From df7f961280c1fee3cb24a6142a13e8fe6915f8a1 Mon Sep 17 00:00:00 2001
From: purplerain <purplerain@secbsd.org>
Date: Wed, 21 Aug 2024 05:59:35 +0000
Subject: [PATCH] sync with OpenBSD -current

---
 bin/csh/sem.c                  |  22 +-
 bin/ps/ps.1                    |   7 +-
 etc/skel/dot.version           |   2 +-
 etc/skel/dot.xsession          |   6 +-
 games/atc/log.c                |   6 +-
 games/phantasia/COPYRIGHT      |   9 +-
 games/phantasia/OWNER          |   6 -
 games/quiz/datfiles/arith      |   1 +
 games/quiz/datfiles/babies     |   2 +-
 sys/arch/amd64/amd64/bus_dma.c |  13 +-
 sys/arch/armv7/omap/omehci.c   |   8 +-
 sys/arch/armv7/omap/omohci.c   |  10 +-
 sys/dev/ic/qwz.c               | 307 +++++----------------------
 sys/dev/ic/qwzvar.h            |  21 +-
 sys/dev/pci/if_qwz_pci.c       |   5 +-
 sys/dev/pci/if_rge.c           | 183 ++++++++--------
 sys/dev/pci/if_rgereg.h        |   6 +-
 sys/kern/exec_elf.c            |   7 +-
 sys/kern/kern_exec.c           |   5 +-
 sys/kern/kern_fork.c           |   4 +-
 sys/sys/proc.h                 |   4 +-
 sys/uvm/uvm_mmap.c             |   3 +-
 usr.bin/tmux/format.c          |  22 +-
 usr.bin/tmux/input-keys.c      | 373 +++++++++++++++++++++------------
 usr.bin/tmux/input.c           |  26 ++-
 usr.bin/tmux/key-string.c      |  79 +++----
 usr.bin/tmux/menu.c            |  10 +-
 usr.bin/tmux/mode-tree.c       |  16 +-
 usr.bin/tmux/options-table.c   |  17 +-
 usr.bin/tmux/popup.c           |   4 +-
 usr.bin/tmux/screen-write.c    |   5 +-
 usr.bin/tmux/screen.c          |  11 +-
 usr.bin/tmux/status.c          |  74 +++----
 usr.bin/tmux/tmux.1            |  70 +++++--
 usr.bin/tmux/tmux.h            |  45 +++-
 usr.bin/tmux/tty-features.c    |   4 +-
 usr.bin/tmux/tty-keys.c        |  60 +++---
 37 files changed, 741 insertions(+), 712 deletions(-)
 delete mode 100644 games/phantasia/OWNER

diff --git a/bin/csh/sem.c b/bin/csh/sem.c
index bb47e8925..f98ca94cd 100644
--- a/bin/csh/sem.c
+++ b/bin/csh/sem.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sem.c,v 1.24 2024/07/28 15:31:22 deraadt Exp $	*/
+/*	$OpenBSD: sem.c,v 1.25 2024/08/20 23:40:39 guenther Exp $	*/
 /*	$NetBSD: sem.c,v 1.9 1995/09/27 00:38:50 jtc Exp $	*/
 
 /*-
@@ -537,8 +537,7 @@ doio(struct command *t, int *pipein, int *pipeout)
 	    (void) dmove(fd, 0);
 	}
 	else if (flags & F_PIPEIN) {
-	    (void) close(0);
-	    (void) dup(pipein[0]);
+	    (void) dup2(pipein[0], 0);
 	    (void) close(pipein[0]);
 	    (void) close(pipein[1]);
 	}
@@ -547,9 +546,7 @@ doio(struct command *t, int *pipein, int *pipeout)
 	    (void) open(_PATH_DEVNULL, O_RDONLY);
 	}
 	else {
-	    (void) close(0);
-	    (void) dup(OLDSTD);
-	    (void) fcntl(STDIN_FILENO, F_SETFD, 0);
+	    (void) dup2(OLDSTD, 0);
 	}
     }
     if (t->t_drit) {
@@ -577,22 +574,17 @@ doio(struct command *t, int *pipein, int *pipeout)
 	(void) dmove(fd, 1);
     }
     else if (flags & F_PIPEOUT) {
-	(void) close(1);
-	(void) dup(pipeout[1]);
+	(void) dup2(pipeout[1], 1);
     }
     else {
-	(void) close(1);
-	(void) dup(SHOUT);
-	(void) fcntl(STDOUT_FILENO, F_SETFD, 0);
+	(void) dup2(SHOUT, 1);
     }
 
-    (void) close(2);
     if (flags & F_STDERR) {
-	(void) dup(1);
+	(void) dup2(1, 2);
     }
     else {
-	(void) dup(SHERR);
-	(void) fcntl(STDERR_FILENO, F_SETFD, 0);
+	(void) dup2(SHERR, 2);
     }
     didfds = 1;
 }
diff --git a/bin/ps/ps.1 b/bin/ps/ps.1
index 0bb930bac..4452bdcc4 100644
--- a/bin/ps/ps.1
+++ b/bin/ps/ps.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ps.1,v 1.136 2024/07/29 09:50:30 claudio Exp $
+.\"	$OpenBSD: ps.1,v 1.137 2024/08/21 03:07:45 deraadt Exp $
 .\"	$NetBSD: ps.1,v 1.16 1996/03/21 01:36:28 jtc Exp $
 .\"
 .\" Copyright (c) 1980, 1990, 1991, 1993, 1994
@@ -30,7 +30,7 @@
 .\"
 .\"     @(#)ps.1	8.3 (Berkeley) 4/18/94
 .\"
-.Dd $Mdocdate: July 29 2024 $
+.Dd $Mdocdate: August 21 2024 $
 .Dt PS 1
 .Os
 .Sh NAME
@@ -357,9 +357,6 @@ PS_EXECPLEDGE	0x00400000 has exec pledges
 PS_ORPHAN	0x00800000 process is on an orphan list
 PS_CHROOT	0x01000000 process is chrooted
 PS_NOBTCFI	0x02000000 no Branch Target CFI
-PS_PIN          0x08000000 ld.so or static executable that
-                           has syscalls pinned
-PS_LIBCPIN      0x10000000 libc.so has syscalls pinned
 PS_CONTINUED    0x20000000 process continued from stopped state
                            but has not been waited for yet
 .Ed
diff --git a/etc/skel/dot.version b/etc/skel/dot.version
index 0434b7046..d9cd194dc 100644
--- a/etc/skel/dot.version
+++ b/etc/skel/dot.version
@@ -1 +1 @@
-# SecBSD 1.6-68b5a75: Tue Aug 20 00:00:00 UTC 2024 (Yatagarasu)
+# SecBSD 1.6-1361d16: Wed Aug 21 00:00:00 UTC 2024 (Yatagarasu)
diff --git a/etc/skel/dot.xsession b/etc/skel/dot.xsession
index 0154d5907..4c82ae9bf 100644
--- a/etc/skel/dot.xsession
+++ b/etc/skel/dot.xsession
@@ -1,4 +1,4 @@
-# $SecBSD: dot.xsession,v 0.4 2024/01/07 19:32:27 purplerain Exp $
+# $SecBSD: dot.xsession,v 0.5 2024/08/21 05:14:40 purplerain Exp $
 #
 # This file is for testing purposes only.
 
@@ -17,8 +17,8 @@ fi
 #manual: https://man.openbsd.org/cwm.1
 #uncomment lines below
 #xterm -geometry 320x1+0+0 -fa "Spleen:size=16" -bg "black" \
-#      -fg grey -fs 12 -name termbar -class termbar \
-#      -T termbar -e ~/.termbar &
+#      -fg grey -fs 12 -name bar -class bar \
+#      -T bar -e ~/.bar &
 #
 #cwm
 #rcctl enable xenodm
diff --git a/games/atc/log.c b/games/atc/log.c
index 88640f61e..5bd3ab323 100644
--- a/games/atc/log.c
+++ b/games/atc/log.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: log.c,v 1.25 2019/06/28 13:32:52 deraadt Exp $	*/
+/*	$OpenBSD: log.c,v 1.26 2024/08/20 15:48:32 deraadt Exp $	*/
 /*	$NetBSD: log.c,v 1.3 1995/03/21 15:04:21 cgd Exp $	*/
 
 /*-
@@ -260,6 +260,6 @@ log_score(int list_em)
 void
 log_score_quit(int dummy)
 {
-	(void)log_score(0);
-	exit(0);
+	(void)log_score(0);	/* XXX signal race */
+	exit(0);		/* XXX signal race */
 }
diff --git a/games/phantasia/COPYRIGHT b/games/phantasia/COPYRIGHT
index a6784aeee..2b81eeca5 100644
--- a/games/phantasia/COPYRIGHT
+++ b/games/phantasia/COPYRIGHT
@@ -1,4 +1,4 @@
-$OpenBSD: COPYRIGHT,v 1.2 2001/01/28 23:41:47 niklas Exp $
+$OpenBSD: COPYRIGHT,v 1.3 2024/08/20 16:07:14 deraadt Exp $
 $NetBSD: COPYRIGHT,v 1.2 1995/03/24 03:58:08 cgd Exp $
 
 This entire subtree is explicitly not copyrighted.
@@ -25,3 +25,10 @@ _____________________________________________________________________________
  *
  * AT&T is in no way connected with this game.
  */
+
+	Edward Estes
+	AT&T
+	5555 Touhy Ave.
+	Skokie, IL  60077
+	(312) 982-3969
+	ihnp4!ttrde!estes
diff --git a/games/phantasia/OWNER b/games/phantasia/OWNER
deleted file mode 100644
index 28387fee6..000000000
--- a/games/phantasia/OWNER
+++ /dev/null
@@ -1,6 +0,0 @@
-	Edward Estes
-	AT&T
-	5555 Touhy Ave.
-	Skokie, IL  60077
-	(312) 982-3969
-	ihnp4!ttrde!estes
diff --git a/games/quiz/datfiles/arith b/games/quiz/datfiles/arith
index 64babb563..184df49de 100644
--- a/games/quiz/datfiles/arith
+++ b/games/quiz/datfiles/arith
@@ -43,3 +43,4 @@
 63 - 48 = ...:15
 57 - 38 = ...:19
 52 - 26 = ...:26
+54 - 12 = ...:42
diff --git a/games/quiz/datfiles/babies b/games/quiz/datfiles/babies
index 5305c0cab..24712b5e3 100644
--- a/games/quiz/datfiles/babies
+++ b/games/quiz/datfiles/babies
@@ -12,7 +12,7 @@ kid:goat|antelope
 chick:chicken
 tadpole|polliwog:frog|toad
 joey:kangaroo
-calf:cow|whale|moose|elephant|buffalo|giraffe
+calf:cow|whale|moose|elephant|buffalo|giraffe|hippo|rhino
 caterpillar:butterfly|moth
 elver:eel
 eaglet:eagle
diff --git a/sys/arch/amd64/amd64/bus_dma.c b/sys/arch/amd64/amd64/bus_dma.c
index a0d3ad1f3..c29501ad7 100644
--- a/sys/arch/amd64/amd64/bus_dma.c
+++ b/sys/arch/amd64/amd64/bus_dma.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bus_dma.c,v 1.55 2024/08/20 12:36:09 sf Exp $	*/
+/*	$OpenBSD: bus_dma.c,v 1.56 2024/08/20 15:30:29 bluhm Exp $	*/
 /*	$NetBSD: bus_dma.c,v 1.3 2003/05/07 21:33:58 fvdl Exp $	*/
 
 /*-
@@ -146,9 +146,9 @@ _bus_dmamap_create(bus_dma_tag_t t, bus_size_t size, int nsegments,
 		mapsize += sizeof(struct vm_page *) * npages;
 	}
 
-	if ((mapstore = malloc(mapsize, M_DEVBUF,
-	    (flags & BUS_DMA_NOWAIT) ?
-	        (M_NOWAIT|M_ZERO) : (M_WAITOK|M_ZERO))) == NULL)
+	mapstore = malloc(mapsize, M_DEVBUF,
+	    (flags & BUS_DMA_NOWAIT) ? (M_NOWAIT|M_ZERO) : (M_WAITOK|M_ZERO));
+	if (mapstore == NULL)
 		return (ENOMEM);
 
 	map = (struct bus_dmamap *)mapstore;
@@ -418,8 +418,8 @@ _bus_dmamap_load_raw(bus_dma_tag_t t, bus_dmamap_t map, bus_dma_segment_t *segs,
 
 			if (paddr > dma_constraint.ucr_high &&
 			    (map->_dm_flags & BUS_DMA_64BIT) == 0)
-				panic("Non dma-reachable buffer at paddr %#lx(raw)",
-				    paddr);
+				panic("Non dma-reachable buffer at "
+				    "paddr %#lx(raw)", paddr);
 
 			/*
 			 * Make sure we don't cross any boundaries.
@@ -865,4 +865,3 @@ _bus_dmamem_alloc_range(bus_dma_tag_t t, bus_size_t size, bus_size_t alignment,
 
 	return (0);
 }
-
diff --git a/sys/arch/armv7/omap/omehci.c b/sys/arch/armv7/omap/omehci.c
index 60500b675..76b31480a 100644
--- a/sys/arch/armv7/omap/omehci.c
+++ b/sys/arch/armv7/omap/omehci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: omehci.c,v 1.10 2024/05/13 01:15:50 jsg Exp $ */
+/*	$OpenBSD: omehci.c,v 1.11 2024/08/20 16:24:50 deraadt Exp $ */
 
 /*
  * Copyright (c) 2005 David Gwynne <dlg@openbsd.org>
@@ -449,9 +449,11 @@ int
 omehci_activate(struct device *self, int act)
 {
 	struct omehci_softc *sc = (struct omehci_softc *)self;
+	int rv;
 
 	switch (act) {
 	case DVACT_SUSPEND:
+		rv = config_activate_children(self, act);
 		sc->sc.sc_bus.use_polling++;
 		/* FIXME */
 		sc->sc.sc_bus.use_polling--;
@@ -460,10 +462,12 @@ omehci_activate(struct device *self, int act)
 		sc->sc.sc_bus.use_polling++;
 		/* FIXME */
 		sc->sc.sc_bus.use_polling--;
+		rv = config_activate_children(self, act);
 		break;
 	case DVACT_POWERDOWN:
+		rv = config_activate_children(self, act);
 		ehci_reset(&sc->sc);
 		break;
 	}
-	return 0;
+	return rv;
 }
diff --git a/sys/arch/armv7/omap/omohci.c b/sys/arch/armv7/omap/omohci.c
index c00c1288e..ee5ad4761 100644
--- a/sys/arch/armv7/omap/omohci.c
+++ b/sys/arch/armv7/omap/omohci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: omohci.c,v 1.4 2021/10/24 17:52:28 mpi Exp $ */
+/*	$OpenBSD: omohci.c,v 1.5 2024/08/20 16:24:50 deraadt Exp $ */
 
