diff --git a/etc/skel/dot.version b/etc/skel/dot.version
index ecda2f22c..44344c38b 100644
--- a/etc/skel/dot.version
+++ b/etc/skel/dot.version
@@ -1 +1 @@
-# SecBSD 1.4-4dba83b: Sun Dec 31 05:08:46 UTC 2023 (Mictlantecuhtli)
+# SecBSD 1.4-407f8e0: Tue Jan  2 04:11:30 UTC 2024 (Mictlantecuhtli)
diff --git a/lib/libcrypto/dh/dh_pmeth.c b/lib/libcrypto/dh/dh_pmeth.c
index fa0443310..ee90ffe73 100644
--- a/lib/libcrypto/dh/dh_pmeth.c
+++ b/lib/libcrypto/dh/dh_pmeth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_pmeth.c,v 1.15 2023/12/28 22:10:33 tb Exp $ */
+/* $OpenBSD: dh_pmeth.c,v 1.16 2024/01/01 16:01:48 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -109,7 +109,7 @@ pkey_dh_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
 
 	if (!pkey_dh_init(dst))
 		return 0;
-       	sctx = src->data;
+	sctx = src->data;
 	dctx = dst->data;
 	dctx->prime_len = sctx->prime_len;
 	dctx->generator = sctx->generator;
@@ -153,7 +153,7 @@ pkey_dh_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
 static int
 pkey_dh_ctrl_str(EVP_PKEY_CTX *ctx, const char *type, const char *value)
 {
- 	long lval;
+	long lval;
 	char *ep;
 	int len;
 
diff --git a/lib/libcrypto/evp/evp_local.h b/lib/libcrypto/evp/evp_local.h
index d21919ac9..eaede4409 100644
--- a/lib/libcrypto/evp/evp_local.h
+++ b/lib/libcrypto/evp/evp_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp_local.h,v 1.10 2023/12/29 10:59:00 tb Exp $ */
+/* $OpenBSD: evp_local.h,v 1.11 2024/01/01 15:23:00 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -156,7 +156,6 @@ struct evp_pkey_asn1_method_st {
  * arbitrary encryption.... */
 struct evp_pkey_st {
 	int type;
-	int save_type;
 	int references;
 	const EVP_PKEY_ASN1_METHOD *ameth;
 	union	{
diff --git a/lib/libcrypto/evp/p_lib.c b/lib/libcrypto/evp/p_lib.c
index 24e1dbb14..b64977bab 100644
--- a/lib/libcrypto/evp/p_lib.c
+++ b/lib/libcrypto/evp/p_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: p_lib.c,v 1.51 2023/12/29 10:59:00 tb Exp $ */
+/* $OpenBSD: p_lib.c,v 1.52 2024/01/01 15:23:00 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -389,7 +389,6 @@ EVP_PKEY_new(void)
 	}
 
 	pkey->type = EVP_PKEY_NONE;
-	pkey->save_type = EVP_PKEY_NONE;
 	pkey->references = 1;
 	pkey->save_parameters = 1;
 
@@ -440,7 +439,6 @@ EVP_PKEY_set_type(EVP_PKEY *pkey, int type)
 	if (pkey != NULL) {
 		pkey->ameth = ameth;
 		pkey->type = pkey->ameth->pkey_id;
-		pkey->save_type = type;
 	}
 
 	return 1;
@@ -460,7 +458,6 @@ EVP_PKEY_set_type_str(EVP_PKEY *pkey, const char *str, int len)
 	if (pkey != NULL) {
 		pkey->ameth = ameth;
 		pkey->type = pkey->ameth->pkey_id;
-		pkey->save_type = EVP_PKEY_NONE;
 	}
 
 	return 1;
diff --git a/lib/libcrypto/evp/pmeth_gn.c b/lib/libcrypto/evp/pmeth_gn.c
index c91076b8d..ce7b107c7 100644
--- a/lib/libcrypto/evp/pmeth_gn.c
+++ b/lib/libcrypto/evp/pmeth_gn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pmeth_gn.c,v 1.14 2023/11/29 21:35:57 tb Exp $ */
+/* $OpenBSD: pmeth_gn.c,v 1.15 2024/01/01 18:33:04 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -197,7 +197,7 @@ EVP_PKEY_CTX_get_keygen_info(EVP_PKEY_CTX *ctx, int idx)
 {
 	if (idx == -1)
 		return ctx->keygen_info_count;
-	if (idx < 0 || idx > ctx->keygen_info_count)
+	if (idx < 0 || idx >= ctx->keygen_info_count)
 		return 0;
 	return ctx->keygen_info[idx];
 }
diff --git a/lib/libcrypto/rsa/rsa_ameth.c b/lib/libcrypto/rsa/rsa_ameth.c
index a43bcf9f9..2266f0cbd 100644
--- a/lib/libcrypto/rsa/rsa_ameth.c
+++ b/lib/libcrypto/rsa/rsa_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa_ameth.c,v 1.53 2023/12/28 21:58:12 tb Exp $ */
+/* $OpenBSD: rsa_ameth.c,v 1.54 2024/01/01 15:43:02 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -74,6 +74,10 @@
 #include "rsa_local.h"
 #include "x509_local.h"
 
+/* Macros to test if a pkey or ctx is for a PSS key */
+#define pkey_is_pss(pkey) (pkey->ameth->pkey_id == EVP_PKEY_RSA_PSS)
+#define pkey_ctx_is_pss(ctx) (ctx->pmeth->pkey_id == EVP_PKEY_RSA_PSS)
+
 #ifndef OPENSSL_NO_CMS
 static int rsa_cms_sign(CMS_SignerInfo *si);
 static int rsa_cms_verify(CMS_SignerInfo *si);
diff --git a/lib/libcrypto/rsa/rsa_local.h b/lib/libcrypto/rsa/rsa_local.h
index f2639d59b..d537ab9c7 100644
--- a/lib/libcrypto/rsa/rsa_local.h
+++ b/lib/libcrypto/rsa/rsa_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa_local.h,v 1.7 2023/11/29 21:35:57 tb Exp $ */
+/* $OpenBSD: rsa_local.h,v 1.8 2024/01/01 15:43:02 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -60,10 +60,6 @@ __BEGIN_HIDDEN_DECLS
 
