80 files changed, 1891 insertions, 630 deletions

diff --git a/contrib/bsnmp/lib/snmpclient.c b/contrib/bsnmp/lib/snmpclient.c
index 8220824d0504..2dc9eb8dc9f0 100644
--- a/contrib/bsnmp/lib/snmpclient.c
+++ b/contrib/bsnmp/lib/snmpclient.c
@@ -728,8 +728,11 @@ snmp_table_fetch_async(const struct snmp_table *descr, void *list,
 	work->last_change = 0;
 	table_init_pdu(descr, &work->pdu);
 
-	if (snmp_pdu_send(&work->pdu, table_cb, work) == -1)
+	if (snmp_pdu_send(&work->pdu, table_cb, work) == -1) {
+		free(work);
+		work = NULL;
 		return (-1);
+	}
 	return (0);
 }
 
diff --git a/contrib/bsnmp/snmp_usm/usm_snmp.c b/contrib/bsnmp/snmp_usm/usm_snmp.c
index c475940c99e9..a6c7b8634a1b 100644
--- a/contrib/bsnmp/snmp_usm/usm_snmp.c
+++ b/contrib/bsnmp/snmp_usm/usm_snmp.c
@@ -167,10 +167,14 @@ op_usm_users(struct snmp_context *ctx, struct snmp_value *val,
 		if ((uuser = usm_get_user(&val->var, sub)) == NULL &&
 		    val->var.subs[sub - 1] != LEAF_usmUserStatus &&
 		    val->var.subs[sub - 1] != LEAF_usmUserCloneFrom)
-				return (SNMP_ERR_NOSUCHNAME);
+			return (SNMP_ERR_NOSUCHNAME);
 
+		/*
+		 * XXX (ngie): need to investigate the MIB to determine how
+		 * this is possible given some of the transitions below.
+		 */
 		if (community != COMM_INITIALIZE &&
-		    uuser->type == StorageType_readOnly)
+		    uuser != NULL && uuser->type == StorageType_readOnly)
 			return (SNMP_ERR_NOT_WRITEABLE);
 
 		switch (val->var.subs[sub - 1]) {
diff --git a/contrib/bsnmp/snmpd/main.c b/contrib/bsnmp/snmpd/main.c
index a4ba7d760f05..a2053e889926 100644
--- a/contrib/bsnmp/snmpd/main.c
+++ b/contrib/bsnmp/snmpd/main.c
@@ -2324,13 +2324,12 @@ lm_load(const char *path, const char *section)
 	}
 	m->handle = NULL;
 	m->flags = 0;
-	strcpy(m->section, section);
+	strlcpy(m->section, section, sizeof(m->section));
 
-	if ((m->path = malloc(strlen(path) + 1)) == NULL) {
+	if ((m->path = strdup(path)) == NULL) {
 		syslog(LOG_ERR, "lm_load: %m");
 		goto err;
 	}
-	strcpy(m->path, path);
 
 	/*
 	 * Make index
diff --git a/contrib/bsnmp/snmpd/trans_lsock.c b/contrib/bsnmp/snmpd/trans_lsock.c
index 356fd50d18b1..a390839f524c 100644
--- a/contrib/bsnmp/snmpd/trans_lsock.c
+++ b/contrib/bsnmp/snmpd/trans_lsock.c
@@ -146,16 +146,14 @@ lsock_open_port(u_char *name, size_t namelen, struct lsock_port **pp,
 		return (SNMP_ERR_BADVALUE);
 	}
 
-	if ((port = malloc(sizeof(*port))) == NULL)
+	if ((port = calloc(1, sizeof(*port))) == NULL)
 		return (SNMP_ERR_GENERR);
 
-	memset(port, 0, sizeof(*port));
 	if (!is_stream) {
-		if ((peer = malloc(sizeof(*peer))) == NULL) {
+		if ((peer = calloc(1, sizeof(*peer))) == NULL) {
 			free(port);
 			return (SNMP_ERR_GENERR);
 		}
-		memset(peer, 0, sizeof(*peer));
 	}
 	if ((port->name = malloc(namelen + 1)) == NULL) {
 		free(port);
@@ -261,12 +259,11 @@ lsock_listen_input(int fd, void *udata)
 	struct lsock_port *p = udata;
 	struct lsock_peer *peer;
 
-	if ((peer = malloc(sizeof(*peer))) == NULL) {
+	if ((peer = calloc(1, sizeof(*peer))) == NULL) {
 		syslog(LOG_WARNING, "%s: peer malloc failed", p->name);
 		(void)close(accept(fd, NULL, NULL));
 		return;
 	}
-	memset(peer, 0, sizeof(*peer));
 
 	peer->port = p;
 
@@ -308,10 +305,9 @@ lsock_init_port(struct tport *tp)
 			return (SNMP_ERR_RES_UNAVAIL);
 		}
 
-		strcpy(sa.sun_path, p->name);
+		strlcpy(sa.sun_path, p->name, sizeof(sa.sun_path));
 		sa.sun_family = AF_LOCAL;
-		sa.sun_len = strlen(p->name) +
-		    offsetof(struct sockaddr_un, sun_path);
+		sa.sun_len = SUN_LEN(&sa);
 
 		(void)remove(p->name);
 
@@ -363,10 +359,9 @@ lsock_init_port(struct tport *tp)
 			return (SNMP_ERR_GENERR);
 		}
 
-		strcpy(sa.sun_path, p->name);
+		strlcpy(sa.sun_path, p->name, sizeof(sa.sun_path));
 		sa.sun_family = AF_LOCAL;
-		sa.sun_len = strlen(p->name) +
-		    offsetof(struct sockaddr_un, sun_path);
+		sa.sun_len = SUN_LEN(&sa);
 
 		(void)remove(p->name);
 
diff --git a/contrib/netbsd-tests/fs/tmpfs/h_tools.c b/contrib/netbsd-tests/fs/tmpfs/h_tools.c
index 9b35eecbd952..492e084d2a5c 100644
--- a/contrib/netbsd-tests/fs/tmpfs/h_tools.c
+++ b/contrib/netbsd-tests/fs/tmpfs/h_tools.c
@@ -244,13 +244,15 @@ sockets_main(int argc, char **argv)
 	}
 
 #ifdef	__FreeBSD__
-	addr.sun_len = sizeof(addr.sun_path);
-	(void)strlcpy(addr.sun_path, argv[1], addr.sun_len);
-#else
-	(void)strlcpy(addr.sun_path, argv[1], sizeof(addr.sun_path));
+	memset(&addr, 0, sizeof(addr));
 #endif
+	(void)strlcpy(addr.sun_path, argv[1], sizeof(addr.sun_path));
 	addr.sun_family = PF_UNIX;
+#ifdef	__FreeBSD__
+	error = bind(fd, (struct sockaddr *)&addr, SUN_LEN(&addr));
+#else
 	error = bind(fd, (struct sockaddr *)&addr, sizeof(addr));
+#endif
 	if (error == -1) {
 		warn("connect");
 #ifdef	__FreeBSD__
diff --git a/contrib/tcp_wrappers/scaffold.c b/contrib/tcp_wrappers/scaffold.c
index 8da9df0c6861..bef84675a7c7 100644
--- a/contrib/tcp_wrappers/scaffold.c
+++ b/contrib/tcp_wrappers/scaffold.c
@@ -235,16 +235,6 @@ struct request_info *request;
     exit(0);
 }
 
-/* dummy function  to intercept the real rfc931() */
-
-/* ARGSUSED */
-
-void    rfc931(request)
-struct request_info *request;
-{
-    strcpy(request->user, unknown);
-}
-
 /* check_path - examine accessibility */
 
 int     check_path(path, st)
diff --git a/contrib/tcp_wrappers/tcpd.h b/contrib/tcp_wrappers/tcpd.h
index af17c076ca3a..861d3389cbcb 100644
--- a/contrib/tcp_wrappers/tcpd.h
+++ b/contrib/tcp_wrappers/tcpd.h
@@ -6,6 +6,12 @@
   * $FreeBSD$
   */
 
+#ifdef INET6
+#define	TCPD_SOCKADDR struct sockaddr
+#else
+#define	TCPD_SOCKADDR struct sockaddr_in
+#endif
+
 /* Structure to describe one communications endpoint. */
 
 #define	STRING_LENGTH	128		/* hosts, users, processes */
@@ -13,11 +19,7 @@
 struct host_info {
     char    name[STRING_LENGTH];	/* access via eval_hostname(host) */
     char    addr[STRING_LENGTH];	/* access via eval_hostaddr(host) */
-#ifdef INET6
-    struct sockaddr *sin;		/* socket address or 0 */
-#else
-    struct sockaddr_in *sin;		/* socket address or 0 */
-#endif
+    TCPD_SOCKADDR *sin;			/* socket address or 0 */
     struct t_unitdata *unit;		/* TLI transport address or 0 */
     struct request_info *request;	/* for shared information */
 };
@@ -67,21 +69,22 @@ extern char paranoid[];
 /* Global functions. */
 
 #if defined(TLI) || defined(PTX) || defined(TLI_SEQUENT)
-extern void fromhost();			/* get/validate client host info */
+extern void fromhost(struct request_info *);	/* get/validate client host info */
 #else
-#define	fromhost sock_host		/* no TLI support needed */
+#define	fromhost sock_host			/* no TLI support needed */
 #endif
 
-extern int hosts_access();		/* access control */
-extern int hosts_ctl();			/* wrapper around request_init() */
-extern void shell_cmd();		/* execute shell command */
-extern char *percent_x();		/* do %<char> expansion */
-extern void rfc931();			/* client name from RFC 931 daemon */
-extern void clean_exit();		/* clean up and exit */
-extern void refuse();			/* clean up and exit */
-extern char *xgets();			/* fgets() on steroids */
-extern char *split_at();		/* strchr() and split */
-extern unsigned long dot_quad_addr();	/* restricted inet_addr() */
+extern int hosts_access(struct request_info *);				/* access control */
+extern int hosts_ctl(char *, char *, char *, char *);			/* wrapper around request_init() */
+extern void shell_cmd(char *);						/* execute shell command */
+extern char *percent_x(char *, int, char *, struct request_info *);	/* do %<char> expansion */
+extern void rfc931(TCPD_SOCKADDR *, TCPD_SOCKADDR *, char *);		/* client name from RFC 931 daemon */
+extern void clean_exit(struct request_info *);				/* clean up and exit */
+extern void refuse(struct request_info *);				/* clean up and exit */
+extern char *xgets(char *, int, FILE *);				/* fgets() on steroids */
+
+extern char *split_at(char *, int);					/* strchr() and split */
+extern unsigned long dot_quad_addr(char *);				/* restricted inet_addr() */
 
 /* Global variables. */
 
@@ -98,13 +101,8 @@ extern int resident;			/* > 0 if resident process */
   * attributes. Each attribute has its own key.
   */
 
-#ifdef __STDC__
-extern struct request_info *request_init(struct request_info *,...);
-extern struct request_info *request_set(struct request_info *,...);
-#else
-extern struct request_info *request_init();	/* initialize request */
-extern struct request_info *request_set();	/* update request structure */
-#endif
+extern struct request_info *request_init(struct request_info *,...);	/* initialize request */
+extern struct request_info *request_set(struct request_info *,...);	/* update request structure */
 
 #define	RQ_FILE		1		/* file descriptor */
 #define	RQ_DAEMON	2		/* server process (argv[0]) */
@@ -124,27 +122,27 @@ extern struct request_info *request_set();	/* update request structure */
   * host_info structures serve as caches for the lookup results.
   */
 
-extern char *eval_user();		/* client user */
-extern char *eval_hostname();		/* printable hostname */
-extern char *eval_hostaddr();		/* printable host address */
-extern char *eval_hostinfo();		/* host name or address */
-extern char *eval_client();		/* whatever is available */
-extern char *eval_server();		/* whatever is available */
+extern char *eval_user(struct request_info *);		/* client user */
+extern char *eval_hostname(struct host_info *);		/* printable hostname */
+extern char *eval_hostaddr(struct host_info *);		/* printable host address */
+extern char *eval_hostinfo(struct host_info *);		/* host name or address */
+extern char *eval_client(struct request_info *);	/* whatever is available */
+extern char *eval_server(struct request_info *);	/* whatever is available */
 #define	eval_daemon(r)	((r)->daemon)	/* daemon process name */
 #define	eval_pid(r)	((r)->pid)	/* process id */
 
 /* Socket-specific methods, including DNS hostname lookups. */
 
-extern void sock_host();		/* look up endpoint addresses */
-extern void sock_hostname();		/* translate address to hostname */
-extern void sock_hostaddr();		/* address to printable address */
+extern void sock_host(struct request_info *);		/* look up endpoint addresses */
+extern void sock_hostname(struct host_info *);		/* translate address to hostname */
+extern void sock_hostaddr(struct host_info *);		/* address to printable address */
 #define	sock_methods(r) \
 	{ (r)->hostname = sock_hostname; (r)->hostaddr = sock_hostaddr; }
 
 /* The System V Transport-Level Interface (TLI) interface. */
 
 #if defined(TLI) || defined(PTX) || defined(TLI_SEQUENT)
-extern void tli_host();			/* look up endpoint addresses etc. */
+extern void tli_host(struct request_info *);		/* look up endpoint addresses etc. */
 #endif
 
  /*
@@ -153,13 +151,8 @@ extern void tli_host();			/* look up endpoint addresses etc. */
   * everyone would have to include <setjmp.h>.
   */
 
-#ifdef __STDC__
 extern void tcpd_warn(char *, ...);	/* report problem and proceed */
 extern void tcpd_jump(char *, ...);	/* report problem and jump */
-#else
-extern void tcpd_warn();
-extern void tcpd_jump();
-#endif
 
 struct tcpd_context {
     char   *file;			/* current file */
@@ -185,42 +178,42 @@ extern struct tcpd_context tcpd_context;
   * behavior.
   */
 
-extern void process_options();		/* execute options */
-extern int dry_run;			/* verification flag */
+extern void process_options(char *, struct request_info *);	/* execute options */
+extern int dry_run;						/* verification flag */
 
 /* Bug workarounds. */
 
 #ifdef INET_ADDR_BUG			/* inet_addr() returns struct */
 #define	inet_addr fix_inet_addr
-extern long fix_inet_addr();
+extern long fix_inet_addr(char *);
 #endif
 
 #ifdef BROKEN_FGETS			/* partial reads from sockets */
 #define	fgets fix_fgets
-extern char *fix_fgets();
+extern char *fix_fgets(char *, int, FILE *);
 #endif
 
 #ifdef RECVFROM_BUG			/* no address family info */
 #define	recvfrom fix_recvfrom
-extern int fix_recvfrom();
+extern int fix_recvfrom(int, char *, int, int, struct sockaddr *, int *);
 #endif
 
 #ifdef GETPEERNAME_BUG			/* claims success with UDP */
 #define	getpeername fix_getpeername
-extern int fix_getpeername();
+extern int fix_getpeername(int, struct sockaddr *, int *);
 #endif
 
 #ifdef SOLARIS_24_GETHOSTBYNAME_BUG	/* lists addresses as aliases */
 #define	gethostbyname fix_gethostbyname
-extern struct hostent *fix_gethostbyname();
+extern struct hostent *fix_gethostbyname(char *);
 #endif
 
 #ifdef USE_STRSEP			/* libc calls strtok() */
 #define	strtok	fix_strtok
-extern char *fix_strtok();
+extern char *fix_strtok(char *, char *);
 #endif
 
 #ifdef LIBC_CALLS_STRTOK		/* libc calls strtok() */
 #define	strtok	my_strtok
-extern char *my_strtok();
+extern char *my_strtok(char *, char *);
 #endif
diff --git a/etc/mtree/BSD.tests.dist b/etc/mtree/BSD.tests.dist
index ea5791af17f5..620f95c04665 100644
--- a/etc/mtree/BSD.tests.dist
+++ b/etc/mtree/BSD.tests.dist
@@ -594,8 +594,8 @@
                 ..
             ..
         ..
-	bsdcat
-	..
+        bsdcat
+        ..
         calendar
         ..
         cmp
diff --git a/etc/mtree/BSD.var.dist b/etc/mtree/BSD.var.dist
index e6dfa507ad9e..e522549fffd0 100644
--- a/etc/mtree/BSD.var.dist
+++ b/etc/mtree/BSD.var.dist
@@ -28,7 +28,7 @@
 /set gname=wheel
     backups
     ..
-    cache		mode=0755
+    cache               mode=0755
     ..
     crash
     ..
diff --git a/lib/libproc/proc_sym.c b/lib/libproc/proc_sym.c
index fd8d3f928e4f..a3c5e554a347 100644
--- a/lib/libproc/proc_sym.c
+++ b/lib/libproc/proc_sym.c
@@ -143,10 +143,12 @@ load_symtab(Elf *e, struct symtab *symtab, u_long sh_type)
 	if (scn == NULL)
 		return (-1);
 
-	if ((symtab->data = elf_getdata(scn, NULL)) == NULL)
+	nsyms = shdr.sh_size / shdr.sh_entsize;
+	if (nsyms > (1 << 20))
 		return (-1);
 
-	nsyms = shdr.sh_size / shdr.sh_entsize;
+	if ((symtab->data = elf_getdata(scn, NULL)) == NULL)
+		return (-1);
 
 	symtab->index = calloc(nsyms, sizeof(u_int));
 	if (symtab->index == NULL)
diff --git a/sys/arm/conf/ARMADA38X b/sys/arm/conf/ARMADA38X
index aa5f23d4d152..80a798c6dcd9 100644
--- a/sys/arm/conf/ARMADA38X
+++ b/sys/arm/conf/ARMADA38X
@@ -37,6 +37,9 @@ device		vlan
 device		mii
 device		bpf
 device		re
+device		mdio
+device		etherswitch
+device		e6000sw
 