 /*
  * Copyright (c) 2005 David Gwynne <dlg@openbsd.org>
@@ -271,6 +271,7 @@ int
 omohci_activate(struct device *self, int act)
 {
 	struct omohci_softc *sc = (struct omohci_softc *)self;
+	int rv;
 
 	switch (act) {
 	case DVACT_SUSPEND:
@@ -280,9 +281,11 @@ omohci_activate(struct device *self, int act)
 		pxa2x0_clkman_config(CKEN_USBHC, 0);
 #endif
 		sc->sc.sc_bus.use_polling--;
+		rv = config_activate_children(self, act);
 		break;
 
 	case DVACT_RESUME:
+		rv = config_activate_children(self, act);
 		sc->sc.sc_bus.use_polling++;
 #if 0
 		pxa2x0_clkman_config(CKEN_USBHC, 1);
@@ -291,8 +294,11 @@ omohci_activate(struct device *self, int act)
 		ohci_power(why, &sc->sc);
 		sc->sc.sc_bus.use_polling--;
 		break;
+	default:
+		rv = config_activate_children(self, act);
+		break;
 	}
-	return 0;
+	return rv;
 }
 
 void
diff --git a/sys/dev/ic/qwz.c b/sys/dev/ic/qwz.c
index 0de2e61e5..061019ef6 100644
--- a/sys/dev/ic/qwz.c
+++ b/sys/dev/ic/qwz.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qwz.c,v 1.5 2024/08/19 08:22:30 jsg Exp $	*/
+/*	$OpenBSD: qwz.c,v 1.7 2024/08/20 21:24:15 patrick Exp $	*/
 
 /*
  * Copyright 2023 Stefan Sperling <stsp@openbsd.org>
@@ -124,6 +124,7 @@ uint32_t	qwz_debug = 0
 #endif
 
 int qwz_ce_init_pipes(struct qwz_softc *);
+int qwz_hal_srng_create_config_wcn7850(struct qwz_softc *);
 int qwz_hal_srng_src_num_free(struct qwz_softc *, struct hal_srng *, int);
 int qwz_ce_per_engine_service(struct qwz_softc *, uint16_t);
 int qwz_hal_srng_setup(struct qwz_softc *, enum hal_ring_type, int, int,
@@ -1009,19 +1010,10 @@ qwz_init_wmi_config_qca6390(struct qwz_softc *sc,
 }
 
 void
-qwz_hw_wcn7850_reo_setup(struct qwz_softc *sc)
+qwz_hal_reo_hw_setup(struct qwz_softc *sc, uint32_t ring_hash_map)
 {
 	uint32_t reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
 	uint32_t val;
-	/* Each hash entry uses four bits to map to a particular ring. */
-	uint32_t ring_hash_map = HAL_HASH_ROUTING_RING_SW1 << 0 |
-	    HAL_HASH_ROUTING_RING_SW2 << 4 |
-	    HAL_HASH_ROUTING_RING_SW3 << 8 |
-	    HAL_HASH_ROUTING_RING_SW4 << 12 |
-	    HAL_HASH_ROUTING_RING_SW1 << 16 |
-	    HAL_HASH_ROUTING_RING_SW2 << 20 |
-	    HAL_HASH_ROUTING_RING_SW3 << 24 |
-	    HAL_HASH_ROUTING_RING_SW4 << 28;
 
 	val = sc->ops.read32(sc, reo_base + HAL_REO1_GEN_ENABLE);
 	val |= FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_LIST_ENABLE, 1) |
@@ -1718,7 +1710,6 @@ const struct ath12k_hw_ops wcn7850_ops = {
 	.get_hw_mac_from_pdev_id = qwz_hw_ipq6018_mac_from_pdev_id,
 	.mac_id_to_pdev_id = qwz_hw_mac_id_to_pdev_id_qca6390,
 	.mac_id_to_srng_id = qwz_hw_mac_id_to_srng_id_qca6390,
-	.reo_setup = qwz_hw_wcn7850_reo_setup,
 };
 
 #define ATH12K_TX_RING_MASK_0 BIT(0)
@@ -1738,186 +1729,22 @@ const struct ath12k_hw_ops wcn7850_ops = {
 
 #define ATH12K_REO_STATUS_RING_MASK_0 0x1
 
-#define ATH12K_RXDMA2HOST_RING_MASK_0 0x1
-#define ATH12K_RXDMA2HOST_RING_MASK_1 0x2
-#define ATH12K_RXDMA2HOST_RING_MASK_2 0x4
-
 #define ATH12K_HOST2RXDMA_RING_MASK_0 0x1
-#define ATH12K_HOST2RXDMA_RING_MASK_1 0x2
-#define ATH12K_HOST2RXDMA_RING_MASK_2 0x4
 
 #define ATH12K_RX_MON_STATUS_RING_MASK_0 0x1
 #define ATH12K_RX_MON_STATUS_RING_MASK_1 0x2
 #define ATH12K_RX_MON_STATUS_RING_MASK_2 0x4
 
-const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_ipq8074 = {
-	.tx  = {
-		ATH12K_TX_RING_MASK_0,
-		ATH12K_TX_RING_MASK_1,
-		ATH12K_TX_RING_MASK_2,
-	},
-	.rx_mon_status = {
-		0, 0, 0, 0,
-		ATH12K_RX_MON_STATUS_RING_MASK_0,
-		ATH12K_RX_MON_STATUS_RING_MASK_1,
-		ATH12K_RX_MON_STATUS_RING_MASK_2,
-	},
-	.rx = {
-		0, 0, 0, 0, 0, 0, 0,
-		ATH12K_RX_RING_MASK_0,
-		ATH12K_RX_RING_MASK_1,
-		ATH12K_RX_RING_MASK_2,
-		ATH12K_RX_RING_MASK_3,
-	},
-	.rx_err = {
-		ATH12K_RX_ERR_RING_MASK_0,
-	},
-	.rx_wbm_rel = {
-		ATH12K_RX_WBM_REL_RING_MASK_0,
-	},
-	.reo_status = {
-		ATH12K_REO_STATUS_RING_MASK_0,
-	},
-	.rxdma2host = {
-		ATH12K_RXDMA2HOST_RING_MASK_0,
-		ATH12K_RXDMA2HOST_RING_MASK_1,
-		ATH12K_RXDMA2HOST_RING_MASK_2,
-	},
-	.host2rxdma = {
-		ATH12K_HOST2RXDMA_RING_MASK_0,
-		ATH12K_HOST2RXDMA_RING_MASK_1,
-		ATH12K_HOST2RXDMA_RING_MASK_2,
-	},
-	.tx_mon_dest = {
-	},
-};
-
-const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_qca6390 = {
-	.tx  = {
-		ATH12K_TX_RING_MASK_0,
-	},
-	.rx_mon_status = {
-		0, 0, 0, 0,
-		ATH12K_RX_MON_STATUS_RING_MASK_0,
-		ATH12K_RX_MON_STATUS_RING_MASK_1,
-		ATH12K_RX_MON_STATUS_RING_MASK_2,
-	},
-	.rx = {
-		0, 0, 0, 0, 0, 0, 0,
-		ATH12K_RX_RING_MASK_0,
-		ATH12K_RX_RING_MASK_1,
-		ATH12K_RX_RING_MASK_2,
-		ATH12K_RX_RING_MASK_3,
-	},
-	.rx_err = {
-		ATH12K_RX_ERR_RING_MASK_0,
-	},
-	.rx_wbm_rel = {
-		ATH12K_RX_WBM_REL_RING_MASK_0,
-	},
-	.reo_status = {
-		ATH12K_REO_STATUS_RING_MASK_0,
-	},
-	.rxdma2host = {
-		ATH12K_RXDMA2HOST_RING_MASK_0,
-		ATH12K_RXDMA2HOST_RING_MASK_1,
-		ATH12K_RXDMA2HOST_RING_MASK_2,
-	},
-	.host2rxdma = {
-	},
-	.tx_mon_dest = {
-	},
-};
-
-const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_qcn9074 = {
-	.tx  = {
-		ATH12K_TX_RING_MASK_0,
-		ATH12K_TX_RING_MASK_1,
-		ATH12K_TX_RING_MASK_2,
-	},
-	.rx_mon_status = {
-		0, 0, 0,
-		ATH12K_RX_MON_STATUS_RING_MASK_0,
-		ATH12K_RX_MON_STATUS_RING_MASK_1,
-		ATH12K_RX_MON_STATUS_RING_MASK_2,
-	},
-	.rx = {
-		0, 0, 0, 0,
-		ATH12K_RX_RING_MASK_0,
-		ATH12K_RX_RING_MASK_1,
-		ATH12K_RX_RING_MASK_2,
-		ATH12K_RX_RING_MASK_3,
-	},
-	.rx_err = {
-		0, 0, 0,
-		ATH12K_RX_ERR_RING_MASK_0,
-	},
-	.rx_wbm_rel = {
-		0, 0, 0,
-		ATH12K_RX_WBM_REL_RING_MASK_0,
-	},
-	.reo_status = {
-		0, 0, 0,
-		ATH12K_REO_STATUS_RING_MASK_0,
-	},
-	.rxdma2host = {
-		0, 0, 0,
-		ATH12K_RXDMA2HOST_RING_MASK_0,
-	},
-	.host2rxdma = {
-		0, 0, 0,
-		ATH12K_HOST2RXDMA_RING_MASK_0,
-	},
-	.tx_mon_dest = {
-	},
-};
-
-const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_wcn6750 = {
-	.tx  = {
-		ATH12K_TX_RING_MASK_0,
-		0,
-		ATH12K_TX_RING_MASK_2,
-		0,
-		ATH12K_TX_RING_MASK_4,
-	},
-	.rx_mon_status = {
-		0, 0, 0, 0, 0, 0,
-		ATH12K_RX_MON_STATUS_RING_MASK_0,
-	},
-	.rx = {
-		0, 0, 0, 0, 0, 0, 0,
-		ATH12K_RX_RING_MASK_0,
-		ATH12K_RX_RING_MASK_1,
-		ATH12K_RX_RING_MASK_2,
-		ATH12K_RX_RING_MASK_3,
-	},
-	.rx_err = {
-		0, ATH12K_RX_ERR_RING_MASK_0,
-	},
-	.rx_wbm_rel = {
-		0, ATH12K_RX_WBM_REL_RING_MASK_0,
-	},
-	.reo_status = {
-		0, ATH12K_REO_STATUS_RING_MASK_0,
-	},
-	.rxdma2host = {
-		ATH12K_RXDMA2HOST_RING_MASK_0,
-		ATH12K_RXDMA2HOST_RING_MASK_1,
-		ATH12K_RXDMA2HOST_RING_MASK_2,
-	},
-	.host2rxdma = {
-	},
-	.tx_mon_dest = {
-	},
-};
+#define ATH12K_TX_MON_RING_MASK_0 0x1
+#define ATH12K_TX_MON_RING_MASK_1 0x2
 
 const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_wcn7850 = {
 	.tx  = {
 		ATH12K_TX_RING_MASK_0,
+		ATH12K_TX_RING_MASK_1,
 		ATH12K_TX_RING_MASK_2,
-		ATH12K_TX_RING_MASK_4,
 	},
-	.rx_mon_status = {
+	.rx_mon_dest = {
 	},
 	.rx = {
 		0, 0, 0,
@@ -1935,8 +1762,6 @@ const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_wcn7850 = {
 	.reo_status = {
 		ATH12K_REO_STATUS_RING_MASK_0,
 	},
-	.rxdma2host = {
-	},
 	.host2rxdma = {
 	},
 	.tx_mon_dest = {
@@ -2964,19 +2789,17 @@ const struct ce_attr qwz_host_ce_config_wcn7850[QWZ_CE_COUNT_QCA6390] = {
 	},
 };
 
-static const struct ath12k_hw_tcl2wbm_rbm_map ath12k_hw_tcl2wbm_rbm_map_wcn7850[] = {
+static const struct ath12k_hal_tcl_to_wbm_rbm_map
+ath12k_hal_wcn7850_tcl_to_wbm_rbm_map[DP_TCL_NUM_RING_MAX] = {
 	{
-		.tcl_ring_num = 0,
 		.wbm_ring_num = 0,
 		.rbm_id = HAL_RX_BUF_RBM_SW0_BM,
 	},
 	{
-		.tcl_ring_num = 1,
 		.wbm_ring_num = 2,
 		.rbm_id = HAL_RX_BUF_RBM_SW2_BM,
 	},
 	{
-		.tcl_ring_num = 2,
 		.wbm_ring_num = 4,
 		.rbm_id = HAL_RX_BUF_RBM_SW4_BM,
 	},
@@ -2984,11 +2807,15 @@ static const struct ath12k_hw_tcl2wbm_rbm_map ath12k_hw_tcl2wbm_rbm_map_wcn7850[
 
 static const struct ath12k_hw_hal_params ath12k_hw_hal_params_wcn7850 = {
 	.rx_buf_rbm = HAL_RX_BUF_RBM_SW1_BM,
-	.tcl2wbm_rbm_map = ath12k_hw_tcl2wbm_rbm_map_wcn7850,
 	.wbm2sw_cc_enable = HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW0_EN |
 			    HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW2_EN |
 			    HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW3_EN |
-                            HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW4_EN,
+			    HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW4_EN,
+};
+
+const struct hal_ops hal_wcn7850_ops = {
+	.create_srng_config = qwz_hal_srng_create_config_wcn7850,
+	.tcl_to_wbm_rbm_map = ath12k_hal_wcn7850_tcl_to_wbm_rbm_map,
 };
 
 static const struct ath12k_hw_params ath12k_hw_params[] = {
@@ -3021,6 +2848,7 @@ static const struct ath12k_hw_params ath12k_hw_params[] = {
 		.supports_shadow_regs = true,
 		.fix_l1ss = false,
 		.hal_params = &ath12k_hw_hal_params_wcn7850,
+		.hal_ops = &hal_wcn7850_ops,
 		.qmi_cnss_feature_bitmap = BIT(CNSS_QDSS_CFG_MISS_V01) |
 					   BIT(CNSS_PCIE_PERST_NO_PULL_V01),
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
@@ -8203,14 +8031,24 @@ int
 qwz_dp_srng_calculate_msi_group(struct qwz_softc *sc, enum hal_ring_type type,
     int ring_num)
 {
+	const struct ath12k_hal_tcl_to_wbm_rbm_map *map;
 	const uint8_t *grp_mask;
+	int i;
 
 	switch (type) {
 	case HAL_WBM2SW_RELEASE:
-		if (ring_num == DP_RX_RELEASE_RING_NUM) {
+		if (ring_num == HAL_WBM2SW_REL_ERR_RING_NUM) {
 			grp_mask = &sc->hw_params.ring_mask->rx_wbm_rel[0];
 			ring_num = 0;
 		} else {
+			map = sc->hw_params.hal_ops->tcl_to_wbm_rbm_map;
+			for (i = 0; i < sc->hw_params.max_tx_ring; i++) {
+				if (ring_num == map[i].wbm_ring_num) {
+					ring_num = i;
+					break;
+				}
+			}
+
 			grp_mask = &sc->hw_params.ring_mask->tx[0];
 		}
 		break;
@@ -8225,14 +8063,11 @@ qwz_dp_srng_calculate_msi_group(struct qwz_softc *sc, enum hal_ring_type type,
 		break;
 	case HAL_RXDMA_MONITOR_STATUS:
 	case HAL_RXDMA_MONITOR_DST:
-		grp_mask = &sc->hw_params.ring_mask->rx_mon_status[0];
+		grp_mask = &sc->hw_params.ring_mask->rx_mon_dest[0];
 		break;
 	case HAL_TX_MONITOR_DST:
 		grp_mask = &sc->hw_params.ring_mask->tx_mon_dest[0];
 		break;
-	case HAL_RXDMA_DST:
-		grp_mask = &sc->hw_params.ring_mask->rxdma2host[0];
-		break;
 	case HAL_RXDMA_BUF:
 		grp_mask = &sc->hw_params.ring_mask->host2rxdma[0];
 		break;
@@ -8969,8 +8804,6 @@ qwz_dp_srng_common_cleanup(struct qwz_softc *sc)
 	int i;
 
 	qwz_dp_srng_cleanup(sc, &dp->wbm_desc_rel_ring);
-	qwz_dp_srng_cleanup(sc, &dp->tcl_cmd_ring);
-	qwz_dp_srng_cleanup(sc, &dp->tcl_status_ring);
 	for (i = 0; i < sc->hw_params.max_tx_ring; i++) {
 		qwz_dp_srng_cleanup(sc, &dp->tx_ring[i].tcl_data_ring);
 		qwz_dp_srng_cleanup(sc, &dp->tx_ring[i].tcl_comp_ring);
@@ -9387,13 +9220,15 @@ out:
 #endif
 	return ret;
 }
+
 int
 qwz_dp_srng_common_setup(struct qwz_softc *sc)
 {
 	struct qwz_dp *dp = &sc->dp;
+	const struct ath12k_hal_tcl_to_wbm_rbm_map *map;
 	struct hal_srng *srng;
 	int i, ret;
-	uint8_t tcl_num, wbm_num;
+	uint8_t tx_comp_ring_num;
 
 	ret = qwz_dp_srng_setup(sc, &dp->wbm_desc_rel_ring, HAL_SW2WBM_RELEASE,
 	    0, 0, DP_WBM_RELEASE_RING_SIZE);
@@ -9403,31 +9238,12 @@ qwz_dp_srng_common_setup(struct qwz_softc *sc)
 		goto err;
 	}
 