 #define RSA_MIN_MODULUS_BITS	512
 
-/* Macros to test if a pkey or ctx is for a PSS key */
-#define pkey_is_pss(pkey) (pkey->ameth->pkey_id == EVP_PKEY_RSA_PSS)
-#define pkey_ctx_is_pss(ctx) (ctx->pmeth->pkey_id == EVP_PKEY_RSA_PSS)
-
 struct rsa_meth_st {
 	char *name;
 	int (*rsa_pub_enc)(int flen, const unsigned char *from,
diff --git a/share/man/man4/umb.4 b/share/man/man4/umb.4
index 04ff4a98f..f7c8e00ee 100644
--- a/share/man/man4/umb.4
+++ b/share/man/man4/umb.4
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: umb.4,v 1.16 2023/02/21 07:47:24 jmc Exp $
+.\"	$OpenBSD: umb.4,v 1.17 2024/01/01 13:04:35 kevlo Exp $
 .\"
 .\" Copyright (c) 2016 genua mbH
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: February 21 2023 $
+.Dd $Mdocdate: January 1 2024 $
 .Dt UMB 4
 .Os
 .Sh NAME
@@ -56,6 +56,7 @@ The following devices should work:
 .\" .It Huawei ME906s -- attaches but needs more work
 .It Medion Mobile S4222 (MediaTek OEM)
 .It Quectel EC25
+.It Quectel RM500Q
 .It SIMCom SIM7600
 .It SIMCom SIM8262E-M2
 .It Sierra Wireless EM7345
diff --git a/share/man/man5/cargo-module.5 b/share/man/man5/cargo-module.5
index c01507406..fb2787eed 100644
--- a/share/man/man5/cargo-module.5
+++ b/share/man/man5/cargo-module.5
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: cargo-module.5,v 1.7 2023/08/18 08:22:29 tb Exp $
+.\"	$OpenBSD: cargo-module.5,v 1.8 2024/01/01 14:16:59 semarie Exp $
 .\"
 .\" Copyright (c) 2008 Marc Espie
 .\" Copyright (c) 2017 Daniel Jakots
@@ -25,7 +25,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: August 18 2023 $
+.Dd $Mdocdate: January 1 2024 $
 .Dt CARGO-MODULE 5
 .Os
 .Sh NAME
@@ -40,6 +40,7 @@ tree.
 .Pp
 Automates download and compilation of dependencies of a Rust project using
 .Xr cargo 1 .
+.Pp
 During
 .Cm fetch ,
 static dependencies ("crates") listed in
@@ -48,6 +49,7 @@ are downloaded using
 .Ev MODCARGO_DIST_SUBDIR
 as
 .Ev DIST_SUBDIR .
+.Pp
 During
 .Cm post-extract ,
 crates defined in
@@ -55,10 +57,12 @@ crates defined in
 are moved to the
 .Ev MODCARGO_VENDOR_DIR
 directory.
+.Pp
 During
 .Cm post-patch ,
 crate-metadata are generated using
 .Pa devel/cargo-generate-vendor .
+.Pp
 With
 .Ev CONFIGURE_STYLE
 set to
@@ -69,20 +73,19 @@ instead of the standard crates-io network source.
 Finally, any crates listed in
 .Ev MODCARGO_CRATES_UPDATE
 are updated.
+.Pp
 .Ev MODCARGO_RUSTFLAGS
 can be used to pass custom flags to all
 .Xr rustc 1
 invocations.
 .Pp
-.Pa lang/rust ,
-.Pa devel/cargo
+.Pa lang/rust
+is added to
+.Ev MODULES ,
 and
 .Pa devel/cargo-generate-vendor
-are added to
+is added to
 .Ev BUILD_DEPENDS .
-By default
-.Ev MASTER_SITES9
-is used to download the crates.
 .Pp
 This module defines:
 .Bl -tag -width MODCARGO_INSTALL_TARGET_PATH
@@ -110,11 +113,9 @@ Defaults to
 Architecture-specific
 .Ev WANTLIB
 entries required by all Rust code.
-Should be used instead of explicit entries for
-.Dq c ,
-.Dq pthread ,
-and
-.Dq c++abi .
+It is a copy of
+.Ev MODRUST_WANTLIB
+provided for simplicity.
 .El
 .Pp
 This module adds three
diff --git a/share/man/man5/port-modules.5 b/share/man/man5/port-modules.5
index cba4da4c1..2d6a46c51 100644
--- a/share/man/man5/port-modules.5
+++ b/share/man/man5/port-modules.5
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: port-modules.5,v 1.266 2023/09/14 03:53:26 bentley Exp $
+.\"	$OpenBSD: port-modules.5,v 1.267 2024/01/01 14:16:59 semarie Exp $
 .\"
 .\" Copyright (c) 2008 Marc Espie
 .\"
@@ -24,7 +24,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: September 14 2023 $
+.Dd $Mdocdate: January 1 2024 $
 .Dt PORT-MODULES 5
 .Os
 .Sh NAME
@@ -978,6 +978,20 @@ See
 .It lang/ruby
 See
 .Xr ruby-module 5 .
+.It lang/rust
+Ports using Rust must use this module so a rebuild can be triggered via
+.Ev SYSTEM_VERSION-rust
+on updates of the lang/rust port or changes to the Rust standard library.
+Sets
+.Ev MODRUST_WANTLIB
+as appropriate for the architecture so it can be added to
+.Ev WANTLIB .
+It adds lang/rust to the
+.Ev BUILD_DEPENDS
+unless
+.Ev MODRUST_BUILDDEP
+is set to anything but
+.Dq yes .
 .It lang/tcl
 Sets
 .Ev MODTCL_VERSION ,
diff --git a/sys/arch/arm/conf/files.arm b/sys/arch/arm/conf/files.arm
index 0d28e6537..2c451014d 100644
--- a/sys/arch/arm/conf/files.arm
+++ b/sys/arch/arm/conf/files.arm
@@ -1,4 +1,4 @@
-#	$OpenBSD: files.arm,v 1.50 2018/05/15 11:11:35 kettenis Exp $
+#	$OpenBSD: files.arm,v 1.51 2024/01/01 18:25:50 kettenis Exp $
 #	$NetBSD: files.arm,v 1.76 2003/11/05 12:53:15 scw Exp $
 
 # generic networking files
@@ -15,8 +15,6 @@ file	arch/arm/arm/disassem.c			ddb
 file	arch/arm/arm/fiq.c			fiq
 file	arch/arm/arm/fiq_subr.S			fiq
 
-define	fdt {[early = 0]}
-
 # mainbus files
 define	mainbus {}
 device	mainbus: fdt
diff --git a/sys/arch/arm64/conf/files.arm64 b/sys/arch/arm64/conf/files.arm64
index 4414dd8d9..117a99b10 100644
--- a/sys/arch/arm64/conf/files.arm64
+++ b/sys/arch/arm64/conf/files.arm64
@@ -1,4 +1,4 @@
-# $OpenBSD: files.arm64,v 1.67 2023/12/11 11:15:44 claudio Exp $
+# $OpenBSD: files.arm64,v 1.68 2024/01/01 18:25:50 kettenis Exp $
 
 maxpartitions	16
 maxusers	2 8 128
@@ -51,8 +51,6 @@ file	arch/arm64/arm64/disasm.c		ddb
 pseudo-device	openprom
 file	arch/arm64/arm64/openprom.c		openprom needs-flag
 
-define	fdt {[early = 0]}
-
 # mainbus files
 define	mainbus {}
 device	mainbus: fdt
diff --git a/sys/conf/files b/sys/conf/files
index 34f73aa71..7ebeee9c3 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -1,4 +1,4 @@
-#	$OpenBSD: files,v 1.728 2023/12/28 17:36:29 stsp Exp $
+#	$OpenBSD: files,v 1.729 2024/01/01 18:25:50 kettenis Exp $
 #	$NetBSD: files,v 1.87 1996/05/19 17:17:50 jonathan Exp $
 
 #	@(#)files.newconf	7.5 (Berkeley) 5/10/93
@@ -22,6 +22,7 @@ define	gpiobus {}
 define	onewirebus {}
 define	video {}
 define	intrmap {}
+define	fdt {[early = 0]}
 
 # filesystem firmware loading attribute
 define firmload
diff --git a/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 8f4b44f43..84dadf3eb 100644
--- a/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5106,6 +5106,9 @@ static void fill_dc_dirty_rects(struct drm_plane *plane,
 	if (plane->type == DRM_PLANE_TYPE_CURSOR)
 		return;
 
+	if (new_plane_state->rotation != DRM_MODE_ROTATE_0)
+		goto ffu;
+
 	num_clips = drm_plane_get_damage_clips_count(new_plane_state);
 	clips = drm_plane_get_damage_clips(new_plane_state);
 
diff --git a/sys/dev/pci/drm/amd/display/dc/dc_hw_types.h b/sys/dev/pci/drm/amd/display/dc/dc_hw_types.h
index 848db8676..46c2b991a 100644
--- a/sys/dev/pci/drm/amd/display/dc/dc_hw_types.h
+++ b/sys/dev/pci/drm/amd/display/dc/dc_hw_types.h
@@ -465,6 +465,7 @@ struct dc_cursor_mi_param {
 	struct fixed31_32 v_scale_ratio;
 	enum dc_rotation_angle rotation;
 	bool mirror;
+	struct dc_stream_state *stream;
 };
 
 /* IPP related types */
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index d84579da6..009b5861a 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -3427,7 +3427,8 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
 		.h_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.horz,
 		.v_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.vert,
 		.rotation = pipe_ctx->plane_state->rotation,
-		.mirror = pipe_ctx->plane_state->horizontal_mirror
+		.mirror = pipe_ctx->plane_state->horizontal_mirror,
+		.stream = pipe_ctx->stream,
 	};
 	bool pipe_split_on = false;
 	bool odm_combine_on = (pipe_ctx->next_odm_pipe != NULL) ||
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn20/dcn20_hubp.c b/sys/dev/pci/drm/amd/display/dc/dcn20/dcn20_hubp.c
index 4566bc7ab..aa252dc26 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn20/dcn20_hubp.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn20/dcn20_hubp.c
@@ -1075,8 +1075,16 @@ void hubp2_cursor_set_position(
 	if (src_y_offset < 0)
 		src_y_offset = 0;
 	/* Save necessary cursor info x, y position. w, h is saved in attribute func. */
-	hubp->cur_rect.x = src_x_offset + param->viewport.x;
-	hubp->cur_rect.y = src_y_offset + param->viewport.y;
+	if (param->stream->link->psr_settings.psr_version >= DC_PSR_VERSION_SU_1 &&
+	    param->rotation != ROTATION_ANGLE_0) {
+		hubp->cur_rect.x = 0;
+		hubp->cur_rect.y = 0;
+		hubp->cur_rect.w = param->stream->timing.h_addressable;
+		hubp->cur_rect.h = param->stream->timing.v_addressable;
+	} else {
+		hubp->cur_rect.x = src_x_offset + param->viewport.x;
+		hubp->cur_rect.y = src_y_offset + param->viewport.y;
+	}
 }
 