 # PCI
 device		pci
diff --git a/sys/boot/fdt/dts/arm/armada-385-db-ap.dts b/sys/boot/fdt/dts/arm/armada-385-db-ap.dts
new file mode 100644
index 000000000000..503a439b82ea
--- /dev/null
+++ b/sys/boot/fdt/dts/arm/armada-385-db-ap.dts
@@ -0,0 +1,271 @@
+/*
+ * Device Tree file for Marvell Armada 385 Access Point Development board
+ * (DB-88F6820-AP)
+ *
+ *  Copyright (C) 2014 Marvell
+ *
+ * Nadav Haklai <nadavh@marvell.com>
+ *
+ * This file is dual-licensed: you can use it either under the terms
+ * of the GPL or the X11 license, at your option. Note that this dual
+ * licensing only applies to this file, and not this project as a
+ * whole.
+ *
+ *  a) This file is licensed under the terms of the GNU General Public
+ *     License version 2.  This program is licensed "as is" without
+ *     any warranty of any kind, whether express or implied.
+ *
+ * Or, alternatively,
+ *
+ *  b) Permission is hereby granted, free of charge, to any person
+ *     obtaining a copy of this software and associated documentation
+ *     files (the "Software"), to deal in the Software without
+ *     restriction, including without limitation the rights to use,
+ *     copy, modify, merge, publish, distribute, sublicense, and/or
+ *     sell copies of the Software, and to permit persons to whom the
+ *     Software is furnished to do so, subject to the following
+ *     conditions:
+ *
+ *     The above copyright notice and this permission notice shall be
+ *     included in all copies or substantial portions of the Software.
+ *
+ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ *     OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * $FreeBSD$
+ */
+
+/dts-v1/;
+#include "armada-385.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	model = "Marvell Armada 385 Access Point Development Board";
+	compatible = "marvell,a385-db-ap", "marvell,armada385", "marvell,armada380";
+
+	chosen {
+		stdout-path = "serial1";
+	};
+
+	memory {
+		device_type = "memory";
+		reg = <0x00000000 0x80000000>; /* 2GB */
+	};
+
+	soc {
+		ranges = <MBUS_ID(0xf0, 0x01) 0 0xf1000000 0x100000>;
+
+		internal-regs {
+			i2c0: i2c@11000 {
+				pinctrl-names = "default";
+				pinctrl-0 = <&i2c0_pins>;
+				status = "okay";
+
+				/*
+				 * This bus is wired to two EEPROM
+				 * sockets, one of which holding the
+				 * board ID used by the	bootloader.
+				 * Erasing this EEPROM's content will
+				 * brick the board.
+				 * Use this bus with caution.
+				 */
+			};
+
+			mdio@72004 {
+				pinctrl-names = "default";
+				pinctrl-0 = <&mdio_pins>;
+
+				phy0: ethernet-phy@1 {
+					reg = <1>;
+				};
+
+				phy1: ethernet-phy@4 {
+					reg = <4>;
+				};
+
+				phy2: ethernet-phy@6 {
+					reg = <6>;
+				};
+			};
+
+			/* UART0 is exposed through the JP8 connector */
+			uart0: serial@12000 {
+				pinctrl-names = "default";
+				pinctrl-0 = <&uart0_pins>;
+				status = "okay";
+			};
+
+			/*
+			 * UART1 is exposed through a FTDI chip
+			 * wired to the mini-USB connector
+			 */
+			uart1: serial@12100 {
+				pinctrl-names = "default";
+				pinctrl-0 = <&uart1_pins>;
+				status = "okay";
+			};
+
+			pinctrl@18000 {
+				xhci0_vbus_pins: xhci0-vbus-pins {
+					marvell,pins = "mpp44";
+					marvell,function = "gpio";
+				};
+			};
+
+			/* CON3 */
+			ethernet@30000 {
+				status = "okay";
+				phy = <&phy2>;
+				phy-mode = "sgmii";
+				buffer-manager = <&bm>;
+				bm,pool-long = <1>;
+				bm,pool-short = <3>;
+			};
+
+			/* CON2 */
+			ethernet@34000 {
+				status = "okay";
+				phy = <&phy1>;
+				phy-mode = "sgmii";
+				buffer-manager = <&bm>;
+				bm,pool-long = <2>;
+				bm,pool-short = <3>;
+			};
+
+			usb@58000 {
+				status = "okay";
+			};
+
+			/* CON4 */
+			ethernet@70000 {
+				pinctrl-names = "default";
+
+				/*
+				 * The Reference Clock 0 is used to
+				 * provide a clock to the PHY
+				 */
+				pinctrl-0 = <&ge0_rgmii_pins>, <&ref_clk0_pins>;
+				status = "okay";
+				phy = <&phy0>;
+				phy-mode = "rgmii-id";
+				buffer-manager = <&bm>;
+				bm,pool-long = <0>;
+				bm,pool-short = <3>;
+			};
+
+			crypto@90000 {
+				status = "okay";
+			};
+
+			crypto@92000 {
+				status = "okay";
+			};
+
+			bm@c8000 {
+				status = "okay";
+			};
+
+			nfc: flash@d0000 {
+				status = "okay";
+				num-cs = <1>;
+				nand-ecc-strength = <4>;
+				nand-ecc-step-size = <512>;
+				marvell,nand-keep-config;
+				marvell,nand-enable-arbiter;
+				nand-on-flash-bbt;
+
+				partitions {
+					compatible = "fixed-partitions";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					partition@0 {
+						label = "U-Boot";
+						reg = <0x00000000 0x00800000>;
+						read-only;
+					};
+
+					partition@800000 {
+						label = "uImage";
+						reg = <0x00800000 0x00400000>;
+						read-only;
+					};
+
+					partition@c00000 {
+						label = "Root";
+						reg = <0x00c00000 0x3f400000>;
+					};
+				};
+			};
+
+			usb3@f0000 {
+				status = "okay";
+				usb-phy = <&usb3_phy>;
+			};
+		};
+
+		bm-bppi {
+			status = "okay";
+		};
+
+		pcie-controller {
+			status = "okay";
+
+			/*
+			 * The three PCIe units are accessible through
+			 * standard mini-PCIe slots on the board.
+			 */
+			pcie@1,0 {
+				/* Port 0, Lane 0 */
+				status = "okay";
+			};
+
+			pcie@2,0 {
+				/* Port 1, Lane 0 */
+				status = "okay";
+			};
+
+			pcie@3,0 {
+				/* Port 2, Lane 0 */
+				status = "okay";
+			};
+		};
+	};
+
+	usb3_phy: usb3_phy {
+		compatible = "usb-nop-xceiv";
+		vcc-supply = <&reg_xhci0_vbus>;
+	};
+
+	reg_xhci0_vbus: xhci0-vbus {
+		compatible = "regulator-fixed";
+		pinctrl-names = "default";
+		pinctrl-0 = <&xhci0_vbus_pins>;
+		regulator-name = "xhci0-vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		enable-active-high;
+		gpio = <&gpio1 12 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&spi1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi1_pins>;
+	status = "okay";
+
+	spi-flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "st,m25p128", "jedec,spi-nor";
+		reg = <0>; /* Chip select 0 */
+		spi-max-frequency = <54000000>;
+	};
+};
diff --git a/sys/boot/fdt/dts/arm/armada-388-clearfog.dts b/sys/boot/fdt/dts/arm/armada-388-clearfog.dts
new file mode 100644
index 000000000000..1319613b690f
--- /dev/null
+++ b/sys/boot/fdt/dts/arm/armada-388-clearfog.dts
@@ -0,0 +1,463 @@
+/*
+ * Device Tree file for SolidRun Clearfog revision A1 rev 2.0 (88F6828)
+ *
+ *  Copyright (C) 2015 Russell King
+ *
+ * This board is in development; the contents of this file work with
+ * the A1 rev 2.0 of the board, which does not represent final
+ * production board.  Things will change, don't expect this file to
+ * remain compatible info the future.
+ *
+ * This file is dual-licensed: you can use it either under the terms
+ * of the GPL or the X11 license, at your option. Note that this dual
+ * licensing only applies to this file, and not this project as a
+ * whole.
+ *
+ *  a) This file is free software; you can redistribute it and/or
+ *     modify it under the terms of the GNU General Public License
+ *     version 2 as published by the Free Software Foundation.
+ *
+ *     This file is distributed in the hope that it will be useful
+ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *     GNU General Public License for more details.
+ *
+ * Or, alternatively
+ *
+ *  b) Permission is hereby granted, free of charge, to any person
+ *     obtaining a copy of this software and associated documentation
+ *     files (the "Software"), to deal in the Software without
+ *     restriction, including without limitation the rights to use
+ *     copy, modify, merge, publish, distribute, sublicense, and/or
+ *     sell copies of the Software, and to permit persons to whom the
+ *     Software is furnished to do so, subject to the following
+ *     conditions:
+ *
+ *     The above copyright notice and this permission notice shall be
+ *     included in all copies or substantial portions of the Software.
+ *
+ *     THE SOFTWARE IS PROVIDED , WITHOUT WARRANTY OF ANY KIND
+ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY
+ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ *     OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * $FreeBSD$
+ */
+
+/dts-v1/;
+#include "armada-388.dtsi"
+#include "armada-38x-solidrun-microsom.dtsi"
+
+/ {
+	model = "SolidRun Clearfog A1";
+	compatible = "solidrun,clearfog-a1", "marvell,armada388",
+		"marvell,armada385", "marvell,armada380";
+
+	aliases {
+		/* So that mvebu u-boot can update the MAC addresses */
+		ethernet1 = &eth0;
+		ethernet2 = &eth1;
+		ethernet3 = &eth2;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "3P3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-always-on;
+	};
+
+	soc {
+		internal-regs {
+			ethernet@30000 {
+				phy-mode = "sgmii";
+				buffer-manager = <&bm>;
+				bm,pool-long = <2>;
+				bm,pool-short = <1>;
+				status = "okay";
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+
+			ethernet@34000 {
+				phy-mode = "sgmii";
+				buffer-manager = <&bm>;
+				bm,pool-long = <3>;
+				bm,pool-short = <1>;
+				status = "okay";
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+
+			i2c@11000 {
+				/* Is there anything on this? */
+				clock-frequency = <100000>;
+				pinctrl-0 = <&i2c0_pins>;
+				pinctrl-names = "default";
+				status = "okay";
+
+				/*
+				 * PCA9655 GPIO expander, up to 1MHz clock.
+				 *  0-CON3 CLKREQ#
+				 *  1-CON3 PERST#
+				 *  2-CON2 PERST#
+				 *  3-CON3 W_DISABLE
+				 *  4-CON2 CLKREQ#
+				 *  5-USB3 overcurrent
+				 *  6-USB3 power
+				 *  7-CON2 W_DISABLE
+				 *  8-JP4 P1
+				 *  9-JP4 P4
+				 * 10-JP4 P5
+				 * 11-m.2 DEVSLP
+				 * 12-SFP_LOS
+				 * 13-SFP_TX_FAULT
+				 * 14-SFP_TX_DISABLE
+				 * 15-SFP_MOD_DEF0
+				 */
+				expander0: gpio-expander@20 {
+					/*
+					 * This is how it should be:
+					 * compatible = "onnn,pca9655",
+					 *	 "nxp,pca9555";
+					 * but you can't do this because of
+					 * the way I2C works.
+					 */
+					compatible = "nxp,pca9555";
+					gpio-controller;
+					#gpio-cells = <2>;
+					reg = <0x20>;
+
+					pcie1_0_clkreq {
+						gpio-hog;
+						gpios = <0 GPIO_ACTIVE_LOW>;
+						input;
+						line-name = "pcie1.0-clkreq";
+					};
+					pcie1_0_w_disable {
+						gpio-hog;
+						gpios = <3 GPIO_ACTIVE_LOW>;
+						output-low;
+						line-name = "pcie1.0-w-disable";
+					};
+					pcie2_0_clkreq {
+						gpio-hog;
+						gpios = <4 GPIO_ACTIVE_LOW>;
+						input;
+						line-name = "pcie2.0-clkreq";
+					};
+					pcie2_0_w_disable {
+						gpio-hog;
+						gpios = <7 GPIO_ACTIVE_LOW>;
+						output-low;
+						line-name = "pcie2.0-w-disable";
+					};
+					usb3_ilimit {
+						gpio-hog;
+						gpios = <5 GPIO_ACTIVE_LOW>;
+						input;
+						line-name = "usb3-current-limit";
+					};
+					usb3_power {
+						gpio-hog;
+						gpios = <6 GPIO_ACTIVE_HIGH>;
+						output-high;
+						line-name = "usb3-power";
+					};
+					m2_devslp {
+						gpio-hog;
+						gpios = <11 GPIO_ACTIVE_HIGH>;
+						output-low;
+						line-name = "m.2 devslp";
+					};
+					sfp_los {
+						/* SFP loss of signal */
+						gpio-hog;
+						gpios = <12 GPIO_ACTIVE_HIGH>;
+						input;
+						line-name = "sfp-los";
+					};
+					sfp_tx_fault {
+						/* SFP laser fault */
+						gpio-hog;
+						gpios = <13 GPIO_ACTIVE_HIGH>;
+						input;
+						line-name = "sfp-tx-fault";
+					};
+					sfp_tx_disable {
+						/* SFP transmit disable */
+						gpio-hog;
+						gpios = <14 GPIO_ACTIVE_HIGH>;
+						output-low;
+						line-name = "sfp-tx-disable";
+					};
+					sfp_mod_def0 {
+						/* SFP module present */
+						gpio-hog;
+						gpios = <15 GPIO_ACTIVE_LOW>;
+						input;
+						line-name = "sfp-mod-def0";
+					};
+				};
+
+				/* The MCP3021 is 100kHz clock only */
+				mikrobus_adc: mcp3021@4c {
+					compatible = "microchip,mcp3021";
+					reg = <0x4c>;
+				};
+
+				/* Also something at 0x64 */
+			};
+
+			i2c@11100 {
+				/*
+				 * Routed to SFP, mikrobus, and PCIe.
+				 * SFP limits this to 100kHz, and requires
+				 *  an AT24C01A/02/04 with address pins tied
+				 *  low, which takes addresses 0x50 and 0x51.
+				 * Mikrobus doesn't specify beyond an I2C
+				 *  bus being present.
+				 * PCIe uses ARP to assign addresses, or
+				 *  0x63-0x64.
+				 */
+				clock-frequency = <100000>;
+				pinctrl-0 = <&clearfog_i2c1_pins>;
+				pinctrl-names = "default";
+				status = "okay";
+			};
+
+			pinctrl@18000 {
+				clearfog_dsa0_clk_pins: clearfog-dsa0-clk-pins {
+					marvell,pins = "mpp46";
+					marvell,function = "ref";
+				};
+				clearfog_dsa0_pins: clearfog-dsa0-pins {
+					marvell,pins = "mpp23", "mpp41";
+					marvell,function = "gpio";
+				};
+				clearfog_i2c1_pins: i2c1-pins {
+					/* SFP, PCIe, mSATA, mikrobus */
+					marvell,pins = "mpp26", "mpp27";
+					marvell,function = "i2c1";
+				};
+				clearfog_sdhci_cd_pins: clearfog-sdhci-cd-pins {
+					marvell,pins = "mpp20";
+					marvell,function = "gpio";
+				};
+				clearfog_sdhci_pins: clearfog-sdhci-pins {
+					marvell,pins = "mpp21", "mpp28",
+						       "mpp37", "mpp38",
+						       "mpp39", "mpp40";
+					marvell,function = "sd0";
+				};
+				clearfog_spi1_cs_pins: spi1-cs-pins {
+					marvell,pins = "mpp55";
+					marvell,function = "spi1";
+				};
+				mikro_pins: mikro-pins {
+					/* int: mpp22 rst: mpp29 */
+					marvell,pins = "mpp22", "mpp29";
+					marvell,function = "gpio";
+				};
+				mikro_spi_pins: mikro-spi-pins {
+					marvell,pins = "mpp43";
+					marvell,function = "spi1";
+				};
+				mikro_uart_pins: mikro-uart-pins {
+					marvell,pins = "mpp24", "mpp25";
+					marvell,function = "ua1";
+				};
+				rear_button_pins: rear-button-pins {
+					marvell,pins = "mpp34";
+					marvell,function = "gpio";
+				};
+			};
+
+			sata@a8000 {
+				/* pinctrl? */
+				status = "okay";
+			};
+
+			sata@e0000 {
+				/* pinctrl? */
+				status = "okay";
+			};
+
+			sdhci@d8000 {
+				bus-width = <4>;
+				cd-gpios = <&gpio0 20 GPIO_ACTIVE_LOW>;
+				no-1-8-v;
+				pinctrl-0 = <&clearfog_sdhci_pins
+					     &clearfog_sdhci_cd_pins>;
+				pinctrl-names = "default";
+				status = "okay";
+				vmmc = <&reg_3p3v>;
+				wp-inverted;
+			};
+
+			serial@12100 {
+				/* mikrobus uart */
+				pinctrl-0 = <&mikro_uart_pins>;
+				pinctrl-names = "default";
+				status = "okay";
+			};
+
+			usb@58000 {
+				/* CON3, nearest  power. */
+				status = "okay";
+			};
+
+			crypto@90000 {
+				status = "okay";
+			};
+
+			crypto@92000 {
+				status = "okay";
+			};
+
+			usb3@f0000 {
+				/* CON2, nearest CPU, USB2 only. */
+				status = "okay";
+			};
+
+			usb3@f8000 {
+				/* CON7 */
+				status = "okay";
+			};
+		};
+
+		pcie-controller {
+			status = "okay";
+			/*
+			 * The two PCIe units are accessible through
+			 * the mini-PCIe connectors on the board.
+			 */
+			pcie@2,0 {
+				/* Port 1, Lane 0. CON3, nearest power. */
+				reset-gpios = <&expander0 1 GPIO_ACTIVE_LOW>;
+				status = "okay";
+			};
+			pcie@3,0 {
+				/* Port 2, Lane 0. CON2, nearest CPU. */
+				reset-gpios = <&expander0 2 GPIO_ACTIVE_LOW>;
+				status = "okay";
+			};
+		};
+	};
+
+	dsa@0 {
+		compatible = "marvell,dsa";
+		dsa,ethernet = <&eth1>;
+		dsa,mii-bus = <&mdio>;
+		pinctrl-0 = <&clearfog_dsa0_clk_pins &clearfog_dsa0_pins>;
+		pinctrl-names = "default";
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		switch@0 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <4 0>;
+
+			port@0 {
+				reg = <0>;
+				label = "lan5";
+				vlangroup = <0>;
+			};
+
+			port@1 {
+				reg = <1>;
+				label = "lan4";
+				vlangroup = <0>;
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan3";
+				vlangroup = <0>;
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan2";
+				vlangroup = <0>;
+			};
+
+			port@4 {
+				reg = <4>;
+				label = "lan1";
+				vlangroup = <0>;
+			};
+
+			port@5 {
+				reg = <5>;
+				label = "cpu";
+				vlangroup = <0>;
+			};
+
+			port@6 {
+				/* 88E1512 external phy */
+				reg = <6>;
+				label = "lan6";
+				vlangroup = <0>;
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&rear_button_pins>;
+		pinctrl-names = "default";
+
+		button_0 {
+			/* The rear SW3 button */
+			label = "Rear Button";
+			gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
+			linux,can-disable;
+			linux,code = <BTN_0>;
+		};
+	};
+};
+
+&spi1 {
+	/*
+	 * We don't seem to have the W25Q32 on the
+	 * A1 Rev 2.0 boards, so disable SPI.
+	 * CS0: W25Q32 (doesn't appear to be present)
+	 * CS1:
+	 * CS2: mikrobus
+	 */
+	pinctrl-0 = <&spi1_pins
+		     &clearfog_spi1_cs_pins
+		     &mikro_spi_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	spi-flash@0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "w25q32", "jedec,spi-nor";
+		reg = <0>; /* Chip select 0 */
+		spi-max-frequency = <3000000>;
+		status = "disabled";
+	};
+};
diff --git a/sys/boot/fdt/dts/arm/armada-38x-solidrun-microsom.dtsi b/sys/boot/fdt/dts/arm/armada-38x-solidrun-microsom.dtsi
new file mode 100644
index 000000000000..bc82f4f0d627
--- /dev/null
+++ b/sys/boot/fdt/dts/arm/armada-38x-solidrun-microsom.dtsi
@@ -0,0 +1,126 @@
+/*
+ * Device Tree file for SolidRun Armada 38x Microsom
+ *
+ *  Copyright (C) 2015 Russell King
+ *
+ * This board is in development; the contents of this file work with
+ * the A1 rev 2.0 of the board, which does not represent final
+ * production board.  Things will change, don't expect this file to
+ * remain compatible info the future.
+ *
+ * This file is dual-licensed: you can use it either under the terms
+ * of the GPL or the X11 license, at your option. Note that this dual
+ * licensing only applies to this file, and not this project as a
+ * whole.
+ *
+ *  a) This file is free software; you can redistribute it and/or
+ *     modify it under the terms of the GNU General Public License
+ *     version 2 as published by the Free Software Foundation.
+ *
+ *     This file is distributed in the hope that it will be useful
+ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *     GNU General Public License for more details.
+ *
+ * Or, alternatively
+ *
+ *  b) Permission is hereby granted, free of charge, to any person
+ *     obtaining a copy of this software and associated documentation
+ *     files (the "Software"), to deal in the Software without
+ *     restriction, including without limitation the rights to use
+ *     copy, modify, merge, publish, distribute, sublicense, and/or
+ *     sell copies of the Software, and to permit persons to whom the
+ *     Software is furnished to do so, subject to the following
+ *     conditions:
+ *
+ *     The above copyright notice and this permission notice shall be
+ *     included in all copies or substantial portions of the Software.
+ *
+ *     THE SOFTWARE IS PROVIDED , WITHOUT WARRANTY OF ANY KIND
+ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY
+ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ *     OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * $FreeBSD$
+ */
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	memory {
+		device_type = "memory";
+		reg = <0x00000000 0x10000000>; /* 256 MB */
+	};
+
+	soc {
+		ranges = <MBUS_ID(0xf0, 0x01) 0 0xf1000000 0x100000>;
+
+		internal-regs {
+			ethernet@70000 {
+				pinctrl-0 = <&ge0_rgmii_pins>;
+				pinctrl-names = "default";
+				phy = <&phy_dedicated>;
+				phy-mode = "rgmii-id";
+				buffer-manager = <&bm>;
+				bm,pool-long = <0>;
+				bm,pool-short = <1>;
+				status = "okay";
+			};
+
+			mdio@72004 {
+				/*
+				 * Add the phy clock here, so the phy can be
+				 * accessed to read its IDs prior to binding
+				 * with the driver.
+				 */
+				pinctrl-0 = <&mdio_pins &microsom_phy_clk_pins>;
+				pinctrl-names = "default";
+
+				phy_dedicated: ethernet-phy@0 {
+					/*
+					 * Annoyingly, the marvell phy driver
+					 * configures the LED register, rather
+					 * than preserving reset-loaded setting.
+					 * We undo that rubbish here.
+					 */
+					marvell,reg-init = <3 16 0 0x101e>;
+					reg = <0>;
+				};
+			};
+
+			pinctrl@18000 {
+				microsom_phy_clk_pins: microsom-phy-clk-pins {
+					marvell,pins = "mpp45";
+					marvell,function = "ref";
+				};
+			};
+
+			rtc@a3800 {
+				/*
+				 * If the rtc doesn't work, run "date reset"
+				 * twice in u-boot.
+				 */
+				status = "okay";
+			};
+
+			serial@12000 {
+				pinctrl-0 = <&uart0_pins>;
+				pinctrl-names = "default";
+				status = "okay";
+			};
+
+			bm@c8000 {
+				status = "okay";
+			};
+		};
+
+		bm-bppi {
+			status = "okay";
+		};
+
+	};
+};
diff --git a/sys/boot/fdt/dts/arm/armada-38x.dtsi b/sys/boot/fdt/dts/arm/armada-38x.dtsi
index 736d41ae8aba..c4673ecc4d09 100644
--- a/sys/boot/fdt/dts/arm/armada-38x.dtsi
+++ b/sys/boot/fdt/dts/arm/armada-38x.dtsi
@@ -154,7 +154,8 @@
 
 			crypto@90000 {
 				compatible = "mrvl,cesa";
-				reg = <0x90000 0x10000>;
+				reg = <0x90000 0x1000   /* tdma base reg chan 0 */
+				       0x9D000 0x1000>;	/* cesa base reg chan 0 */
 				interrupts = <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>;
 				interrupt-parent = <&gic>;
 				sram-handle = <&SRAM0>;
@@ -562,6 +563,14 @@
 				status = "disabled";
 			};
 
+			bm: bm@c8000 {
+				compatible = "marvell,armada-380-neta-bm";
+				reg = <0xc8000 0xac>;
+				clocks = <&gateclk 13>;
+				internal-mem = <&bm_bppi>;
+				status = "disabled";
+			};
+
 			sata@e0000 {
 				compatible = "marvell,armada-380-ahci";
 				reg = <0xe0000 0x2000>;
@@ -622,6 +631,17 @@
 				status = "disabled";
 			};
 		};
+
+		bm_bppi: bm-bppi {
+			compatible = "mmio-sram";
+			reg = <MBUS_ID(0x0c, 0x04) 0 0x100000>;
+			ranges = <0 MBUS_ID(0x0c, 0x04) 0 0x100000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			clocks = <&gateclk 13>;
+			no-memory-wc;
+			status = "disabled";
+		};
 	};
 
 	pci0: pcie@f1080000 {
diff --git a/sys/boot/mips/beri/boot2/Makefile b/sys/boot/mips/beri/boot2/Makefile
index f9950a96b875..46af76298e96 100644
--- a/sys/boot/mips/beri/boot2/Makefile
+++ b/sys/boot/mips/beri/boot2/Makefile
@@ -71,7 +71,7 @@ LDFLAGS=	-nostdlib			\
 CFLAGS+=	-I${.CURDIR}/../common
 
 flashboot.elf: relocate.o start.o boot2.o altera_jtag_uart.o cfi.o sdcard.o
-	${LD} ${_LDFLAGS} -T ${.CURDIR}/flashboot.ldscript -o ${.TARGET}	\
+	${CC} ${_LDFLAGS} -T ${.CURDIR}/flashboot.ldscript -o ${.TARGET}	\
 	    ${.ALLSRC} ${LIBSTAND}
 flashboot: flashboot.elf
 	${OBJCOPY} -S -O binary ${.TARGET}.elf ${.TARGET}
@@ -79,7 +79,7 @@ flashboot.md5: flashboot
 	md5 flashboot > flashboot.md5
 
 jtagboot: start.o boot2.o altera_jtag_uart.o cfi.o sdcard.o
-	${LD} ${_LDFLAGS} -T ${.CURDIR}/jtagboot.ldscript -o ${.TARGET}	\
+	${CC} ${_LDFLAGS} -T ${.CURDIR}/jtagboot.ldscript -o ${.TARGET}	\
 	    ${.ALLSRC} ${LIBSTAND}
 jtagboot.md5: jtagboot
 	md5 jtagboot > jtagboot.md5
diff --git a/sys/boot/mips/beri/common/common.ldscript b/sys/boot/mips/beri/common/common.ldscript
index ac3b07601298..6266646cfc3c 100644
--- a/sys/boot/mips/beri/common/common.ldscript
+++ b/sys/boot/mips/beri/common/common.ldscript
@@ -73,5 +73,4 @@ __cheri_sdcard_vaddr__ = __mips64_xkphys_uncached__ + __cheri_sdcard_base__;
 __kernel_base__ = 0x100000;
 __kernel_vaddr__ = __mips64_xkphys_cached__ + __kernel_base__;
 
-OUTPUT_FORMAT("elf64-tradbigmips");
 OUTPUT_ARCH(mips)
diff --git a/sys/boot/mips/beri/loader/loader.ldscript b/sys/boot/mips/beri/loader/loader.ldscript
index f3d286ae61e4..deb4865c28ee 100644
--- a/sys/boot/mips/beri/loader/loader.ldscript
+++ b/sys/boot/mips/beri/loader/loader.ldscript
@@ -44,7 +44,6 @@ __loader_base_vaddr__ = __mips64_xkphys_cached__ + __loader_base__;
 __loader_end__ = 0x100000;
 __loader_end_vaddr__ = __mips64_xkphys_cached__ + __loader_end__;
 