-	ret = qwz_dp_srng_setup(sc, &dp->tcl_cmd_ring, HAL_TCL_CMD,
-	    0, 0, DP_TCL_CMD_RING_SIZE);
-	if (ret) {
-		printf("%s: failed to set up tcl_cmd ring :%d\n",
-		    sc->sc_dev.dv_xname, ret);
-		goto err;
-	}
-
-	ret = qwz_dp_srng_setup(sc, &dp->tcl_status_ring, HAL_TCL_STATUS,
-	    0, 0, DP_TCL_STATUS_RING_SIZE);
-	if (ret) {
-		printf("%s: failed to set up tcl_status ring :%d\n",
-		    sc->sc_dev.dv_xname, ret);
-		goto err;
-	}
-
 	for (i = 0; i < sc->hw_params.max_tx_ring; i++) {
-		const struct ath12k_hw_hal_params *hal_params;
-
-		hal_params = sc->hw_params.hal_params;
-		tcl_num = hal_params->tcl2wbm_rbm_map[i].tcl_ring_num;
-		wbm_num = hal_params->tcl2wbm_rbm_map[i].wbm_ring_num;
+		map = sc->hw_params.hal_ops->tcl_to_wbm_rbm_map;
+		tx_comp_ring_num = map[i].wbm_ring_num;
 
 		ret = qwz_dp_srng_setup(sc, &dp->tx_ring[i].tcl_data_ring,
-		    HAL_TCL_DATA, tcl_num, 0, sc->hw_params.tx_ring_size);
+		    HAL_TCL_DATA, i, 0, DP_TCL_DATA_RING_SIZE);
 		if (ret) {
 			printf("%s: failed to set up tcl_data ring (%d) :%d\n",
 			    sc->sc_dev.dv_xname, i, ret);
@@ -9435,7 +9251,7 @@ qwz_dp_srng_common_setup(struct qwz_softc *sc)
 		}
 
 		ret = qwz_dp_srng_setup(sc, &dp->tx_ring[i].tcl_comp_ring,
-		    HAL_WBM2SW_RELEASE, wbm_num, 0, DP_TX_COMP_RING_SIZE);
+		    HAL_WBM2SW_RELEASE, tx_comp_ring_num, 0, DP_TX_COMP_RING_SIZE);
 		if (ret) {
 			printf("%s: failed to set up tcl_comp ring (%d) :%d\n",
 			    sc->sc_dev.dv_xname, i, ret);
@@ -9491,8 +9307,17 @@ qwz_dp_srng_common_setup(struct qwz_softc *sc)
 
 	/* When hash based routing of rx packet is enabled, 32 entries to map
 	 * the hash values to the ring will be configured.
-	 */
-	sc->hw_params.hw_ops->reo_setup(sc);
+	 * Each hash entry uses four bits to map to a particular ring. */
+	uint32_t ring_hash_map = HAL_HASH_ROUTING_RING_SW1 << 0 |
+	    HAL_HASH_ROUTING_RING_SW2 << 4 |
+	    HAL_HASH_ROUTING_RING_SW3 << 8 |
+	    HAL_HASH_ROUTING_RING_SW4 << 12 |
+	    HAL_HASH_ROUTING_RING_SW1 << 16 |
+	    HAL_HASH_ROUTING_RING_SW2 << 20 |
+	    HAL_HASH_ROUTING_RING_SW3 << 24 |
+	    HAL_HASH_ROUTING_RING_SW4 << 28;
+
+	qwz_hal_reo_hw_setup(sc, ring_hash_map);
 	return 0;
 
 err:
@@ -16893,14 +16718,9 @@ qwz_dp_service_srng(struct qwz_softc *sc, int grp_id)
 	struct qwz_pdev_dp *dp = &sc->pdev_dp;
 	int i, j, ret = 0;
 
-	for (i = 0; i < sc->hw_params.max_tx_ring; i++) {
-		const struct ath12k_hw_tcl2wbm_rbm_map *map;
-
-		map = &sc->hw_params.hal_params->tcl2wbm_rbm_map[i];
-		if ((sc->hw_params.ring_mask->tx[grp_id]) &
-		    (1 << (map->wbm_ring_num)) &&
-		    qwz_dp_tx_completion_handler(sc, i))
-			ret = 1;
+	if (sc->hw_params.ring_mask->tx[grp_id]) {
+		i = fls(sc->hw_params.ring_mask->tx[grp_id]) - 1;
+		qwz_dp_tx_completion_handler(sc, i);
 	}
 
 	if (sc->hw_params.ring_mask->rx_err[grp_id] &&
@@ -16921,7 +16741,7 @@ qwz_dp_service_srng(struct qwz_softc *sc, int grp_id)
 		for (j = 0; j < sc->hw_params.num_rxmda_per_pdev; j++) {
 			int id = i * sc->hw_params.num_rxmda_per_pdev + j;
 
-			if ((sc->hw_params.ring_mask->rx_mon_status[grp_id] &
+			if ((sc->hw_params.ring_mask->rx_mon_dest[grp_id] &
 			   (1 << id)) == 0)
 				continue;
 
@@ -16934,23 +16754,10 @@ qwz_dp_service_srng(struct qwz_softc *sc, int grp_id)
 	    qwz_dp_process_reo_status(sc))
 		ret = 1;
 
-	for (i = 0; i < sc->num_radios; i++) {
-		for (j = 0; j < sc->hw_params.num_rxmda_per_pdev; j++) {
-			int id = i * sc->hw_params.num_rxmda_per_pdev + j;
-
-			if (sc->hw_params.ring_mask->rxdma2host[grp_id] &
-			   (1 << (id))) {
-				if (qwz_dp_process_rxdma_err(sc, id))
-					ret = 1;
-			}
-
-			if (sc->hw_params.ring_mask->host2rxdma[grp_id] &
-			    (1 << id)) {
-				qwz_dp_rxbufs_replenish(sc, id,
-				    &dp->rx_refill_buf_ring, 0,
-				    sc->hw_params.hal_params->rx_buf_rbm);
-			}
-		}
+	if (sc->hw_params.ring_mask->host2rxdma[grp_id]) {
+		qwz_dp_rxbufs_replenish(sc, 0 /* FIXME */,
+		    &dp->rx_refill_buf_ring, 0,
+		    sc->hw_params.hal_params->rx_buf_rbm);
 	}
 
 	return ret;
@@ -19577,7 +19384,7 @@ static const struct hal_srng_config hw_srng_config_templ[] = {
 };
 
 int
-qwz_hal_srng_create_config(struct qwz_softc *sc)
+qwz_hal_srng_create_config_wcn7850(struct qwz_softc *sc)
 {
 	struct ath12k_hal *hal = &sc->hal;
 	struct hal_srng_config *s;
@@ -19915,7 +19722,7 @@ qwz_hal_srng_init(struct qwz_softc *sc)
 
 	memset(hal, 0, sizeof(*hal));
 
-	ret = qwz_hal_srng_create_config(sc);
+	ret = sc->hw_params.hal_ops->create_srng_config(sc);
 	if (ret)
 		goto err_hal;
 
@@ -23670,7 +23477,7 @@ qwz_dp_tx(struct qwz_softc *sc, struct qwz_vif *arvif, uint8_t pdev_id,
 	ring_selector = 0;
 
 	ti.ring_id = ring_selector % sc->hw_params.max_tx_ring;
-	ti.rbm_id = sc->hw_params.hal_params->tcl2wbm_rbm_map[ti.ring_id].rbm_id;
+	ti.rbm_id = sc->hw_params.hal_ops->tcl_to_wbm_rbm_map[ti.ring_id].rbm_id;
 
 	ring_map |= (1 << ti.ring_id);
 
diff --git a/sys/dev/ic/qwzvar.h b/sys/dev/ic/qwzvar.h
index c17202069..8eb515838 100644
--- a/sys/dev/ic/qwzvar.h
+++ b/sys/dev/ic/qwzvar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qwzvar.h,v 1.4 2024/08/16 00:26:54 patrick Exp $	*/
+/*	$OpenBSD: qwzvar.h,v 1.6 2024/08/20 21:24:15 patrick Exp $	*/
 
 /*
  * Copyright (c) 2018-2019 The Linux Foundation.
@@ -57,14 +57,13 @@ struct qwz_softc;
 
 struct ath12k_hw_ring_mask {
 	uint8_t tx[ATH12K_EXT_IRQ_GRP_NUM_MAX];
-	uint8_t rx_mon_status[ATH12K_EXT_IRQ_GRP_NUM_MAX];
+	uint8_t rx_mon_dest[ATH12K_EXT_IRQ_GRP_NUM_MAX];
 	uint8_t rx[ATH12K_EXT_IRQ_GRP_NUM_MAX];
 	uint8_t rx_err[ATH12K_EXT_IRQ_GRP_NUM_MAX];
 	uint8_t rx_wbm_rel[ATH12K_EXT_IRQ_GRP_NUM_MAX];
 	uint8_t reo_status[ATH12K_EXT_IRQ_GRP_NUM_MAX];
-	uint8_t rxdma2host[ATH12K_EXT_IRQ_GRP_NUM_MAX];
 	uint8_t host2rxdma[ATH12K_EXT_IRQ_GRP_NUM_MAX];
-	uint8_t	tx_mon_dest[ATH12K_EXT_IRQ_GRP_NUM_MAX];
+	uint8_t tx_mon_dest[ATH12K_EXT_IRQ_GRP_NUM_MAX];
 };
 
 #define ATH12K_FW_DIR			"qwz"
@@ -78,8 +77,7 @@ struct ath12k_hw_ring_mask {
 
 #define QWZ_FW_BUILD_ID_MASK "QC_IMAGE_VERSION_STRING="
 
-struct ath12k_hw_tcl2wbm_rbm_map {
-	uint8_t tcl_ring_num;
+struct ath12k_hal_tcl_to_wbm_rbm_map {
 	uint8_t wbm_ring_num;
 	uint8_t rbm_id;
 };
@@ -167,6 +165,11 @@ struct hal_tx_status {
 	uint32_t rate_stats;
 };
 
+struct hal_ops {
+	int (*create_srng_config)(struct qwz_softc *);
+	const struct ath12k_hal_tcl_to_wbm_rbm_map *tcl_to_wbm_rbm_map;
+};
+
 struct ath12k_hw_params {
 	const char *name;
 	uint16_t hw_rev;
@@ -226,6 +229,7 @@ struct ath12k_hw_params {
 	bool credit_flow;
 	uint8_t max_tx_ring;
 	const struct ath12k_hw_hal_params *hal_params;
+	const struct hal_ops *hal_ops;
 	uint64_t qmi_cnss_feature_bitmap;
 #if notyet
 	bool supports_dynamic_smps_6ghz;
@@ -297,9 +301,6 @@ struct ath12k_hw_ops {
 	struct rx_attention *(*rx_desc_get_attention)(struct hal_rx_desc *desc);
 #ifdef notyet
 	uint8_t *(*rx_desc_get_msdu_payload)(struct hal_rx_desc *desc);
-#endif
-	void (*reo_setup)(struct qwz_softc *);
-#ifdef notyet
 	uint16_t (*mpdu_info_get_peerid)(uint8_t *tlv_data);
 	bool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);
 	uint8_t* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
@@ -1197,8 +1198,6 @@ struct qwz_dp {
 	struct dp_link_desc_bank link_desc_banks[DP_LINK_DESC_BANKS_MAX];
 	struct dp_srng wbm_idle_ring;
 	struct dp_srng wbm_desc_rel_ring;
-	struct dp_srng tcl_cmd_ring;
-	struct dp_srng tcl_status_ring;
 	struct dp_srng reo_reinject_ring;
 	struct dp_srng rx_rel_ring;
 	struct dp_srng reo_except_ring;
diff --git a/sys/dev/pci/if_qwz_pci.c b/sys/dev/pci/if_qwz_pci.c
index d4cad8d5b..6acaade99 100644
--- a/sys/dev/pci/if_qwz_pci.c
+++ b/sys/dev/pci/if_qwz_pci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_qwz_pci.c,v 1.3 2024/08/16 00:26:54 patrick Exp $	*/
+/*	$OpenBSD: if_qwz_pci.c,v 1.4 2024/08/20 21:24:15 patrick Exp $	*/
 
 /*
  * Copyright 2023 Stefan Sperling <stsp@openbsd.org>
@@ -1506,9 +1506,8 @@ qwz_pcic_ext_irq_config(struct qwz_softc *sc, struct pci_attach_args *pa)
 		    sc->hw_params.ring_mask->rx_err[i] ||
 		    sc->hw_params.ring_mask->rx_wbm_rel[i] ||
 		    sc->hw_params.ring_mask->reo_status[i] ||
-		    sc->hw_params.ring_mask->rxdma2host[i] ||
 		    sc->hw_params.ring_mask->host2rxdma[i] ||
-		    sc->hw_params.ring_mask->rx_mon_status[i]) {
+		    sc->hw_params.ring_mask->rx_mon_dest[i]) {
 			num_irq = 1;
 		}
 
diff --git a/sys/dev/pci/if_rge.c b/sys/dev/pci/if_rge.c
index 02dba360b..c30c4c995 100644
--- a/sys/dev/pci/if_rge.c
+++ b/sys/dev/pci/if_rge.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_rge.c,v 1.30 2024/08/20 00:09:12 dlg Exp $	*/
+/*	$OpenBSD: if_rge.c,v 1.34 2024/08/21 01:22:31 dlg Exp $	*/
 
