfs_emit(buf, "vddnb\n");
 }
 
-static unsigned int amdgpu_hwmon_get_power(struct device *dev,
-					   enum amd_pp_sensors sensor)
+static int amdgpu_hwmon_get_power(struct device *dev,
+				  enum amd_pp_sensors sensor)
 {
 	struct amdgpu_device *adev = dev_get_drvdata(dev);
 	unsigned int uw;
@@ -2811,7 +2811,7 @@ static ssize_t amdgpu_hwmon_show_power_avg(struct device *dev,
 					   struct device_attribute *attr,
 					   char *buf)
 {
-	unsigned int val;
+	int val;
 
 	val = amdgpu_hwmon_get_power(dev, AMDGPU_PP_SENSOR_GPU_AVG_POWER);
 	if (val < 0)
@@ -2824,7 +2824,7 @@ static ssize_t amdgpu_hwmon_show_power_input(struct device *dev,
 					     struct device_attribute *attr,
 					     char *buf)
 {
-	unsigned int val;
+	int val;
 
 	val = amdgpu_hwmon_get_power(dev, AMDGPU_PP_SENSOR_GPU_INPUT_POWER);
 	if (val < 0)
diff --git a/usr.bin/openssl/openssl.1 b/usr.bin/openssl/openssl.1
index 8385ac212..ea20639c4 100644
--- a/usr.bin/openssl/openssl.1
+++ b/usr.bin/openssl/openssl.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: openssl.1,v 1.160 2024/08/29 17:01:40 tb Exp $
+.\" $OpenBSD: openssl.1,v 1.161 2024/08/30 06:05:10 jmc Exp $
 .\" ====================================================================
 .\" Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
 .\"
@@ -110,7 +110,7 @@
 .\" copied and put under another distribution licence
 .\" [including the GNU Public Licence.]
 .\"
-.Dd $Mdocdate: August 29 2024 $
+.Dd $Mdocdate: August 30 2024 $
 .Dt OPENSSL 1
 .Os
 .Sh NAME
@@ -3330,7 +3330,6 @@ The output format.
 The key password source.
 .It Fl passout Ar arg
 The output file password source.
-or the public component of a key pair.
 .It Fl pubin
 Read in a public key, not a private key.
 .It Fl pubout
diff --git a/usr.bin/patch/patch.c b/usr.bin/patch/patch.c
index 213d2fcf5..55eb1f2ce 100644
--- a/usr.bin/patch/patch.c
+++ b/usr.bin/patch/patch.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: patch.c,v 1.76 2024/03/22 19:22:23 jcs Exp $	*/
+/*	$OpenBSD: patch.c,v 1.77 2024/08/30 07:11:02 op Exp $	*/
 
 /*
  * patch - a program to apply diffs to original files
@@ -542,6 +542,7 @@ get_some_switches(void)
 		{NULL,			0,			0,	0}
 	};
 	int ch;
+	const char *errstr;
 
 	rejname[0] = '\0';
 	Argc_last = Argc;
@@ -598,7 +599,10 @@ get_some_switches(void)
 			force = true;
 			break;
 		case 'F':
-			maxfuzz = atoi(optarg);
+			maxfuzz = strtonum(optarg, 0, INT_MAX, &errstr);
+			if (errstr != NULL)
+				fatal("maximum fuzz is %s: %s\n",
+				    errstr, optarg);
 			break;
 		case 'i':
 			if (++filec == MAXFILEC)
@@ -618,7 +622,10 @@ get_some_switches(void)
 			outname = xstrdup(optarg);
 			break;
 		case 'p':
-			strippath = atoi(optarg);
+			strippath = strtonum(optarg, 0, INT_MAX, &errstr);
+			if (errstr != NULL)
+				fatal("strip count is %s: %s\n",
+				    errstr, optarg);
 			break;
 		case 'r':
 			if (strlcpy(rejname, optarg,
@@ -647,7 +654,10 @@ get_some_switches(void)
 			break;
 #ifdef DEBUGGING
 		case 'x':
-			debug = atoi(optarg);
+			debug = strtonum(optarg, 0, INT_MAX, &errstr);
+			if (errstr != NULL)
+				fatal("debug number is %s: %s\n",
+				    errstr, optarg);
 			break;
 #endif
 		default:
diff --git a/usr.bin/vacation/vacation.c b/usr.bin/vacation/vacation.c
index 7105f567c..56dd0e79a 100644
--- a/usr.bin/vacation/vacation.c
+++ b/usr.bin/vacation/vacation.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vacation.c,v 1.38 2019/06/28 13:35:05 deraadt Exp $	*/
+/*	$OpenBSD: vacation.c,v 1.39 2024/08/29 21:04:16 op Exp $	*/
 /*	$NetBSD: vacation.c,v 1.7 1995/04/29 05:58:27 cgd Exp $	*/
 
 /*
@@ -246,6 +246,10 @@ readheaders(void)
 				break;
 			for (p = buf + 12; isspace((unsigned char)*p); ++p)
 				;
+			if (*p == '<') {
+				++p;
+				p[strcspn(p, ">")] = '\0';
+			}
 			if (strlcpy(from, p, sizeof(from)) >= sizeof(from)) {
 				syslog(LOG_NOTICE,
 				    "Return-Path %s exceeds limits", p);
@@ -303,13 +307,8 @@ readheaders(void)
 findme:			for (cur = names; !tome && cur; cur = cur->next)
 				tome += nsearch(cur->name, buf);
 		}
-	if (!tome)
+	if (!tome || !*from)
 		exit(0);
-	if (!*from) {
-		syslog(LOG_NOTICE,
-		    "no initial \"From\" or \"Return-Path\"line.");
-		exit(1);
-	}
 }
 
 /*