-OUTPUT_FORMAT("elf64-tradbigmips");
 OUTPUT_ARCH(mips)
 ENTRY(start)
 SECTIONS
diff --git a/sys/cam/ctl/ctl_ha.c b/sys/cam/ctl/ctl_ha.c
index f1f5b8c58a4f..d7f21c7a74b6 100644
--- a/sys/cam/ctl/ctl_ha.c
+++ b/sys/cam/ctl/ctl_ha.c
@@ -443,8 +443,9 @@ ctl_ha_connect(struct ha_softc *softc)
 
 	memcpy(&sa, &softc->ha_peer_in, sizeof(sa));
 	error = soconnect(so, (struct sockaddr *)&sa, td);
-	if (error != 0 && bootverbose) {
-		printf("%s: soconnect() error %d\n", __func__, error);
+	if (error != 0) {
+		if (bootverbose)
+			printf("%s: soconnect() error %d\n", __func__, error);
 		goto out;
 	}
 	return (0);
diff --git a/sys/compat/freebsd32/freebsd32_misc.c b/sys/compat/freebsd32/freebsd32_misc.c
index e6463f708525..b491a85a27c0 100644
--- a/sys/compat/freebsd32/freebsd32_misc.c
+++ b/sys/compat/freebsd32/freebsd32_misc.c
@@ -244,7 +244,8 @@ copy_statfs(struct statfs *in, struct statfs32 *out)
 
 #ifdef COMPAT_FREEBSD4
 int
-freebsd4_freebsd32_getfsstat(struct thread *td, struct freebsd4_freebsd32_getfsstat_args *uap)
+freebsd4_freebsd32_getfsstat(struct thread *td,
+    struct freebsd4_freebsd32_getfsstat_args *uap)
 {
 	struct statfs *buf, *sp;
 	struct statfs32 stat32;
@@ -264,7 +265,7 @@ freebsd4_freebsd32_getfsstat(struct thread *td, struct freebsd4_freebsd32_getfss
 			uap->buf++;
 			copycount--;
 		}
-		free(buf, M_TEMP);
+		free(buf, M_STATFS);
 	}
 	if (error == 0)
 		td->td_retval[0] = count;
@@ -1393,14 +1394,17 @@ int
 freebsd4_freebsd32_statfs(struct thread *td, struct freebsd4_freebsd32_statfs_args *uap)
 {
 	struct statfs32 s32;
-	struct statfs s;
+	struct statfs *sp;
 	int error;
 
-	error = kern_statfs(td, uap->path, UIO_USERSPACE, &s);
-	if (error)
-		return (error);
-	copy_statfs(&s, &s32);
-	return (copyout(&s32, uap->buf, sizeof(s32)));
+	sp = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_statfs(td, uap->path, UIO_USERSPACE, sp);
+	if (error == 0) {
+		copy_statfs(sp, &s32);
+		error = copyout(&s32, uap->buf, sizeof(s32));
+	}
+	free(sp, M_STATFS);
+	return (error);
 }
 #endif
 
@@ -1409,14 +1413,17 @@ int
 freebsd4_freebsd32_fstatfs(struct thread *td, struct freebsd4_freebsd32_fstatfs_args *uap)
 {
 	struct statfs32 s32;
-	struct statfs s;
+	struct statfs *sp;
 	int error;
 
-	error = kern_fstatfs(td, uap->fd, &s);
-	if (error)
-		return (error);
-	copy_statfs(&s, &s32);
-	return (copyout(&s32, uap->buf, sizeof(s32)));
+	sp = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_fstatfs(td, uap->fd, sp);
+	if (error == 0) {
+		copy_statfs(sp, &s32);
+		error = copyout(&s32, uap->buf, sizeof(s32));
+	}
+	free(sp, M_STATFS);
+	return (error);
 }
 #endif
 
@@ -1425,17 +1432,20 @@ int
 freebsd4_freebsd32_fhstatfs(struct thread *td, struct freebsd4_freebsd32_fhstatfs_args *uap)
 {
 	struct statfs32 s32;
-	struct statfs s;
+	struct statfs *sp;
 	fhandle_t fh;
 	int error;
 
 	if ((error = copyin(uap->u_fhp, &fh, sizeof(fhandle_t))) != 0)
 		return (error);
-	error = kern_fhstatfs(td, fh, &s);
-	if (error)
-		return (error);
-	copy_statfs(&s, &s32);
-	return (copyout(&s32, uap->buf, sizeof(s32)));
+	sp = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_fhstatfs(td, fh, sp);
+	if (error == 0) {
+		copy_statfs(sp, &s32);
+		error = copyout(&s32, uap->buf, sizeof(s32));
+	}
+	free(sp, M_STATFS);
+	return (error);
 }
 #endif
 
diff --git a/sys/compat/linux/linux_stats.c b/sys/compat/linux/linux_stats.c
index 3638c6be1ca0..f74fa803cb41 100644
--- a/sys/compat/linux/linux_stats.c
+++ b/sys/compat/linux/linux_stats.c
@@ -415,7 +415,7 @@ int
 linux_statfs(struct thread *td, struct linux_statfs_args *args)
 {
 	struct l_statfs linux_statfs;
-	struct statfs bsd_statfs;
+	struct statfs *bsd_statfs;
 	char *path;
 	int error;
 
@@ -425,12 +425,13 @@ linux_statfs(struct thread *td, struct linux_statfs_args *args)
 	if (ldebug(statfs))
 		printf(ARGS(statfs, "%s, *"), path);
 #endif
-	error = kern_statfs(td, path, UIO_SYSSPACE, &bsd_statfs);
+	bsd_statfs = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_statfs(td, path, UIO_SYSSPACE, bsd_statfs);
 	LFREEPATH(path);
-	if (error)
-		return (error);
-	error = bsd_to_linux_statfs(&bsd_statfs, &linux_statfs);
-	if (error)
+	if (error == 0)
+		error = bsd_to_linux_statfs(bsd_statfs, &linux_statfs);
+	free(bsd_statfs, M_STATFS);
+	if (error != 0)
 		return (error);
 	return (copyout(&linux_statfs, args->buf, sizeof(linux_statfs)));
 }
@@ -456,7 +457,7 @@ int
 linux_statfs64(struct thread *td, struct linux_statfs64_args *args)
 {
 	struct l_statfs64 linux_statfs;
-	struct statfs bsd_statfs;
+	struct statfs *bsd_statfs;
 	char *path;
 	int error;
 
@@ -469,11 +470,14 @@ linux_statfs64(struct thread *td, struct linux_statfs64_args *args)
 	if (ldebug(statfs64))
 		printf(ARGS(statfs64, "%s, *"), path);
 #endif
-	error = kern_statfs(td, path, UIO_SYSSPACE, &bsd_statfs);
+	bsd_statfs = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_statfs(td, path, UIO_SYSSPACE, bsd_statfs);
 	LFREEPATH(path);
-	if (error)
+	if (error == 0)
+		bsd_to_linux_statfs64(bsd_statfs, &linux_statfs);
+	free(bsd_statfs, M_STATFS);
+	if (error != 0)
 		return (error);
-	bsd_to_linux_statfs64(&bsd_statfs, &linux_statfs);
 	return (copyout(&linux_statfs, args->buf, sizeof(linux_statfs)));
 }
 
@@ -481,7 +485,7 @@ int
 linux_fstatfs64(struct thread *td, struct linux_fstatfs64_args *args)
 {
 	struct l_statfs64 linux_statfs;
-	struct statfs bsd_statfs;
+	struct statfs *bsd_statfs;
 	int error;
 
 #ifdef DEBUG
@@ -491,10 +495,13 @@ linux_fstatfs64(struct thread *td, struct linux_fstatfs64_args *args)
 	if (args->bufsize != sizeof(struct l_statfs64))
 		return (EINVAL);
 
-	error = kern_fstatfs(td, args->fd, &bsd_statfs);
-	if (error)
-		return error;
-	bsd_to_linux_statfs64(&bsd_statfs, &linux_statfs);
+	bsd_statfs = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_fstatfs(td, args->fd, bsd_statfs);
+	if (error == 0)
+		bsd_to_linux_statfs64(bsd_statfs, &linux_statfs);
+	free(bsd_statfs, M_STATFS);
+	if (error != 0)
+		return (error);
 	return (copyout(&linux_statfs, args->buf, sizeof(linux_statfs)));
 }
 #endif /* __i386__ || (__amd64__ && COMPAT_LINUX32) */
@@ -503,18 +510,19 @@ int
 linux_fstatfs(struct thread *td, struct linux_fstatfs_args *args)
 {
 	struct l_statfs linux_statfs;
-	struct statfs bsd_statfs;
+	struct statfs *bsd_statfs;
 	int error;
 
 #ifdef DEBUG
 	if (ldebug(fstatfs))
 		printf(ARGS(fstatfs, "%d, *"), args->fd);
 #endif
-	error = kern_fstatfs(td, args->fd, &bsd_statfs);
-	if (error)
-		return (error);
-	error = bsd_to_linux_statfs(&bsd_statfs, &linux_statfs);
-	if (error)
+	bsd_statfs = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_fstatfs(td, args->fd, bsd_statfs);
+	if (error == 0)
+		error = bsd_to_linux_statfs(bsd_statfs, &linux_statfs);
+	free(bsd_statfs, M_STATFS);
+	if (error != 0)
 		return (error);
 	return (copyout(&linux_statfs, args->buf, sizeof(linux_statfs)));
 }
diff --git a/sys/compat/svr4/svr4_misc.c b/sys/compat/svr4/svr4_misc.c
index aaed81f42289..46be42c1933a 100644
--- a/sys/compat/svr4/svr4_misc.c
+++ b/sys/compat/svr4/svr4_misc.c
@@ -1430,17 +1430,20 @@ svr4_sys_statvfs(td, uap)
 	struct svr4_sys_statvfs_args *uap;
 {
 	struct svr4_statvfs sfs;
-	struct statfs bfs;
+	struct statfs *bfs;
 	char *path;
 	int error;
 
 	CHECKALTEXIST(td, uap->path, &path);
 
-	error = kern_statfs(td, path, UIO_SYSSPACE, &bfs);
+	bfs = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_statfs(td, path, UIO_SYSSPACE, bfs);
 	free(path, M_TEMP);
-	if (error)
+	if (error == 0)
+		bsd_statfs_to_svr4_statvfs(bfs, &sfs);
+	free(bfs, M_STATFS);
+	if (error != 0)
 		return (error);
-	bsd_statfs_to_svr4_statvfs(&bfs, &sfs);
 	return copyout(&sfs, uap->fs, sizeof(sfs));
 }
 
@@ -1451,13 +1454,16 @@ svr4_sys_fstatvfs(td, uap)
 	struct svr4_sys_fstatvfs_args *uap;
 {
 	struct svr4_statvfs sfs;
-	struct statfs bfs;
+	struct statfs *bfs;
 	int error;
 
-	error = kern_fstatfs(td, uap->fd, &bfs);
-	if (error)
+	bfs = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_fstatfs(td, uap->fd, bfs);
+	if (error == 0)
+		bsd_statfs_to_svr4_statvfs(bfs, &sfs);
+	free(bfs, M_STATFS);
+	if (error != 0)
 		return (error);
-	bsd_statfs_to_svr4_statvfs(&bfs, &sfs);
 	return copyout(&sfs, uap->fs, sizeof(sfs));
 }
 
@@ -1468,17 +1474,20 @@ svr4_sys_statvfs64(td, uap)
 	struct svr4_sys_statvfs64_args *uap;
 {
 	struct svr4_statvfs64 sfs;
-	struct statfs bfs;
+	struct statfs *bfs;
 	char *path;
 	int error;
 
 	CHECKALTEXIST(td, uap->path, &path);
 
-	error = kern_statfs(td, path, UIO_SYSSPACE, &bfs);
+	bfs = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_statfs(td, path, UIO_SYSSPACE, bfs);
 	free(path, M_TEMP);
-	if (error)
+	if (error == 0)
+		bsd_statfs_to_svr4_statvfs64(bfs, &sfs);
+	free(bfs, M_STATFS);
+	if (error != 0)
 		return (error);
-	bsd_statfs_to_svr4_statvfs64(&bfs, &sfs);
 	return copyout(&sfs, uap->fs, sizeof(sfs));
 }
 
@@ -1489,13 +1498,16 @@ svr4_sys_fstatvfs64(td, uap)
 	struct svr4_sys_fstatvfs64_args *uap;
 {
 	struct svr4_statvfs64 sfs;
-	struct statfs bfs;
+	struct statfs *bfs;
 	int error;
 
-	error = kern_fstatfs(td, uap->fd, &bfs);
-	if (error)
+	bfs = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_fstatfs(td, uap->fd, bfs);
+	if (error == 0)
+		bsd_statfs_to_svr4_statvfs64(bfs, &sfs);
+	free(bfs, M_STATFS);
+	if (error != 0)
 		return (error);
-	bsd_statfs_to_svr4_statvfs64(&bfs, &sfs);
 	return copyout(&sfs, uap->fs, sizeof(sfs));
 }
 
diff --git a/sys/conf/files b/sys/conf/files
index aa8d3782f633..a71edc94adde 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -1639,6 +1639,7 @@ dev/etherswitch/ip17x/ip17x_phy.c	optional ip17x
 dev/etherswitch/ip17x/ip17x_vlans.c	optional ip17x
 dev/etherswitch/miiproxy.c		optional miiproxy
 dev/etherswitch/rtl8366/rtl8366rb.c	optional rtl8366rb
+dev/etherswitch/e6000sw/e6000sw.c	optional e6000sw
 dev/etherswitch/ukswitch/ukswitch.c	optional ukswitch
 dev/evdev/cdev.c			optional evdev
 dev/evdev/evdev.c			optional evdev
diff --git a/sys/dev/advansys/adwcam.c b/sys/dev/advansys/adwcam.c
index 9485109f938c..02f9c49d8006 100644
--- a/sys/dev/advansys/adwcam.c
+++ b/sys/dev/advansys/adwcam.c
@@ -712,10 +712,10 @@ adw_action(struct cam_sim *sim, union ccb *ccb)
 		strlcpy(cpi->hba_vid, "AdvanSys", HBA_IDLEN);
 		strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
 		cpi->unit_number = cam_sim_unit(sim);
-                cpi->transport = XPORT_SPI;
-                cpi->transport_version = 2;
-                cpi->protocol = PROTO_SCSI;
-                cpi->protocol_version = SCSI_REV_2;
+		cpi->transport = XPORT_SPI;
+		cpi->transport_version = 2;
+		cpi->protocol = PROTO_SCSI;
+		cpi->protocol_version = SCSI_REV_2;
 		cpi->ccb_h.status = CAM_REQ_CMP;
 		xpt_done(ccb);
 		break;
diff --git a/sys/dev/agp/agp_i810.c b/sys/dev/agp/agp_i810.c
index 7df5d84780d1..7a0b2ff51519 100644
--- a/sys/dev/agp/agp_i810.c
+++ b/sys/dev/agp/agp_i810.c
@@ -1932,8 +1932,6 @@ DRIVER_MODULE(agp_i810, vgapci, agp_i810_driver, agp_devclass, 0, 0);
 MODULE_DEPEND(agp_i810, agp, 1, 1, 1);
 MODULE_DEPEND(agp_i810, pci, 1, 1, 1);
 
-extern vm_page_t bogus_page;
-
 void
 agp_intel_gtt_clear_range(device_t dev, u_int first_entry, u_int num_entries)
 {
diff --git a/sys/dev/aha/aha.c b/sys/dev/aha/aha.c
index 9e8511bdbf9c..1fed39fb36d3 100644
--- a/sys/dev/aha/aha.c
+++ b/sys/dev/aha/aha.c
@@ -951,10 +951,10 @@ ahaaction(struct cam_sim *sim, union ccb *ccb)
 		strlcpy(cpi->hba_vid, "Adaptec", HBA_IDLEN);
 		strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
 		cpi->unit_number = cam_sim_unit(sim);
-                cpi->transport = XPORT_SPI;
-                cpi->transport_version = 2;
-                cpi->protocol = PROTO_SCSI;
-                cpi->protocol_version = SCSI_REV_2;
+		cpi->transport = XPORT_SPI;
+		cpi->transport_version = 2;
+		cpi->protocol = PROTO_SCSI;
+		cpi->protocol_version = SCSI_REV_2;
 		cpi->ccb_h.status = CAM_REQ_CMP;
 		xpt_done(ccb);
 		break;
diff --git a/sys/dev/ahb/ahb.c b/sys/dev/ahb/ahb.c
index e3e3a7cce9a3..b6665009d9af 100644
--- a/sys/dev/ahb/ahb.c
+++ b/sys/dev/ahb/ahb.c
@@ -1182,10 +1182,10 @@ ahbaction(struct cam_sim *sim, union ccb *ccb)
 		strlcpy(cpi->hba_vid, "Adaptec", HBA_IDLEN);
 		strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
 		cpi->unit_number = cam_sim_unit(sim);
-                cpi->transport = XPORT_SPI;
-                cpi->transport_version = 2;
-                cpi->protocol = PROTO_SCSI;
-                cpi->protocol_version = SCSI_REV_2;
+		cpi->transport = XPORT_SPI;
+		cpi->transport_version = 2;
+		cpi->protocol = PROTO_SCSI;
+		cpi->protocol_version = SCSI_REV_2;
 		cpi->ccb_h.status = CAM_REQ_CMP;
 		xpt_done(ccb);
 		break;
diff --git a/sys/dev/aic/aic.c b/sys/dev/aic/aic.c
index 30a7d69a385d..c728710989ab 100644
--- a/sys/dev/aic/aic.c
+++ b/sys/dev/aic/aic.c
@@ -280,7 +280,7 @@ aic_action(struct cam_sim *sim, union ccb *ccb)
                 cpi->max_lun = 7;
                 cpi->initiator_id = aic->initiator;
                 cpi->bus_id = cam_sim_bus(sim);
-		cpi->base_transfer_speed = 3300;
+                cpi->base_transfer_speed = 3300;
                 strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
                 strlcpy(cpi->hba_vid, "Adaptec", HBA_IDLEN);
                 strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
diff --git a/sys/dev/ath/ath_hal/ah_regdomain.c b/sys/dev/ath/ath_hal/ah_regdomain.c
index d3770356d7ea..941eb93f35d0 100644
--- a/sys/dev/ath/ath_hal/ah_regdomain.c
+++ b/sys/dev/ath/ath_hal/ah_regdomain.c
@@ -426,6 +426,10 @@ addchan(struct ath_hal *ah, struct ieee80211_channel chans[],
 	if (*nchans >= maxchans)
 		return (HAL_ENOMEM);
 
+	HALDEBUG(ah, HAL_DEBUG_REGDOMAIN,
+	    "%s: %d: freq=%d, flags=0x%08x\n",
+	    __func__, *nchans, (int) freq, flags);
+
 	c = &chans[(*nchans)++];
 	c->ic_freq = freq;
 	c->ic_flags = flags;
@@ -439,7 +443,7 @@ addchan(struct ath_hal *ah, struct ieee80211_channel chans[],
 
 static int
 copychan_prev(struct ath_hal *ah, struct ieee80211_channel chans[],
-    u_int maxchans, int *nchans, uint16_t freq)
+    u_int maxchans, int *nchans, uint16_t freq, uint32_t flags)
 {
 	struct ieee80211_channel *c;
 
@@ -449,6 +453,10 @@ copychan_prev(struct ath_hal *ah, struct ieee80211_channel chans[],
 	if (*nchans >= maxchans)
 		return (HAL_ENOMEM);
 
+	HALDEBUG(ah, HAL_DEBUG_REGDOMAIN,
+	    "%s: %d: freq=%d, flags=0x%08x\n",
+	    __func__, *nchans, (int) freq, flags);
+
 	c = &chans[(*nchans)++];
 	c[0] = c[-1];
 	c->ic_freq = freq;
@@ -469,9 +477,13 @@ add_chanlist_band(struct ath_hal *ah, struct ieee80211_channel chans[],
 	if (freq_hi < freq_lo)
 		return (0);
 
+	HALDEBUG(ah, HAL_DEBUG_REGDOMAIN,
+	    "%s: freq=%d..%d, flags=0x%08x, step=%d\n", __func__,
+	    (int) freq_lo, (int) freq_hi, flags, step);
+
 	error = addchan(ah, chans, maxchans, nchans, freq, flags, fband, rd);
 	for (freq += step; freq <= freq_hi && error == 0; freq += step)
-		error = copychan_prev(ah, chans, maxchans, nchans, freq);
+		error = copychan_prev(ah, chans, maxchans, nchans, freq, flags);
 
 	return (error);
 }
@@ -548,7 +560,6 @@ add_chanlist_mode(struct ath_hal *ah, struct ieee80211_channel chans[],
 			continue;
 		}
 #endif
-
 		/*
 		 * XXX TODO: handle REG_EXT_FCC_CH_144.
 		 *
@@ -558,11 +569,52 @@ add_chanlist_mode(struct ath_hal *ah, struct ieee80211_channel chans[],
 
 		bfreq_lo = MAX(fband->lowChannel + low_adj, freq_lo);
 		bfreq_hi = MIN(fband->highChannel + hi_adj, freq_hi);
+
+		/*
+		 * Don't start the 5GHz channel list at 5120MHz.
+		 *
+		 * Unfortunately (sigh) the HT40 channel creation
+		 * logic will create HT40U channels at 5120, 5160, 5200.
+		 * This means that 36 (5180) isn't considered as a
+		 * HT40 channel, and everything goes messed up from there.
+		 */
+		if ((cm->flags & IEEE80211_CHAN_5GHZ) &&
+		    (cm->flags & IEEE80211_CHAN_HT40U)) {
+			if (bfreq_lo < 5180)
+				bfreq_lo = 5180;
+		}
+
+		/*
+		 * Same with HT40D - need to start at 5200 or the low
+		 * channels are all wrong again.
+		 */
+		if ((cm->flags & IEEE80211_CHAN_5GHZ) &&
+		    (cm->flags & IEEE80211_CHAN_HT40D)) {
+			if (bfreq_lo < 5200)
+				bfreq_lo = 5200;
+		}
+
 		if (fband->channelSep >= channelSep)
 			step = fband->channelSep;
 		else
 			step = roundup(channelSep, fband->channelSep);
 