 /*
  * Copyright (c) 2019, 2020, 2023, 2024
@@ -74,7 +74,6 @@ int		rge_ifmedia_upd(struct ifnet *);
 void		rge_ifmedia_sts(struct ifnet *, struct ifmediareq *);
 int		rge_allocmem(struct rge_softc *);
 int		rge_newbuf(struct rge_queues *);
-void		rge_discard_rxbuf(struct rge_queues *, int);
 void		rge_rx_list_init(struct rge_queues *);
 void		rge_tx_list_init(struct rge_queues *);
 void		rge_fill_rx_ring(struct rge_queues *);
@@ -567,7 +566,7 @@ rge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		break;
 	case SIOCGIFRXR:
 		error = if_rxr_ioctl((struct if_rxrinfo *)ifr->ifr_data,
-		    NULL, RGE_JUMBO_FRAMELEN, &sc->sc_queues->q_rx.rge_rx_ring);
+		    NULL, MCLBYTES, &sc->sc_queues->q_rx.rge_rx_ring);
 		break;
 	default:
 		error = ether_ioctl(ifp, &sc->sc_arpcom, cmd, data);
@@ -886,7 +885,8 @@ rge_stop(struct ifnet *ifp)
 
 	if (q->q_rx.rge_head != NULL) {
 		m_freem(q->q_rx.rge_head);
-		q->q_rx.rge_head = q->q_rx.rge_tail = NULL;
+		q->q_rx.rge_head = NULL;
+		q->q_rx.rge_tail = &q->q_rx.rge_head;
 	}
 
 	/* Free the TX list buffers. */
@@ -1141,13 +1141,15 @@ rge_newbuf(struct rge_queues *q)
 	struct rge_rx_desc *r;
 	struct rge_rxq *rxq;
 	bus_dmamap_t rxmap;
+	uint32_t cmdsts;
 	int idx;
 
-	m = MCLGETL(NULL, M_DONTWAIT, RGE_JUMBO_FRAMELEN);
+	m = MCLGETL(NULL, M_DONTWAIT, MCLBYTES);
 	if (m == NULL)
 		return (ENOBUFS);
 
-	m->m_len = m->m_pkthdr.len = RGE_JUMBO_FRAMELEN;
+	m->m_len = m->m_pkthdr.len = MCLBYTES;
+	m_adj(m, ETHER_ALIGN);
 
 	idx = q->q_rx.rge_rxq_prodidx;
 	rxq = &q->q_rx.rge_rxq[idx];
@@ -1166,15 +1168,23 @@ rge_newbuf(struct rge_queues *q)
 
 	rxq->rxq_mbuf = m;
 
-	r->hi_qword1.rx_qword4.rge_extsts = 0;
+	cmdsts = rxmap->dm_segs[0].ds_len;
+	if (idx == RGE_RX_LIST_CNT - 1)
+		cmdsts |= RGE_RDCMDSTS_EOR;
+
+	r->hi_qword1.rx_qword4.rge_cmdsts = htole32(cmdsts);
+	r->hi_qword1.rx_qword4.rge_extsts = htole32(0);
 	r->hi_qword0.rge_addr = htole64(rxmap->dm_segs[0].ds_addr);
 
-	r->hi_qword1.rx_qword4.rge_cmdsts = htole32(rxmap->dm_segs[0].ds_len);
-	if (idx == RGE_RX_LIST_CNT - 1)
-		r->hi_qword1.rx_qword4.rge_cmdsts |= htole32(RGE_RDCMDSTS_EOR);
-
-	r->hi_qword1.rx_qword4.rge_cmdsts |= htole32(RGE_RDCMDSTS_OWN);
+	bus_dmamap_sync(sc->sc_dmat, q->q_rx.rge_rx_list_map,
+	    idx * sizeof(struct rge_rx_desc), sizeof(struct rge_rx_desc),
+	    BUS_DMASYNC_PREWRITE);
 
+	bus_dmamap_sync(sc->sc_dmat, q->q_rx.rge_rx_list_map,
+	    idx * sizeof(struct rge_rx_desc), sizeof(struct rge_rx_desc),
+	    BUS_DMASYNC_POSTWRITE);
+	cmdsts |= RGE_RDCMDSTS_OWN;
+	r->hi_qword1.rx_qword4.rge_cmdsts = htole32(cmdsts);
 	bus_dmamap_sync(sc->sc_dmat, q->q_rx.rge_rx_list_map,
 	    idx * sizeof(struct rge_rx_desc), sizeof(struct rge_rx_desc),
 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
@@ -1184,34 +1194,16 @@ rge_newbuf(struct rge_queues *q)
 	return (0);
 }
 
-void
-rge_discard_rxbuf(struct rge_queues *q, int idx)
-{
-	struct rge_softc *sc = q->q_sc;
-	struct rge_rx_desc *r;
-
-	r = &q->q_rx.rge_rx_list[idx];
-
-	r->hi_qword1.rx_qword4.rge_cmdsts = htole32(RGE_JUMBO_FRAMELEN);
-	r->hi_qword1.rx_qword4.rge_extsts = 0;
-	if (idx == RGE_RX_LIST_CNT - 1)
-		r->hi_qword1.rx_qword4.rge_cmdsts |= htole32(RGE_RDCMDSTS_EOR);
-	r->hi_qword1.rx_qword4.rge_cmdsts |= htole32(RGE_RDCMDSTS_OWN);
-
-	bus_dmamap_sync(sc->sc_dmat, q->q_rx.rge_rx_list_map,
-	    idx * sizeof(struct rge_rx_desc), sizeof(struct rge_rx_desc),
-	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
-}
-
 void
 rge_rx_list_init(struct rge_queues *q)
 {
 	memset(q->q_rx.rge_rx_list, 0, RGE_RX_LIST_SZ);
 
 	q->q_rx.rge_rxq_prodidx = q->q_rx.rge_rxq_considx = 0;
-	q->q_rx.rge_head = q->q_rx.rge_tail = NULL;
+	q->q_rx.rge_head = NULL;
+	q->q_rx.rge_tail = &q->q_rx.rge_head;
 
-	if_rxr_init(&q->q_rx.rge_rx_ring, 32, RGE_RX_LIST_CNT);
+	if_rxr_init(&q->q_rx.rge_rx_ring, 32, RGE_RX_LIST_CNT - 1);
 	rge_fill_rx_ring(q);
 }
 
@@ -1261,80 +1253,76 @@ rge_rxeof(struct rge_queues *q)
 	struct rge_rx_desc *cur_rx;
 	struct rge_rxq *rxq;
 	uint32_t rxstat, extsts;
-	int i, total_len, rx = 0;
+	int i, mlen, rx = 0;
+	int cons;
 
-	for (i = q->q_rx.rge_rxq_considx; if_rxr_inuse(rxr) > 0;
-	    i = RGE_NEXT_RX_DESC(i)) {
-		/* Invalidate the descriptor memory. */
-		bus_dmamap_sync(sc->sc_dmat, q->q_rx.rge_rx_list_map,
-		    i * sizeof(struct rge_rx_desc), sizeof(struct rge_rx_desc),
-		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
+	i = cons = q->q_rx.rge_rxq_considx;
 
+	while (if_rxr_inuse(rxr) > 0) {
 		cur_rx = &q->q_rx.rge_rx_list[i];
+
+		bus_dmamap_sync(sc->sc_dmat, q->q_rx.rge_rx_list_map,
+		    i * sizeof(*cur_rx), sizeof(*cur_rx),
+		    BUS_DMASYNC_POSTREAD);
 		rxstat = letoh32(cur_rx->hi_qword1.rx_qword4.rge_cmdsts);
-		extsts = letoh32(cur_rx->hi_qword1.rx_qword4.rge_extsts);
-
-		if (rxstat & RGE_RDCMDSTS_OWN)
+		if (rxstat & RGE_RDCMDSTS_OWN) {
+			bus_dmamap_sync(sc->sc_dmat, q->q_rx.rge_rx_list_map,
+			    i * sizeof(*cur_rx), sizeof(*cur_rx),
+			    BUS_DMASYNC_PREREAD);
 			break;
+		}
 
-		total_len = rxstat & RGE_RDCMDSTS_FRAGLEN;
 		rxq = &q->q_rx.rge_rxq[i];
-		m = rxq->rxq_mbuf;
-		rxq->rxq_mbuf = NULL;
-		if_rxr_put(rxr, 1);
-		rx = 1;
-
-		/* Invalidate the RX mbuf and unload its map. */
 		bus_dmamap_sync(sc->sc_dmat, rxq->rxq_dmamap, 0,
 		    rxq->rxq_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
 		bus_dmamap_unload(sc->sc_dmat, rxq->rxq_dmamap);
+		m = rxq->rxq_mbuf;
+		rxq->rxq_mbuf = NULL;
 
-		if ((rxstat & (RGE_RDCMDSTS_SOF | RGE_RDCMDSTS_EOF)) !=
-		    (RGE_RDCMDSTS_SOF | RGE_RDCMDSTS_EOF)) {
-			ifp->if_ierrors++;
+		i = RGE_NEXT_RX_DESC(i);
+		if_rxr_put(rxr, 1);
+		rx = 1;
+
+		if (ISSET(rxstat, RGE_RDCMDSTS_SOF)) {
+			if (q->q_rx.rge_head != NULL) {
+				ifp->if_ierrors++;
+				m_freem(q->q_rx.rge_head);
+				q->q_rx.rge_tail = &q->q_rx.rge_head;
+			}
+
+			m->m_pkthdr.len = 0;
+		} else if (q->q_rx.rge_head == NULL) {
 			m_freem(m);
-			rge_discard_rxbuf(q, i);
 			continue;
-		}
+		} else
+			CLR(m->m_flags, M_PKTHDR);
+
+		*q->q_rx.rge_tail = m;
+		q->q_rx.rge_tail = &m->m_next;
+
+		mlen = rxstat & RGE_RDCMDSTS_FRAGLEN;
+		m->m_len = mlen;
+
+		m = q->q_rx.rge_head;
+		m->m_pkthdr.len += mlen;
 
 		if (rxstat & RGE_RDCMDSTS_RXERRSUM) {
 			ifp->if_ierrors++;
-			/*
-			 * If this is part of a multi-fragment packet,
-			 * discard all the pieces.
-			 */
-			if (q->q_rx.rge_head != NULL) {
-				m_freem(q->q_rx.rge_head);
-				q->q_rx.rge_head = q->q_rx.rge_tail = NULL;
-			}
 			m_freem(m);
-			rge_discard_rxbuf(q, i);
+			q->q_rx.rge_head = NULL;
+			q->q_rx.rge_tail = &q->q_rx.rge_head;
 			continue;
 		}
 
-		if (q->q_rx.rge_head != NULL) {
-			m->m_len = total_len;
-			/*
-			 * Special case: if there's 4 bytes or less
-			 * in this buffer, the mbuf can be discarded:
-			 * the last 4 bytes is the CRC, which we don't
-			 * care about anyway.
-			 */
-			if (m->m_len <= ETHER_CRC_LEN) {
-				q->q_rx.rge_tail->m_len -=
-				    (ETHER_CRC_LEN - m->m_len);
-				m_freem(m);
-			} else {
-				m->m_len -= ETHER_CRC_LEN;
-				m->m_flags &= ~M_PKTHDR;
-				q->q_rx.rge_tail->m_next = m;
-			}
-			m = q->q_rx.rge_head;
-			q->q_rx.rge_head = q->q_rx.rge_tail = NULL;
-			m->m_pkthdr.len = total_len - ETHER_CRC_LEN;
-		} else
-			m->m_pkthdr.len = m->m_len =
-			    (total_len - ETHER_CRC_LEN);
+		if (!ISSET(rxstat, RGE_RDCMDSTS_EOF))
+			continue;
+
+		q->q_rx.rge_head = NULL;
+		q->q_rx.rge_tail = &q->q_rx.rge_head;
+
+		m_adj(m, -ETHER_CRC_LEN);
+
+		extsts = letoh32(cur_rx->hi_qword1.rx_qword4.rge_extsts);
 
 		/* Check IP header checksum. */
 		if (!(extsts & RGE_RDEXTSTS_IPCSUMERR) &&
@@ -1361,13 +1349,32 @@ rge_rxeof(struct rge_queues *q)
 		ml_enqueue(&ml, m);
 	}
 
+	if (!rx)
+		return (0);
+
+	if (i >= cons) {
+		bus_dmamap_sync(sc->sc_dmat, q->q_rx.rge_rx_list_map,
+		    cons * sizeof(*cur_rx), (i - cons) * sizeof(*cur_rx),
+		    BUS_DMASYNC_POSTWRITE);
+	} else {
+		bus_dmamap_sync(sc->sc_dmat, q->q_rx.rge_rx_list_map,
+		    cons * sizeof(*cur_rx),
+		    (RGE_RX_LIST_CNT - cons) * sizeof(*cur_rx),
+		    BUS_DMASYNC_POSTWRITE);
+		if (i > 0) {
+			bus_dmamap_sync(sc->sc_dmat, q->q_rx.rge_rx_list_map,
+			    0, i * sizeof(*cur_rx),
+			    BUS_DMASYNC_POSTWRITE);
+		}
+	}
+
 	if (ifiq_input(&ifp->if_rcv, &ml))
 		if_rxr_livelocked(rxr);
 
 	q->q_rx.rge_rxq_considx = i;
 	rge_fill_rx_ring(q);
 
-	return (rx);
+	return (1);
 }
 
 int
diff --git a/sys/dev/pci/if_rgereg.h b/sys/dev/pci/if_rgereg.h
index 62b02f8cc..bee10d61a 100644
--- a/sys/dev/pci/if_rgereg.h
+++ b/sys/dev/pci/if_rgereg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_rgereg.h,v 1.12 2024/08/20 00:09:12 dlg Exp $	*/
+/*	$OpenBSD: if_rgereg.h,v 1.13 2024/08/21 01:12:52 dlg Exp $	*/
 
 /*
  * Copyright (c) 2019, 2020 Kevin Lo <kevlo@openbsd.org>
@@ -270,7 +270,7 @@ struct rge_rx_desc {
 			uint32_t	rsvd8;
 		} rx_ptp;
 	} hi_qword1;
-};
+} __packed __aligned(16);
 
 #define RGE_RDCMDSTS_RXERRSUM	0x00100000
 #define RGE_RDCMDSTS_EOF	0x01000000
@@ -344,7 +344,7 @@ struct rge_rx {
 	struct rge_rx_desc	*rge_rx_list;
 
 	struct mbuf		*rge_head;
-	struct mbuf		*rge_tail;
+	struct mbuf		**rge_tail;
 };
 
 struct rge_queues {
diff --git a/sys/kern/exec_elf.c b/sys/kern/exec_elf.c
index c6a092d91..548f96c64 100644
--- a/sys/kern/exec_elf.c
+++ b/sys/kern/exec_elf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: exec_elf.c,v 1.188 2024/07/14 11:36:54 jca Exp $	*/
+/*	$OpenBSD: exec_elf.c,v 1.190 2024/08/21 03:16:25 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1996 Per Fogelstrom
@@ -569,8 +569,10 @@ elf_load_file(struct proc *p, char *path, struct exec_package *epp,
 			pr->ps_pin.pn_end = base + len;
 			pr->ps_pin.pn_pins = pins;
 			pr->ps_pin.pn_npins = npins;
-			pr->ps_flags |= PS_PIN;
 		}
+	} else {
+		error = EINVAL;	/* no pin table */
+		goto bad1;
 	}
 
 	vn_marktext(nd.ni_vp);
@@ -867,7 +869,6 @@ exec_elf_makecmds(struct proc *p, struct exec_package *epp)
 			epp->ep_pinend = base + len;
 			epp->ep_pins = pins;
 			epp->ep_npins = npins;
-			p->p_p->ps_flags |= PS_PIN;
 		}
 	}
 
diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index 189596c53..76f4e70e2 100644
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_exec.c,v 1.257 2024/08/06 08:44:54 claudio Exp $	*/
+/*	$OpenBSD: kern_exec.c,v 1.258 2024/08/21 03:07:45 deraadt Exp $	*/
 /*	$NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $	*/
 