 void hubp2_clk_cntl(struct hubp *hubp, bool enable)
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/sys/dev/pci/drm/amd/display/dc/dcn30/dcn30_hwseq.c
index 53262f6bc..72bec33e3 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn30/dcn30_hwseq.c
@@ -994,5 +994,8 @@ void dcn30_prepare_bandwidth(struct dc *dc,
 			dc->clk_mgr->funcs->set_max_memclk(dc->clk_mgr, dc->clk_mgr->bw_params->clk_table.entries[dc->clk_mgr->bw_params->clk_table.num_entries - 1].memclk_mhz);
 
 	dcn20_prepare_bandwidth(dc, context);
+
+	dc_dmub_srv_p_state_delegate(dc,
+		context->bw_ctx.bw.dcn.clk.fw_based_mclk_switching, context);
 }
 
diff --git a/sys/dev/pci/drm/i915/display/intel_atomic.c b/sys/dev/pci/drm/i915/display/intel_atomic.c
index 18f0a5ae3..a502af0b6 100644
--- a/sys/dev/pci/drm/i915/display/intel_atomic.c
+++ b/sys/dev/pci/drm/i915/display/intel_atomic.c
@@ -41,6 +41,7 @@
 #include "intel_global_state.h"
 #include "intel_hdcp.h"
 #include "intel_psr.h"
+#include "intel_fb.h"
 #include "skl_universal_plane.h"
 
 /**
@@ -302,198 +303,6 @@ intel_crtc_destroy_state(struct drm_crtc *crtc,
 	kfree(crtc_state);
 }
 
-static void intel_atomic_setup_scaler(struct intel_crtc_scaler_state *scaler_state,
-				      int num_scalers_need, struct intel_crtc *intel_crtc,
-				      const char *name, int idx,
-				      struct intel_plane_state *plane_state,
-				      int *scaler_id)
-{
-	struct drm_i915_private *dev_priv = to_i915(intel_crtc->base.dev);
-	int j;
-	u32 mode;
-
-	if (*scaler_id < 0) {
-		/* find a free scaler */
-		for (j = 0; j < intel_crtc->num_scalers; j++) {
-			if (scaler_state->scalers[j].in_use)
-				continue;
-
-			*scaler_id = j;
-			scaler_state->scalers[*scaler_id].in_use = 1;
-			break;
-		}
-	}
-
-	if (drm_WARN(&dev_priv->drm, *scaler_id < 0,
-		     "Cannot find scaler for %s:%d\n", name, idx))
-		return;
-
-	/* set scaler mode */
-	if (plane_state && plane_state->hw.fb &&
-	    plane_state->hw.fb->format->is_yuv &&
-	    plane_state->hw.fb->format->num_planes > 1) {
-		struct intel_plane *plane = to_intel_plane(plane_state->uapi.plane);
-		if (DISPLAY_VER(dev_priv) == 9) {
-			mode = SKL_PS_SCALER_MODE_NV12;
-		} else if (icl_is_hdr_plane(dev_priv, plane->id)) {
-			/*
-			 * On gen11+'s HDR planes we only use the scaler for
-			 * scaling. They have a dedicated chroma upsampler, so
-			 * we don't need the scaler to upsample the UV plane.
-			 */
-			mode = PS_SCALER_MODE_NORMAL;
-		} else {
-			struct intel_plane *linked =
-				plane_state->planar_linked_plane;
-
-			mode = PS_SCALER_MODE_PLANAR;
-
-			if (linked)
-				mode |= PS_PLANE_Y_SEL(linked->id);
-		}
-	} else if (DISPLAY_VER(dev_priv) >= 10) {
-		mode = PS_SCALER_MODE_NORMAL;
-	} else if (num_scalers_need == 1 && intel_crtc->num_scalers > 1) {
-		/*
-		 * when only 1 scaler is in use on a pipe with 2 scalers
-		 * scaler 0 operates in high quality (HQ) mode.
-		 * In this case use scaler 0 to take advantage of HQ mode
-		 */
-		scaler_state->scalers[*scaler_id].in_use = 0;
-		*scaler_id = 0;
-		scaler_state->scalers[0].in_use = 1;
-		mode = SKL_PS_SCALER_MODE_HQ;
-	} else {
-		mode = SKL_PS_SCALER_MODE_DYN;
-	}
-
-	drm_dbg_kms(&dev_priv->drm, "Attached scaler id %u.%u to %s:%d\n",
-		    intel_crtc->pipe, *scaler_id, name, idx);
-	scaler_state->scalers[*scaler_id].mode = mode;
-}
-
-/**
- * intel_atomic_setup_scalers() - setup scalers for crtc per staged requests
- * @dev_priv: i915 device
- * @intel_crtc: intel crtc
- * @crtc_state: incoming crtc_state to validate and setup scalers
- *
- * This function sets up scalers based on staged scaling requests for
- * a @crtc and its planes. It is called from crtc level check path. If request
- * is a supportable request, it attaches scalers to requested planes and crtc.
- *
- * This function takes into account the current scaler(s) in use by any planes
- * not being part of this atomic state
- *
- *  Returns:
- *         0 - scalers were setup succesfully
- *         error code - otherwise
- */
-int intel_atomic_setup_scalers(struct drm_i915_private *dev_priv,
-			       struct intel_crtc *intel_crtc,
-			       struct intel_crtc_state *crtc_state)
-{
-	struct drm_plane *plane = NULL;
-	struct intel_plane *intel_plane;
-	struct intel_plane_state *plane_state = NULL;
-	struct intel_crtc_scaler_state *scaler_state =
-		&crtc_state->scaler_state;
-	struct drm_atomic_state *drm_state = crtc_state->uapi.state;
-	struct intel_atomic_state *intel_state = to_intel_atomic_state(drm_state);
-	int num_scalers_need;
-	int i;
-
-	num_scalers_need = hweight32(scaler_state->scaler_users);
-
-	/*
-	 * High level flow:
-	 * - staged scaler requests are already in scaler_state->scaler_users
-	 * - check whether staged scaling requests can be supported
-	 * - add planes using scalers that aren't in current transaction
-	 * - assign scalers to requested users
-	 * - as part of plane commit, scalers will be committed
-	 *   (i.e., either attached or detached) to respective planes in hw
-	 * - as part of crtc_commit, scaler will be either attached or detached
-	 *   to crtc in hw
-	 */
-
-	/* fail if required scalers > available scalers */
-	if (num_scalers_need > intel_crtc->num_scalers){
-		drm_dbg_kms(&dev_priv->drm,
-			    "Too many scaling requests %d > %d\n",
-			    num_scalers_need, intel_crtc->num_scalers);
-		return -EINVAL;
-	}
-
-	/* walkthrough scaler_users bits and start assigning scalers */
-	for (i = 0; i < sizeof(scaler_state->scaler_users) * 8; i++) {
-		int *scaler_id;
-		const char *name;
-		int idx;
-
-		/* skip if scaler not required */
-		if (!(scaler_state->scaler_users & (1 << i)))
-			continue;
-
-		if (i == SKL_CRTC_INDEX) {
-			name = "CRTC";
-			idx = intel_crtc->base.base.id;
-
-			/* panel fitter case: assign as a crtc scaler */
-			scaler_id = &scaler_state->scaler_id;
-		} else {
-			name = "PLANE";
-
-			/* plane scaler case: assign as a plane scaler */
-			/* find the plane that set the bit as scaler_user */
-			plane = drm_state->planes[i].ptr;
-
-			/*
-			 * to enable/disable hq mode, add planes that are using scaler
-			 * into this transaction
-			 */
-			if (!plane) {
-				struct drm_plane_state *state;
-
-				/*
-				 * GLK+ scalers don't have a HQ mode so it
-				 * isn't necessary to change between HQ and dyn mode
-				 * on those platforms.
-				 */
-				if (DISPLAY_VER(dev_priv) >= 10)
-					continue;
-
-				plane = drm_plane_from_index(&dev_priv->drm, i);
-				state = drm_atomic_get_plane_state(drm_state, plane);
-				if (IS_ERR(state)) {
-					drm_dbg_kms(&dev_priv->drm,
-						    "Failed to add [PLANE:%d] to drm_state\n",
-						    plane->base.id);
-					return PTR_ERR(state);
-				}
-			}
-
-			intel_plane = to_intel_plane(plane);
-			idx = plane->base.id;
-
-			/* plane on different crtc cannot be a scaler user of this crtc */
-			if (drm_WARN_ON(&dev_priv->drm,
-					intel_plane->pipe != intel_crtc->pipe))
-				continue;
-
-			plane_state = intel_atomic_get_new_plane_state(intel_state,
-								       intel_plane);
-			scaler_id = &plane_state->scaler_id;
-		}
-
-		intel_atomic_setup_scaler(scaler_state, num_scalers_need,
-					  intel_crtc, name, idx,
-					  plane_state, scaler_id);
-	}
-
-	return 0;
-}
-
 struct drm_atomic_state *
 intel_atomic_state_alloc(struct drm_device *dev)
 {
diff --git a/sys/dev/pci/drm/i915/display/intel_atomic.h b/sys/dev/pci/drm/i915/display/intel_atomic.h
index 726f46947..d1cd8dc00 100644
--- a/sys/dev/pci/drm/i915/display/intel_atomic.h
+++ b/sys/dev/pci/drm/i915/display/intel_atomic.h
@@ -54,8 +54,4 @@ struct intel_crtc_state *
 intel_atomic_get_crtc_state(struct drm_atomic_state *state,
 			    struct intel_crtc *crtc);
 