+		HALDEBUG(ah, HAL_DEBUG_REGDOMAIN,
+		    "%s: freq_lo=%d, freq_hi=%d, low_adj=%d, hi_adj=%d, "
+		    "bandlo=%d, bandhi=%d, bfreqlo=%d, bfreqhi=%d, step=%d, "
+		    "flags=0x%08x\n",
+		    __func__,
+		    (int) freq_lo,
+		    (int) freq_hi,
+		    (int) low_adj,
+		    (int) hi_adj,
+		    (int) fband->lowChannel,
+		    (int) fband->highChannel,
+		    (int) bfreq_lo,
+		    (int) bfreq_hi,
+		    step,
+		    (int) cm->flags);
+
 		error = add_chanlist_band(ah, chans, maxchans, nchans,
 		    bfreq_lo, bfreq_hi, step, cm->flags, fband, rd);
 		if (error != 0)	{
diff --git a/sys/dev/ciss/ciss.c b/sys/dev/ciss/ciss.c
index 41d1fdefc3d4..a3baca4e9d6b 100644
--- a/sys/dev/ciss/ciss.c
+++ b/sys/dev/ciss/ciss.c
@@ -3027,10 +3027,10 @@ ciss_cam_action(struct cam_sim *sim, union ccb *ccb)
 	cpi->max_lun = 0;		/* 'logical drive' channel only */
 	cpi->initiator_id = sc->ciss_cfg->max_logical_supported;
 	strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
-        strlcpy(cpi->hba_vid, "CISS", HBA_IDLEN);
-        strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
-        cpi->unit_number = cam_sim_unit(sim);
-        cpi->bus_id = cam_sim_bus(sim);
+	strlcpy(cpi->hba_vid, "CISS", HBA_IDLEN);
+	strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
+	cpi->unit_number = cam_sim_unit(sim);
+	cpi->bus_id = cam_sim_bus(sim);
 	cpi->base_transfer_speed = 132 * 1024;	/* XXX what to set this to? */
 	cpi->transport = XPORT_SPI;
 	cpi->transport_version = 2;
diff --git a/sys/dev/dpt/dpt_scsi.c b/sys/dev/dpt/dpt_scsi.c
index e3330cf11c30..f960dc9ccaf3 100644
--- a/sys/dev/dpt/dpt_scsi.c
+++ b/sys/dev/dpt/dpt_scsi.c
@@ -1031,10 +1031,10 @@ dpt_action(struct cam_sim *sim, union ccb *ccb)
 		strlcpy(cpi->hba_vid, "DPT", HBA_IDLEN);
 		strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
 		cpi->unit_number = cam_sim_unit(sim);
-                cpi->transport = XPORT_SPI;
-                cpi->transport_version = 2;
-                cpi->protocol = PROTO_SCSI;
-                cpi->protocol_version = SCSI_REV_2;
+		cpi->transport = XPORT_SPI;
+		cpi->transport_version = 2;
+		cpi->protocol = PROTO_SCSI;
+		cpi->protocol_version = SCSI_REV_2;
 		cpi->ccb_h.status = CAM_REQ_CMP;
 		xpt_done(ccb);
 		break;
diff --git a/sys/dev/etherswitch/e6000sw/e6000sw.c b/sys/dev/etherswitch/e6000sw/e6000sw.c
index ae552b81728e..adac7ff68cbf 100644
--- a/sys/dev/etherswitch/e6000sw/e6000sw.c
+++ b/sys/dev/etherswitch/e6000sw/e6000sw.c
@@ -59,6 +59,10 @@ __FBSDID("$FreeBSD$");
 #include <dev/mii/miivar.h>
 #include <dev/mge/if_mgevar.h>
 
+#include <dev/fdt/fdt_common.h>
+#include <dev/ofw/ofw_bus.h>
+#include <dev/ofw/ofw_bus_subr.h>
+
 #include "e6000swreg.h"
 #include "etherswitch_if.h"
 #include "miibus_if.h"
@@ -78,23 +82,28 @@ MALLOC_DEFINE(M_E6000SW, "e6000sw", "e6000sw switch");
 
 typedef struct e6000sw_softc {
 	device_t		dev;
+	phandle_t		node;
 
 	struct sx		sx;
-	struct ifnet		*ifp[E6000SW_NUM_PHYS];
-	char			*ifname[E6000SW_NUM_PHYS];
-	device_t		miibus[E6000SW_NUM_PHYS];
-	struct mii_data		*mii[E6000SW_NUM_PHYS];
+	struct ifnet		*ifp[E6000SW_MAX_PORTS];
+	char			*ifname[E6000SW_MAX_PORTS];
+	device_t		miibus[E6000SW_MAX_PORTS];
+	struct mii_data		*mii[E6000SW_MAX_PORTS];
 	struct callout		tick_callout;
 
 	uint32_t		cpuports_mask;
+	uint32_t		fixed_mask;
+	int			sw_addr;
+	int			num_ports;
+	boolean_t		multi_chip;
 
 	int			vid[E6000SW_NUM_VGROUPS];
 	int			members[E6000SW_NUM_VGROUPS];
-	int			vgroup[E6000SW_NUM_PORTS];
+	int			vgroup[E6000SW_MAX_PORTS];
 } e6000sw_softc_t;
 
 static etherswitch_info_t etherswitch_info = {
-	.es_nports =		E6000SW_NUM_PORTS,
+	.es_nports =		0,
 	.es_nvlangroups =	E6000SW_NUM_VGROUPS,
 	.es_name =		"Marvell 6000 series switch"
 };
@@ -134,7 +143,9 @@ static int e6000sw_atu_mac_table(device_t dev, e6000sw_softc_t *sc, struct
     atu_opt *atu, int flag);
 static int e6000sw_get_pvid(e6000sw_softc_t *sc, int port, int *pvid);
 static int e6000sw_set_pvid(e6000sw_softc_t *sc, int port, int pvid);
-static __inline int e6000sw_cpuport(e6000sw_softc_t *sc, int port);
+static __inline int e6000sw_is_cpuport(e6000sw_softc_t *sc, int port);
+static __inline int e6000sw_is_fixedport(e6000sw_softc_t *sc, int port);
+static __inline int e6000sw_is_phyport(e6000sw_softc_t *sc, int port);
 static __inline struct mii_data *e6000sw_miiforphy(e6000sw_softc_t *sc,
     unsigned int phy);
 
@@ -181,6 +192,14 @@ DRIVER_MODULE(etherswitch, e6000sw, etherswitch_driver, etherswitch_devclass, 0,
 DRIVER_MODULE(miibus, e6000sw, miibus_driver, miibus_devclass, 0, 0);
 MODULE_DEPEND(e6000sw, mdio, 1, 1, 1);
 
+#define SMI_CMD 0
+#define SMI_CMD_BUSY	(1<<15)
+#define SMI_CMD_OP_READ	((2<<10)|SMI_CMD_BUSY|(1<<12))
+#define SMI_CMD_OP_WRITE	((1<<10)|SMI_CMD_BUSY|(1<<12))
+#define SMI_DATA	1
+
+#define MDIO_READ(dev, addr, reg) MDIO_READREG(device_get_parent(dev), (addr), (reg))
+#define MDIO_WRITE(dev, addr, reg, val) MDIO_WRITEREG(device_get_parent(dev), (addr), (reg), (val))
 static void
 e6000sw_identify(driver_t *driver, device_t parent)
 {
@@ -195,10 +214,37 @@ e6000sw_probe(device_t dev)
 	e6000sw_softc_t *sc;
 	const char *description;
 	unsigned int id;
+	uint16_t dev_addr;
+	phandle_t dsa_node, switch_node;
+
+	dsa_node = fdt_find_compatible(OF_finddevice("/"),
+	    "marvell,dsa", 0);
+	switch_node = OF_child(dsa_node);
+
+	if (switch_node == 0)
+		return (ENXIO);
 
 	sc = device_get_softc(dev);
 	bzero(sc, sizeof(e6000sw_softc_t));
 	sc->dev = dev;
+	sc->node = switch_node;
+
+	/* Read ADDR[4:1]n using indirect access */
+	MDIO_WRITE(dev, REG_GLOBAL2, SCR_AND_MISC_REG,
+	    SCR_AND_MISC_PTR_CFG);
+	dev_addr = MDIO_READ(dev, REG_GLOBAL2, SCR_AND_MISC_REG) &
+	    SCR_AND_MISC_DATA_CFG_MASK;
+	if (dev_addr != 0) {
+		sc->multi_chip = true;
+		device_printf(dev, "multi-chip addresing mode\n");
+	} else {
+		device_printf(dev, "single-chip addressing mode\n");
+	}
+
+	if (OF_getencprop(sc->node, "reg", &sc->sw_addr,
+	    sizeof(sc->sw_addr)) < 0)
+		return (ENXIO);
+
 	/* Lock is necessary due to assertions. */
 	sx_init(&sc->sx, "e6000sw");
 	E6000SW_LOCK(sc);
@@ -218,7 +264,7 @@ e6000sw_probe(device_t dev)
 	default:
 		E6000SW_UNLOCK(sc);
 		sx_destroy(&sc->sx);
-		device_printf(dev, "Unrecognized device.\n");
+		device_printf(dev, "Unrecognized device, id 0x%x.\n", id);
 		return (ENXIO);
 	}
 
@@ -230,48 +276,151 @@ e6000sw_probe(device_t dev)
 }
 
 static int
+e6000sw_parse_child_fdt(device_t dev, phandle_t child, uint32_t *fixed_mask,
+    uint32_t *cpu_mask, int *pport, int *pvlangroup)
+{
+	char portlabel[100];
+	uint32_t port, vlangroup;
+	boolean_t fixed_link;
+
+	if (fixed_mask == NULL || cpu_mask == NULL || pport == NULL)
+		return (ENXIO);
+
+	OF_getprop(child, "label", (void *)portlabel, 100);
+	OF_getencprop(child, "reg", (void *)&port, sizeof(port));
+
+	if (OF_getencprop(child, "vlangroup", (void *)&vlangroup,
+	    sizeof(vlangroup)) > 0) {
+		if (vlangroup >= E6000SW_NUM_VGROUPS)
+			return (ENXIO);
+		*pvlangroup = vlangroup;
+	} else {
+		*pvlangroup = -1;
+	}
+
+	if (port >= E6000SW_MAX_PORTS)
+		return (ENXIO);
+	*pport = port;
+
+	if (strncmp(portlabel, "cpu", 3) == 0) {
+		device_printf(dev, "CPU port at %d\n", port);
+		*cpu_mask |= (1 << port);
+		return (0);
+	}
+
+	fixed_link = OF_child(child);
+	if (fixed_link) {
+		*fixed_mask |= (1 << port);
+		device_printf(dev, "fixed port at %d\n", port);
+	} else {
+		device_printf(dev, "PHY at %d\n", port);
+	}
+
+	return (0);
+}
+
+static int
+e6000sw_init_interface(e6000sw_softc_t *sc, int port)
+{
+	char name[IFNAMSIZ];
+
+	snprintf(name, IFNAMSIZ, "%sport", device_get_nameunit(sc->dev));
+
+	sc->ifp[port] = if_alloc(IFT_ETHER);
+	if (sc->ifp[port] == NULL)
+		return (ENOMEM);
+	sc->ifp[port]->if_softc = sc;
+	sc->ifp[port]->if_flags |= IFF_UP | IFF_BROADCAST |
+	    IFF_DRV_RUNNING | IFF_SIMPLEX;
+	sc->ifname[port] = malloc(strlen(name) + 1, M_E6000SW, M_WAITOK);
+	if (sc->ifname[port] == NULL)
+		return (ENOMEM);
+	memcpy(sc->ifname[port], name, strlen(name) + 1);
+	if_initname(sc->ifp[port], sc->ifname[port], port);
+
+	return (0);
+}
+
+static int
+e6000sw_attach_miibus(e6000sw_softc_t *sc, int port)
+{
+	int err;
+
+	err = mii_attach(sc->dev, &sc->miibus[port], sc->ifp[port],
+	    e6000sw_ifmedia_upd, e6000sw_ifmedia_sts, BMSR_DEFCAPMASK,
+	    port, MII_OFFSET_ANY, 0);
+	if (err != 0)
+		return (err);
+
+	sc->mii[port] = device_get_softc(sc->miibus[port]);
+	return (0);
+}
+
+static int
 e6000sw_attach(device_t dev)
 {
 	e6000sw_softc_t *sc;
-	int phy, err, port;
-	char name[IFNAMSIZ];
+	phandle_t child;
+	int err, port, vlangroup;
+	int member_ports[E6000SW_NUM_VGROUPS];
+	etherswitch_vlangroup_t vg;
 
 	err = 0;
 	sc = device_get_softc(dev);
+
 	E6000SW_LOCK(sc);
-	sc->cpuports_mask = E6000SW_CPUPORTS_MASK;
-	for (port = 0; port < E6000SW_NUM_PORTS; port++)
-		sc->vgroup[port] = E6000SW_PORT_NO_VGROUP;
 	e6000sw_setup(dev, sc);
+	bzero(member_ports, sizeof(member_ports));
 
-	snprintf(name, IFNAMSIZ, "%sport", device_get_nameunit(sc->dev));
-	for (phy = 0; phy < E6000SW_NUM_PHYS; phy++) {
-		sc->ifp[phy] = if_alloc(IFT_ETHER);
-		if (sc->ifp[phy] == NULL)
+	for (child = OF_child(sc->node); child != 0; child = OF_peer(child)) {
+		err = e6000sw_parse_child_fdt(dev, child, &sc->fixed_mask,
+		    &sc->cpuports_mask, &port, &vlangroup);
+		if (err != 0) {
+			device_printf(sc->dev, "failed to parse DTS\n");
 			goto out_fail;
-		sc->ifp[phy]->if_softc = sc;
-		sc->ifp[phy]->if_flags |= IFF_UP | IFF_BROADCAST |
-		    IFF_DRV_RUNNING | IFF_SIMPLEX;
-		sc->ifname[phy] = malloc(strlen(name) + 1, M_E6000SW, M_WAITOK);
-		if (sc->ifname[phy] == NULL)
+		}
+
+		if (vlangroup != -1)
+			member_ports[vlangroup] |= (1 << port);
+
+		sc->num_ports++;
+
+		err = e6000sw_init_interface(sc, port);
+		if (err != 0) {
+			device_printf(sc->dev, "failed to init interface\n");
 			goto out_fail;
-		bcopy(name, sc->ifname[phy], strlen(name) + 1);
-		if_initname(sc->ifp[phy], sc->ifname[phy], phy);
-		err = mii_attach(sc->dev, &sc->miibus[phy], sc->ifp[phy],
-		    e6000sw_ifmedia_upd, e6000sw_ifmedia_sts, BMSR_DEFCAPMASK,
-		    phy, MII_OFFSET_ANY, 0);
+		}
+
+		/* Don't attach miibus at CPU/fixed ports */
+		if (!e6000sw_is_phyport(sc, port))
+			continue;
+
+		err = e6000sw_attach_miibus(sc, port);
 		if (err != 0) {
-			device_printf(sc->dev,
-			    "attaching PHY %d failed\n",
-			    phy);
+			device_printf(sc->dev, "failed to attach miibus\n");
 			goto out_fail;
 		}
-		sc->mii[phy] = device_get_softc(sc->miibus[phy]);
 	}
+
+	etherswitch_info.es_nports = sc->num_ports;
+	for (port = 0; port < sc->num_ports; port++)
+		sc->vgroup[port] = E6000SW_PORT_NO_VGROUP;
+
+	/* Set VLAN configuration */
+	e6000sw_port_vlan_conf(sc);
+
+	/* Set vlangroups */
+	for (vlangroup = 0; vlangroup < E6000SW_NUM_VGROUPS; vlangroup++)
+		if (member_ports[vlangroup] != 0) {
+			vg.es_vlangroup = vg.es_vid = vlangroup;
+			vg.es_member_ports = vg.es_untagged_ports =
+			    member_ports[vlangroup];
+			e6000sw_setvgroup(dev, &vg);
+		}
+
 	E6000SW_UNLOCK(sc);
 
 	bus_generic_probe(dev);
-	bus_enumerate_hinted_children(dev);
 	bus_generic_attach(dev);
 
 	kproc_create(e6000sw_tick, sc, &e6000sw_kproc, 0, 0,
@@ -282,7 +431,7 @@ e6000sw_attach(device_t dev)
 out_fail:
 	e6000sw_detach(dev);
 
-	return (ENXIO);
+	return (err);
 }
 
 static __inline void
@@ -294,7 +443,6 @@ e6000sw_poll_done(e6000sw_softc_t *sc)
 		continue;
 }
 
-
 /*
  * PHY registers are paged. Put page index in reg 22 (accessible from every
  * page), then access specific register.
@@ -308,7 +456,7 @@ e6000sw_readphy(device_t dev, int phy, int reg)
 	sc = device_get_softc(dev);
 	val = 0;
 
-	if (phy >= E6000SW_NUM_PHYS || reg >= E6000SW_NUM_PHY_REGS) {
+	if (!e6000sw_is_phyport(sc, phy) || reg >= E6000SW_NUM_PHY_REGS) {
 		device_printf(dev, "Wrong register address.\n");
 		return (EINVAL);
 	}
@@ -338,7 +486,7 @@ e6000sw_writephy(device_t dev, int phy, int reg, int data)
 	sc = device_get_softc(dev);
 	val = 0;
 
-	if (phy >= E6000SW_NUM_PHYS || reg >= E6000SW_NUM_PHY_REGS) {
+	if (!e6000sw_is_phyport(sc, phy) || reg >= E6000SW_NUM_PHY_REGS) {
 		device_printf(dev, "Wrong register address.\n");
 		return (EINVAL);
 	}
@@ -368,7 +516,7 @@ e6000sw_detach(device_t dev)
 	sc = device_get_softc(dev);
 	bus_generic_detach(dev);
 	sx_destroy(&sc->sx);
-	for (phy = 0; phy < E6000SW_NUM_PHYS; phy++) {
+	for (phy = 0; phy < sc->num_ports; phy++) {
 		if (sc->miibus[phy] != NULL)
 			device_delete_child(dev, sc->miibus[phy]);
 		if (sc->ifp[phy] != NULL)
@@ -422,7 +570,7 @@ e6000sw_getport(device_t dev, etherswitch_port_t *p)
 
 	E6000SW_LOCK(sc);
 
-	if (p->es_port >= E6000SW_NUM_PORTS ||
+	if (p->es_port >= sc->num_ports ||
 	    p->es_port < 0) {
 		err = EINVAL;
 		goto out;
@@ -430,7 +578,7 @@ e6000sw_getport(device_t dev, etherswitch_port_t *p)
 
 	e6000sw_get_pvid(sc, p->es_port, &p->es_pvid);
 
-	if (e6000sw_cpuport(sc, p->es_port)) {
+	if (e6000sw_is_cpuport(sc, p->es_port)) {
 		p->es_flags |= ETHERSWITCH_PORT_CPU;
 		ifmr = &p->es_ifmr;
 		ifmr->ifm_status = IFM_ACTIVE | IFM_AVALID;
@@ -438,6 +586,13 @@ e6000sw_getport(device_t dev, etherswitch_port_t *p)
 		ifmr->ifm_current = ifmr->ifm_active =
 		    IFM_ETHER | IFM_1000_T | IFM_FDX;
 		ifmr->ifm_mask = 0;
+	} else if (e6000sw_is_fixedport(sc, p->es_port)) {
+		ifmr = &p->es_ifmr;
+		ifmr->ifm_status = IFM_ACTIVE | IFM_AVALID;
+		ifmr->ifm_count = 0;
+		ifmr->ifm_current = ifmr->ifm_active =
+		    IFM_ETHER | IFM_1000_T | IFM_FDX;
+		ifmr->ifm_mask = 0;
 	} else {
 		mii = e6000sw_miiforphy(sc, p->es_port);
 		err = ifmedia_ioctl(mii->mii_ifp, &p->es_ifr,
@@ -462,7 +617,7 @@ e6000sw_setport(device_t dev, etherswitch_port_t *p)
 
 	E6000SW_LOCK(sc);
 
-	if (p->es_port >= E6000SW_NUM_PORTS ||
+	if (p->es_port >= sc->num_ports ||
 	    p->es_port < 0) {
 		err = EINVAL;
 		goto out;
@@ -470,7 +625,7 @@ e6000sw_setport(device_t dev, etherswitch_port_t *p)
 
 	if (p->es_pvid != 0)
 		e6000sw_set_pvid(sc, p->es_port, p->es_pvid);
-	if (!e6000sw_cpuport(sc, p->es_port)) {
+	if (!e6000sw_is_cpuport(sc, p->es_port)) {
 		mii = e6000sw_miiforphy(sc, p->es_port);
 		err = ifmedia_ioctl(mii->mii_ifp, &p->es_ifr, &mii->mii_media,
 		    SIOCSIFMEDIA);
@@ -644,7 +799,7 @@ e6000sw_setvgroup(device_t dev, etherswitch_vlangroup_t *vg)
 
 	vg->es_untagged_ports &= PORT_VLAN_MAP_TABLE_MASK;
 	fid = vg->es_vlangroup + 1;
-	for (port = 0; port < E6000SW_NUM_PORTS; port++) {
+	for (port = 0; port < sc->num_ports; port++) {
 		if ((sc->members[vg->es_vlangroup] & (1 << port)) ||
 		    (vg->es_untagged_ports & (1 << port)))
 			e6000sw_flush_port(sc, port);
@@ -679,7 +834,7 @@ static __inline struct mii_data*
 e6000sw_miiforphy(e6000sw_softc_t *sc, unsigned int phy)
 {
 
-	if (phy >= E6000SW_NUM_PHYS)
+	if (!e6000sw_is_phyport(sc, phy))
 		return (NULL);
 
 	return (device_get_softc(sc->miibus[phy]));
@@ -717,13 +872,42 @@ e6000sw_ifmedia_sts(struct ifnet *ifp, struct ifmediareq *ifmr)
 	ifmr->ifm_status = mii->mii_media_status;
 }
 
+
+static int
+e6000sw_smi_waitready(e6000sw_softc_t *sc, int phy)
+{
+	int i;
+
+	for (i = 0; i < E6000SW_SMI_TIMEOUT; i++) {
+		if ((MDIO_READ(sc->dev, phy, SMI_CMD)
+		     & SMI_CMD_BUSY) == 0)
+			return 0;
+	}
+
+	return 1;
+}
+
 static __inline uint32_t
 e6000sw_readreg(e6000sw_softc_t *sc, int addr, int reg)
 {
 
 	E6000SW_LOCK_ASSERT(sc, SA_XLOCKED);
 
-	return (MDIO_READREG(device_get_parent(sc->dev), addr, reg));
+	if (!sc->multi_chip)
+		return (MDIO_READ(sc->dev, addr, reg) & 0xffff);
+
+	if (e6000sw_smi_waitready(sc, sc->sw_addr)) {
+		printf("e6000sw: readreg timeout\n");
+		return (0xffff);
+	}
+	MDIO_WRITE(sc->dev, sc->sw_addr, SMI_CMD, SMI_CMD_OP_READ |
+		   (addr << 5) | reg);
+	if (e6000sw_smi_waitready(sc, sc->sw_addr)) {
+		printf("e6000sw: readreg timeout\n");
+		return (0xffff);
+	}
+
+	return (MDIO_READ(sc->dev, sc->sw_addr, SMI_DATA) & 0xffff);
 }
 
 static __inline void
@@ -732,17 +916,50 @@ e6000sw_writereg(e6000sw_softc_t *sc, int addr, int reg, int val)
 
 	E6000SW_LOCK_ASSERT(sc, SA_XLOCKED);
 