 /*-
@@ -514,12 +514,10 @@ sys_execve(struct proc *p, void *v, register_t *retval)
 		pr->ps_pin.pn_pins = pack.ep_pins;
 		pack.ep_pins = NULL;
 		pr->ps_pin.pn_npins = pack.ep_npins;
-		pr->ps_flags |= PS_PIN;
 	} else {
 		pr->ps_pin.pn_start = pr->ps_pin.pn_end = 0;
 		pr->ps_pin.pn_pins = NULL;
 		pr->ps_pin.pn_npins = 0;
-		pr->ps_flags &= ~PS_PIN;
 	}
 	if (pr->ps_libcpin.pn_pins) {
 		free(pr->ps_libcpin.pn_pins, M_PINSYSCALL,
@@ -527,7 +525,6 @@ sys_execve(struct proc *p, void *v, register_t *retval)
 		pr->ps_libcpin.pn_start = pr->ps_libcpin.pn_end = 0;
 		pr->ps_libcpin.pn_pins = NULL;
 		pr->ps_libcpin.pn_npins = 0;
-		pr->ps_flags &= ~PS_LIBCPIN;
 	}
 
 	stopprofclock(pr);	/* stop profiling */
diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c
index 6676926a0..4663ba8fd 100644
--- a/sys/kern/kern_fork.c
+++ b/sys/kern/kern_fork.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_fork.c,v 1.264 2024/08/20 07:48:23 mvs Exp $	*/
+/*	$OpenBSD: kern_fork.c,v 1.265 2024/08/21 03:07:45 deraadt Exp $	*/
 /*	$NetBSD: kern_fork.c,v 1.29 1996/02/09 18:59:34 christos Exp $	*/
 
 /*
@@ -256,14 +256,12 @@ process_new(struct proc *p, struct process *parent, int flags)
 		    sizeof(u_int), M_PINSYSCALL, M_WAITOK);
 		memcpy(pr->ps_pin.pn_pins, parent->ps_pin.pn_pins,
 		    parent->ps_pin.pn_npins * sizeof(u_int));
-		pr->ps_flags |= PS_PIN;
 	}
 	if (parent->ps_libcpin.pn_pins) {
 		pr->ps_libcpin.pn_pins = mallocarray(parent->ps_libcpin.pn_npins,
 		    sizeof(u_int), M_PINSYSCALL, M_WAITOK);
 		memcpy(pr->ps_libcpin.pn_pins, parent->ps_libcpin.pn_pins,
 		    parent->ps_libcpin.pn_npins * sizeof(u_int));
-		pr->ps_flags |= PS_LIBCPIN;
 	}
 
 	/*
diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index 01eb58bb3..3cae156eb 100644
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: proc.h,v 1.369 2024/08/11 21:07:05 mvs Exp $	*/
+/*	$OpenBSD: proc.h,v 1.370 2024/08/21 03:07:45 deraadt Exp $	*/
 /*	$NetBSD: proc.h,v 1.44 1996/04/22 01:23:21 christos Exp $	*/
 
 /*-
@@ -303,8 +303,6 @@ struct process {
 #define	PS_CHROOT	0x01000000	/* Process is chrooted */
 #define	PS_NOBTCFI	0x02000000	/* No Branch Target CFI */
 #define	PS_ITIMER	0x04000000	/* Virtual interval timers running */
-#define	PS_PIN		0x08000000	/* ld.so or static syscall pin */
-#define	PS_LIBCPIN	0x10000000	/* libc.so syscall pin */
 #define	PS_CONTINUED	0x20000000	/* Continued proc not yet waited for */
 
 #define	PS_BITS \
diff --git a/sys/uvm/uvm_mmap.c b/sys/uvm/uvm_mmap.c
index d89069127..5a69fa757 100644
--- a/sys/uvm/uvm_mmap.c
+++ b/sys/uvm/uvm_mmap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_mmap.c,v 1.191 2024/04/05 14:16:05 deraadt Exp $	*/
+/*	$OpenBSD: uvm_mmap.c,v 1.192 2024/08/21 03:07:45 deraadt Exp $	*/
 /*	$NetBSD: uvm_mmap.c,v 1.49 2001/02/18 21:19:08 chs Exp $	*/
 
 /*
@@ -647,7 +647,6 @@ err:
 	pr->ps_libcpin.pn_end = base + len;
 	pr->ps_libcpin.pn_pins = pins;
 	pr->ps_libcpin.pn_npins = npins;
-	pr->ps_flags |= PS_LIBCPIN;
 
 #ifdef PMAP_CHECK_COPYIN
 	/* Assume (and insist) on libc.so text being execute-only */
diff --git a/usr.bin/tmux/format.c b/usr.bin/tmux/format.c
index 2377697bc..aa17e924f 100644
--- a/usr.bin/tmux/format.c
+++ b/usr.bin/tmux/format.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: format.c,v 1.318 2023/09/08 06:52:31 nicm Exp $ */
+/* $OpenBSD: format.c,v 1.319 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2011 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -1962,6 +1962,23 @@ format_cb_pane_unseen_changes(struct format_tree *ft)
 	return (NULL);
 }
 
+/* Callback for pane_key_mode. */
+static void *
+format_cb_pane_key_mode(struct format_tree *ft)
+{
+	if (ft->wp != NULL && ft->wp->screen != NULL) {
+		switch (ft->wp->screen->mode & EXTENDED_KEY_MODES) {
+		case MODE_KEYS_EXTENDED:
+			return (xstrdup("Ext 1"));
+		case MODE_KEYS_EXTENDED_2:
+			return (xstrdup("Ext 2"));
+		default:
+			return (xstrdup("VT10x"));
+		}
+	}
+	return (NULL);
+}
+
 /* Callback for pane_last. */
 static void *
 format_cb_pane_last(struct format_tree *ft)
@@ -2997,6 +3014,9 @@ static const struct format_table_entry format_table[] = {
 	{ "pane_input_off", FORMAT_TABLE_STRING,
 	  format_cb_pane_input_off
 	},
+	{ "pane_key_mode", FORMAT_TABLE_STRING,
+	  format_cb_pane_key_mode
+	},
 	{ "pane_last", FORMAT_TABLE_STRING,
 	  format_cb_pane_last
 	},
diff --git a/usr.bin/tmux/input-keys.c b/usr.bin/tmux/input-keys.c
index 3dbf465ec..7a83b165e 100644
--- a/usr.bin/tmux/input-keys.c
+++ b/usr.bin/tmux/input-keys.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: input-keys.c,v 1.94 2023/01/12 18:49:11 nicm Exp $ */
+/* $OpenBSD: input-keys.c,v 1.95 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -308,20 +308,6 @@ static struct input_key_entry input_key_defaults[] = {
 	{ .key = KEYC_DC|KEYC_BUILD_MODIFIERS,
 	  .data = "\033[3;_~"
 	},
-
-	/* Tab and modifiers. */
-	{ .key = '\011'|KEYC_CTRL,
-	  .data = "\011"
-	},
-	{ .key = '\011'|KEYC_CTRL|KEYC_EXTENDED,
-	  .data = "\033[9;5u"
-	},
-	{ .key = '\011'|KEYC_CTRL|KEYC_SHIFT,
-	  .data = "\033[Z"
-	},
-	{ .key = '\011'|KEYC_CTRL|KEYC_SHIFT|KEYC_EXTENDED,
-	  .data = "\033[1;5Z"
-	}
 };
 static const key_code input_key_modifiers[] = {
 	0,
@@ -427,126 +413,18 @@ input_key_write(const char *from, struct bufferevent *bev, const char *data,
 	bufferevent_write(bev, data, size);
 }
 
-/* Translate a key code into an output key sequence. */
-int
-input_key(struct screen *s, struct bufferevent *bev, key_code key)
+/*
+ * Encode and write an extended key escape sequence in one of the two
+ * possible formats, depending on the configured output mode.
+ */
+static int
+input_key_extended(struct bufferevent *bev, key_code key)
 {
-	struct input_key_entry	*ike = NULL;
-	key_code		 justkey, newkey, outkey, modifiers;
-	struct utf8_data	 ud;
-	char			 tmp[64], modifier;
+	char		 tmp[64], modifier;
+	struct utf8_data ud;
+	wchar_t		 wc;
 
-	/* Mouse keys need a pane. */
-	if (KEYC_IS_MOUSE(key))
-		return (0);
-
-	/* Literal keys go as themselves (can't be more than eight bits). */
-	if (key & KEYC_LITERAL) {
-		ud.data[0] = (u_char)key;
-		input_key_write(__func__, bev, &ud.data[0], 1);
-		return (0);
-	}
-
-	/* Is this backspace? */
-	if ((key & KEYC_MASK_KEY) == KEYC_BSPACE) {
-		newkey = options_get_number(global_options, "backspace");
-		if (newkey >= 0x7f)
-			newkey = '\177';
-		key = newkey|(key & (KEYC_MASK_MODIFIERS|KEYC_MASK_FLAGS));
-	}
-
-	/*
-	 * If this is a normal 7-bit key, just send it, with a leading escape
-	 * if necessary. If it is a UTF-8 key, split it and send it.
-	 */
-	justkey = (key & ~(KEYC_META|KEYC_IMPLIED_META));
-	if (justkey <= 0x7f) {
-		if (key & KEYC_META)
-			input_key_write(__func__, bev, "\033", 1);
-		ud.data[0] = justkey;
-		input_key_write(__func__, bev, &ud.data[0], 1);
-		return (0);
-	}
-	if (KEYC_IS_UNICODE(justkey)) {
-		if (key & KEYC_META)
-			input_key_write(__func__, bev, "\033", 1);
-		utf8_to_data(justkey, &ud);
-		input_key_write(__func__, bev, ud.data, ud.size);
-		return (0);
-	}
-
-	/*
-	 * Look up in the tree. If not in application keypad or cursor mode,
-	 * remove the flags from the key.
-	 */
-	if (~s->mode & MODE_KKEYPAD)
-		key &= ~KEYC_KEYPAD;
-	if (~s->mode & MODE_KCURSOR)
-		key &= ~KEYC_CURSOR;
-	if (s->mode & MODE_KEXTENDED)
-		ike = input_key_get(key|KEYC_EXTENDED);
-	if (ike == NULL)
-		ike = input_key_get(key);
-	if (ike == NULL && (key & KEYC_META) && (~key & KEYC_IMPLIED_META))
-		ike = input_key_get(key & ~KEYC_META);
-	if (ike == NULL && (key & KEYC_CURSOR))
-		ike = input_key_get(key & ~KEYC_CURSOR);
-	if (ike == NULL && (key & KEYC_KEYPAD))
-		ike = input_key_get(key & ~KEYC_KEYPAD);
-	if (ike == NULL && (key & KEYC_EXTENDED))
-		ike = input_key_get(key & ~KEYC_EXTENDED);
-	if (ike != NULL) {
-		log_debug("found key 0x%llx: \"%s\"", key, ike->data);
-		if ((key == KEYC_PASTE_START || key == KEYC_PASTE_END) &&
-		    (~s->mode & MODE_BRACKETPASTE))
-			return (0);
-		if ((key & KEYC_META) && (~key & KEYC_IMPLIED_META))
-			input_key_write(__func__, bev, "\033", 1);
-		input_key_write(__func__, bev, ike->data, strlen(ike->data));
-		return (0);
-	}
-
-	/* No builtin key sequence; construct an extended key sequence. */
-	if (~s->mode & MODE_KEXTENDED) {
-		if ((key & KEYC_MASK_MODIFIERS) != KEYC_CTRL)
-			goto missing;
-		justkey = (key & KEYC_MASK_KEY);
-		switch (justkey) {
-		case ' ':
-		case '2':
-			key = 0|(key & ~KEYC_MASK_KEY);
-			break;
-		case '|':
-			key = 28|(key & ~KEYC_MASK_KEY);
-			break;
-		case '6':
-			key = 30|(key & ~KEYC_MASK_KEY);
-			break;
-		case '-':
-		case '/':
-			key = 31|(key & ~KEYC_MASK_KEY);
-			break;
-		case '?':
-			key = 127|(key & ~KEYC_MASK_KEY);
-			break;
-		default:
-			if (justkey >= 'A' && justkey <= '_')
-				key = (justkey - 'A')|(key & ~KEYC_MASK_KEY);
-			else if (justkey >= 'a' && justkey <= '~')
-				key = (justkey - 96)|(key & ~KEYC_MASK_KEY);
-			else
-				return (0);
-			break;
-		}
-		return (input_key(s, bev, key & ~KEYC_CTRL));
-	}
-	outkey = (key & KEYC_MASK_KEY);
-	modifiers = (key & KEYC_MASK_MODIFIERS);
-	if (outkey < 32 && outkey != 9 && outkey != 13 && outkey != 27) {
-		outkey = 64 + outkey;
-		modifiers |= KEYC_CTRL;
-	}
-	switch (modifiers) {
+	switch (key & KEYC_MASK_MODIFIERS) {
 	case KEYC_SHIFT:
 		modifier = '2';
 		break;
@@ -569,17 +447,238 @@ input_key(struct screen *s, struct bufferevent *bev, key_code key)
 		modifier = '8';
 		break;
 	default:
-		goto missing;
+		return (-1);
 	}
-	xsnprintf(tmp, sizeof tmp, "\033[%llu;%cu", outkey, modifier);
+
+	if (KEYC_IS_UNICODE(key)) {
+		utf8_to_data(key & KEYC_MASK_KEY, &ud);
+		if (utf8_towc(&ud, &wc) == UTF8_DONE)
+			key = wc;
+		else
+			return (-1);
+	} else
+		key &= KEYC_MASK_KEY;
+
+	if (options_get_number(global_options, "extended-keys-format") == 1)
+		xsnprintf(tmp, sizeof tmp, "\033[27;%c;%llu~", modifier, key);
+	else
+		xsnprintf(tmp, sizeof tmp, "\033[%llu;%cu", key, modifier);
+
 	input_key_write(__func__, bev, tmp, strlen(tmp));
 	return (0);
+}
+
+/*
+ * Outputs the key in the "standard" mode. This is by far the most
+ * complicated output mode, with a lot of remapping in order to
+ * emulate quirks of terminals that today can be only found in museums.
+ */
+static int
+input_key_vt10x(struct bufferevent *bev, key_code key)
+{
+	struct utf8_data	 ud;
+	key_code		 onlykey;
+	char			*p;
+	static const char	*standard_map[2] = {
+		"1!9(0)=+;:'\",<.>/-8? 2",
+		"119900=+;;'',,..\x1f\x1f\x7f\x7f\0\0",
+	};
+
+	log_debug("%s: key in %llx", __func__, key);
+
+	if (key & KEYC_META)
+		input_key_write(__func__, bev, "\033", 1);
+
+	/*
+	 * There's no way to report modifiers for unicode keys in standard mode
+	 * so lose the modifiers.
+	 */
+	if (KEYC_IS_UNICODE(key)) {
+		utf8_to_data(key, &ud);
+                input_key_write(__func__, bev, ud.data, ud.size);
+		return (0);
+	}
+
+	onlykey = key & KEYC_MASK_KEY;
+
+	/* Prevent TAB and RET from being swallowed by C0 remapping logic. */
+	if (onlykey == '\r' || onlykey == '\t')
+		key &= ~KEYC_CTRL;
+
+	/*
+	 * Convert keys with Ctrl modifier into corresponding C0 control codes,
+	 * with the exception of *some* keys, which are remapped into printable
+	 * ASCII characters.
+	 *
+	 * There is no special handling for Shift modifier, which is pretty
+	 * much redundant anyway, as no terminal will send <base key>|SHIFT,
+	 * but only <shifted key>|SHIFT.
+	 */
+	if (key & KEYC_CTRL) {
+		p = strchr(standard_map[0], onlykey);
+		if (p != NULL)
+			key = standard_map[1][p - standard_map[0]];
+		else if (onlykey >= '3' && onlykey <= '7')
+			key = onlykey - '\030';
+		else if (onlykey >= '@' && onlykey <= '~')
+			key = onlykey & 0x1f;
+		else
+			return (-1);
+	}
+
+	log_debug("%s: key out %llx", __func__, key);
+
+	ud.data[0] = key & 0x7f;
+	input_key_write(__func__, bev, &ud.data[0], 1);
+	return (0);
+}
+
+/* Pick keys that are reported as vt10x keys in modifyOtherKeys=1 mode. */
+static int
+input_key_mode1(struct bufferevent *bev, key_code key)
+{
+	key_code	 onlykey;
+
+	log_debug("%s: key in %llx", __func__, key);
+
+	/*
+	 * As per
+	 * https://invisible-island.net/xterm/modified-keys-us-pc105.html.
+	 */
+	onlykey = key & KEYC_MASK_KEY;
+	if ((key & (KEYC_META | KEYC_CTRL)) == KEYC_CTRL &&
+	    (onlykey == '/' || onlykey == '@' || onlykey == '^' ||
+	     (onlykey >= '2' && onlykey <= '8') ||
+	     (onlykey >= '@' && onlykey <= '~')))
+		return (input_key_vt10x(bev, key));
+
+	/*
+	 * A regular or shifted Unicode key + Meta. In the absence of a
+	 * standard to back this, we mimic what iTerm 2 does.
+	 */
+	if ((key & (KEYC_CTRL | KEYC_META)) == KEYC_META &&
+	    KEYC_IS_UNICODE(key))
+		return (input_key_vt10x(bev, key));
 