-int intel_atomic_setup_scalers(struct drm_i915_private *dev_priv,
-			       struct intel_crtc *intel_crtc,
-			       struct intel_crtc_state *crtc_state);
-
 #endif /* __INTEL_ATOMIC_H__ */
diff --git a/sys/dev/pci/drm/i915/display/intel_display.c b/sys/dev/pci/drm/i915/display/intel_display.c
index a6bbf26c6..cab50df3a 100644
--- a/sys/dev/pci/drm/i915/display/intel_display.c
+++ b/sys/dev/pci/drm/i915/display/intel_display.c
@@ -6481,6 +6481,17 @@ static int intel_async_flip_check_uapi(struct intel_atomic_state *state,
 		return -EINVAL;
 	}
 
+	/*
+	 * FIXME: Bigjoiner+async flip is busted currently.
+	 * Remove this check once the issues are fixed.
+	 */
+	if (new_crtc_state->bigjoiner_pipes) {
+		drm_dbg_kms(&i915->drm,
+			    "[CRTC:%d:%s] async flip disallowed with bigjoiner\n",
+			    crtc->base.base.id, crtc->base.name);
+		return -EINVAL;
+	}
+
 	for_each_oldnew_intel_plane_in_state(state, plane, old_plane_state,
 					     new_plane_state, i) {
 		if (plane->pipe != crtc->pipe)
diff --git a/sys/dev/pci/drm/i915/display/intel_fb.c b/sys/dev/pci/drm/i915/display/intel_fb.c
index 8605bbfa6..2a3e37c42 100644
--- a/sys/dev/pci/drm/i915/display/intel_fb.c
+++ b/sys/dev/pci/drm/i915/display/intel_fb.c
@@ -1176,7 +1176,8 @@ bool intel_fb_needs_pot_stride_remap(const struct intel_framebuffer *fb)
 {
 	struct drm_i915_private *i915 = to_i915(fb->base.dev);
 
-	return IS_ALDERLAKE_P(i915) && fb->base.modifier != DRM_FORMAT_MOD_LINEAR;
+	return (IS_ALDERLAKE_P(i915) || DISPLAY_VER(i915) >= 14) &&
+		intel_fb_uses_dpt(&fb->base);
 }
 
 static int intel_fb_pitch(const struct intel_framebuffer *fb, int color_plane, unsigned int rotation)
@@ -1312,9 +1313,11 @@ plane_view_scanout_stride(const struct intel_framebuffer *fb, int color_plane,
 			  unsigned int tile_width,
 			  unsigned int src_stride_tiles, unsigned int dst_stride_tiles)
 {
+	struct drm_i915_private *i915 = to_i915(fb->base.dev);
 	unsigned int stride_tiles;
 
-	if (IS_ALDERLAKE_P(to_i915(fb->base.dev)))
+	if ((IS_ALDERLAKE_P(i915) || DISPLAY_VER(i915) >= 14) &&
+	    src_stride_tiles < dst_stride_tiles)
 		stride_tiles = src_stride_tiles;
 	else
 		stride_tiles = dst_stride_tiles;
@@ -1520,7 +1523,8 @@ static void intel_fb_view_init(struct drm_i915_private *i915, struct intel_fb_vi
 	memset(view, 0, sizeof(*view));
 	view->gtt.type = view_type;
 
-	if (view_type == I915_GTT_VIEW_REMAPPED && IS_ALDERLAKE_P(i915))
+	if (view_type == I915_GTT_VIEW_REMAPPED &&
+	    (IS_ALDERLAKE_P(i915) || DISPLAY_VER(i915) >= 14))
 		view->gtt.remapped.plane_alignment = SZ_2M / PAGE_SIZE;
 }
 
diff --git a/sys/dev/pci/drm/i915/display/skl_scaler.c b/sys/dev/pci/drm/i915/display/skl_scaler.c
index 90f42f631..0b74f91e8 100644
--- a/sys/dev/pci/drm/i915/display/skl_scaler.c
+++ b/sys/dev/pci/drm/i915/display/skl_scaler.c
@@ -337,6 +337,263 @@ int skl_update_scaler_plane(struct intel_crtc_state *crtc_state,
 	return 0;
 }
 