-	MDIO_WRITEREG(device_get_parent(sc->dev), addr, reg, val);
+	if (!sc->multi_chip) {
+		MDIO_WRITE(sc->dev, addr, reg, val);
+		return;
+	}
+
+	if (e6000sw_smi_waitready(sc, sc->sw_addr)) {
+		printf("e6000sw: readreg timeout\n");
+		return;
+	}
+	MDIO_WRITE(sc->dev, sc->sw_addr, SMI_DATA, val);
+	MDIO_WRITE(sc->dev, sc->sw_addr, SMI_CMD, SMI_CMD_OP_WRITE |
+		   (addr << 5) | reg);
+	if (e6000sw_smi_waitready(sc, sc->sw_addr)) {
+		printf("e6000sw: readreg timeout\n");
+		return;
+	}
+
+	return;
 }
 
 static __inline int
-e6000sw_cpuport(e6000sw_softc_t *sc, int port)
+e6000sw_is_cpuport(e6000sw_softc_t *sc, int port)
 {
 
 	return (sc->cpuports_mask & (1 << port));
 }
 
 static __inline int
+e6000sw_is_fixedport(e6000sw_softc_t *sc, int port)
+{
+
+	return (sc->fixed_mask & (1 << port));
+}
+
+static __inline int
+e6000sw_is_phyport(e6000sw_softc_t *sc, int port)
+{
+	uint32_t phy_mask;
+	phy_mask = ~(sc->fixed_mask | sc->cpuports_mask);
+
+	return (phy_mask & (1 << port));
+}
+
+static __inline int
 e6000sw_set_pvid(e6000sw_softc_t *sc, int port, int pvid)
 {
 
@@ -770,17 +987,20 @@ e6000sw_tick (void *arg)
 {
 	e6000sw_softc_t *sc;
 	struct mii_softc *miisc;
-	int i;
+	int port;
 
 	sc = arg;
 
 	E6000SW_LOCK_ASSERT(sc, SA_UNLOCKED);
 	for (;;) {
 		E6000SW_LOCK(sc);
-		for (i = 0; i < E6000SW_NUM_PHYS; i++) {
-			mii_tick(sc->mii[i]);
-			LIST_FOREACH(miisc, &sc->mii[i]->mii_phys, mii_list) {
-				if (IFM_INST(sc->mii[i]->mii_media.ifm_cur->ifm_media)
+		for (port = 0; port < sc->num_ports; port++) {
+			/* Tick only on PHY ports */
+			if (!e6000sw_is_phyport(sc, port))
+				continue;
+			mii_tick(sc->mii[port]);
+			LIST_FOREACH(miisc, &sc->mii[port]->mii_phys, mii_list) {
+				if (IFM_INST(sc->mii[port]->mii_media.ifm_cur->ifm_media)
 				    != miisc->mii_inst)
 					continue;
 				mii_phy_update(miisc, MII_POLLSTAT);
@@ -815,9 +1035,6 @@ e6000sw_setup(device_t dev, e6000sw_softc_t *sc)
 	    SWITCH_MGMT_FC_PRI_MASK |
 	    (1 << SWITCH_MGMT_FORCEFLOW));
 
-	/* Set VLAN configuration */
-	e6000sw_port_vlan_conf(sc);
-
 	e6000sw_atu_flush(dev, sc, NO_OPERATION);
 	e6000sw_atu_mac_table(dev, sc, NULL, NO_OPERATION);
 	e6000sw_set_atustat(dev, sc, 0, COUNT_ALL);
@@ -837,36 +1054,25 @@ static void
 e6000sw_port_vlan_conf(e6000sw_softc_t *sc)
 {
 	int port, ret;
-	etherswitch_vlangroup_t vg;
 	device_t dev;
 
 	dev = sc->dev;
 	/* Disable all ports */
-	for (port = 0; port < E6000SW_NUM_PORTS; port++) {
+	for (port = 0; port < sc->num_ports; port++) {
 		ret = e6000sw_readreg(sc, REG_PORT(port), PORT_CONTROL);
 		e6000sw_writereg(sc, REG_PORT(port), PORT_CONTROL,
 		    (ret & ~PORT_CONTROL_ENABLE));
 	}
 
 	/* Set port priority */
-	for (port = 0; port < E6000SW_NUM_PORTS; port++) {
+	for (port = 0; port < sc->num_ports; port++) {
 		ret = e6000sw_readreg(sc, REG_PORT(port), PORT_VID);
 		ret &= ~PORT_VID_PRIORITY_MASK;
 		e6000sw_writereg(sc, REG_PORT(port), PORT_VID, ret);
 	}
 
-	vg.es_vlangroup = 0;
-	vg.es_vid = 0;
-	vg.es_member_ports = vg.es_untagged_ports = E6000SW_DEF_VLANGROUP0;
-	e6000sw_setvgroup(dev, &vg);
-	vg.es_vlangroup = 1;
-	vg.es_vid = 1;
-	vg.es_member_ports = vg.es_untagged_ports = E6000SW_DEF_VLANGROUP1;
-	e6000sw_setvgroup(dev, &vg);
-
-	device_printf(dev, "Default vlangroups set.\n");
 	/* Set VID map */
-	for (port = 0; port < E6000SW_NUM_PORTS; port++) {
+	for (port = 0; port < sc->num_ports; port++) {
 		ret = e6000sw_readreg(sc, REG_PORT(port), PORT_VID);
 		ret &= ~PORT_VID_DEF_VID_MASK;
 		ret |= (port + 1);
@@ -874,7 +1080,7 @@ e6000sw_port_vlan_conf(e6000sw_softc_t *sc)
 	}
 
 	/* Enable all ports */
-	for (port = 0; port < E6000SW_NUM_PORTS; port++) {
+	for (port = 0; port < sc->num_ports; port++) {
 		ret = e6000sw_readreg(sc, REG_PORT(port), PORT_CONTROL);
 		e6000sw_writereg(sc, REG_PORT(port), PORT_CONTROL, (ret |
 		    PORT_CONTROL_ENABLE));
diff --git a/sys/dev/etherswitch/e6000sw/e6000swreg.h b/sys/dev/etherswitch/e6000sw/e6000swreg.h
index b8cdfe32a6f0..b3a053366d45 100644
--- a/sys/dev/etherswitch/e6000sw/e6000swreg.h
+++ b/sys/dev/etherswitch/e6000sw/e6000swreg.h
@@ -42,8 +42,6 @@ struct atu_opt {
  * Definitions for the Marvell 88E6000 series Ethernet Switch.
  */
 
-#define CPU_PORT			0x5
-
 /*
  * Switch Registers
  */
@@ -167,19 +165,21 @@ struct atu_opt {
 
 #define PHY_PAGE_REG			22
 
-#define E6000SW_NUM_PHYS		5
+/*
+ * Scratch and Misc register accessed via
+ * 'Switch Global Registers' (REG_GLOBAL2)
+ */
+#define SCR_AND_MISC_REG		0x1a
+
+#define SCR_AND_MISC_PTR_CFG		0x7000
+#define SCR_AND_MISC_DATA_CFG_MASK	0xf0
+
 #define E6000SW_NUM_PHY_REGS		29
-#define E6000SW_CPUPORTS_MASK		((1 << 5) | (1 << 6))
 #define E6000SW_NUM_VGROUPS		8
-#define E6000SW_NUM_PORTS		7
+#define E6000SW_MAX_PORTS		10
 #define E6000SW_PORT_NO_VGROUP		-1
 #define E6000SW_DEFAULT_AGETIME		20
 #define E6000SW_RETRIES			100
-
-
-/* Default vlangroups */
-#define E6000SW_DEF_VLANGROUP0		(1 | (1 << 1) | (1 << 2) | (1 << 3) | \
-    (1 << 6))
-#define E6000SW_DEF_VLANGROUP1		((1 << 4) | (1 << 5))
+#define E6000SW_SMI_TIMEOUT		16
 
 #endif /* _E6000SWREG_H_ */
diff --git a/sys/dev/firewire/sbp.c b/sys/dev/firewire/sbp.c
index f0aca6f29222..bc0b59fe2fd1 100644
--- a/sys/dev/firewire/sbp.c
+++ b/sys/dev/firewire/sbp.c
@@ -2488,10 +2488,10 @@ END_DEBUG
 		strlcpy(cpi->hba_vid, "SBP", HBA_IDLEN);
 		strlcpy(cpi->dev_name, sim->sim_name, DEV_IDLEN);
 		cpi->unit_number = sim->unit_number;
-                cpi->transport = XPORT_SPI;	/* XX should have a FireWire */
-                cpi->transport_version = 2;
-                cpi->protocol = PROTO_SCSI;
-                cpi->protocol_version = SCSI_REV_2;
+		cpi->transport = XPORT_SPI;	/* XX should have a FireWire */
+		cpi->transport_version = 2;
+		cpi->protocol = PROTO_SCSI;
+		cpi->protocol_version = SCSI_REV_2;
 
 		cpi->ccb_h.status = CAM_REQ_CMP;
 		xpt_done(ccb);
diff --git a/sys/dev/mly/mly.c b/sys/dev/mly/mly.c
index 196e4e6ec1dc..9e3b3329c5cd 100644
--- a/sys/dev/mly/mly.c
+++ b/sys/dev/mly/mly.c
@@ -2110,10 +2110,10 @@ mly_cam_action(struct cam_sim *sim, union ccb *ccb)
 	cpi->max_lun = MLY_MAX_LUNS - 1;
 	cpi->initiator_id = sc->mly_controllerparam->initiator_id;
 	strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
-        strlcpy(cpi->hba_vid, "Mylex", HBA_IDLEN);
-        strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
-        cpi->unit_number = cam_sim_unit(sim);
-        cpi->bus_id = cam_sim_bus(sim);
+	strlcpy(cpi->hba_vid, "Mylex", HBA_IDLEN);
+	strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
+	cpi->unit_number = cam_sim_unit(sim);
+	cpi->bus_id = cam_sim_bus(sim);
 	cpi->base_transfer_speed = 132 * 1024;	/* XXX what to set this to? */
 	cpi->transport = XPORT_SPI;
 	cpi->transport_version = 2;
diff --git a/sys/dev/ncr/ncr.c b/sys/dev/ncr/ncr.c
index ee8a07f7757c..b2bfcdba89e6 100644
--- a/sys/dev/ncr/ncr.c
+++ b/sys/dev/ncr/ncr.c
@@ -4351,10 +4351,10 @@ ncr_action (struct cam_sim *sim, union ccb *ccb)
 		strlcpy(cpi->hba_vid, "Symbios", HBA_IDLEN);
 		strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
 		cpi->unit_number = cam_sim_unit(sim);
-                cpi->transport = XPORT_SPI;
-                cpi->transport_version = 2;
-                cpi->protocol = PROTO_SCSI;
-                cpi->protocol_version = SCSI_REV_2;
+		cpi->transport = XPORT_SPI;
+		cpi->transport_version = 2;
+		cpi->protocol = PROTO_SCSI;
+		cpi->protocol_version = SCSI_REV_2;
 		cpi->ccb_h.status = CAM_REQ_CMP;
 		xpt_done(ccb);
 		break;
diff --git a/sys/dev/nvme/nvme_sim.c b/sys/dev/nvme/nvme_sim.c
index 47001951287a..397a3bc7110a 100644
--- a/sys/dev/nvme/nvme_sim.c
+++ b/sys/dev/nvme/nvme_sim.c
@@ -185,10 +185,10 @@ nvme_sim_action(struct cam_sim *sim, union ccb *ccb)
 		strlcpy(cpi->hba_vid, "NVMe", HBA_IDLEN);
 		strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
 		cpi->unit_number = cam_sim_unit(sim);
-                cpi->transport = XPORT_NVME;		/* XXX XPORT_PCIE ? */
-                cpi->transport_version = 1;		/* XXX Get PCIe spec ? */
-                cpi->protocol = PROTO_NVME;
-                cpi->protocol_version = NVME_REV_1;	/* Groks all 1.x NVMe cards */
+		cpi->transport = XPORT_NVME;		/* XXX XPORT_PCIE ? */
+		cpi->transport_version = 1;		/* XXX Get PCIe spec ? */
+		cpi->protocol = PROTO_NVME;
+		cpi->protocol_version = NVME_REV_1;	/* Groks all 1.x NVMe cards */
 		cpi->xport_specific.nvme.nsid = ns->id;
 		cpi->ccb_h.status = CAM_REQ_CMP;
 		break;
diff --git a/sys/dev/rtwn/rtl8192c/pci/r92ce_init.c b/sys/dev/rtwn/rtl8192c/pci/r92ce_init.c
index 92845aab162f..5b7f9a0e1987 100644
--- a/sys/dev/rtwn/rtl8192c/pci/r92ce_init.c
+++ b/sys/dev/rtwn/rtl8192c/pci/r92ce_init.c
@@ -105,10 +105,6 @@ r92ce_init_bb(struct rtwn_softc *sc)
 	rtwn_setbits_4(sc, R92C_LEDCFG0, 0, 0x00800000);
 
 	r92c_init_bb_common(sc);
-
-	if (rtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
-	    R92C_HSSI_PARAM2_CCK_HIPWR)
-		sc->sc_flags |= RTWN_FLAG_CCK_HIPWR;
 }
 
 int
diff --git a/sys/dev/rtwn/rtl8192c/r92c_init.c b/sys/dev/rtwn/rtl8192c/r92c_init.c
index 95b91a39083b..ed6c18c951fa 100644
--- a/sys/dev/rtwn/rtl8192c/r92c_init.c
+++ b/sys/dev/rtwn/rtl8192c/r92c_init.c
@@ -159,6 +159,9 @@ r92c_init_bb_common(struct rtwn_softc *sc)
 			rtwn_delay(sc, 1);
 		}
 	}
+
+	if (rtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) & R92C_HSSI_PARAM2_CCK_HIPWR)
+		sc->sc_flags |= RTWN_FLAG_CCK_HIPWR;
 }
 
 int
diff --git a/sys/dev/rtwn/rtl8192c/usb/r92cu_init.c b/sys/dev/rtwn/rtl8192c/usb/r92cu_init.c
index fbe0c2132ff6..fc39cee28ebd 100644
--- a/sys/dev/rtwn/rtl8192c/usb/r92cu_init.c
+++ b/sys/dev/rtwn/rtl8192c/usb/r92cu_init.c
@@ -78,10 +78,6 @@ r92cu_init_bb(struct rtwn_softc *sc)
 	rtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
 
 	r92c_init_bb_common(sc);
-
-	if (rtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
-	    R92C_HSSI_PARAM2_CCK_HIPWR)
-		sc->sc_flags |= RTWN_FLAG_CCK_HIPWR;
 }
 
 int
diff --git a/sys/dev/twa/tw_osl_cam.c b/sys/dev/twa/tw_osl_cam.c
index 699c0f468eab..75739ec36537 100644
--- a/sys/dev/twa/tw_osl_cam.c
+++ b/sys/dev/twa/tw_osl_cam.c
@@ -427,11 +427,11 @@ twa_action(struct cam_sim *sim, union ccb *ccb)
 		strlcpy(path_inq->sim_vid, "FreeBSD", SIM_IDLEN);
 		strlcpy(path_inq->hba_vid, "3ware", HBA_IDLEN);
 		strlcpy(path_inq->dev_name, cam_sim_name(sim), DEV_IDLEN);
-                path_inq->transport = XPORT_SPI;
-                path_inq->transport_version = 2;
-                path_inq->protocol = PROTO_SCSI;
-                path_inq->protocol_version = SCSI_REV_2;
-                path_inq->maxio = TW_CL_MAX_IO_SIZE;
+		path_inq->transport = XPORT_SPI;
+		path_inq->transport_version = 2;
+		path_inq->protocol = PROTO_SCSI;
+		path_inq->protocol_version = SCSI_REV_2;
+		path_inq->maxio = TW_CL_MAX_IO_SIZE;
 		ccb_h->status = CAM_REQ_CMP;
 		xpt_done(ccb);
 		break;
diff --git a/sys/fs/nfs/nfs_commonsubs.c b/sys/fs/nfs/nfs_commonsubs.c
index 50093535c260..3e4984eb304f 100644
--- a/sys/fs/nfs/nfs_commonsubs.c
+++ b/sys/fs/nfs/nfs_commonsubs.c
@@ -2047,7 +2047,7 @@ nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
 	nfsattrbit_t *retbitp = &retbits;
 	u_int32_t freenum, *retnump;
 	u_int64_t uquad;
-	struct statfs fs;
+	struct statfs *fs;
 	struct nfsfsinfo fsinf;
 	struct timespec temptime;
 	NFSACL_T *aclp, *naclp = NULL;
@@ -2079,11 +2079,13 @@ nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
 	/*
 	 * Get the VFS_STATFS(), since some attributes need them.
 	 */
+	fs = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
 	if (NFSISSETSTATFS_ATTRBIT(retbitp)) {
-		error = VFS_STATFS(mp, &fs);
+		error = VFS_STATFS(mp, fs);
 		if (error != 0) {
 			if (reterr) {
 				nd->nd_repstat = NFSERR_ACCES;
+				free(fs, M_STATFS);
 				return (0);
 			}
 			NFSCLRSTATFS_ATTRBIT(retbitp);
@@ -2115,6 +2117,7 @@ nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
 			if (error != 0) {
 				if (reterr) {
 					nd->nd_repstat = NFSERR_ACCES;
+					free(fs, M_STATFS);
 					return (0);
 				}
 				NFSCLRBIT_ATTRBIT(retbitp, NFSATTRBIT_ACL);
@@ -2256,7 +2259,7 @@ nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
 			/*
 			 * Check quota and use min(quota, f_ffree).
 			 */
-			freenum = fs.f_ffree;
+			freenum = fs->f_ffree;
 #ifdef QUOTA
 			/*
 			 * ufs_quotactl() insists that the uid argument
@@ -2279,13 +2282,13 @@ nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
 		case NFSATTRBIT_FILESFREE:
 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
 			*tl++ = 0;
-			*tl = txdr_unsigned(fs.f_ffree);
+			*tl = txdr_unsigned(fs->f_ffree);
 			retnum += NFSX_HYPER;
 			break;
 		case NFSATTRBIT_FILESTOTAL:
 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
 			*tl++ = 0;
-			*tl = txdr_unsigned(fs.f_files);
+			*tl = txdr_unsigned(fs->f_files);
 			retnum += NFSX_HYPER;
 			break;
 		case NFSATTRBIT_FSLOCATIONS:
@@ -2361,9 +2364,9 @@ nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
 			break;
 		case NFSATTRBIT_QUOTAHARD:
 			if (priv_check_cred(cred, PRIV_VFS_EXCEEDQUOTA, 0))
-				freenum = fs.f_bfree;
+				freenum = fs->f_bfree;
 			else
-				freenum = fs.f_bavail;
+				freenum = fs->f_bavail;
 #ifdef QUOTA
 			/*
 			 * ufs_quotactl() insists that the uid argument
@@ -2379,15 +2382,15 @@ nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
 #endif	/* QUOTA */
 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
 			uquad = (u_int64_t)freenum;
-			NFSQUOTABLKTOBYTE(uquad, fs.f_bsize);
+			NFSQUOTABLKTOBYTE(uquad, fs->f_bsize);
 			txdr_hyper(uquad, tl);
 			retnum += NFSX_HYPER;
 			break;
 		case NFSATTRBIT_QUOTASOFT:
 			if (priv_check_cred(cred, PRIV_VFS_EXCEEDQUOTA, 0))
-				freenum = fs.f_bfree;
+				freenum = fs->f_bfree;
 			else
-				freenum = fs.f_bavail;
+				freenum = fs->f_bavail;
 #ifdef QUOTA
 			/*
 			 * ufs_quotactl() insists that the uid argument
@@ -2403,7 +2406,7 @@ nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
 #endif	/* QUOTA */
 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
 			uquad = (u_int64_t)freenum;
-			NFSQUOTABLKTOBYTE(uquad, fs.f_bsize);
+			NFSQUOTABLKTOBYTE(uquad, fs->f_bsize);
 			txdr_hyper(uquad, tl);
 			retnum += NFSX_HYPER;
 			break;
@@ -2424,7 +2427,7 @@ nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
 #endif	/* QUOTA */
 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
 			uquad = (u_int64_t)freenum;
-			NFSQUOTABLKTOBYTE(uquad, fs.f_bsize);
+			NFSQUOTABLKTOBYTE(uquad, fs->f_bsize);
 			txdr_hyper(uquad, tl);
 			retnum += NFSX_HYPER;
 			break;
@@ -2437,24 +2440,24 @@ nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
 		case NFSATTRBIT_SPACEAVAIL:
 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
 			if (priv_check_cred(cred, PRIV_VFS_BLOCKRESERVE, 0))
-				uquad = (u_int64_t)fs.f_bfree;
+				uquad = (u_int64_t)fs->f_bfree;
 			else
-				uquad = (u_int64_t)fs.f_bavail;
-			uquad *= fs.f_bsize;
+				uquad = (u_int64_t)fs->f_bavail;
+			uquad *= fs->f_bsize;
 			txdr_hyper(uquad, tl);
 			retnum += NFSX_HYPER;
 			break;
 		case NFSATTRBIT_SPACEFREE:
 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
-			uquad = (u_int64_t)fs.f_bfree;
-			uquad *= fs.f_bsize;
+			uquad = (u_int64_t)fs->f_bfree;
+			uquad *= fs->f_bsize;
 			txdr_hyper(uquad, tl);
 			retnum += NFSX_HYPER;
 			break;
 		case NFSATTRBIT_SPACETOTAL:
 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
-			uquad = (u_int64_t)fs.f_blocks;
-			uquad *= fs.f_bsize;
+			uquad = (u_int64_t)fs->f_blocks;
+			uquad *= fs->f_bsize;
 			txdr_hyper(uquad, tl);
 			retnum += NFSX_HYPER;
 			break;
@@ -2531,6 +2534,7 @@ nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
 	}
 	if (naclp != NULL)
 		acl_free(naclp);
+	free(fs, M_STATFS);
 	*retnump = txdr_unsigned(retnum);
 	return (retnum + prefixnum);
 }
diff --git a/sys/fs/nfsserver/nfs_nfsdserv.c b/sys/fs/nfsserver/nfs_nfsdserv.c
index 54fad67dda3c..8102c5810a97 100644
--- a/sys/fs/nfsserver/nfs_nfsdserv.c
+++ b/sys/fs/nfsserver/nfs_nfsdserv.c
@@ -2035,14 +2035,14 @@ nfsrvd_statfs(struct nfsrv_descript *nd, __unused int isdgram,
 	u_int32_t *tl;
 	int getret = 1;
 	struct nfsvattr at;
-	struct statfs sfs;
 	u_quad_t tval;
 
+	sf = NULL;
 	if (nd->nd_repstat) {
 		nfsrv_postopattr(nd, getret, &at);
 		goto out;
 	}
-	sf = &sfs;
+	sf = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
 	nd->nd_repstat = nfsvno_statfs(vp, sf);
 	getret = nfsvno_getattr(vp, &at, nd->nd_cred, p, 1);
 	vput(vp);
@@ -2078,6 +2078,7 @@ nfsrvd_statfs(struct nfsrv_descript *nd, __unused int isdgram,
 	}
 
 out:
+	free(sf, M_STATFS);
 	NFSEXITCODE2(0, nd);
 	return (0);
 }
@@ -3603,19 +3604,20 @@ nfsrvd_verify(struct nfsrv_descript *nd, int isdgram,
 {
 	int error = 0, ret, fhsize = NFSX_MYFH;
 	struct nfsvattr nva;
-	struct statfs sf;
+	struct statfs *sf;
 	struct nfsfsinfo fs;
 	fhandle_t fh;
 