-missing:
-	log_debug("key 0x%llx missing", key);
 	return (-1);
 }
 
+/* Translate a key code into an output key sequence. */
+int
+input_key(struct screen *s, struct bufferevent *bev, key_code key)
+{
+	struct input_key_entry	*ike = NULL;
+	key_code		 newkey;
+	struct utf8_data	 ud;
+
+	/* Mouse keys need a pane. */
+	if (KEYC_IS_MOUSE(key))
+		return (0);
+
+	/* Literal keys go as themselves (can't be more than eight bits). */
+	if (key & KEYC_LITERAL) {
+		ud.data[0] = (u_char)key;
+		input_key_write(__func__, bev, &ud.data[0], 1);
+		return (0);
+	}
+
+	/* Is this backspace? */
+	if ((key & KEYC_MASK_KEY) == KEYC_BSPACE) {
+		newkey = options_get_number(global_options, "backspace");
+		if (newkey >= 0x7f)
+			newkey = '\177';
+		key = newkey|(key & (KEYC_MASK_MODIFIERS|KEYC_MASK_FLAGS));
+	}
+
+	/* Is this backtab? */
+	if ((key & KEYC_MASK_KEY) == KEYC_BTAB) {
+		if (s->mode & EXTENDED_KEY_MODES) {
+			/* When in xterm extended mode, remap into S-Tab. */
+			key = '\011' | (key & ~KEYC_MASK_KEY) | KEYC_SHIFT;
+		} else {
+			/* Otherwise clear modifiers. */
+			key &= ~KEYC_MASK_MODIFIERS;
+		}
+	}
+
+	/*
+	 * A trivial case, that is a 7-bit key, excluding C0 control characters
+	 * that can't be entered from the keyboard, and no modifiers; or a UTF-8
+	 * key and no modifiers.
+	 */
+	if (!(key & ~KEYC_MASK_KEY)) {
+		if (key == C0_BS || key == C0_HT ||
+		    key == C0_CR || key == C0_ESC ||
+		    (key >= 0x20 && key <= 0x7f)) {
+			ud.data[0] = key;
+			input_key_write(__func__, bev, &ud.data[0], 1);
+			return (0);
+		}
+		if (KEYC_IS_UNICODE(key)) {
+			utf8_to_data(key, &ud);
+			input_key_write(__func__, bev, ud.data, ud.size);
+			return (0);
+		}
+	}
+
+	/*
+	 * Look up the standard VT10x keys in the tree. If not in application
+	 * keypad or cursor mode, remove the respective flags from the key.
+	 */
+	if (~s->mode & MODE_KKEYPAD)
+		key &= ~KEYC_KEYPAD;
+	if (~s->mode & MODE_KCURSOR)
+		key &= ~KEYC_CURSOR;
+	if (ike == NULL)
+		ike = input_key_get(key);
+	if (ike == NULL && (key & KEYC_META) && (~key & KEYC_IMPLIED_META))
+		ike = input_key_get(key & ~KEYC_META);
+	if (ike == NULL && (key & KEYC_CURSOR))
+		ike = input_key_get(key & ~KEYC_CURSOR);
+	if (ike == NULL && (key & KEYC_KEYPAD))
+		ike = input_key_get(key & ~KEYC_KEYPAD);
+	if (ike != NULL) {
+		log_debug("%s: found key 0x%llx: \"%s\"", __func__, key,
+		    ike->data);
+		if ((key == KEYC_PASTE_START || key == KEYC_PASTE_END) &&
+		    (~s->mode & MODE_BRACKETPASTE))
+			return (0);
+		if ((key & KEYC_META) && (~key & KEYC_IMPLIED_META))
+			input_key_write(__func__, bev, "\033", 1);
+		input_key_write(__func__, bev, ike->data, strlen(ike->data));
+		return (0);
+	}
+
+	/*
+	 * No builtin key sequence; construct an extended key sequence
+	 * depending on the client mode.
+	 *
+	 * If something invalid reaches here, an invalid output may be
+	 * produced. For example Ctrl-Shift-2 is invalid (as there's
+	 * no way to enter it). The correct form is Ctrl-Shift-@, at
+	 * least in US English keyboard layout.
+	 */
+	switch (s->mode & EXTENDED_KEY_MODES) {
+	case MODE_KEYS_EXTENDED_2:
+		/*
+		 * The simplest mode to handle - *all* modified keys are
+		 * reported in the extended form.
+		 */
+		return (input_key_extended(bev, key));
+        case MODE_KEYS_EXTENDED:
+		/*
+		 * Some keys are still reported in standard mode, to maintain
+		 * compatibility with applications unaware of extended keys.
+		 */
+		if (input_key_mode1(bev, key) == -1)
+			return (input_key_extended(bev, key));
+		return (0);
+	default:
+		/* The standard mode. */
+		return (input_key_vt10x(bev, key));
+	}
+}
+
 /* Get mouse event string. */
 int
 input_key_get_mouse(struct screen *s, struct mouse_event *m, u_int x, u_int y,
diff --git a/usr.bin/tmux/input.c b/usr.bin/tmux/input.c
index 00268e8e9..eb23e89c7 100644
--- a/usr.bin/tmux/input.c
+++ b/usr.bin/tmux/input.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: input.c,v 1.226 2024/08/19 08:31:36 nicm Exp $ */
+/* $OpenBSD: input.c,v 1.227 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -1408,17 +1408,29 @@ input_csi_dispatch(struct input_ctx *ictx)
 	case INPUT_CSI_MODSET:
 		n = input_get(ictx, 0, 0, 0);
 		m = input_get(ictx, 1, 0, 0);
+		/*
+		 * Set the extended key reporting mode as per the client request,
+		 * unless "extended-keys always" forces us into mode 1.
+		 */
 		if (options_get_number(global_options, "extended-keys") == 2)
 			break;
-		if (n == 0 || (n == 4 && m == 0))
-			screen_write_mode_clear(sctx, MODE_KEXTENDED);
-		else if (n == 4 && (m == 1 || m == 2))
-			screen_write_mode_set(sctx, MODE_KEXTENDED);
+		screen_write_mode_clear(sctx,
+		    MODE_KEYS_EXTENDED|MODE_KEYS_EXTENDED_2);
+		if (n == 4 && m == 1)
+			screen_write_mode_set(sctx, MODE_KEYS_EXTENDED);
+		if (n == 4 && m == 2)
+			screen_write_mode_set(sctx, MODE_KEYS_EXTENDED_2);
 		break;
 	case INPUT_CSI_MODOFF:
 		n = input_get(ictx, 0, 0, 0);
-		if (n == 4)
-			screen_write_mode_clear(sctx, MODE_KEXTENDED);
+		/*
+		 * Clear the extended key reporting mode as per the client request,
+		 * unless "extended-keys always" forces us into mode 1.
+		 */
+		if (n == 4) {
+			screen_write_mode_clear(sctx,
+			    MODE_KEYS_EXTENDED|MODE_KEYS_EXTENDED_2);
+		}
 		break;
 	case INPUT_CSI_WINOPS:
 		input_csi_dispatch_winops(ictx);
diff --git a/usr.bin/tmux/key-string.c b/usr.bin/tmux/key-string.c
index 9b22d2ea1..d9ba95afa 100644
--- a/usr.bin/tmux/key-string.c
+++ b/usr.bin/tmux/key-string.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: key-string.c,v 1.71 2023/01/16 11:26:14 nicm Exp $ */
+/* $OpenBSD: key-string.c,v 1.72 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -56,12 +56,47 @@ static const struct {
 	{ "PPage",	KEYC_PPAGE|KEYC_IMPLIED_META },
 	{ "PageUp",	KEYC_PPAGE|KEYC_IMPLIED_META },
 	{ "PgUp",	KEYC_PPAGE|KEYC_IMPLIED_META },
-	{ "Tab",	'\011' },
 	{ "BTab",	KEYC_BTAB },
 	{ "Space",	' ' },
 	{ "BSpace",	KEYC_BSPACE },
-	{ "Enter",	'\r' },
-	{ "Escape",	'\033' },
+
+	/*
+	 * C0 control characters, with the exception of Tab, Enter,
+	 * and Esc, should never appear as keys. We still render them,
+	 * so to be able to spot them in logs in case of an abnormality.
+	 */
+	{ "[NUL]",	C0_NUL },
+	{ "[SOH]",	C0_SOH },
+	{ "[STX]",	C0_STX },
+	{ "[ETX]",	C0_ETX },
+	{ "[EOT]",	C0_EOT },
+	{ "[ENQ]",	C0_ENQ },
+	{ "[ASC]",	C0_ASC },
+	{ "[BEL]",	C0_BEL },
+	{ "[BS]",	C0_BS },
+	{ "Tab",	C0_HT },
+	{ "[LF]",	C0_LF },
+	{ "[VT]",	C0_VT },
+	{ "[FF]",	C0_FF },
+	{ "Enter",	C0_CR },
+	{ "[SO]",	C0_SO },
+	{ "[SI]",	C0_SI },
+	{ "[DLE]",	C0_DLE },
+	{ "[DC1]",	C0_DC1 },
+	{ "[DC2]",	C0_DC2 },
+	{ "[DC3]",	C0_DC3 },
+	{ "[DC4]",	C0_DC4 },
+	{ "[NAK]",	C0_NAK },
+	{ "[SYN]",	C0_SYN },
+	{ "[ETB]",	C0_ETB },
+	{ "[CAN]",	C0_CAN },
+	{ "[EM]",	C0_EM },
+	{ "[SUB]",	C0_SUB },
+	{ "Escape",	C0_ESC },
+	{ "[FS]",	C0_FS },
+	{ "[GS]",	C0_GS },
+	{ "[RS]",	C0_RS },
+	{ "[US]",	C0_US },
 
 	/* Arrow keys. */
 	{ "Up",		KEYC_UP|KEYC_CURSOR|KEYC_IMPLIED_META },
@@ -206,7 +241,6 @@ key_string_get_modifiers(const char **string)
 key_code
 key_string_lookup_string(const char *string)
 {
-	static const char	*other = "!#()+,-.0123456789:;<=>'\r\t\177`/";
 	key_code		 key, modifiers;
 	u_int			 u, i;
 	struct utf8_data	 ud, *udp;
@@ -281,26 +315,6 @@ key_string_lookup_string(const char *string)
 			key &= ~KEYC_IMPLIED_META;
 	}
 
-	/* Convert the standard control keys. */
-	if (key <= 127 &&
-	    (modifiers & KEYC_CTRL) &&
-	    strchr(other, key) == NULL &&
-	    key != 9 &&
-	    key != 13 &&
-	    key != 27) {
-		if (key >= 97 && key <= 122)
-			key -= 96;
-		else if (key >= 64 && key <= 95)
-                       key -= 64;
-		else if (key == 32)
-			key = 0;
-		else if (key == 63)
-			key = 127;
-		else
-			return (KEYC_UNKNOWN);
-		modifiers &= ~KEYC_CTRL;
-	}
-
 	return (key|modifiers);
 }
 
@@ -324,10 +338,6 @@ key_string_lookup_key(key_code key, int with_flags)
 		goto out;
 	}
 
-	/* Display C-@ as C-Space. */
-	if ((key & (KEYC_MASK_KEY|KEYC_MASK_MODIFIERS)) == 0)
-		key = ' '|KEYC_CTRL;
-
 	/* Fill in the modifiers. */
 	if (key & KEYC_CTRL)
 		strlcat(out, "C-", sizeof out);
@@ -427,13 +437,8 @@ key_string_lookup_key(key_code key, int with_flags)
 		goto out;
 	}
 