+static int intel_atomic_setup_scaler(struct intel_crtc_scaler_state *scaler_state,
+				     int num_scalers_need, struct intel_crtc *intel_crtc,
+				     const char *name, int idx,
+				     struct intel_plane_state *plane_state,
+				     int *scaler_id)
+{
+	struct drm_i915_private *dev_priv = to_i915(intel_crtc->base.dev);
+	int j;
+	u32 mode;
+
+	if (*scaler_id < 0) {
+		/* find a free scaler */
+		for (j = 0; j < intel_crtc->num_scalers; j++) {
+			if (scaler_state->scalers[j].in_use)
+				continue;
+
+			*scaler_id = j;
+			scaler_state->scalers[*scaler_id].in_use = 1;
+			break;
+		}
+	}
+
+	if (drm_WARN(&dev_priv->drm, *scaler_id < 0,
+		     "Cannot find scaler for %s:%d\n", name, idx))
+		return -EINVAL;
+
+	/* set scaler mode */
+	if (plane_state && plane_state->hw.fb &&
+	    plane_state->hw.fb->format->is_yuv &&
+	    plane_state->hw.fb->format->num_planes > 1) {
+		struct intel_plane *plane = to_intel_plane(plane_state->uapi.plane);
+
+		if (DISPLAY_VER(dev_priv) == 9) {
+			mode = SKL_PS_SCALER_MODE_NV12;
+		} else if (icl_is_hdr_plane(dev_priv, plane->id)) {
+			/*
+			 * On gen11+'s HDR planes we only use the scaler for
+			 * scaling. They have a dedicated chroma upsampler, so
+			 * we don't need the scaler to upsample the UV plane.
+			 */
+			mode = PS_SCALER_MODE_NORMAL;
+		} else {
+			struct intel_plane *linked =
+				plane_state->planar_linked_plane;
+
+			mode = PS_SCALER_MODE_PLANAR;
+
+			if (linked)
+				mode |= PS_PLANE_Y_SEL(linked->id);
+		}
+	} else if (DISPLAY_VER(dev_priv) >= 10) {
+		mode = PS_SCALER_MODE_NORMAL;
+	} else if (num_scalers_need == 1 && intel_crtc->num_scalers > 1) {
+		/*
+		 * when only 1 scaler is in use on a pipe with 2 scalers
+		 * scaler 0 operates in high quality (HQ) mode.
+		 * In this case use scaler 0 to take advantage of HQ mode
+		 */
+		scaler_state->scalers[*scaler_id].in_use = 0;
+		*scaler_id = 0;
+		scaler_state->scalers[0].in_use = 1;
+		mode = SKL_PS_SCALER_MODE_HQ;
+	} else {
+		mode = SKL_PS_SCALER_MODE_DYN;
+	}
+
+	/*
+	 * FIXME: we should also check the scaler factors for pfit, so
+	 * this shouldn't be tied directly to planes.
+	 */
+	if (plane_state && plane_state->hw.fb) {
+		const struct drm_framebuffer *fb = plane_state->hw.fb;
+		const struct drm_rect *src = &plane_state->uapi.src;
+		const struct drm_rect *dst = &plane_state->uapi.dst;
+		int hscale, vscale, max_vscale, max_hscale;
+
+		/*
+		 * FIXME: When two scalers are needed, but only one of
+		 * them needs to downscale, we should make sure that
+		 * the one that needs downscaling support is assigned
+		 * as the first scaler, so we don't reject downscaling
+		 * unnecessarily.
+		 */
+
+		if (DISPLAY_VER(dev_priv) >= 14) {
+			/*
+			 * On versions 14 and up, only the first
+			 * scaler supports a vertical scaling factor
+			 * of more than 1.0, while a horizontal
+			 * scaling factor of 3.0 is supported.
+			 */
+			max_hscale = 0x30000 - 1;
+			if (*scaler_id == 0)
+				max_vscale = 0x30000 - 1;
+			else
+				max_vscale = 0x10000;
+
+		} else if (DISPLAY_VER(dev_priv) >= 10 ||
+			   !intel_format_info_is_yuv_semiplanar(fb->format, fb->modifier)) {
+			max_hscale = 0x30000 - 1;
+			max_vscale = 0x30000 - 1;
+		} else {
+			max_hscale = 0x20000 - 1;
+			max_vscale = 0x20000 - 1;
+		}
+
+		/*
+		 * FIXME: We should change the if-else block above to
+		 * support HQ vs dynamic scaler properly.
+		 */
+
+		/* Check if required scaling is within limits */
+		hscale = drm_rect_calc_hscale(src, dst, 1, max_hscale);
+		vscale = drm_rect_calc_vscale(src, dst, 1, max_vscale);
+
+		if (hscale < 0 || vscale < 0) {
+			drm_dbg_kms(&dev_priv->drm,
+				    "Scaler %d doesn't support required plane scaling\n",
+				    *scaler_id);
+			drm_rect_debug_print("src: ", src, true);
+			drm_rect_debug_print("dst: ", dst, false);
+
+			return -EINVAL;
+		}
+	}
+
+	drm_dbg_kms(&dev_priv->drm, "Attached scaler id %u.%u to %s:%d\n",
+		    intel_crtc->pipe, *scaler_id, name, idx);
+	scaler_state->scalers[*scaler_id].mode = mode;
+
+	return 0;
+}
+
+/**
+ * intel_atomic_setup_scalers() - setup scalers for crtc per staged requests
+ * @dev_priv: i915 device
+ * @intel_crtc: intel crtc
+ * @crtc_state: incoming crtc_state to validate and setup scalers
+ *
+ * This function sets up scalers based on staged scaling requests for
+ * a @crtc and its planes. It is called from crtc level check path. If request
+ * is a supportable request, it attaches scalers to requested planes and crtc.
+ *
+ * This function takes into account the current scaler(s) in use by any planes
+ * not being part of this atomic state
+ *
+ *  Returns:
+ *         0 - scalers were setup successfully
+ *         error code - otherwise
+ */
+int intel_atomic_setup_scalers(struct drm_i915_private *dev_priv,
+			       struct intel_crtc *intel_crtc,
+			       struct intel_crtc_state *crtc_state)
+{
+	struct drm_plane *plane = NULL;
+	struct intel_plane *intel_plane;
+	struct intel_crtc_scaler_state *scaler_state =
+		&crtc_state->scaler_state;
+	struct drm_atomic_state *drm_state = crtc_state->uapi.state;
+	struct intel_atomic_state *intel_state = to_intel_atomic_state(drm_state);
+	int num_scalers_need;
+	int i;
+
+	num_scalers_need = hweight32(scaler_state->scaler_users);
+
+	/*
+	 * High level flow:
+	 * - staged scaler requests are already in scaler_state->scaler_users
+	 * - check whether staged scaling requests can be supported
+	 * - add planes using scalers that aren't in current transaction
+	 * - assign scalers to requested users
+	 * - as part of plane commit, scalers will be committed
+	 *   (i.e., either attached or detached) to respective planes in hw
+	 * - as part of crtc_commit, scaler will be either attached or detached
+	 *   to crtc in hw
+	 */
+
+	/* fail if required scalers > available scalers */
+	if (num_scalers_need > intel_crtc->num_scalers) {
+		drm_dbg_kms(&dev_priv->drm,
+			    "Too many scaling requests %d > %d\n",
+			    num_scalers_need, intel_crtc->num_scalers);
+		return -EINVAL;
+	}
+
+	/* walkthrough scaler_users bits and start assigning scalers */
+	for (i = 0; i < sizeof(scaler_state->scaler_users) * 8; i++) {
+		struct intel_plane_state *plane_state = NULL;
+		int *scaler_id;
+		const char *name;
+		int idx, ret;
+
+		/* skip if scaler not required */
+		if (!(scaler_state->scaler_users & (1 << i)))
+			continue;
+
+		if (i == SKL_CRTC_INDEX) {
+			name = "CRTC";
+			idx = intel_crtc->base.base.id;
+
+			/* panel fitter case: assign as a crtc scaler */
+			scaler_id = &scaler_state->scaler_id;
+		} else {
+			name = "PLANE";
+
+			/* plane scaler case: assign as a plane scaler */
+			/* find the plane that set the bit as scaler_user */
+			plane = drm_state->planes[i].ptr;
+
+			/*
+			 * to enable/disable hq mode, add planes that are using scaler
+			 * into this transaction
+			 */
+			if (!plane) {
+				struct drm_plane_state *state;
+
+				/*
+				 * GLK+ scalers don't have a HQ mode so it
+				 * isn't necessary to change between HQ and dyn mode
+				 * on those platforms.
+				 */
+				if (DISPLAY_VER(dev_priv) >= 10)
+					continue;
+
+				plane = drm_plane_from_index(&dev_priv->drm, i);
+				state = drm_atomic_get_plane_state(drm_state, plane);
+				if (IS_ERR(state)) {
+					drm_dbg_kms(&dev_priv->drm,
+						    "Failed to add [PLANE:%d] to drm_state\n",
+						    plane->base.id);
+					return PTR_ERR(state);
+				}
+			}
+
+			intel_plane = to_intel_plane(plane);
+			idx = plane->base.id;
+
+			/* plane on different crtc cannot be a scaler user of this crtc */
+			if (drm_WARN_ON(&dev_priv->drm,
+					intel_plane->pipe != intel_crtc->pipe))
+				continue;
+
+			plane_state = intel_atomic_get_new_plane_state(intel_state,
+								       intel_plane);
+			scaler_id = &plane_state->scaler_id;
+		}
+
+		ret = intel_atomic_setup_scaler(scaler_state, num_scalers_need,
+						intel_crtc, name, idx,
+						plane_state, scaler_id);
+		if (ret < 0)
+			return ret;
+	}
+
+	return 0;
+}
+
 static int glk_coef_tap(int i)
 {
 	return i % 7;
diff --git a/sys/dev/pci/drm/i915/display/skl_scaler.h b/sys/dev/pci/drm/i915/display/skl_scaler.h
index 0097d5d08..f040f6ac0 100644
--- a/sys/dev/pci/drm/i915/display/skl_scaler.h
+++ b/sys/dev/pci/drm/i915/display/skl_scaler.h
@@ -8,17 +8,22 @@
 #include <linux/types.h>
 
 enum drm_scaling_filter;
-struct drm_i915_private;
-struct intel_crtc_state;
-struct intel_plane_state;
-struct intel_plane;
 enum pipe;
+struct drm_i915_private;
+struct intel_crtc;
+struct intel_crtc_state;
+struct intel_plane;
+struct intel_plane_state;
 
 int skl_update_scaler_crtc(struct intel_crtc_state *crtc_state);
 
 int skl_update_scaler_plane(struct intel_crtc_state *crtc_state,
 			    struct intel_plane_state *plane_state);
 
+int intel_atomic_setup_scalers(struct drm_i915_private *dev_priv,
+			       struct intel_crtc *intel_crtc,
+			       struct intel_crtc_state *crtc_state);
+
 void skl_pfit_enable(const struct intel_crtc_state *crtc_state);
 
 void skl_program_plane_scaler(struct intel_plane *plane,
@@ -26,4 +31,5 @@ void skl_program_plane_scaler(struct intel_plane *plane,
 			      const struct intel_plane_state *plane_state);
 void skl_detach_scalers(const struct intel_crtc_state *crtc_state);
 void skl_scaler_disable(const struct intel_crtc_state *old_crtc_state);
+
 #endif
diff --git a/sys/kern/init_main.c b/sys/kern/init_main.c
index ed2483c8a..0b5d2ed56 100644
--- a/sys/kern/init_main.c
+++ b/sys/kern/init_main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: init_main.c,v 1.324 2024/01/01 07:00:18 jsgs Exp $	*/
+/*	$OpenBSD: init_main.c,v 1.324 2024/01/01 07:00:18 jsg Exp $	*/
 /*	$NetBSD: init_main.c,v 1.84.4.1 1996/06/02 09:08:06 mrg Exp $	*/
 