+	sf = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
 	nd->nd_repstat = nfsvno_getattr(vp, &nva, nd->nd_cred, p, 1);
 	if (!nd->nd_repstat)
-		nd->nd_repstat = nfsvno_statfs(vp, &sf);
+		nd->nd_repstat = nfsvno_statfs(vp, sf);
 	if (!nd->nd_repstat)
 		nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
 	if (!nd->nd_repstat) {
 		nfsvno_getfs(&fs, isdgram);
 		error = nfsv4_loadattr(nd, vp, &nva, NULL, &fh, fhsize, NULL,
-		    &sf, NULL, &fs, NULL, 1, &ret, NULL, NULL, p, nd->nd_cred);
+		    sf, NULL, &fs, NULL, 1, &ret, NULL, NULL, p, nd->nd_cred);
 		if (!error) {
 			if (nd->nd_procnum == NFSV4OP_NVERIFY) {
 				if (ret == 0)
@@ -3627,6 +3629,7 @@ nfsrvd_verify(struct nfsrv_descript *nd, int isdgram,
 		}
 	}
 	vput(vp);
+	free(sf, M_STATFS);
 	NFSEXITCODE2(error, nd);
 	return (error);
 }
diff --git a/sys/fs/nullfs/null_vfsops.c b/sys/fs/nullfs/null_vfsops.c
index de05e8bcaf66..87b89da19988 100644
--- a/sys/fs/nullfs/null_vfsops.c
+++ b/sys/fs/nullfs/null_vfsops.c
@@ -301,29 +301,33 @@ nullfs_statfs(mp, sbp)
 	struct statfs *sbp;
 {
 	int error;
-	struct statfs mstat;
+	struct statfs *mstat;
 
 	NULLFSDEBUG("nullfs_statfs(mp = %p, vp = %p->%p)\n", (void *)mp,
 	    (void *)MOUNTTONULLMOUNT(mp)->nullm_rootvp,
 	    (void *)NULLVPTOLOWERVP(MOUNTTONULLMOUNT(mp)->nullm_rootvp));
 
-	bzero(&mstat, sizeof(mstat));
+	mstat = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK | M_ZERO);
 
-	error = VFS_STATFS(MOUNTTONULLMOUNT(mp)->nullm_vfs, &mstat);
-	if (error)
+	error = VFS_STATFS(MOUNTTONULLMOUNT(mp)->nullm_vfs, mstat);
+	if (error) {
+		free(mstat, M_STATFS);
 		return (error);
+	}
 
 	/* now copy across the "interesting" information and fake the rest */
-	sbp->f_type = mstat.f_type;
+	sbp->f_type = mstat->f_type;
 	sbp->f_flags = (sbp->f_flags & (MNT_RDONLY | MNT_NOEXEC | MNT_NOSUID |
-	    MNT_UNION | MNT_NOSYMFOLLOW)) | (mstat.f_flags & ~MNT_ROOTFS);
-	sbp->f_bsize = mstat.f_bsize;
-	sbp->f_iosize = mstat.f_iosize;
-	sbp->f_blocks = mstat.f_blocks;
-	sbp->f_bfree = mstat.f_bfree;
-	sbp->f_bavail = mstat.f_bavail;
-	sbp->f_files = mstat.f_files;
-	sbp->f_ffree = mstat.f_ffree;
+	    MNT_UNION | MNT_NOSYMFOLLOW)) | (mstat->f_flags & ~MNT_ROOTFS);
+	sbp->f_bsize = mstat->f_bsize;
+	sbp->f_iosize = mstat->f_iosize;
+	sbp->f_blocks = mstat->f_blocks;
+	sbp->f_bfree = mstat->f_bfree;
+	sbp->f_bavail = mstat->f_bavail;
+	sbp->f_files = mstat->f_files;
+	sbp->f_ffree = mstat->f_ffree;
+
+	free(mstat, M_STATFS);
 	return (0);
 }
 
diff --git a/sys/fs/unionfs/union_vfsops.c b/sys/fs/unionfs/union_vfsops.c
index f4b83bbc24bc..2ba4f06206fe 100644
--- a/sys/fs/unionfs/union_vfsops.c
+++ b/sys/fs/unionfs/union_vfsops.c
@@ -390,7 +390,7 @@ unionfs_statfs(struct mount *mp, struct statfs *sbp)
 {
 	struct unionfs_mount *ump;
 	int		error;
-	struct statfs	mstat;
+	struct statfs	*mstat;
 	uint64_t	lbsize;
 
 	ump = MOUNTTOUNIONFSMOUNT(mp);
@@ -398,39 +398,47 @@ unionfs_statfs(struct mount *mp, struct statfs *sbp)
 	UNIONFSDEBUG("unionfs_statfs(mp = %p, lvp = %p, uvp = %p)\n",
 	    (void *)mp, (void *)ump->um_lowervp, (void *)ump->um_uppervp);
 
-	bzero(&mstat, sizeof(mstat));
+	mstat = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK | M_ZERO);
 
-	error = VFS_STATFS(ump->um_lowervp->v_mount, &mstat);
-	if (error)
+	error = VFS_STATFS(ump->um_lowervp->v_mount, mstat);
+	if (error) {
+		free(mstat, M_STATFS);
 		return (error);
+	}
 
 	/* now copy across the "interesting" information and fake the rest */
-	sbp->f_blocks = mstat.f_blocks;
-	sbp->f_files = mstat.f_files;
+	sbp->f_blocks = mstat->f_blocks;
+	sbp->f_files = mstat->f_files;
 
-	lbsize = mstat.f_bsize;
+	lbsize = mstat->f_bsize;
 
-	error = VFS_STATFS(ump->um_uppervp->v_mount, &mstat);
-	if (error)
+	error = VFS_STATFS(ump->um_uppervp->v_mount, mstat);
+	if (error) {
+		free(mstat, M_STATFS);
 		return (error);
+	}
+
 
 	/*
 	 * The FS type etc is copy from upper vfs.
 	 * (write able vfs have priority)
 	 */
-	sbp->f_type = mstat.f_type;
-	sbp->f_flags = mstat.f_flags;
-	sbp->f_bsize = mstat.f_bsize;
-	sbp->f_iosize = mstat.f_iosize;
+	sbp->f_type = mstat->f_type;
+	sbp->f_flags = mstat->f_flags;
+	sbp->f_bsize = mstat->f_bsize;
+	sbp->f_iosize = mstat->f_iosize;
+
+	if (mstat->f_bsize != lbsize)
+		sbp->f_blocks = ((off_t)sbp->f_blocks * lbsize) /
+		    mstat->f_bsize;
 
-	if (mstat.f_bsize != lbsize)
-		sbp->f_blocks = ((off_t)sbp->f_blocks * lbsize) / mstat.f_bsize;
+	sbp->f_blocks += mstat->f_blocks;
+	sbp->f_bfree = mstat->f_bfree;
+	sbp->f_bavail = mstat->f_bavail;
+	sbp->f_files += mstat->f_files;
+	sbp->f_ffree = mstat->f_ffree;
 
-	sbp->f_blocks += mstat.f_blocks;
-	sbp->f_bfree = mstat.f_bfree;
-	sbp->f_bavail = mstat.f_bavail;
-	sbp->f_files += mstat.f_files;
-	sbp->f_ffree = mstat.f_ffree;
+	free(mstat, M_STATFS);
 	return (0);
 }
 
diff --git a/sys/i386/ibcs2/ibcs2_stat.c b/sys/i386/ibcs2/ibcs2_stat.c
index 55d14af99b52..115c2ae2ac29 100644
--- a/sys/i386/ibcs2/ibcs2_stat.c
+++ b/sys/i386/ibcs2/ibcs2_stat.c
@@ -38,6 +38,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/filedesc.h>
 #include <sys/jail.h>
 #include <sys/kernel.h>
+#include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/malloc.h>
 #include <sys/vnode.h>
@@ -108,16 +109,18 @@ ibcs2_statfs(td, uap)
 	struct thread *td;
 	struct ibcs2_statfs_args *uap;
 {
-	struct statfs sf;
+	struct statfs *sf;
 	char *path;
 	int error;
 
 	CHECKALTEXIST(td, uap->path, &path);
-	error = kern_statfs(td, path, UIO_SYSSPACE, &sf);
+	sf = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_statfs(td, path, UIO_SYSSPACE, sf);
 	free(path, M_TEMP);
-	if (error)
-		return (error);
-	return cvt_statfs(&sf, (caddr_t)uap->buf, uap->len);
+	if (error == 0)
+		error = cvt_statfs(sf, (caddr_t)uap->buf, uap->len);
+	free(sf, M_STATFS);
+	return (error);
 }
 
 int
@@ -125,13 +128,15 @@ ibcs2_fstatfs(td, uap)
 	struct thread *td;
 	struct ibcs2_fstatfs_args *uap;
 {
-	struct statfs sf;
+	struct statfs *sf;
 	int error;
 
-	error = kern_fstatfs(td, uap->fd, &sf);
-	if (error)
-		return (error);
-	return cvt_statfs(&sf, (caddr_t)uap->buf, uap->len);
+	sf = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_fstatfs(td, uap->fd, sf);
+	if (error == 0)
+		error = cvt_statfs(sf, (caddr_t)uap->buf, uap->len);
+	free(sf, M_STATFS);
+	return (error);
 }
 
 int
diff --git a/sys/kern/kern_acct.c b/sys/kern/kern_acct.c
index f3bc0cd288e6..622a6a49ea19 100644
--- a/sys/kern/kern_acct.c
+++ b/sys/kern/kern_acct.c
@@ -78,6 +78,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/kthread.h>
 #include <sys/limits.h>
 #include <sys/lock.h>
+#include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
 #include <sys/namei.h>
@@ -552,7 +553,7 @@ encode_long(long val)
 static void
 acctwatch(void)
 {
-	struct statfs sb;
+	struct statfs *sp;
 
 	sx_assert(&acct_sx, SX_XLOCKED);
 
@@ -580,21 +581,25 @@ acctwatch(void)
 	 * Stopping here is better than continuing, maybe it will be VBAD
 	 * next time around.
 	 */
-	if (VFS_STATFS(acct_vp->v_mount, &sb) < 0)
+	sp = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	if (VFS_STATFS(acct_vp->v_mount, sp) < 0) {
+		free(sp, M_STATFS);
 		return;
+	}
 	if (acct_suspended) {
-		if (sb.f_bavail > (int64_t)(acctresume * sb.f_blocks /
+		if (sp->f_bavail > (int64_t)(acctresume * sp->f_blocks /
 		    100)) {
 			acct_suspended = 0;
 			log(LOG_NOTICE, "Accounting resumed\n");
 		}
 	} else {
-		if (sb.f_bavail <= (int64_t)(acctsuspend * sb.f_blocks /
+		if (sp->f_bavail <= (int64_t)(acctsuspend * sp->f_blocks /
 		    100)) {
 			acct_suspended = 1;
 			log(LOG_NOTICE, "Accounting suspended\n");
 		}
 	}
+	free(sp, M_STATFS);
 }
 
 /*
diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index 1a41aac581d4..eda273176794 100644
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -33,39 +33,41 @@ __FBSDID("$FreeBSD$");
 #include "opt_vm.h"
 
 #include <sys/param.h>
-#include <sys/capsicum.h>
 #include <sys/systm.h>
-#include <sys/eventhandler.h>
-#include <sys/lock.h>
-#include <sys/mutex.h>
-#include <sys/sysproto.h>
-#include <sys/signalvar.h>
-#include <sys/kernel.h>
-#include <sys/mount.h>
-#include <sys/filedesc.h>
-#include <sys/fcntl.h>
 #include <sys/acct.h>
+#include <sys/capsicum.h>
+#include <sys/eventhandler.h>
 #include <sys/exec.h>
+#include <sys/fcntl.h>
+#include <sys/filedesc.h>
 #include <sys/imgact.h>
 #include <sys/imgact_elf.h>
-#include <sys/wait.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
 #include <sys/malloc.h>
+#include <sys/mman.h>
+#include <sys/mount.h>
+#include <sys/mutex.h>
+#include <sys/namei.h>
+#include <sys/pioctl.h>
 #include <sys/priv.h>
 #include <sys/proc.h>
-#include <sys/pioctl.h>
 #include <sys/ptrace.h>
-#include <sys/namei.h>
 #include <sys/resourcevar.h>
 #include <sys/rwlock.h>
 #include <sys/sched.h>
 #include <sys/sdt.h>
 #include <sys/sf_buf.h>
-#include <sys/syscallsubr.h>
-#include <sys/sysent.h>
 #include <sys/shm.h>
+#include <sys/signalvar.h>
+#include <sys/smp.h>
+#include <sys/stat.h>
+#include <sys/syscallsubr.h>
 #include <sys/sysctl.h>
+#include <sys/sysent.h>
+#include <sys/sysproto.h>
 #include <sys/vnode.h>
-#include <sys/stat.h>
+#include <sys/wait.h>
 #ifdef KTRACE
 #include <sys/ktrace.h>
 #endif
@@ -1315,17 +1317,80 @@ err_exit:
 	return (error);
 }
 
+struct exec_args_kva {
+	vm_offset_t addr;
+	SLIST_ENTRY(exec_args_kva) next;
+};
+
+static DPCPU_DEFINE(struct exec_args_kva *, exec_args_kva);
+
+static SLIST_HEAD(, exec_args_kva) exec_args_kva_freelist;
+static struct mtx exec_args_kva_mtx;
+
+static void
+exec_prealloc_args_kva(void *arg __unused)
+{
+	struct exec_args_kva *argkva;
+	u_int i;
+
+	SLIST_INIT(&exec_args_kva_freelist);
+	mtx_init(&exec_args_kva_mtx, "exec args kva", NULL, MTX_DEF);
+	for (i = 0; i < exec_map_entries; i++) {
+		argkva = malloc(sizeof(*argkva), M_PARGS, M_WAITOK);
+		argkva->addr = kmap_alloc_wait(exec_map, exec_map_entry_size);
+		SLIST_INSERT_HEAD(&exec_args_kva_freelist, argkva, next);
+	}
+}
+SYSINIT(exec_args_kva, SI_SUB_EXEC, SI_ORDER_ANY, exec_prealloc_args_kva, NULL);
+
+static vm_offset_t
+exec_alloc_args_kva(void **cookie)
+{
+	struct exec_args_kva *argkva;
+
+	argkva = (void *)atomic_readandclear_ptr(
+	    (uintptr_t *)DPCPU_PTR(exec_args_kva));
+	if (argkva == NULL) {
+		mtx_lock(&exec_args_kva_mtx);
+		while ((argkva = SLIST_FIRST(&exec_args_kva_freelist)) == NULL)
+			(void)mtx_sleep(&exec_args_kva_freelist,
+			    &exec_args_kva_mtx, 0, "execkva", 0);
+		SLIST_REMOVE_HEAD(&exec_args_kva_freelist, next);
+		mtx_unlock(&exec_args_kva_mtx);
+	}
+	*(struct exec_args_kva **)cookie = argkva;
+	return (argkva->addr);
+}
+
+static void
+exec_free_args_kva(void *cookie)
+{
+	struct exec_args_kva *argkva;
+	vm_offset_t base;
+
+	argkva = cookie;
+	base = argkva->addr;
+
+	vm_map_madvise(exec_map, base, base + exec_map_entry_size, MADV_FREE);
+	if (!atomic_cmpset_ptr((uintptr_t *)DPCPU_PTR(exec_args_kva),
+	    (uintptr_t)NULL, (uintptr_t)argkva)) {
+		mtx_lock(&exec_args_kva_mtx);
+		SLIST_INSERT_HEAD(&exec_args_kva_freelist, argkva, next);
+		wakeup_one(&exec_args_kva_freelist);
+		mtx_unlock(&exec_args_kva_mtx);
+	}
+}
+
 /*
  * Allocate temporary demand-paged, zero-filled memory for the file name,
- * argument, and environment strings.  Returns zero if the allocation succeeds
- * and ENOMEM otherwise.
+ * argument, and environment strings.
  */
 int
 exec_alloc_args(struct image_args *args)
 {
 
-	args->buf = (char *)kmap_alloc_wait(exec_map, PATH_MAX + ARG_MAX);
-	return (args->buf != NULL ? 0 : ENOMEM);
+	args->buf = (char *)exec_alloc_args_kva(&args->bufkva);
+	return (0);
 }
 
 void
@@ -1333,8 +1398,7 @@ exec_free_args(struct image_args *args)
 {
 
 	if (args->buf != NULL) {
-		kmap_free_wakeup(exec_map, (vm_offset_t)args->buf,
-		    PATH_MAX + ARG_MAX);
+		exec_free_args_kva(args->bufkva);
 		args->buf = NULL;
 	}
 	if (args->fname_buf != NULL) {
diff --git a/sys/kern/kern_sendfile.c b/sys/kern/kern_sendfile.c
index 2b21b3831d0b..d8b88665d15b 100644
--- a/sys/kern/kern_sendfile.c
+++ b/sys/kern/kern_sendfile.c
@@ -62,8 +62,6 @@ __FBSDID("$FreeBSD$");
 #include <vm/vm_object.h>
 #include <vm/vm_pager.h>
 
-extern vm_page_t bogus_page;
-
 /*
  * Structure describing a single sendfile(2) I/O, which may consist of
  * several underlying pager I/Os.
diff --git a/sys/kern/vfs_bio.c b/sys/kern/vfs_bio.c
index 842447d1f6e3..b746eb93eb4d 100644
--- a/sys/kern/vfs_bio.c
+++ b/sys/kern/vfs_bio.c
@@ -288,15 +288,6 @@ static int bufspace_request;
 static int bd_speedupreq;
 
 /*
- * bogus page -- for I/O to/from partially complete buffers
- * this is a temporary solution to the problem, but it is not
- * really that bad.  it would be better to split the buffer
- * for input in the case of buffers partially already in memory,
- * but the code is intricate enough already.
- */
-vm_page_t bogus_page;
-
-/*
  * Synchronization (sleep/wakeup) variable for active buffer space requests.
  * Set when wait starts, cleared prior to wakeup().
  * Used in runningbufwakeup() and waitrunningbufspace().
@@ -1115,9 +1106,6 @@ bufinit(void)
 	hifreebuffers = (3 * lofreebuffers) / 2;
 	numfreebuffers = nbuf;
 
-	bogus_page = vm_page_alloc(NULL, 0, VM_ALLOC_NOOBJ |
-	    VM_ALLOC_NORMAL | VM_ALLOC_WIRED);
-
 	/* Setup the kva and free list allocators. */
 	vmem_set_reclaim(buffer_arena, bufkva_reclaim);
 	buf_zone = uma_zcache_create("buf free cache", sizeof(struct buf),
diff --git a/sys/kern/vfs_cluster.c b/sys/kern/vfs_cluster.c
index 532261e8625f..c77a5ba3eee9 100644
--- a/sys/kern/vfs_cluster.c
+++ b/sys/kern/vfs_cluster.c
@@ -81,9 +81,6 @@ static int read_min = 1;
 SYSCTL_INT(_vfs, OID_AUTO, read_min, CTLFLAG_RW, &read_min, 0,
     "Cluster read min block count");
 
-/* Page expended to mark partially backed buffers */
-extern vm_page_t	bogus_page;
-
 /*
  * Read data to a buf, including read-ahead if we find this to be beneficial.
  * cluster_read replaces bread.
diff --git a/sys/kern/vfs_default.c b/sys/kern/vfs_default.c
index 1e910f8bbb4f..fe34e5658c41 100644
--- a/sys/kern/vfs_default.c
+++ b/sys/kern/vfs_default.c
@@ -931,7 +931,8 @@ int
 vop_stdallocate(struct vop_allocate_args *ap)
 {
 #ifdef __notyet__
-	struct statfs sfs;
+	struct statfs *sfs;
+	off_t maxfilesize = 0;
 #endif
 	struct iovec aiov;
 	struct vattr vattr, *vap;
@@ -967,12 +968,16 @@ vop_stdallocate(struct vop_allocate_args *ap)
 	 * Check if the filesystem sets f_maxfilesize; if not use
 	 * VOP_SETATTR to perform the check.
 	 */
-	error = VFS_STATFS(vp->v_mount, &sfs, td);
+	sfs = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = VFS_STATFS(vp->v_mount, sfs, td);
+	if (error == 0)
+		maxfilesize = sfs->f_maxfilesize;
+	free(sfs, M_STATFS);
 	if (error != 0)
 		goto out;
-	if (sfs.f_maxfilesize) {
-		if (offset > sfs.f_maxfilesize || len > sfs.f_maxfilesize ||
-		    offset + len > sfs.f_maxfilesize) {
+	if (maxfilesize) {
+		if (offset > maxfilesize || len > maxfilesize ||
+		    offset + len > maxfilesize) {
 			error = EFBIG;
 			goto out;
 		}
diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c
index 99bfb101f135..34bf1aaf456c 100644
--- a/sys/kern/vfs_mount.c
+++ b/sys/kern/vfs_mount.c
@@ -79,6 +79,7 @@ SYSCTL_INT(_vfs, OID_AUTO, usermount, CTLFLAG_RW, &usermount, 0,
     "Unprivileged users may mount and unmount file systems");
 
 MALLOC_DEFINE(M_MOUNT, "mount", "vfs mount structure");
+MALLOC_DEFINE(M_STATFS, "statfs", "statfs structure");
 static uma_zone_t mount_zone;
 
 /* List of mounted filesystems. */
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 6407732c9548..bcd12b4fa918 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -298,12 +298,14 @@ sys_statfs(td, uap)
 		struct statfs *buf;
 	} */ *uap;
 {
-	struct statfs sf;
+	struct statfs *sfp;
 	int error;
 
-	error = kern_statfs(td, uap->path, UIO_USERSPACE, &sf);
+	sfp = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_statfs(td, uap->path, UIO_USERSPACE, sfp);
 	if (error == 0)
-		error = copyout(&sf, uap->buf, sizeof(sf));
+		error = copyout(sfp, uap->buf, sizeof(struct statfs));
+	free(sfp, M_STATFS);
 	return (error);
 }
 
@@ -344,12 +346,14 @@ sys_fstatfs(td, uap)
 		struct statfs *buf;
 	} */ *uap;
 {
-	struct statfs sf;
+	struct statfs *sfp;
 	int error;
 
-	error = kern_fstatfs(td, uap->fd, &sf);
+	sfp = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_fstatfs(td, uap->fd, sfp);
 	if (error == 0)
-		error = copyout(&sf, uap->buf, sizeof(sf));
+		error = copyout(sfp, uap->buf, sizeof(struct statfs));
+	free(sfp, M_STATFS);
 	return (error);
 }
 
@@ -420,7 +424,7 @@ kern_getfsstat(struct thread *td, struct statfs **buf, size_t bufsize,
     size_t *countp, enum uio_seg bufseg, int mode)
 {
 	struct mount *mp, *nmp;
-	struct statfs *sfsp, *sp, sb, *tofree;
+	struct statfs *sfsp, *sp, *sptmp, *tofree;
 	size_t count, maxcount;
 	int error;
 