-	/* Check for standard or control key. */
-	if (key <= 32) {
-		if (key == 0 || key > 26)
-			xsnprintf(tmp, sizeof tmp, "C-%c", (int)(64 + key));
-		else
-			xsnprintf(tmp, sizeof tmp, "C-%c", (int)(96 + key));
-	} else if (key >= 32 && key <= 126) {
+	/* Printable ASCII keys. */
+	if (key > 32 && key <= 126) {
 		tmp[0] = key;
 		tmp[1] = '\0';
 	} else if (key == 127)
@@ -460,8 +465,6 @@ out:
 			strlcat(out, "I", sizeof out);
 		if (saved & KEYC_BUILD_MODIFIERS)
 			strlcat(out, "B", sizeof out);
-		if (saved & KEYC_EXTENDED)
-			strlcat(out, "E", sizeof out);
 		if (saved & KEYC_SENT)
 			strlcat(out, "S", sizeof out);
 		strlcat(out, "]", sizeof out);
diff --git a/usr.bin/tmux/menu.c b/usr.bin/tmux/menu.c
index 79ad009ff..10ad66469 100644
--- a/usr.bin/tmux/menu.c
+++ b/usr.bin/tmux/menu.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: menu.c,v 1.52 2023/08/15 07:01:47 nicm Exp $ */
+/* $OpenBSD: menu.c,v 1.53 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2019 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -335,7 +335,7 @@ menu_key_cb(struct client *c, void *data, struct key_event *event)
 		c->flags |= CLIENT_REDRAWOVERLAY;
 		return (0);
 	case KEYC_PPAGE:
-	case '\002': /* C-b */
+	case 'b'|KEYC_CTRL:
 		if (md->choice < 6)
 			md->choice = 0;
 		else {
@@ -394,13 +394,13 @@ menu_key_cb(struct client *c, void *data, struct key_event *event)
 		}
 		c->flags |= CLIENT_REDRAWOVERLAY;
 		break;
-	case '\006': /* C-f */
+	case 'f'|KEYC_CTRL:
 		break;
 	case '\r':
 		goto chosen;
 	case '\033': /* Escape */
-	case '\003': /* C-c */
-	case '\007': /* C-g */
+	case 'c'|KEYC_CTRL:
+	case 'g'|KEYC_CTRL:
 	case 'q':
 		return (1);
 	}
diff --git a/usr.bin/tmux/mode-tree.c b/usr.bin/tmux/mode-tree.c
index 8c6260242..41c220100 100644
--- a/usr.bin/tmux/mode-tree.c
+++ b/usr.bin/tmux/mode-tree.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mode-tree.c,v 1.68 2024/08/04 08:53:43 nicm Exp $ */
+/* $OpenBSD: mode-tree.c,v 1.69 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2017 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -1088,22 +1088,22 @@ mode_tree_key(struct mode_tree_data *mtd, struct client *c, key_code *key,
 	switch (*key) {
 	case 'q':
 	case '\033': /* Escape */
-	case '\007': /* C-g */
+	case 'g'|KEYC_CTRL:
 		return (1);
 	case KEYC_UP:
 	case 'k':
 	case KEYC_WHEELUP_PANE:
-	case '\020': /* C-p */
+	case 'p'|KEYC_CTRL:
 		mode_tree_up(mtd, 1);
 		break;
 	case KEYC_DOWN:
 	case 'j':
 	case KEYC_WHEELDOWN_PANE:
-	case '\016': /* C-n */
+	case 'n'|KEYC_CTRL:
 		mode_tree_down(mtd, 1);
 		break;
 	case KEYC_PPAGE:
-	case '\002': /* C-b */
+	case 'b'|KEYC_CTRL:
 		for (i = 0; i < mtd->height; i++) {
 			if (mtd->current == 0)
 				break;
@@ -1111,7 +1111,7 @@ mode_tree_key(struct mode_tree_data *mtd, struct client *c, key_code *key,
 		}
 		break;
 	case KEYC_NPAGE:
-	case '\006': /* C-f */
+	case 'f'|KEYC_CTRL:
 		for (i = 0; i < mtd->height; i++) {
 			if (mtd->current == mtd->line_size - 1)
 				break;
@@ -1155,7 +1155,7 @@ mode_tree_key(struct mode_tree_data *mtd, struct client *c, key_code *key,
 		for (i = 0; i < mtd->line_size; i++)
 			mtd->line_list[i].item->tagged = 0;
 		break;
-	case '\024': /* C-t */
+	case 't'|KEYC_CTRL:
 		for (i = 0; i < mtd->line_size; i++) {
 			if ((mtd->line_list[i].item->parent == NULL &&
 			    !mtd->line_list[i].item->no_tag) ||
@@ -1211,7 +1211,7 @@ mode_tree_key(struct mode_tree_data *mtd, struct client *c, key_code *key,
 		break;
 	case '?':
 	case '/':
-	case '\023': /* C-s */
+	case 's'|KEYC_CTRL:
 		mtd->references++;
 		status_prompt_set(c, NULL, "(search) ", "",
 		    mode_tree_search_callback, mode_tree_search_free, mtd,
diff --git a/usr.bin/tmux/options-table.c b/usr.bin/tmux/options-table.c
index f1e856092..dd1782bc2 100644
--- a/usr.bin/tmux/options-table.c
+++ b/usr.bin/tmux/options-table.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: options-table.c,v 1.175 2024/08/04 09:35:30 nicm Exp $ */
+/* $OpenBSD: options-table.c,v 1.176 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2011 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -94,6 +94,9 @@ static const char *options_table_detach_on_destroy_list[] = {
 static const char *options_table_extended_keys_list[] = {
 	"off", "on", "always", NULL
 };
+static const char *options_table_extended_keys_format_list[] = {
+	"csi-u", "xterm", NULL
+};
 static const char *options_table_allow_passthrough_list[] = {
 	"off", "on", "all", NULL
 };
@@ -310,11 +313,19 @@ const struct options_table_entry options_table[] = {
 	  .type = OPTIONS_TABLE_CHOICE,
 	  .scope = OPTIONS_TABLE_SERVER,
 	  .choices = options_table_extended_keys_list,
-	  .default_num = 0,
+	  .default_num = 1,
 	  .text = "Whether to request extended key sequences from terminals "
 		  "that support it."
 	},
 
+	{ .name = "extended-keys-format",
+	  .type = OPTIONS_TABLE_CHOICE,
+	  .scope = OPTIONS_TABLE_SERVER,
+	  .choices = options_table_extended_keys_format_list,
+	  .default_num = 1,
+	  .text = "The format of emitted extended key sequences."
+	},
+
 	{ .name = "focus-events",
 	  .type = OPTIONS_TABLE_FLAG,
 	  .scope = OPTIONS_TABLE_SERVER,
@@ -614,7 +625,7 @@ const struct options_table_entry options_table[] = {
 	{ .name = "prefix",
 	  .type = OPTIONS_TABLE_KEY,
 	  .scope = OPTIONS_TABLE_SESSION,
-	  .default_num = '\002',
+	  .default_num = 'b'|KEYC_CTRL,
 	  .text = "The prefix key."
 	},
 
diff --git a/usr.bin/tmux/popup.c b/usr.bin/tmux/popup.c
index 8f543f83f..81d749d80 100644
--- a/usr.bin/tmux/popup.c
+++ b/usr.bin/tmux/popup.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: popup.c,v 1.53 2024/03/21 11:30:42 nicm Exp $ */
+/* $OpenBSD: popup.c,v 1.54 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2020 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -543,7 +543,7 @@ popup_key_cb(struct client *c, void *data, struct key_event *event)
 	}
 	if ((((pd->flags & (POPUP_CLOSEEXIT|POPUP_CLOSEEXITZERO)) == 0) ||
 	    pd->job == NULL) &&
-	    (event->key == '\033' || event->key == '\003'))
+	    (event->key == '\033' || event->key == ('c'|KEYC_CTRL)))
 		return (1);
 	if (pd->job != NULL) {
 		if (KEYC_IS_MOUSE(event->key)) {
diff --git a/usr.bin/tmux/screen-write.c b/usr.bin/tmux/screen-write.c
index 350ff672b..17dfb1d33 100644
--- a/usr.bin/tmux/screen-write.c
+++ b/usr.bin/tmux/screen-write.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: screen-write.c,v 1.225 2024/03/21 12:10:57 nicm Exp $ */
+/* $OpenBSD: screen-write.c,v 1.226 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -326,8 +326,9 @@ screen_write_reset(struct screen_write_ctx *ctx)
 	screen_write_scrollregion(ctx, 0, screen_size_y(s) - 1);
 
 	s->mode = MODE_CURSOR|MODE_WRAP;
+
 	if (options_get_number(global_options, "extended-keys") == 2)
-		s->mode |= MODE_KEXTENDED;
+		s->mode = (s->mode & ~EXTENDED_KEY_MODES)|MODE_KEYS_EXTENDED;
 
 	screen_write_clearscreen(ctx, 8);
 	screen_write_set_cursor(ctx, 0, 0);
diff --git a/usr.bin/tmux/screen.c b/usr.bin/tmux/screen.c
index ff73a8c4e..182d6a894 100644
--- a/usr.bin/tmux/screen.c
+++ b/usr.bin/tmux/screen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: screen.c,v 1.85 2024/03/21 11:26:28 nicm Exp $ */
+/* $OpenBSD: screen.c,v 1.86 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -107,8 +107,9 @@ screen_reinit(struct screen *s)
 	s->rlower = screen_size_y(s) - 1;
 
 	s->mode = MODE_CURSOR|MODE_WRAP|(s->mode & MODE_CRLF);
+
 	if (options_get_number(global_options, "extended-keys") == 2)
-		s->mode |= MODE_KEXTENDED;
+		s->mode = (s->mode & ~EXTENDED_KEY_MODES)|MODE_KEYS_EXTENDED;
 
 	if (s->saved_grid != NULL)
 		screen_alternate_off(s, NULL, 0);
@@ -714,8 +715,10 @@ screen_mode_to_string(int mode)
 		strlcat(tmp, "ORIGIN,", sizeof tmp);
 	if (mode & MODE_CRLF)
 		strlcat(tmp, "CRLF,", sizeof tmp);
-	if (mode & MODE_KEXTENDED)
-		strlcat(tmp, "KEXTENDED,", sizeof tmp);
+	if (mode & MODE_KEYS_EXTENDED)
+		strlcat(tmp, "KEYS_EXTENDED,", sizeof tmp);
+	if (mode & MODE_KEYS_EXTENDED_2)
+		strlcat(tmp, "KEYS_EXTENDED_2,", sizeof tmp);
 	tmp[strlen(tmp) - 1] = '\0';
 	return (tmp);
 }
diff --git a/usr.bin/tmux/status.c b/usr.bin/tmux/status.c
index 5c75db37a..f85937fd9 100644
--- a/usr.bin/tmux/status.c
+++ b/usr.bin/tmux/status.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: status.c,v 1.242 2024/05/15 08:39:30 nicm Exp $ */
+/* $OpenBSD: status.c,v 1.243 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -839,19 +839,19 @@ status_prompt_translate_key(struct client *c, key_code key, key_code *new_key)
 {
 	if (c->prompt_mode == PROMPT_ENTRY) {
 		switch (key) {
-		case '\001': /* C-a */
-		case '\003': /* C-c */
-		case '\005': /* C-e */
-		case '\007': /* C-g */
-		case '\010': /* C-h */
+		case 'a'|KEYC_CTRL:
+		case 'c'|KEYC_CTRL:
+		case 'e'|KEYC_CTRL:
+		case 'g'|KEYC_CTRL:
+		case 'h'|KEYC_CTRL:
 		case '\011': /* Tab */
-		case '\013': /* C-k */
-		case '\016': /* C-n */
-		case '\020': /* C-p */
-		case '\024': /* C-t */
-		case '\025': /* C-u */
-		case '\027': /* C-w */
-		case '\031': /* C-y */
+		case 'k'|KEYC_CTRL:
+		case 'n'|KEYC_CTRL:
+		case 'p'|KEYC_CTRL:
+		case 't'|KEYC_CTRL:
+		case 'u'|KEYC_CTRL:
+		case 'w'|KEYC_CTRL:
+		case 'y'|KEYC_CTRL:
 		case '\n':
 		case '\r':
 		case KEYC_LEFT|KEYC_CTRL:
@@ -890,7 +890,7 @@ status_prompt_translate_key(struct client *c, key_code key, key_code *new_key)
 	case 'S':
 		c->prompt_mode = PROMPT_ENTRY;
 		c->flags |= CLIENT_REDRAWSTATUS;
-		*new_key = '\025'; /* C-u */
+		*new_key = 'u'|KEYC_CTRL;
 		return (1);
 	case 'i':
 	case '\033': /* Escape */
@@ -911,7 +911,7 @@ status_prompt_translate_key(struct client *c, key_code key, key_code *new_key)
 		return (1);
 	case 'C':
 	case 'D':
-		*new_key = '\013'; /* C-k */
+		*new_key = 'k'|KEYC_CTRL;
 		return (1);
 	case KEYC_BSPACE:
 	case 'X':
@@ -924,7 +924,7 @@ status_prompt_translate_key(struct client *c, key_code key, key_code *new_key)
 		*new_key = 'B'|KEYC_VI;
 		return (1);
 	case 'd':
-		*new_key = '\025'; /* C-u */
+		*new_key = 'u'|KEYC_CTRL;
 		return (1);
 	case 'e':
 		*new_key = 'e'|KEYC_VI;
@@ -939,10 +939,10 @@ status_prompt_translate_key(struct client *c, key_code key, key_code *new_key)
 		*new_key = 'W'|KEYC_VI;
 		return (1);
 	case 'p':
-		*new_key = '\031'; /* C-y */
+		*new_key = 'y'|KEYC_CTRL;
 		return (1);
 	case 'q':
-		*new_key = '\003'; /* C-c */
+		*new_key = 'c'|KEYC_CTRL;
 		return (1);
 	case 's':
 	case KEYC_DC:
@@ -966,8 +966,8 @@ status_prompt_translate_key(struct client *c, key_code key, key_code *new_key)
 	case 'k':
 		*new_key = KEYC_UP;
 		return (1);
-	case '\010' /* C-h */:
-	case '\003' /* C-c */:
+	case 'h'|KEYC_CTRL:
+	case 'c'|KEYC_CTRL:
 	case '\n':
 	case '\r':
 		return (1);
@@ -1263,28 +1263,28 @@ status_prompt_key(struct client *c, key_code key)
 process_key:
 	switch (key) {
 	case KEYC_LEFT:
-	case '\002': /* C-b */
+	case 'b'|KEYC_CTRL:
 		if (c->prompt_index > 0) {
 			c->prompt_index--;
 			break;
 		}
 		break;
 	case KEYC_RIGHT:
-	case '\006': /* C-f */
+	case 'f'|KEYC_CTRL:
 		if (c->prompt_index < size) {
 			c->prompt_index++;
 			break;
 		}
 		break;
 	case KEYC_HOME:
-	case '\001': /* C-a */
+	case 'a'|KEYC_CTRL:
 		if (c->prompt_index != 0) {
 			c->prompt_index = 0;
 			break;
 		}
 		break;
 	case KEYC_END:
-	case '\005': /* C-e */
+	case 'e'|KEYC_CTRL:
 		if (c->prompt_index != size) {
 			c->prompt_index = size;
 			break;
@@ -1295,7 +1295,7 @@ process_key:
 			goto changed;
 		break;
 	case KEYC_BSPACE:
-	case '\010': /* C-h */
+	case 'h'|KEYC_CTRL:
 		if (c->prompt_index != 0) {
 			if (c->prompt_index == size)
 				c->prompt_buffer[--c->prompt_index].size = 0;
@@ -1310,7 +1310,7 @@ process_key:
 		}
 		break;
 	case KEYC_DC:
-	case '\004': /* C-d */
+	case 'd'|KEYC_CTRL:
 		if (c->prompt_index != size) {
 			memmove(c->prompt_buffer + c->prompt_index,
 			    c->prompt_buffer + c->prompt_index + 1,
@@ -1319,17 +1319,17 @@ process_key:
 			goto changed;
 		}
 		break;
-	case '\025': /* C-u */
+	case 'u'|KEYC_CTRL:
 		c->prompt_buffer[0].size = 0;
 		c->prompt_index = 0;
 		goto changed;
-	case '\013': /* C-k */
+	case 'k'|KEYC_CTRL:
 		if (c->prompt_index < size) {
 			c->prompt_buffer[c->prompt_index].size = 0;
 			goto changed;
 		}
 		break;
-	case '\027': /* C-w */
+	case 'w'|KEYC_CTRL:
 		separators = options_get_string(oo, "word-separators");
 		idx = c->prompt_index;
 