 /*
diff --git a/sys/net/if_gif.c b/sys/net/if_gif.c
index 884d26a37..7a652bd4c 100644
--- a/sys/net/if_gif.c
+++ b/sys/net/if_gif.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_gif.c,v 1.136 2023/12/23 10:52:54 bluhm Exp $	*/
+/*	$OpenBSD: if_gif.c,v 1.137 2024/01/01 18:47:02 mvs Exp $	*/
 /*	$KAME: if_gif.c,v 1.43 2001/02/20 08:51:07 itojun Exp $	*/
 
 /*
@@ -174,9 +174,9 @@ gif_clone_create(struct if_clone *ifc, int unit)
 	ifp->if_type   = IFT_GIF;
 	ifp->if_softc = sc;
 
+	if_counters_alloc(ifp);
 	if_attach(ifp);
 	if_alloc_sadl(ifp);
-	if_counters_alloc(ifp);
 
 #if NBPFILTER > 0
 	bpfattach(&ifp->if_bpf, ifp, DLT_LOOP, sizeof(uint32_t));
diff --git a/sys/net/if_mpe.c b/sys/net/if_mpe.c
index a72347b4c..9f26a9011 100644
--- a/sys/net/if_mpe.c
+++ b/sys/net/if_mpe.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: if_mpe.c,v 1.104 2023/12/23 10:52:54 bluhm Exp $ */
+/* $OpenBSD: if_mpe.c,v 1.105 2024/01/01 18:47:02 mvs Exp $ */
 
 /*
  * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@spootnik.org>
@@ -117,9 +117,9 @@ mpe_clone_create(struct if_clone *ifc, int unit)
 
 	sc->sc_dead = 0;
 
+	if_counters_alloc(ifp);
 	if_attach(ifp);
 	if_alloc_sadl(ifp);
-	if_counters_alloc(ifp);
 
 #if NBPFILTER > 0
 	bpfattach(&ifp->if_bpf, ifp, DLT_LOOP, sizeof(u_int32_t));
diff --git a/sys/net/if_mpip.c b/sys/net/if_mpip.c
index 8daac9346..761a1fe5a 100644
--- a/sys/net/if_mpip.c
+++ b/sys/net/if_mpip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_mpip.c,v 1.18 2023/12/23 10:52:54 bluhm Exp $ */
+/*	$OpenBSD: if_mpip.c,v 1.19 2024/01/01 18:47:02 mvs Exp $ */
 
 /*
  * Copyright (c) 2015 Rafael Zalamena <rzalamena@openbsd.org>
@@ -120,8 +120,8 @@ mpip_clone_create(struct if_clone *ifc, int unit)
 	ifp->if_mtu = 1500;
 	ifp->if_hardmtu = 65535;
 
-	if_attach(ifp);
 	if_counters_alloc(ifp);
+	if_attach(ifp);
 	if_alloc_sadl(ifp);
 
 #if NBPFILTER > 0
diff --git a/sys/net/if_wg.c b/sys/net/if_wg.c
index 01a0e9c61..fd4b43b1b 100644
--- a/sys/net/if_wg.c
+++ b/sys/net/if_wg.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_wg.c,v 1.34 2023/12/23 10:52:54 bluhm Exp $ */
+/*	$OpenBSD: if_wg.c,v 1.35 2024/01/01 18:47:02 mvs Exp $ */
 
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
@@ -2691,9 +2691,9 @@ wg_clone_create(struct if_clone *ifc, int unit)
 	ifp->if_type = IFT_WIREGUARD;
 	ifp->if_rtrequest = p2p_rtrequest;
 
+	if_counters_alloc(ifp);
 	if_attach(ifp);
 	if_alloc_sadl(ifp);
-	if_counters_alloc(ifp);
 
 #if NBPFILTER > 0
 	bpfattach(&ifp->if_bpf, ifp, DLT_LOOP, sizeof(uint32_t));
diff --git a/sys/net/pf.c b/sys/net/pf.c
index 07744c5c6..d1ce9f369 100644
--- a/sys/net/pf.c
+++ b/sys/net/pf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf.c,v 1.1190 2023/12/28 16:21:08 aisha Exp $ */
+/*	$OpenBSD: pf.c,v 1.1192 2024/01/01 22:16:51 bluhm Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -112,6 +112,8 @@ struct pf_queuehead	*pf_queues_inactive;
 
 struct pf_status	 pf_status;
 
+struct mutex		 pf_inp_mtx = MUTEX_INITIALIZER(IPL_SOFTNET);
+
 int			 pf_hdr_limit = 20;  /* arbitrary limit, tune in ddb */
 
 SHA2_CTX		 pf_tcp_secret_ctx;
@@ -256,7 +258,6 @@ void			 pf_state_key_unlink_reverse(struct pf_state_key *);
 void			 pf_state_key_link_inpcb(struct pf_state_key *,
 			    struct inpcb *);
 void			 pf_state_key_unlink_inpcb(struct pf_state_key *);
-void			 pf_inpcb_unlink_state_key(struct inpcb *);
 void			 pf_pktenqueue_delayed(void *);
 int32_t			 pf_state_expires(const struct pf_state *, uint8_t);
 
@@ -1128,7 +1129,7 @@ int
 pf_find_state(struct pf_pdesc *pd, struct pf_state_key_cmp *key,
     struct pf_state **stp)
 {
-	struct pf_state_key	*sk, *pkt_sk, *inp_sk;
+	struct pf_state_key	*sk, *pkt_sk;
 	struct pf_state_item	*si;
 	struct pf_state		*st = NULL;
 
@@ -1140,7 +1141,6 @@ pf_find_state(struct pf_pdesc *pd, struct pf_state_key_cmp *key,
 		addlog("\n");
 	}
 
-	inp_sk = NULL;
 	pkt_sk = NULL;
 	sk = NULL;
 	if (pd->dir == PF_OUT) {
@@ -1156,14 +1156,27 @@ pf_find_state(struct pf_pdesc *pd, struct pf_state_key_cmp *key,
 			sk = pkt_sk->sk_reverse;
 
 		if (pkt_sk == NULL) {
+			struct inpcb *inp = pd->m->m_pkthdr.pf.inp;
+
 			/* here we deal with local outbound packet */
-			if (pd->m->m_pkthdr.pf.inp != NULL) {
-				inp_sk = pd->m->m_pkthdr.pf.inp->inp_pf_sk;
-				if (pf_state_key_isvalid(inp_sk))
+			if (inp != NULL) {
+				struct pf_state_key	*inp_sk;
+
+				mtx_enter(&pf_inp_mtx);
+				inp_sk = inp->inp_pf_sk;
+				if (pf_state_key_isvalid(inp_sk)) {
 					sk = inp_sk;
-				else
-					pf_inpcb_unlink_state_key(
-					    pd->m->m_pkthdr.pf.inp);
+					mtx_leave(&pf_inp_mtx);
+				} else if (inp_sk != NULL) {
+					KASSERT(inp_sk->sk_inp == inp);
+					inp_sk->sk_inp = NULL;
+					inp->inp_pf_sk = NULL;
+					mtx_leave(&pf_inp_mtx);
+
+					pf_state_key_unref(inp_sk);
+					in_pcbunref(inp);
+				} else
+					mtx_leave(&pf_inp_mtx);
 			}
 		}
 	}
@@ -1175,8 +1188,7 @@ pf_find_state(struct pf_pdesc *pd, struct pf_state_key_cmp *key,
 		if (pd->dir == PF_OUT && pkt_sk &&
 		    pf_compare_state_keys(pkt_sk, sk, pd->kif, pd->dir) == 0)
 			pf_state_key_link_reverse(sk, pkt_sk);
-		else if (pd->dir == PF_OUT && pd->m->m_pkthdr.pf.inp &&
-		    !pd->m->m_pkthdr.pf.inp->inp_pf_sk && !sk->sk_inp)
+		else if (pd->dir == PF_OUT)
 			pf_state_key_link_inpcb(sk, pd->m->m_pkthdr.pf.inp);
 	}
 
@@ -1801,12 +1813,22 @@ pf_remove_state(struct pf_state *st)
 }
 
 void
-pf_remove_divert_state(struct pf_state_key *sk)
+pf_remove_divert_state(struct inpcb *inp)
 {
+	struct pf_state_key	*sk;
 	struct pf_state_item	*si;
 
 	PF_ASSERT_UNLOCKED();
 