@@ -451,7 +455,7 @@ restart:
 		if (maxcount > count)
 			maxcount = count;
 		tofree = sfsp = *buf = malloc(maxcount * sizeof(struct statfs),
-		    M_TEMP, M_WAITOK);
+		    M_STATFS, M_WAITOK);
 	}
 	count = 0;
 	mtx_lock(&mountlist_mtx);
@@ -476,7 +480,7 @@ restart:
 				 * no other choice than to start over.
 				 */
 				mtx_unlock(&mountlist_mtx);
-				free(tofree, M_TEMP);
+				free(tofree, M_STATFS);
 				goto restart;
 			}
 		} else {
@@ -485,7 +489,7 @@ restart:
 				continue;
 			}
 		}
-		if (sfsp && count < maxcount) {
+		if (sfsp != NULL && count < maxcount) {
 			sp = &mp->mnt_stat;
 			/*
 			 * Set these in case the underlying filesystem
@@ -508,15 +512,20 @@ restart:
 				}
 			}
 			if (priv_check(td, PRIV_VFS_GENERATION)) {
-				bcopy(sp, &sb, sizeof(sb));
-				sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0;
-				prison_enforce_statfs(td->td_ucred, mp, &sb);
-				sp = &sb;
-			}
-			if (bufseg == UIO_SYSSPACE)
+				sptmp = malloc(sizeof(struct statfs), M_STATFS,
+				    M_WAITOK);
+				*sptmp = *sp;
+				sptmp->f_fsid.val[0] = sptmp->f_fsid.val[1] = 0;
+				prison_enforce_statfs(td->td_ucred, mp, sptmp);
+				sp = sptmp;
+			} else
+				sptmp = NULL;
+			if (bufseg == UIO_SYSSPACE) {
 				bcopy(sp, sfsp, sizeof(*sp));
-			else /* if (bufseg == UIO_USERSPACE) */ {
+				free(sptmp, M_STATFS);
+			} else /* if (bufseg == UIO_USERSPACE) */ {
 				error = copyout(sp, sfsp, sizeof(*sp));
+				free(sptmp, M_STATFS);
 				if (error != 0) {
 					vfs_unbusy(mp);
 					return (error);
@@ -530,7 +539,7 @@ restart:
 		vfs_unbusy(mp);
 	}
 	mtx_unlock(&mountlist_mtx);
-	if (sfsp && count > maxcount)
+	if (sfsp != NULL && count > maxcount)
 		*countp = maxcount;
 	else
 		*countp = count;
@@ -558,14 +567,17 @@ freebsd4_statfs(td, uap)
 	} */ *uap;
 {
 	struct ostatfs osb;
-	struct statfs sf;
+	struct statfs *sfp;
 	int error;
 
-	error = kern_statfs(td, uap->path, UIO_USERSPACE, &sf);
-	if (error != 0)
-		return (error);
-	cvtstatfs(&sf, &osb);
-	return (copyout(&osb, uap->buf, sizeof(osb)));
+	sfp = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_statfs(td, uap->path, UIO_USERSPACE, sfp);
+	if (error == 0) {
+		cvtstatfs(sfp, &osb);
+		error = copyout(&osb, uap->buf, sizeof(osb));
+	}
+	free(sfp, M_STATFS);
+	return (error);
 }
 
 /*
@@ -586,14 +598,17 @@ freebsd4_fstatfs(td, uap)
 	} */ *uap;
 {
 	struct ostatfs osb;
-	struct statfs sf;
+	struct statfs *sfp;
 	int error;
 
-	error = kern_fstatfs(td, uap->fd, &sf);
-	if (error != 0)
-		return (error);
-	cvtstatfs(&sf, &osb);
-	return (copyout(&osb, uap->buf, sizeof(osb)));
+	sfp = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_fstatfs(td, uap->fd, sfp);
+	if (error == 0) {
+		cvtstatfs(sfp, &osb);
+		error = copyout(&osb, uap->buf, sizeof(osb));
+	}
+	free(sfp, M_STATFS);
+	return (error);
 }
 
 /*
@@ -638,7 +653,7 @@ freebsd4_getfsstat(td, uap)
 			uap->buf++;
 			count--;
 		}
-		free(buf, M_TEMP);
+		free(buf, M_STATFS);
 	}
 	return (error);
 }
@@ -661,18 +676,21 @@ freebsd4_fhstatfs(td, uap)
 	} */ *uap;
 {
 	struct ostatfs osb;
-	struct statfs sf;
+	struct statfs *sfp;
 	fhandle_t fh;
 	int error;
 
 	error = copyin(uap->u_fhp, &fh, sizeof(fhandle_t));
 	if (error != 0)
 		return (error);
-	error = kern_fhstatfs(td, fh, &sf);
-	if (error != 0)
-		return (error);
-	cvtstatfs(&sf, &osb);
-	return (copyout(&osb, uap->buf, sizeof(osb)));
+	sfp = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_fhstatfs(td, fh, sfp);
+	if (error == 0) {
+		cvtstatfs(sfp, &osb);
+		error = copyout(&osb, uap->buf, sizeof(osb));
+	}
+	free(sfp, M_STATFS);
+	return (error);
 }
 
 /*
@@ -4407,17 +4425,19 @@ sys_fhstatfs(td, uap)
 		struct statfs *buf;
 	} */ *uap;
 {
-	struct statfs sf;
+	struct statfs *sfp;
 	fhandle_t fh;
 	int error;
 
 	error = copyin(uap->u_fhp, &fh, sizeof(fhandle_t));
 	if (error != 0)
 		return (error);
-	error = kern_fhstatfs(td, fh, &sf);
-	if (error != 0)
-		return (error);
-	return (copyout(&sf, uap->buf, sizeof(sf)));
+	sfp = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
+	error = kern_fhstatfs(td, fh, sfp);
+	if (error == 0)
+		error = copyout(sfp, uap->buf, sizeof(*sfp));
+	free(sfp, M_STATFS);
+	return (error);
 }
 
 int
diff --git a/sys/mips/include/db_machdep.h b/sys/mips/include/db_machdep.h
index a4959553d9a4..e6e6b50ce169 100644
--- a/sys/mips/include/db_machdep.h
+++ b/sys/mips/include/db_machdep.h
@@ -92,7 +92,6 @@ db_addr_t	next_instr_address(db_addr_t, boolean_t);
 
 int db_inst_type(int);
 db_addr_t branch_taken(int inst, db_addr_t pc);
-void stacktrace_subr(register_t pc, register_t sp, register_t ra, int (*)(const char *, ...));
 int32_t kdbpeek(int *);
 int64_t kdbpeekd(int *);
 
diff --git a/sys/mips/mips/db_trace.c b/sys/mips/mips/db_trace.c
index 9a3b7308b014..e2db19820655 100644
--- a/sys/mips/mips/db_trace.c
+++ b/sys/mips/mips/db_trace.c
@@ -79,60 +79,8 @@ extern char edata[];
 					((vm_offset_t)(reg) >= MIPS_KSEG0_START))
 #endif
 
-/*
- * Functions ``special'' enough to print by name
- */
-#ifdef __STDC__
-#define	Name(_fn)  { (void*)_fn, # _fn }
-#else
-#define	Name(_fn) { _fn, "_fn"}
-#endif
-static struct {
-	void *addr;
-	char *name;
-}      names[] = {
-
-	Name(trap),
-	Name(MipsKernGenException),
-	Name(MipsUserGenException),
-	Name(MipsKernIntr),
-	Name(MipsUserIntr),
-	Name(cpu_switch),
-	{
-		0, 0
-	}
-};
-
-/*
- * Map a function address to a string name, if known; or a hex string.
- */
-static const char *
-fn_name(uintptr_t addr)
-{
-	static char buf[17];
-	int i = 0;
-
-	db_expr_t diff;
-	c_db_sym_t sym;
-	const char *symname;
-
-	diff = 0;
-	symname = NULL;
-	sym = db_search_symbol((db_addr_t)addr, DB_STGY_ANY, &diff);
-	db_symbol_values(sym, &symname, NULL);
-	if (symname && diff == 0)
-		return (symname);
-
-	for (i = 0; names[i].name; i++)
-		if (names[i].addr == (void *)addr)
-			return (names[i].name);
-	sprintf(buf, "%jx", (uintmax_t)addr);
-	return (buf);
-}
-
-void
-stacktrace_subr(register_t pc, register_t sp, register_t ra,
-	int (*printfn) (const char *,...))
+static void
+stacktrace_subr(register_t pc, register_t sp, register_t ra)
 {
 	InstFmt i;
 	/*
@@ -163,14 +111,13 @@ loop:
 	subr = 0;
 	trapframe = false;
 	if (frames++ > 100) {
-		(*printfn) ("\nstackframe count exceeded\n");
-		/* return breaks stackframe-size heuristics with gcc -O2 */
-		goto finish;	/* XXX */
+		db_printf("\nstackframe count exceeded\n");
+		return;
 	}
-	/* check for bad SP: could foul up next frame */
-	/*XXX MIPS64 bad: this hard-coded SP is lame */
+
+	/* Check for bad SP: could foul up next frame. */
 	if (!MIPS_IS_VALID_KERNELADDR(sp)) {
-		(*printfn) ("SP 0x%jx: not in kernel\n", sp);
+		db_printf("SP 0x%jx: not in kernel\n", sp);
 		ra = 0;
 		subr = 0;
 		goto done;
@@ -212,10 +159,10 @@ loop:
 		ra = 0;
 		goto done;
 	}
-	/* check for bad PC */
-	/*XXX MIPS64 bad: These hard coded constants are lame */
+
+	/* Check for bad PC. */
 	if (!MIPS_IS_VALID_KERNELADDR(pc)) {
-		(*printfn) ("PC 0x%jx: not in kernel\n", pc);
+		db_printf("PC 0x%jx: not in kernel\n", pc);
 		ra = 0;
 		goto done;
 	}
@@ -389,17 +336,18 @@ loop:
 	}
 
 done:
-	(*printfn) ("%s+%x (", fn_name(subr), pc - subr);
+	db_printsym(pc, DB_STGY_PROC);
+	db_printf(" (");
 	for (j = 0; j < 4; j ++) {
 		if (j > 0)
-			(*printfn)(",");
+			db_printf(",");
 		if (valid_args[j])
-			(*printfn)("%jx", (uintmax_t)(u_register_t)args[j]);
+			db_printf("%jx", (uintmax_t)(u_register_t)args[j]);
 		else
-			(*printfn)("?");
+			db_printf("?");
 	}
 
-	(*printfn) (") ra %jx sp %jx sz %d\n",
+	db_printf(") ra %jx sp %jx sz %d\n",
 	    (uintmax_t)(u_register_t) ra,
 	    (uintmax_t)(u_register_t) sp,
 	    stksize);
@@ -420,24 +368,18 @@ done:
 		badvaddr = kdbpeek((int *)TF_REG(sp, BADVADDR));
 #endif
 #undef TF_REG
-		(*printfn) ("--- exception, cause %jx badvaddr %jx ---\n",
+		db_printf("--- exception, cause %jx badvaddr %jx ---\n",
 		    (uintmax_t)cause, (uintmax_t)badvaddr);
 		goto loop;
 	} else if (ra) {
 		if (pc == ra && stksize == 0)
-			(*printfn) ("stacktrace: loop!\n");
+			db_printf("stacktrace: loop!\n");
 		else {
 			pc = ra;
 			sp += stksize;
 			ra = next_ra;
 			goto loop;
 		}
-	} else {
-finish:
-		if (curproc)
-			(*printfn) ("pid %d\n", curproc->p_pid);
-		else
-			(*printfn) ("curproc NULL\n");
 	}
 }
 
@@ -479,7 +421,7 @@ db_trace_self(void)
 		 "move $31, %1\n" /* restore ra */
 		 : "=r" (pc)
 		 : "r" (ra));
-	stacktrace_subr(pc, sp, ra, db_printf);
+	stacktrace_subr(pc, sp, ra);
 	return;
 }
 
@@ -493,7 +435,7 @@ db_trace_thread(struct thread *thr, int count)
 	sp = (register_t)ctx->pcb_context[PCB_REG_SP];
 	pc = (register_t)ctx->pcb_context[PCB_REG_PC];
 	ra = (register_t)ctx->pcb_context[PCB_REG_RA];
-	stacktrace_subr(pc, sp, ra, db_printf);
+	stacktrace_subr(pc, sp, ra);
 
 	return (0);
 }
diff --git a/sys/mips/mips/trap.c b/sys/mips/mips/trap.c
index 33874a8d6c0c..1475d7b659d1 100644
--- a/sys/mips/mips/trap.c
+++ b/sys/mips/mips/trap.c
@@ -278,11 +278,6 @@ char *trap_type[] = {
 struct trapdebug trapdebug[TRAPSIZE], *trp = trapdebug;
 #endif
 
-#if defined(DDB) || defined(DEBUG)
-void stacktrace(struct trapframe *);
-void logstacktrace(struct trapframe *);
-#endif
-
 #define	KERNLAND(x)	((vm_offset_t)(x) >= VM_MIN_KERNEL_ADDRESS && (vm_offset_t)(x) < VM_MAX_KERNEL_ADDRESS)
 #define	DELAYBRANCH(x)	((int)(x) < 0)
 
@@ -1082,7 +1077,6 @@ dofault:
 err:
 
 #if !defined(SMP) && defined(DEBUG)
-		stacktrace(!usermode ? trapframe : td->td_frame);
 		trapDump("trap");
 #endif
 #ifdef SMP
@@ -1302,18 +1296,6 @@ MipsEmulateBranch(struct trapframe *framePtr, uintptr_t instPC, int fpcCSR,
 	return (retAddr);
 }
 
-
-#if defined(DDB) || defined(DEBUG)
-/*
- * Print a stack backtrace.
- */
-void
-stacktrace(struct trapframe *regs)
-{
-	stacktrace_subr(regs->pc, regs->sp, regs->ra, printf);
-}
-#endif
-
 static void
 log_frame_dump(struct trapframe *frame)
 {
diff --git a/sys/net/if_media.h b/sys/net/if_media.h
index 19bf4686937b..b6c999d3522d 100644
--- a/sys/net/if_media.h
+++ b/sys/net/if_media.h
@@ -573,6 +573,7 @@ struct ifmedia_description {
 	{ IFM_IEEE80211_OFDM4, "OFDM/4.5Mbps" },			\
 	{ IFM_IEEE80211_OFDM27, "OFDM/27Mbps" },			\
 	{ IFM_IEEE80211_MCS, "MCS" },					\
+	{ IFM_IEEE80211_VHT, "VHT" },					\
 	{ 0, NULL },							\
 }
 
@@ -612,6 +613,7 @@ struct ifmedia_description {
 	{ IFM_IEEE80211_OFDM4, "OFDM4.5" },				\
 	{ IFM_IEEE80211_OFDM27, "OFDM27" },				\
 	{ IFM_IEEE80211_MCS, "MCS" },					\
+	{ IFM_IEEE80211_VHT, "VHT" },					\
 	{ 0, NULL },							\
 }
 
@@ -634,6 +636,8 @@ struct ifmedia_description {
 	{ IFM_IEEE80211_FH, "fh" },					\
 	{ IFM_IEEE80211_11NA, "11na" },					\
 	{ IFM_IEEE80211_11NG, "11ng" },					\
+	{ IFM_IEEE80211_VHT5G, "11ac" },				\
+	{ IFM_IEEE80211_VHT2G, "11ac2" },				\
 	{ 0, NULL },							\
 }
 
diff --git a/sys/net80211/ieee80211_var.h b/sys/net80211/ieee80211_var.h
index fa1d18e001c3..5238893fe950 100644
--- a/sys/net80211/ieee80211_var.h
+++ b/sys/net80211/ieee80211_var.h
@@ -232,8 +232,9 @@ struct ieee80211com {
 	/* VHT information */
 	uint32_t		ic_vhtcaps;	/* VHT capabilities */
 	uint32_t		ic_vhtextcaps;	/* VHT extended capabilities (TODO) */
-	struct ieee80211_vht_mcs_info	iv_vht_mcsinfo; /* Support TX/RX VHT MCS */
-	uint32_t		ic_vht_spare[4];
+	struct ieee80211_vht_mcs_info	ic_vht_mcsinfo; /* Support TX/RX VHT MCS */
+	uint32_t		ic_flags_vht;	/* VHT state flags */
+	uint32_t		ic_vht_spare[3];
 
 	/* optional state for Atheros SuperG protocol extensions */
 	struct ieee80211_superg	*ic_superg;
@@ -651,6 +652,10 @@ MALLOC_DECLARE(M_80211_VAP);
 
 #define	IEEE80211_FVEN_BITS	"\20"
 
+#define	IEEE80211_FVHT_VHT	0x000000001	/* CONF: VHT supported */
+#define	IEEE80211_VFHT_BITS \
+	"\20\1VHT"
+
 int	ic_printf(struct ieee80211com *, const char *, ...) __printflike(2, 3);
 void	ieee80211_ifattach(struct ieee80211com *);
 void	ieee80211_ifdetach(struct ieee80211com *);
diff --git a/sys/netinet/tcp_hostcache.c b/sys/netinet/tcp_hostcache.c
index bb2efda391d2..d27f2b53df28 100644
--- a/sys/netinet/tcp_hostcache.c
+++ b/sys/netinet/tcp_hostcache.c
@@ -69,10 +69,12 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/param.h>
 #include <sys/systm.h>
+#include <sys/jail.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
 #include <sys/mutex.h>
 #include <sys/malloc.h>
+#include <sys/proc.h>
 #include <sys/sbuf.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
@@ -625,6 +627,9 @@ sysctl_tcp_hc_list(SYSCTL_HANDLER_ARGS)
 	char ip6buf[INET6_ADDRSTRLEN];
 #endif
 
+	if (jailed_without_vnet(curthread->td_ucred) != 0)
+		return (EPERM);
+
 	sbuf_new(&sb, NULL, linesize * (V_tcp_hostcache.cache_count + 1),
 		SBUF_INCLUDENUL);
 
diff --git a/sys/sys/imgact.h b/sys/sys/imgact.h
index c53bbfb8c4d1..8cefb65e93cc 100644
--- a/sys/sys/imgact.h
+++ b/sys/sys/imgact.h
@@ -42,6 +42,7 @@ struct ucred;
 
 struct image_args {
 	char *buf;		/* pointer to string buffer */
+	void *bufkva;		/* cookie for string buffer KVA */
 	char *begin_argv;	/* beginning of argv in buf */
 	char *begin_envv;	/* beginning of envv in buf */
 	char *endp;		/* current `end' pointer of arg & env strings */
diff --git a/sys/sys/mount.h b/sys/sys/mount.h
index b6f9fec39407..6969c18721f2 100644
--- a/sys/sys/mount.h
+++ b/sys/sys/mount.h
@@ -597,6 +597,7 @@ struct uio;
 
 #ifdef MALLOC_DECLARE
 MALLOC_DECLARE(M_MOUNT);
+MALLOC_DECLARE(M_STATFS);
 #endif
 extern int maxvfsconf;		/* highest defined filesystem type */
 
diff --git a/sys/vm/vm_init.c b/sys/vm/vm_init.c
index 8b5f2adf691f..21ff61a394e6 100644
--- a/sys/vm/vm_init.c
+++ b/sys/vm/vm_init.c
@@ -91,10 +91,6 @@ __FBSDID("$FreeBSD$");
 
 long physmem;
 
-static int exec_map_entries = 16;
-SYSCTL_INT(_vm, OID_AUTO, exec_map_entries, CTLFLAG_RDTUN, &exec_map_entries, 0,
-    "Maximum number of simultaneous execs");
-
 /*
  * System initialization
  */
@@ -271,10 +267,19 @@ again:
 		panic("Clean map calculation incorrect");
 
 	/*
- 	 * Allocate the pageable submaps.
+	 * Allocate the pageable submaps.  We may cache an exec map entry per
+	 * CPU, so we therefore need to reserve space for at least ncpu+1
+	 * entries to avoid deadlock.  The exec map is also used by some image
+	 * activators, so we leave a fixed number of pages for their use.
 	 */
+#ifdef __LP64__
+	exec_map_entries = 8 * mp_ncpus;
+#else
+	exec_map_entries = 2 * mp_ncpus + 4;
+#endif
+	exec_map_entry_size = round_page(PATH_MAX + ARG_MAX);
 	exec_map = kmem_suballoc(kernel_map, &minaddr, &maxaddr,
-	    exec_map_entries * round_page(PATH_MAX + ARG_MAX), FALSE);
+	    exec_map_entries * exec_map_entry_size + 64 * PAGE_SIZE, FALSE);
 	pipe_map = kmem_suballoc(kernel_map, &minaddr, &maxaddr, maxpipekva,
 	    FALSE);
 }
diff --git a/sys/vm/vm_kern.c b/sys/vm/vm_kern.c
index f56dbca2fb66..faaee403025e 100644
--- a/sys/vm/vm_kern.c
+++ b/sys/vm/vm_kern.c
@@ -97,6 +97,9 @@ CTASSERT((ZERO_REGION_SIZE & PAGE_MASK) == 0);
 /* NB: Used by kernel debuggers. */
 const u_long vm_maxuser_address = VM_MAXUSER_ADDRESS;
 
+u_int exec_map_entry_size;
+u_int exec_map_entries;
+
 SYSCTL_ULONG(_vm, OID_AUTO, min_kernel_address, CTLFLAG_RD,
     SYSCTL_NULL_ULONG_PTR, VM_MIN_KERNEL_ADDRESS, "Min kernel address");
 
diff --git a/sys/vm/vm_kern.h b/sys/vm/vm_kern.h
index aec3ebde74f7..89059e63944f 100644
--- a/sys/vm/vm_kern.h
+++ b/sys/vm/vm_kern.h
@@ -61,7 +61,7 @@
  */
 
 #ifndef _VM_VM_KERN_H_
-#define _VM_VM_KERN_H_ 1
+#define	_VM_VM_KERN_H_
 
 /* Kernel memory management definitions. */
 extern vm_map_t kernel_map;
@@ -74,5 +74,7 @@ extern struct vmem *transient_arena;
 extern struct vmem *memguard_arena;
 extern vm_offset_t swapbkva;
 extern u_long vm_kmem_size;
+extern u_int exec_map_entries;
+extern u_int exec_map_entry_size;
 
-#endif				/* _VM_VM_KERN_H_ */
+#endif /* _VM_VM_KERN_H_ */
diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c
index 503b02be29f8..ff76cab8991c 100644
--- a/sys/vm/vm_page.c
+++ b/sys/vm/vm_page.c
@@ -131,6 +131,12 @@ struct mtx_padalign vm_page_queue_free_mtx;
 
 struct mtx_padalign pa_lock[PA_LOCK_COUNT];
 
+/*
+ * bogus page -- for I/O to/from partially complete buffers,
+ * or for paging into sparsely invalid regions.
+ */
+vm_page_t bogus_page;
+
 vm_page_t vm_page_array;
 long vm_page_array_size;
 long first_page;
@@ -158,7 +164,7 @@ static void vm_page_alloc_check(vm_page_t m);
 static void vm_page_clear_dirty_mask(vm_page_t m, vm_page_bits_t pagebits);
 static void vm_page_enqueue(uint8_t queue, vm_page_t m);
 static void vm_page_free_wakeup(void);
-static void vm_page_init_fakepg(void *dummy);
+static void vm_page_init(void *dummy);
 static int vm_page_insert_after(vm_page_t m, vm_object_t object,
     vm_pindex_t pindex, vm_page_t mpred);
 static void vm_page_insert_radixdone(vm_page_t m, vm_object_t object,
@@ -166,14 +172,16 @@ static void vm_page_insert_radixdone(vm_page_t m, vm_object_t object,
 static int vm_page_reclaim_run(int req_class, u_long npages, vm_page_t m_run,
     vm_paddr_t high);
 