@@ -1397,7 +1397,7 @@ process_key:
 		status_prompt_backward_word(c, separators);
 		goto changed;
 	case KEYC_UP:
-	case '\020': /* C-p */
+	case 'p'|KEYC_CTRL:
 		histstr = status_prompt_up_history(c->prompt_hindex,
 		    c->prompt_type);
 		if (histstr == NULL)
@@ -1407,7 +1407,7 @@ process_key:
 		c->prompt_index = utf8_strlen(c->prompt_buffer);
 		goto changed;
 	case KEYC_DOWN:
-	case '\016': /* C-n */
+	case 'n'|KEYC_CTRL:
 		histstr = status_prompt_down_history(c->prompt_hindex,
 		    c->prompt_type);
 		if (histstr == NULL)
@@ -1416,11 +1416,11 @@ process_key:
 		c->prompt_buffer = utf8_fromcstr(histstr);
 		c->prompt_index = utf8_strlen(c->prompt_buffer);
 		goto changed;
-	case '\031': /* C-y */
+	case 'y'|KEYC_CTRL:
 		if (status_prompt_paste(c))
 			goto changed;
 		break;
-	case '\024': /* C-t */
+	case 't'|KEYC_CTRL:
 		idx = c->prompt_index;
 		if (idx < size)
 			idx++;
@@ -1443,12 +1443,12 @@ process_key:
 		free(s);
 		break;
 	case '\033': /* Escape */
-	case '\003': /* C-c */
-	case '\007': /* C-g */
+	case 'c'|KEYC_CTRL:
+	case 'g'|KEYC_CTRL:
 		if (c->prompt_inputcb(c, c->prompt_data, NULL, 1) == 0)
 			status_prompt_clear(c);
 		break;
-	case '\022': /* C-r */
+	case 'r'|KEYC_CTRL:
 		if (~c->prompt_flags & PROMPT_INCREMENTAL)
 			break;
 		if (c->prompt_buffer[0].size == 0) {
@@ -1459,7 +1459,7 @@ process_key:
 		} else
 			prefix = '-';
 		goto changed;
-	case '\023': /* C-s */
+	case 's'|KEYC_CTRL:
 		if (~c->prompt_flags & PROMPT_INCREMENTAL)
 			break;
 		if (c->prompt_buffer[0].size == 0) {
diff --git a/usr.bin/tmux/tmux.1 b/usr.bin/tmux/tmux.1
index 11ac32c62..983383c4f 100644
--- a/usr.bin/tmux/tmux.1
+++ b/usr.bin/tmux/tmux.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: tmux.1,v 1.947 2024/08/04 09:01:18 nicm Exp $
+.\" $OpenBSD: tmux.1,v 1.948 2024/08/21 04:17:09 nicm Exp $
 .\"
 .\" Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
 .\"
@@ -14,7 +14,7 @@
 .\" IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
 .\" OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: August 4 2024 $
+.Dd $Mdocdate: August 21 2024 $
 .Dt TMUX 1
 .Os
 .Sh NAME
@@ -3733,6 +3733,10 @@ Note that aliases are expanded when a command is parsed rather than when it is
 executed, so binding an alias with
 .Ic bind-key
 will bind the expanded form.
+.It Ic copy-command Ar shell-command
+Give the command to pipe to if the
+.Ic copy-pipe
+copy mode command is used without arguments.
 .It Ic default-terminal Ar terminal
 Set the default terminal for new windows created in this session - the
 default value of the
@@ -3746,10 +3750,6 @@ be set to
 .Ql screen ,
 .Ql tmux
 or a derivative of them.
-.It Ic copy-command Ar shell-command
-Give the command to pipe to if the
-.Ic copy-pipe
-copy mode command is used without arguments.
 .It Ic escape-time Ar time
 Set the time in milliseconds for which
 .Nm
@@ -3771,22 +3771,53 @@ If enabled, the server will exit when there are no attached clients.
 .It Xo Ic extended-keys
 .Op Ic on | off | always
 .Xc
-When
-.Ic on
-or
-.Ic always ,
-the escape sequence to enable extended keys is sent to the terminal, if
-.Nm
-knows that it is supported.
-.Nm
-always recognises extended keys itself.
-If this option is
+Controls how modified keys (keys pressed together with Control, Meta, or Shift)
+are reported.
+This is the equivalent of the
+.Ic modifyOtherKeys
+.Xr xterm 1
+resource.
+.Pp
+When set to
 .Ic on ,
-.Nm
-will only forward extended keys to applications when they request them; if
+the program inside the pane can request one of two modes: mode 1 which changes
+the sequence for only keys which lack an existing well-known representation; or
+mode 2 which changes the sequence for all keys.
+When set to
 .Ic always ,
+mode 1 output is forced and the program cannot change it.
+When set to
+.Ic off ,
+this feature is disabled and only standard keys are reported.
+.Pp
 .Nm
-will always forward the keys.
+will always request extended keys itself if the terminal supports them.
+See also the
+.Ic extkeys
+feature for the
+.Ic terminal-features
+option, the
+.Ic extended-keys-format
+option and the
+.Ic pane_key_mode
+variable.
+.It Xo Ic extended-keys-format
+.Op Ic csi-u | xterm
+.Xc
+Selects one of the two possible formats for reporting modified keys to
+applications.
+This is the equivalent of the
+.Ic formatOtherKeys
+.Xr xterm 1
+resource.
+For example, C-S-a will be reported as
+.Ql ^[[27;6;65~
+when set to
+.Ic xterm ,
+and as
+.Ql ^[[65;6u
+when set to
+.Ic csi-u .
 .It Xo Ic focus-events
 .Op Ic on | off
 .Xc
@@ -5512,6 +5543,7 @@ The following variables are available, where appropriate:
 .It Li "pane_in_mode" Ta "" Ta "1 if pane is in a mode"
 .It Li "pane_index" Ta "#P" Ta "Index of pane"
 .It Li "pane_input_off" Ta "" Ta "1 if input to pane is disabled"
+.It Li "pane_key_mode" Ta "" Ta "Extended key reporting mode in this pane"
 .It Li "pane_last" Ta "" Ta "1 if last pane"
 .It Li "pane_left" Ta "" Ta "Left of pane"
 .It Li "pane_marked" Ta "" Ta "1 if this is the marked pane"
diff --git a/usr.bin/tmux/tmux.h b/usr.bin/tmux/tmux.h
index a1ffc50b3..7c6f7c7c8 100644
--- a/usr.bin/tmux/tmux.h
+++ b/usr.bin/tmux/tmux.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tmux.h,v 1.1220 2024/08/04 08:53:43 nicm Exp $ */
+/* $OpenBSD: tmux.h,v 1.1221 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -138,8 +138,7 @@ struct winlink;
 #define KEYC_IMPLIED_META    0x08000000000000ULL
 #define KEYC_BUILD_MODIFIERS 0x10000000000000ULL
 #define KEYC_VI		     0x20000000000000ULL
-#define KEYC_EXTENDED	     0x40000000000000ULL
-#define KEYC_SENT	     0x80000000000000ULL
+#define KEYC_SENT	     0x40000000000000ULL
 
 /* Masks for key bits. */
 #define KEYC_MASK_MODIFIERS  0x00f00000000000ULL
@@ -187,6 +186,42 @@ struct winlink;
  */
 typedef unsigned long long key_code;
 
+/* C0 control characters */
+enum {
+	C0_NUL,
+	C0_SOH,
+	C0_STX,
+	C0_ETX,
+	C0_EOT,
+	C0_ENQ,
+	C0_ASC,
+	C0_BEL,
+	C0_BS,
+	C0_HT,
+	C0_LF,
+	C0_VT,
+	C0_FF,
+	C0_CR,
+	C0_SO,
+	C0_SI,
+	C0_DLE,
+	C0_DC1,
+	C0_DC2,
+	C0_DC3,
+	C0_DC4,
+	C0_NAK,
+	C0_SYN,
+	C0_ETB,
+	C0_CAN,
+	C0_EM,
+	C0_SUB,
+	C0_ESC,
+	C0_FS,
+	C0_GS,
+	C0_RS,
+	C0_US
+};
+
 /* Special key codes. */
 enum {
 	/* Focus events. */
@@ -582,14 +617,16 @@ enum tty_code_code {
 #define MODE_MOUSE_ALL 0x1000
 #define MODE_ORIGIN 0x2000
 #define MODE_CRLF 0x4000
-#define MODE_KEXTENDED 0x8000
+#define MODE_KEYS_EXTENDED 0x8000
 #define MODE_CURSOR_VERY_VISIBLE 0x10000
 #define MODE_CURSOR_BLINKING_SET 0x20000
+#define MODE_KEYS_EXTENDED_2 0x40000
 
 #define ALL_MODES 0xffffff
 #define ALL_MOUSE_MODES (MODE_MOUSE_STANDARD|MODE_MOUSE_BUTTON|MODE_MOUSE_ALL)
 #define MOTION_MOUSE_MODES (MODE_MOUSE_BUTTON|MODE_MOUSE_ALL)
 #define CURSOR_MODES (MODE_CURSOR|MODE_CURSOR_BLINKING|MODE_CURSOR_VERY_VISIBLE)
+#define EXTENDED_KEY_MODES (MODE_KEYS_EXTENDED|MODE_KEYS_EXTENDED_2)
 
 /* Mouse protocol constants. */
 #define MOUSE_PARAM_MAX 0xff
diff --git a/usr.bin/tmux/tty-features.c b/usr.bin/tmux/tty-features.c
index 6e75ebcf2..3d5529fbf 100644
--- a/usr.bin/tmux/tty-features.c
+++ b/usr.bin/tmux/tty-features.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tty-features.c,v 1.30 2023/11/14 15:38:33 nicm Exp $ */
+/* $OpenBSD: tty-features.c,v 1.31 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2020 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -227,7 +227,7 @@ static const struct tty_feature tty_feature_sync = {
 
 /* Terminal supports extended keys. */
 static const char *const tty_feature_extkeys_capabilities[] = {
-	"Eneks=\\E[>4;1m",
+	"Eneks=\\E[>4;2m",
 	"Dseks=\\E[>4m",
 	NULL
 };
diff --git a/usr.bin/tmux/tty-keys.c b/usr.bin/tmux/tty-keys.c
index 67b7f5844..f859747e3 100644
--- a/usr.bin/tmux/tty-keys.c
+++ b/usr.bin/tmux/tty-keys.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tty-keys.c,v 1.176 2024/08/19 08:29:16 nicm Exp $ */
+/* $OpenBSD: tty-keys.c,v 1.177 2024/08/21 04:17:09 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -664,7 +664,7 @@ tty_keys_next(struct tty *tty)
 	size_t			 len, size;
 	cc_t			 bspace;
 	int			 delay, expired = 0, n;
-	key_code		 key;
+	key_code		 key, onlykey;
 	struct mouse_event	 m = { 0 };
 	struct key_event	*event;
 
@@ -801,6 +801,26 @@ first_key:
 		key = (u_char)buf[0];
 		size = 1;
 	}
+
+	/* C-Space is special. */
+	if ((key & KEYC_MASK_KEY) == C0_NUL)
+		key = ' ' | KEYC_CTRL | (key & KEYC_META);
+
+	/*
+	 * Fix up all C0 control codes that don't have a dedicated key into
+	 * corresponding Ctrl keys. Convert characters in the A-Z range into
+	 * lowercase, so ^A becomes a|CTRL.
+	 */
+	onlykey = key & KEYC_MASK_KEY;
+	if (onlykey < 0x20 && onlykey != C0_BS &&
+	    onlykey != C0_HT && onlykey != C0_CR &&
+	    onlykey != C0_ESC) {
+		onlykey |= 0x40;
+		if (onlykey >= 'A' && onlykey <= 'Z')
+			onlykey |= 0x20;
+		key = onlykey | KEYC_CTRL | (key & KEYC_META);
+	}
+
 	goto complete_key;
 
 partial_key:
@@ -910,7 +930,6 @@ tty_keys_extended_key(struct tty *tty, const char *buf, size_t len,
 	char		 tmp[64];
 	cc_t		 bspace;
 	key_code	 nkey;
-	key_code	 onlykey;
 	struct utf8_data ud;
 	utf8_char        uc;
 
@@ -974,7 +993,13 @@ tty_keys_extended_key(struct tty *tty, const char *buf, size_t len,
 	/* Update the modifiers. */
 	if (modifiers > 0) {
 		modifiers--;
-		if (modifiers & 1)
+		/*
+		 * The Shift modifier may not be reported in some input modes,
+		 * which is unfortunate, as in general case determining if a
+		 * character is shifted or not requires knowing the input
+		 * keyboard layout. So we only fix up the trivial case.
+		 */
+		if (modifiers & 1 || (nkey >= 'A' && nkey <= 'Z'))
 			nkey |= KEYC_SHIFT;
 		if (modifiers & 2)
 			nkey |= (KEYC_META|KEYC_IMPLIED_META); /* Alt */
@@ -984,34 +1009,15 @@ tty_keys_extended_key(struct tty *tty, const char *buf, size_t len,
 			nkey |= (KEYC_META|KEYC_IMPLIED_META); /* Meta */
 	}
 
-	/*
-	 * Don't allow both KEYC_CTRL and as an implied modifier. Also convert
-	 * C-X into C-x and so on.
-	 */
-	if (nkey & KEYC_CTRL) {
-		onlykey = (nkey & KEYC_MASK_KEY);
-		if (onlykey < 32 &&
-		    onlykey != 9 &&
-		    onlykey != 13 &&
-		    onlykey != 27)
-			/* nothing */;
-		else if (onlykey >= 97 && onlykey <= 122)
-			onlykey -= 96;
-		else if (onlykey >= 64 && onlykey <= 95)
-			onlykey -= 64;
-		else if (onlykey == 32)
-			onlykey = 0;
-		else if (onlykey == 63)
-			onlykey = 127;
-		else
-			onlykey |= KEYC_CTRL;
-		nkey = onlykey|((nkey & KEYC_MASK_MODIFIERS) & ~KEYC_CTRL);
-	}
+	/* Convert S-Tab into Backtab. */
+	if ((nkey & KEYC_MASK_KEY) == '\011' && (nkey & KEYC_SHIFT))
+		nkey = KEYC_BTAB | (nkey & ~KEYC_MASK_KEY & ~KEYC_SHIFT);
 
 	if (log_get_level() != 0) {
 		log_debug("%s: extended key %.*s is %llx (%s)", c->name,
 		    (int)*size, buf, nkey, key_string_lookup_key(nkey, 1));
 	}
+
 	*key = nkey;
 	return (0);
 }