+	if (READ_ONCE(inp->inp_pf_sk) == NULL)
+		return;
+
+	mtx_enter(&pf_inp_mtx);
+	sk = pf_state_key_ref(inp->inp_pf_sk);
+	mtx_leave(&pf_inp_mtx);
+	if (sk == NULL)
+		return;
+
 	PF_LOCK();
 	PF_STATE_ENTER_WRITE();
 	TAILQ_FOREACH(si, &sk->sk_states, si_entry) {
@@ -1837,6 +1859,8 @@ pf_remove_divert_state(struct pf_state_key *sk)
 	}
 	PF_STATE_EXIT_WRITE();
 	PF_UNLOCK();
+
+	pf_state_key_unref(sk);
 }
 
 void
@@ -4285,8 +4309,8 @@ enter_ruleset:
 			if (r->anchor_wildcard) {
 				RB_FOREACH(child, pf_anchor_node,
 				    &r->anchor->children) {
-					if (pf_anchor_stack_push(ruleset, r, child,
-					    PF_NEXT_CHILD) != 0)
+					if (pf_anchor_stack_push(ruleset, r,
+					    child, PF_NEXT_CHILD) != 0)
 						return (PF_TEST_FAIL);
 
 					ruleset = &child->ruleset;
@@ -7842,9 +7866,7 @@ done:
 		pd.m->m_pkthdr.pf.qid = qid;
 	if (pd.dir == PF_IN && st && st->key[PF_SK_STACK])
 		pf_mbuf_link_state_key(pd.m, st->key[PF_SK_STACK]);
-	if (pd.dir == PF_OUT &&
-	    pd.m->m_pkthdr.pf.inp && !pd.m->m_pkthdr.pf.inp->inp_pf_sk &&
-	    st && st->key[PF_SK_STACK] && !st->key[PF_SK_STACK]->sk_inp)
+	if (pd.dir == PF_OUT && st && st->key[PF_SK_STACK])
 		pf_state_key_link_inpcb(st->key[PF_SK_STACK],
 		    pd.m->m_pkthdr.pf.inp);
 
@@ -8015,7 +8037,7 @@ pf_ouraddr(struct mbuf *m)
 
 	sk = m->m_pkthdr.pf.statekey;
 	if (sk != NULL) {
-		if (sk->sk_inp != NULL)
+		if (READ_ONCE(sk->sk_inp) != NULL)
 			return (1);
 	}
 
@@ -8041,13 +8063,12 @@ pf_inp_lookup(struct mbuf *m)
 
 	if (!pf_state_key_isvalid(sk))
 		pf_mbuf_unlink_state_key(m);
-	else
-		inp = m->m_pkthdr.pf.statekey->sk_inp;
+	else if (READ_ONCE(sk->sk_inp) != NULL) {
+		mtx_enter(&pf_inp_mtx);
+		inp = in_pcbref(sk->sk_inp);
+		mtx_leave(&pf_inp_mtx);
+	}
 
-	if (inp && inp->inp_pf_sk)
-		KASSERT(m->m_pkthdr.pf.statekey == inp->inp_pf_sk);
-
-	in_pcbref(inp);
 	return (inp);
 }
 
@@ -8066,8 +8087,7 @@ pf_inp_link(struct mbuf *m, struct inpcb *inp)
 	 * state, which might be just being marked as deleted by another
 	 * thread.
 	 */
-	if (inp && !sk->sk_inp && !inp->inp_pf_sk)
-		pf_state_key_link_inpcb(sk, inp);
+	pf_state_key_link_inpcb(sk, inp);
 
 	/* The statekey has finished finding the inp, it is no longer needed. */
 	pf_mbuf_unlink_state_key(m);
@@ -8076,7 +8096,24 @@ pf_inp_link(struct mbuf *m, struct inpcb *inp)
 void
 pf_inp_unlink(struct inpcb *inp)
 {
-	pf_inpcb_unlink_state_key(inp);
+	struct pf_state_key *sk;
+
+	if (READ_ONCE(inp->inp_pf_sk) == NULL)
+		return;
+
+	mtx_enter(&pf_inp_mtx);
+	sk = inp->inp_pf_sk;
+	if (sk == NULL) {
+		mtx_leave(&pf_inp_mtx);
+		return;
+	}
+	KASSERT(sk->sk_inp == inp);
+	sk->sk_inp = NULL;
+	inp->inp_pf_sk = NULL;
+	mtx_leave(&pf_inp_mtx);
+
+	pf_state_key_unref(sk);
+	in_pcbunref(inp);
 }
 
 void
@@ -8189,38 +8226,40 @@ pf_mbuf_unlink_inpcb(struct mbuf *m)
 void
 pf_state_key_link_inpcb(struct pf_state_key *sk, struct inpcb *inp)
 {
-	KASSERT(sk->sk_inp == NULL);
-	sk->sk_inp = in_pcbref(inp);
-	KASSERT(inp->inp_pf_sk == NULL);
-	inp->inp_pf_sk = pf_state_key_ref(sk);
-}
+	if (inp == NULL || READ_ONCE(sk->sk_inp) != NULL)
+		return;
 
-void
-pf_inpcb_unlink_state_key(struct inpcb *inp)
-{
-	struct pf_state_key *sk = inp->inp_pf_sk;
-
-	if (sk != NULL) {
-		KASSERT(sk->sk_inp == inp);
-		sk->sk_inp = NULL;
-		inp->inp_pf_sk = NULL;
-		pf_state_key_unref(sk);
-		in_pcbunref(inp);
+	mtx_enter(&pf_inp_mtx);
+	if (inp->inp_pf_sk != NULL || sk->sk_inp != NULL) {
+		mtx_leave(&pf_inp_mtx);
+		return;
 	}
+	sk->sk_inp = in_pcbref(inp);
+	inp->inp_pf_sk = pf_state_key_ref(sk);
+	mtx_leave(&pf_inp_mtx);
 }
 
 void
 pf_state_key_unlink_inpcb(struct pf_state_key *sk)
 {
-	struct inpcb *inp = sk->sk_inp;
+	struct inpcb *inp;
 
-	if (inp != NULL) {
-		KASSERT(inp->inp_pf_sk == sk);
-		sk->sk_inp = NULL;
-		inp->inp_pf_sk = NULL;
-		pf_state_key_unref(sk);
-		in_pcbunref(inp);
+	if (READ_ONCE(sk->sk_inp) == NULL)
+		return;
+
+	mtx_enter(&pf_inp_mtx);
+	inp = sk->sk_inp;
+	if (inp == NULL) {
+		mtx_leave(&pf_inp_mtx);
+		return;
 	}
+	KASSERT(inp->inp_pf_sk == sk);
+	sk->sk_inp = NULL;
+	inp->inp_pf_sk = NULL;
+	mtx_leave(&pf_inp_mtx);
+
+	pf_state_key_unref(sk);
+	in_pcbunref(inp);
 }
 
 void
diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index b8f1286e6..bfddbf9da 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfvar.h,v 1.534 2023/10/10 11:25:31 bluhm Exp $ */
+/*	$OpenBSD: pfvar.h,v 1.535 2024/01/01 22:16:51 bluhm Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -1600,7 +1600,7 @@ extern void			 pf_calc_skip_steps(struct pf_rulequeue *);
 extern void			 pf_purge_expired_src_nodes(void);
 extern void			 pf_purge_expired_rules(void);
 extern void			 pf_remove_state(struct pf_state *);
-extern void			 pf_remove_divert_state(struct pf_state_key *);
+extern void			 pf_remove_divert_state(struct inpcb *);
 extern void			 pf_free_state(struct pf_state *);
 int				 pf_insert_src_node(struct pf_src_node **,
 				    struct pf_rule *, enum pf_sn_types,
diff --git a/sys/net/pfvar_priv.h b/sys/net/pfvar_priv.h
index ee4302e4b..a9a794078 100644
--- a/sys/net/pfvar_priv.h
+++ b/sys/net/pfvar_priv.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfvar_priv.h,v 1.34 2023/07/06 04:55:05 dlg Exp $	*/
+/*	$OpenBSD: pfvar_priv.h,v 1.35 2024/01/01 22:16:51 bluhm Exp $	*/
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -41,6 +41,11 @@
 #include <sys/mutex.h>
 #include <sys/percpu.h>
 
+/*
+ * Locks used to protect struct members in this file:
+ *	L	pf_inp_mtx		link pf to inp mutex
+ */
+
 struct pfsync_deferral;
 
 /*
@@ -70,7 +75,7 @@ struct pf_state_key {
 	RB_ENTRY(pf_state_key)	 sk_entry;
 	struct pf_statelisthead	 sk_states;
 	struct pf_state_key	*sk_reverse;
-	struct inpcb		*sk_inp;
+	struct inpcb		*sk_inp;	/* [L] */
 	pf_refcnt_t		 sk_refcnt;
 	u_int8_t		 sk_removed;
 };
@@ -365,6 +370,7 @@ void			 pf_state_unref(struct pf_state *);
 
 extern struct rwlock	pf_lock;
 extern struct rwlock	pf_state_lock;
+extern struct mutex	pf_inp_mtx;
 
 #define PF_LOCK()		do {			\
 		rw_enter_write(&pf_lock);		\
diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index 67e80baa7..1d40a0c2d 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in_pcb.c,v 1.282 2023/12/07 16:08:30 bluhm Exp $	*/
+/*	$OpenBSD: in_pcb.c,v 1.283 2024/01/01 22:16:51 bluhm Exp $	*/
 /*	$NetBSD: in_pcb.c,v 1.25 1996/02/13 23:41:53 christos Exp $	*/
 
 /*
@@ -573,17 +573,9 @@ in_pcbconnect(struct inpcb *inp, struct mbuf *nam)
 void
 in_pcbdisconnect(struct inpcb *inp)
 {
-	/*
-	 * XXXSMP pf lock sleeps, so we cannot use table->inpt_mtx
-	 * to keep inp_pf_sk in sync with pcb.  Use net lock for now.
-	 */
-	NET_ASSERT_LOCKED_EXCLUSIVE();
 #if NPF > 0
-	if (inp->inp_pf_sk) {
-		pf_remove_divert_state(inp->inp_pf_sk);
-		/* pf_remove_divert_state() may have detached the state */
-		pf_inp_unlink(inp);
-	}
+	pf_remove_divert_state(inp);
+	pf_inp_unlink(inp);
 #endif
 	inp->inp_flowid = 0;
 	if (inp->inp_socket->so_state & SS_NOFDREF)
@@ -616,17 +608,9 @@ in_pcbdetach(struct inpcb *inp)
 #endif
 		ip_freemoptions(inp->inp_moptions);
 
-	/*
-	 * XXXSMP pf lock sleeps, so we cannot use table->inpt_mtx
-	 * to keep inp_pf_sk in sync with pcb.  Use net lock for now.
-	 */
-	NET_ASSERT_LOCKED_EXCLUSIVE();
 #if NPF > 0
-	if (inp->inp_pf_sk) {
-		pf_remove_divert_state(inp->inp_pf_sk);
-		/* pf_remove_divert_state() may have detached the state */
-		pf_inp_unlink(inp);
-	}
+	pf_remove_divert_state(inp);
+	pf_inp_unlink(inp);
 #endif
 	mtx_enter(&table->inpt_mtx);
 	LIST_REMOVE(inp, inp_lhash);
diff --git a/sys/netinet/in_pcb.h b/sys/netinet/in_pcb.h
index 16d1ce324..ed800f016 100644
--- a/sys/netinet/in_pcb.h
+++ b/sys/netinet/in_pcb.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in_pcb.h,v 1.145 2023/12/18 13:11:20 bluhm Exp $	*/
+/*	$OpenBSD: in_pcb.h,v 1.146 2024/01/01 22:16:51 bluhm Exp $	*/
 /*	$NetBSD: in_pcb.h,v 1.14 1996/02/13 23:42:00 christos Exp $	*/
 
 /*
@@ -82,6 +82,7 @@
  *	t	inpt_mtx		pcb table mutex
  *	y	inpt_notify		pcb table rwlock for notify
  *	p	inpcb_mtx		pcb mutex
+ *	L	pf_inp_mtx		link pf to inp mutex
  */
 
 /*
@@ -187,7 +188,7 @@ struct inpcb {
 #define inp_csumoffset	inp_cksum6
 #endif
 	struct	icmp6_filter *inp_icmp6filt;
-	struct	pf_state_key *inp_pf_sk;
+	struct	pf_state_key *inp_pf_sk; /* [L] */
 	struct	mbuf *(*inp_upcall)(void *, struct mbuf *,
 		    struct ip *, struct ip6_hdr *, void *, int);
 	void	*inp_upcall_arg;
diff --git a/sys/netinet6/ip6_divert.c b/sys/netinet6/ip6_divert.c
index 6826bd9a2..896441742 100644
--- a/sys/netinet6/ip6_divert.c
+++ b/sys/netinet6/ip6_divert.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ip6_divert.c,v 1.90 2023/09/16 09:33:27 mpi Exp $ */
+/*      $OpenBSD: ip6_divert.c,v 1.91 2024/01/01 18:52:09 bluhm Exp $ */
 
 /*
  * Copyright (c) 2009 Michele Marchetto <michele@openbsd.org>
@@ -33,6 +33,7 @@
 #include <netinet/ip.h>
 #include <netinet/ip_var.h>
 #include <netinet/in_pcb.h>
+#include <netinet/ip_divert.h>
 #include <netinet/ip6.h>
 #include <netinet6/in6_var.h>
 #include <netinet6/ip6_divert.h>
@@ -65,11 +66,11 @@ const struct sysctl_bounded_args divert6ctl_vars[] = {
 
 const struct pr_usrreqs divert6_usrreqs = {
 	.pru_attach	= divert6_attach,
-	.pru_detach	= divert6_detach,
-	.pru_lock	= divert6_lock,
-	.pru_unlock	= divert6_unlock,
-	.pru_bind	= divert6_bind,
-	.pru_shutdown	= divert6_shutdown,
+	.pru_detach	= divert_detach,
+	.pru_lock	= divert_lock,
+	.pru_unlock	= divert_unlock,
+	.pru_bind	= divert_bind,
+	.pru_shutdown	= divert_shutdown,
 	.pru_send	= divert6_send,
 	.pru_control	= in6_control,
 	.pru_sockaddr	= in6_sockaddr,
@@ -272,7 +273,6 @@ divert6_attach(struct socket *so, int proto, int wait)
 
 	if (so->so_pcb != NULL)
 		return EINVAL;
-
 	if ((so->so_state & SS_PRIV) == 0)
 		return EACCES;
 
@@ -283,57 +283,6 @@ divert6_attach(struct socket *so, int proto, int wait)
 	error = soreserve(so, divert6_sendspace, divert6_recvspace);
 	if (error)
 		return (error);
-	sotoinpcb(so)->inp_flags |= INP_HDRINCL;
-	return (0);
-}
-
-int
-divert6_detach(struct socket *so)
-{
-	struct inpcb *inp = sotoinpcb(so);
-
-	soassertlocked(so);
-
-	if (inp == NULL)
-		return (EINVAL);
-
-	in_pcbdetach(inp);
-
-	return (0);
-}
-
-void
-divert6_lock(struct socket *so)
-{
-	struct inpcb *inp = sotoinpcb(so);
-
-	NET_ASSERT_LOCKED();
-	mtx_enter(&inp->inp_mtx);
-}
-
-void
-divert6_unlock(struct socket *so)
-{
-	struct inpcb *inp = sotoinpcb(so);
-
-	NET_ASSERT_LOCKED();
-	mtx_leave(&inp->inp_mtx);
-}
-
-int
-divert6_bind(struct socket *so, struct mbuf *addr, struct proc *p)
-{
-	struct inpcb *inp = sotoinpcb(so);
-
-	soassertlocked(so);
-	return in_pcbbind(inp, addr, p);
-}
-
-int
-divert6_shutdown(struct socket *so)
-{
-	soassertlocked(so);
-	socantsendmore(so);
 
 	return (0);
 }
diff --git a/sys/netinet6/ip6_divert.h b/sys/netinet6/ip6_divert.h
index aeff58338..27f246115 100644
--- a/sys/netinet6/ip6_divert.h
+++ b/sys/netinet6/ip6_divert.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ip6_divert.h,v 1.22 2022/10/17 14:49:02 mvs Exp $ */
+/*      $OpenBSD: ip6_divert.h,v 1.23 2024/01/01 18:52:09 bluhm Exp $ */
 
 /*
  * Copyright (c) 2009 Michele Marchetto <michele@openbsd.org>
@@ -71,11 +71,6 @@ void	 divert6_init(void);
 void	 divert6_packet(struct mbuf *, int, u_int16_t);
 int	 divert6_sysctl(int *, u_int, void *, size_t *, void *, size_t);
 int	 divert6_attach(struct socket *, int, int);
-int	 divert6_detach(struct socket *);
-void	 divert6_lock(struct socket *);
-void	 divert6_unlock(struct socket *);
-int	 divert6_bind(struct socket *, struct mbuf *, struct proc *);
-int	 divert6_shutdown(struct socket *);
 int	 divert6_send(struct socket *, struct mbuf *, struct mbuf *,
 	     struct mbuf *);
 #endif /* _KERNEL */