-SYSINIT(vm_page, SI_SUB_VM, SI_ORDER_SECOND, vm_page_init_fakepg, NULL);
+SYSINIT(vm_page, SI_SUB_VM, SI_ORDER_SECOND, vm_page_init, NULL);
 
 static void
-vm_page_init_fakepg(void *dummy)
+vm_page_init(void *dummy)
 {
 
 	fakepg_zone = uma_zcreate("fakepg", sizeof(struct vm_page), NULL, NULL,
 	    NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE | UMA_ZONE_VM);
+	bogus_page = vm_page_alloc(NULL, 0, VM_ALLOC_NOOBJ |
+	    VM_ALLOC_NORMAL | VM_ALLOC_WIRED);
 }
 
 /* Make sure that u_long is at least 64 bits when PAGE_SIZE is 32K. */
diff --git a/sys/vm/vm_page.h b/sys/vm/vm_page.h
index f53e41ea689f..25b83e4a580c 100644
--- a/sys/vm/vm_page.h
+++ b/sys/vm/vm_page.h
@@ -243,6 +243,8 @@ extern struct vm_domain vm_dom[MAXMEMDOM];
 #define	vm_pagequeue_unlock(pq)		mtx_unlock(&(pq)->pq_mutex)
 
 #ifdef _KERNEL
+extern vm_page_t bogus_page;
+
 static __inline void
 vm_pagequeue_cnt_add(struct vm_pagequeue *pq, int addend)
 {
diff --git a/sys/vm/vm_pager.c b/sys/vm/vm_pager.c
index ec23a43665b9..b57657657286 100644
--- a/sys/vm/vm_pager.c
+++ b/sys/vm/vm_pager.c
@@ -84,8 +84,6 @@ __FBSDID("$FreeBSD$");
 #include <vm/vm_pager.h>
 #include <vm/vm_extern.h>
 
-extern vm_page_t bogus_page;
-
 int cluster_pbuf_freecnt = -1;	/* unlimited to begin with */
 
 struct buf *swbuf;
diff --git a/sys/vm/vnode_pager.c b/sys/vm/vnode_pager.c
index 42ef98c0e49d..ccb4b8a5713a 100644
--- a/sys/vm/vnode_pager.c
+++ b/sys/vm/vnode_pager.c
@@ -974,10 +974,14 @@ vnode_pager_generic_getpages(struct vnode *vp, vm_page_t *m, int count,
 #ifdef INVARIANTS
 	KASSERT(bp->b_npages <= nitems(bp->b_pages),
 	    ("%s: buf %p overflowed", __func__, bp));
-	for (int j = 1; j < bp->b_npages; j++)
-		KASSERT(bp->b_pages[j]->pindex - 1 ==
-		    bp->b_pages[j - 1]->pindex,
-		    ("%s: pages array not consecutive, bp %p", __func__, bp));
+	for (int j = 1, prev = 1; j < bp->b_npages; j++) {
+		if (bp->b_pages[j] == bogus_page)
+			continue;
+		KASSERT(bp->b_pages[j]->pindex - bp->b_pages[prev]->pindex ==
+		    j - prev, ("%s: pages array not consecutive, bp %p",
+		     __func__, bp));
+		prev = j;
+	}
 #endif
 
 	/*
diff --git a/usr.bin/netstat/if.c b/usr.bin/netstat/if.c
index 55d320e9c8c9..6fb8e63bc011 100644
--- a/usr.bin/netstat/if.c
+++ b/usr.bin/netstat/if.c
@@ -393,10 +393,10 @@ intpr(void (*pfunc)(char *), int af)
 		case AF_LINK:
 		    {
 			struct sockaddr_dl *sdl;
-			char linknum[10];
+			char linknum[sizeof("<Link#32767>")];
 
 			sdl = (struct sockaddr_dl *)ifa->ifa_addr;
-			sprintf(linknum, "<Link#%d>", sdl->sdl_index);
+			snprintf(linknum, sizeof(linknum), "<Link#%d>", sdl->sdl_index);
 			xo_emit("{t:network/%-*.*s} ", net_len, net_len,
 			    linknum);
 			if (sdl->sdl_nlen == 0 &&
diff --git a/usr.bin/netstat/inet.c b/usr.bin/netstat/inet.c
index c48d93dfbd5a..71dc9f6ab72b 100644
--- a/usr.bin/netstat/inet.c
+++ b/usr.bin/netstat/inet.c
@@ -84,7 +84,6 @@ __FBSDID("$FreeBSD$");
 #include "netstat.h"
 #include "nl_defs.h"
 
-char	*inetname(struct in_addr *);
 void	inetprint(const char *, struct in_addr *, int, const char *, int,
     const int);
 #ifdef INET6
@@ -1413,21 +1412,26 @@ inetprint(const char *container, struct in_addr *in, int port,
 	struct servent *sp = 0;
 	char line[80], *cp;
 	int width;
+	size_t alen, plen;
 
 	if (container)
 		xo_open_container(container);
 
 	if (Wflag)
-	    sprintf(line, "%s.", inetname(in));
+	    snprintf(line, sizeof(line), "%s.", inetname(in));
 	else
-	    sprintf(line, "%.*s.", (Aflag && !num_port) ? 12 : 16, inetname(in));
-	cp = strchr(line, '\0');
+	    snprintf(line, sizeof(line), "%.*s.",
+		(Aflag && !num_port) ? 12 : 16, inetname(in));
+	alen = strlen(line);
+	cp = line + alen;
 	if (!num_port && port)
 		sp = getservbyport((int)port, proto);
 	if (sp || port == 0)
-		sprintf(cp, "%.15s ", sp ? sp->s_name : "*");
+		snprintf(cp, sizeof(line) - alen,
+		    "%.15s ", sp ? sp->s_name : "*");
 	else
-		sprintf(cp, "%d ", ntohs((u_short)port));
+		snprintf(cp, sizeof(line) - alen,
+		    "%d ", ntohs((u_short)port));
 	width = (Aflag && !Wflag) ? 18 :
 		((!Wflag || af1 == AF_INET) ? 22 : 45);
 	if (Wflag)
@@ -1435,7 +1439,8 @@ inetprint(const char *container, struct in_addr *in, int port,
 	else
 		xo_emit("{d:target/%-*.*s} ", width, width, line);
 
-	int alen = cp - line - 1, plen = strlen(cp) - 1;
+	plen = strlen(cp) - 1;
+	alen--;
 	xo_emit("{e:address/%*.*s}{e:port/%*.*s}", alen, alen, line, plen,
 	    plen, cp);
 
@@ -1481,8 +1486,9 @@ inetname(struct in_addr *inp)
 	} else {
 		inp->s_addr = ntohl(inp->s_addr);
 #define	C(x)	((u_int)((x) & 0xff))
-		sprintf(line, "%u.%u.%u.%u", C(inp->s_addr >> 24),
-		    C(inp->s_addr >> 16), C(inp->s_addr >> 8), C(inp->s_addr));
+		snprintf(line, sizeof(line), "%u.%u.%u.%u",
+		    C(inp->s_addr >> 24), C(inp->s_addr >> 16),
+		    C(inp->s_addr >> 8), C(inp->s_addr));
 	}
 	return (line);
 }
diff --git a/usr.bin/netstat/inet6.c b/usr.bin/netstat/inet6.c
index d01f690ec6ed..e62eeac2e10f 100644
--- a/usr.bin/netstat/inet6.c
+++ b/usr.bin/netstat/inet6.c
@@ -70,8 +70,6 @@ __FBSDID("$FreeBSD$");
 #include <libxo/xo.h>
 #include "netstat.h"
 
-char	*inet6name(struct in6_addr *);
-
 static char ntop_buf[INET6_ADDRSTRLEN];
 
 static	const char *ip6nh[] = {
@@ -1270,24 +1268,30 @@ inet6print(const char *container, struct in6_addr *in6, int port,
 	struct servent *sp = 0;
 	char line[80], *cp;
 	int width;
+	size_t alen, plen;
 
 	if (container)
 		xo_open_container(container);
 
-	sprintf(line, "%.*s.", Wflag ? 39 : (Aflag && !numeric) ? 12 : 16,
+	snprintf(line, sizeof(line), "%.*s.",
+	    Wflag ? 39 : (Aflag && !numeric) ? 12 : 16,
 	    inet6name(in6));
-	cp = strchr(line, '\0');
+	alen = strlen(line);
+	cp = line + alen;
 	if (!numeric && port)
 		GETSERVBYPORT6(port, proto, sp);
 	if (sp || port == 0)
-		sprintf(cp, "%.15s", sp ? sp->s_name : "*");
+		snprintf(cp, sizeof(line) - alen,
+		    "%.15s", sp ? sp->s_name : "*");
 	else
-		sprintf(cp, "%d", ntohs((u_short)port));
+		snprintf(cp, sizeof(line) - alen,
+		    "%d", ntohs((u_short)port));
 	width = Wflag ? 45 : Aflag ? 18 : 22;
 
 	xo_emit("{d:target/%-*.*s} ", width, width, line);
 
-	int alen = cp - line - 1, plen = strlen(cp) - 1;
+	plen = strlen(cp);
+	alen--;
 	xo_emit("{e:address/%*.*s}{e:port/%*.*s}", alen, alen, line, plen,
 	    plen, cp);
 
@@ -1306,7 +1310,7 @@ inet6name(struct in6_addr *in6p)
 {
 	struct sockaddr_in6 sin6;
 	char hbuf[NI_MAXHOST], *cp;
-	static char line[50];
+	static char line[NI_MAXHOST];
 	static char domain[MAXHOSTNAMELEN];
 	static int first = 1;
 	int flags, error;
@@ -1317,9 +1321,9 @@ inet6name(struct in6_addr *in6p)
 	}
 	if (first && !numeric_addr) {
 		first = 0;
-		if (gethostname(domain, MAXHOSTNAMELEN) == 0 &&
+		if (gethostname(domain, sizeof(domain)) == 0 &&
 		    (cp = strchr(domain, '.')))
-			(void) strcpy(domain, cp + 1);
+			strlcpy(domain, cp + 1, sizeof(domain));
 		else
 			domain[0] = 0;
 	}
@@ -1336,10 +1340,10 @@ inet6name(struct in6_addr *in6p)
 		    (cp = strchr(hbuf, '.')) &&
 		    !strcmp(cp + 1, domain))
 			*cp = 0;
-		strcpy(line, hbuf);
+		strlcpy(line, hbuf, sizeof(line));
 	} else {
 		/* XXX: this should not happen. */
-		sprintf(line, "%s",
+		snprintf(line, sizeof(line), "%s",
 			inet_ntop(AF_INET6, (void *)&sin6.sin6_addr, ntop_buf,
 				sizeof(ntop_buf)));
 	}
diff --git a/usr.bin/netstat/mroute.c b/usr.bin/netstat/mroute.c
index 975473ee82d5..d4d60145f18e 100644
--- a/usr.bin/netstat/mroute.c
+++ b/usr.bin/netstat/mroute.c
@@ -100,17 +100,19 @@ print_bw_meter(struct bw_meter *bw_meter, int *banner_printed)
 
 	/* The measured values */
 	if (bw_meter->bm_flags & BW_METER_UNIT_PACKETS) {
-		sprintf(s1, "%ju", (uintmax_t)bw_meter->bm_measured.b_packets);
+		snprintf(s1, sizeof(s1), "%ju",
+		    (uintmax_t)bw_meter->bm_measured.b_packets);
 		xo_emit("{e:measured-packets/%ju}",
 		    (uintmax_t)bw_meter->bm_measured.b_packets);
 	} else
-		sprintf(s1, "?");
+		strcpy(s1, "?");
 	if (bw_meter->bm_flags & BW_METER_UNIT_BYTES) {
-		sprintf(s2, "%ju", (uintmax_t)bw_meter->bm_measured.b_bytes);
+		snprintf(s2, sizeof(s2), "%ju",
+		    (uintmax_t)bw_meter->bm_measured.b_bytes);
 		xo_emit("{e:measured-bytes/%ju}",
 		    (uintmax_t)bw_meter->bm_measured.b_bytes);
 	} else
-		sprintf(s2, "?");
+		strcpy(s2, "?");
 	xo_emit("  {[:-30}{:start-time/%lu.%06lu}|{q:measured-packets/%s}"
 	    "|{q:measured-bytes%s}{]:}",
 	    (u_long)bw_meter->bm_start_time.tv_sec,
@@ -122,17 +124,19 @@ print_bw_meter(struct bw_meter *bw_meter, int *banner_printed)
 
 	/* The threshold values */
 	if (bw_meter->bm_flags & BW_METER_UNIT_PACKETS) {
-		sprintf(s1, "%ju", (uintmax_t)bw_meter->bm_threshold.b_packets);
+		snprintf(s1, sizeof(s1), "%ju",
+		    (uintmax_t)bw_meter->bm_threshold.b_packets);
 		xo_emit("{e:threshold-packets/%ju}",
 		    (uintmax_t)bw_meter->bm_threshold.b_packets);
 	} else
-		sprintf(s1, "?");
+		strcpy(s1, "?");
 	if (bw_meter->bm_flags & BW_METER_UNIT_BYTES) {
-		sprintf(s2, "%ju", (uintmax_t)bw_meter->bm_threshold.b_bytes);
+		snprintf(s2, sizeof(s2), "%ju",
+		    (uintmax_t)bw_meter->bm_threshold.b_bytes);
 		xo_emit("{e:threshold-bytes/%ju}",
 		    (uintmax_t)bw_meter->bm_threshold.b_bytes);
 	} else
-		sprintf(s2, "?");
+		strcpy(s2, "?");
 
 	xo_emit("  {[:-30}{:threshold-time/%lu.%06lu}|{q:threshold-packets/%s}"
 	    "|{q:threshold-bytes%s}{]:}",
@@ -144,13 +148,13 @@ print_bw_meter(struct bw_meter *bw_meter, int *banner_printed)
 		 &bw_meter->bm_threshold.b_time, &end);
 	if (timercmp(&now, &end, <=)) {
 		timersub(&end, &now, &delta);
-		sprintf(s3, "%lu.%06lu",
+		snprintf(s3, sizeof(s3), "%lu.%06lu",
 			(u_long)delta.tv_sec,
 			(u_long)delta.tv_usec);
 	} else {
 		/* Negative time */
 		timersub(&now, &end, &delta);
-		sprintf(s3, "-%lu.06%lu",
+		snprintf(s3, sizeof(s3), "-%lu.06%lu",
 			(u_long)delta.tv_sec,
 			(u_long)delta.tv_usec);
 	}
diff --git a/usr.bin/netstat/netstat.h b/usr.bin/netstat/netstat.h
index 4db28445e02d..ee30d3a0529c 100644
--- a/usr.bin/netstat/netstat.h
+++ b/usr.bin/netstat/netstat.h
@@ -100,7 +100,16 @@ void	ah_stats(u_long, const char *, int, int);
 void	ipcomp_stats(u_long, const char *, int, int);
 #endif
 
+#ifdef INET
+struct in_addr;
+
+char	*inetname(struct in_addr *);
+#endif
+
 #ifdef INET6
+struct in6_addr;
+
+char	*inet6name(struct in6_addr *);
 void	ip6_stats(u_long, const char *, int, int);
 void	ip6_ifstats(char *);
 void	icmp6_stats(u_long, const char *, int, int);
diff --git a/usr.bin/netstat/route.c b/usr.bin/netstat/route.c
index 808f4cd660ef..b4a86bbbf592 100644
--- a/usr.bin/netstat/route.c
+++ b/usr.bin/netstat/route.c
@@ -56,6 +56,7 @@ __FBSDID("$FreeBSD$");
 #include <ifaddrs.h>
 #include <libutil.h>
 #include <netdb.h>
+#include <stdbool.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -115,7 +116,7 @@ static const char *fmt_sockaddr(struct sockaddr *sa, struct sockaddr *mask,
     int flags);
 static void p_flags(int, const char *);
 static const char *fmt_flags(int f);
-static void domask(char *, in_addr_t, u_long);
+static void domask(char *, size_t, u_long);
 
 
 /*
@@ -494,12 +495,16 @@ fmt_sockaddr(struct sockaddr *sa, struct sockaddr *mask, int flags)
 
 		cq = buf;
 		slim =  sa->sa_len + (u_char *) sa;
-		cqlim = cq + sizeof(buf) - 6;
-		cq += sprintf(cq, "(%d)", sa->sa_family);
+		cqlim = cq + sizeof(buf) - sizeof(" ffff");
+		snprintf(cq, sizeof(cq), "(%d)", sa->sa_family);
+		cq += strlen(cq);
 		while (s < slim && cq < cqlim) {
-			cq += sprintf(cq, " %02x", *s++);
-			if (s < slim)
-			    cq += sprintf(cq, "%02x", *s++);
+			snprintf(cq, sizeof(" ff"), " %02x", *s++);
+			cq += strlen(cq);
+			if (s < slim) {
+			    snprintf(cq, sizeof("ff"), "%02x", *s++);
+			    cq += strlen(cq);
+			}
 		}
 		cp = buf;
 	    }
@@ -576,7 +581,7 @@ routename(struct sockaddr *sa, int flags)
 	0)
 
 static void
-domask(char *dst, in_addr_t addr __unused, u_long mask)
+domask(char *dst, size_t buflen, u_long mask)
 {
 	int b, i;
 
@@ -598,9 +603,9 @@ domask(char *dst, in_addr_t addr __unused, u_long mask)
 			break;
 		}
 	if (i == -1)
-		sprintf(dst, "&0x%lx", mask);
+		snprintf(dst, buflen, "&0x%lx", mask);
 	else
-		sprintf(dst, "/%d", 32-i);
+		snprintf(dst, buflen, "/%d", 32-i);
 }
 
 /*
@@ -631,7 +636,7 @@ static const char *
 netname4(in_addr_t in, in_addr_t mask)
 {
 	char *cp = 0;
-	static char line[MAXHOSTNAMELEN + sizeof("/xx")];
+	static char line[MAXHOSTNAMELEN + sizeof("&0xffffffff")];
 	char nline[INET_ADDRSTRLEN];
 	struct netent *np = 0;
 	in_addr_t i;
@@ -657,7 +662,7 @@ netname4(in_addr_t in, in_addr_t mask)
 	else {
 		inet_ntop(AF_INET, &in, nline, sizeof(nline));
 		strlcpy(line, nline, sizeof(line));
-		domask(line + strlen(line), i, ntohl(mask));
+		domask(line + strlen(line), sizeof(line) - strlen(line), ntohl(mask));
 	}
 
 	return (line);
@@ -686,7 +691,7 @@ in6_fillscopeid(struct sockaddr_in6 *sa6)
 }
 
 /* Mask to length table.  To check an invalid value, (length + 1) is used. */
-static int masktolen[256] = {
+static const u_char masktolen[256] = {
 	[0xff] = 8 + 1,
 	[0xfe] = 7 + 1,
 	[0xfc] = 6 + 1,
@@ -704,17 +709,20 @@ netname6(struct sockaddr_in6 *sa6, struct sockaddr_in6 *mask)
 	static char line[NI_MAXHOST + sizeof("/xxx") - 1];
 	struct sockaddr_in6 addr;
 	char nline[NI_MAXHOST];
+	char maskbuf[sizeof("/xxx")];
 	u_char *p, *lim;
-	int masklen, illegal = 0, i;
+	u_char masklen;
+	int i;
+	bool illegal = false;
 
 	if (mask) {
 		p = (u_char *)&mask->sin6_addr;
 		for (masklen = 0, lim = p + 16; p < lim; p++) {
-			if (masktolen[*p] > 0)
+			if (masktolen[*p] > 0) {
 				/* -1 is required. */
-				masklen += masktolen[*p] - 1;
-			else
-				illegal++;
+				masklen += (masktolen[*p] - 1);
+			} else
+				illegal = true;
 		}
 		if (illegal)
 			xo_error("illegal prefixlen\n");
@@ -738,8 +746,10 @@ netname6(struct sockaddr_in6 *sa6, struct sockaddr_in6 *mask)
 	else
 		getnameinfo((struct sockaddr *)sa6, sa6->sin6_len, line,
 		    sizeof(line), NULL, 0, 0);
-	if (numeric_addr || strcmp(line, nline) == 0)
-		sprintf(&line[strlen(line)], "/%d", masklen);
+	if (numeric_addr || strcmp(line, nline) == 0) {
+		snprintf(maskbuf, sizeof(maskbuf), "/%d", masklen);
+		strlcat(line, maskbuf, sizeof(line));
+	}
 
 	return (line);
 }
diff --git a/usr.bin/netstat/sctp.c b/usr.bin/netstat/sctp.c
index fd133e35b0d5..084e9ece7543 100644
--- a/usr.bin/netstat/sctp.c
+++ b/usr.bin/netstat/sctp.c
@@ -104,16 +104,6 @@ struct xraddr_entry {
 	LIST_ENTRY(xraddr_entry) xraddr_entries;
 };
 
-#ifdef INET
-char *
-inetname(struct in_addr *inp);
-#endif
-
-#ifdef INET6
-char *
-inet6name(struct in6_addr *in6p);
-#endif
-
 static void
 sctp_print_address(const char *container, union sctp_sockstore *address,
     int port, int num_port)
@@ -121,6 +111,7 @@ sctp_print_address(const char *container, union sctp_sockstore *address,
 	struct servent *sp = 0;
 	char line[80], *cp;
 	int width;
+	size_t alen, plen;
 
 	if (container)
 		xo_open_container(container);
@@ -128,29 +119,36 @@ sctp_print_address(const char *container, union sctp_sockstore *address,
 	switch (address->sa.sa_family) {
 #ifdef INET
 	case AF_INET:
-		sprintf(line, "%.*s.", Wflag ? 39 : 16, inetname(&address->sin.sin_addr));
+		snprintf(line, sizeof(line), "%.*s.",
+		    Wflag ? 39 : 16, inetname(&address->sin.sin_addr));
 		break;
 #endif
 #ifdef INET6
 	case AF_INET6:
-		sprintf(line, "%.*s.", Wflag ? 39 : 16, inet6name(&address->sin6.sin6_addr));
+		snprintf(line, sizeof(line), "%.*s.",
+		    Wflag ? 39 : 16, inet6name(&address->sin6.sin6_addr));
 		break;
 #endif
 	default:
-		sprintf(line, "%.*s.", Wflag ? 39 : 16, "");
+		snprintf(line, sizeof(line), "%.*s.",
+		    Wflag ? 39 : 16, "");
 		break;
 	}
-	cp = strchr(line, '\0');
+	alen = strlen(line);
+	cp = line + alen;
 	if (!num_port && port)
 		sp = getservbyport((int)port, "sctp");
 	if (sp || port == 0)
-		sprintf(cp, "%.15s ", sp ? sp->s_name : "*");
+		snprintf(cp, sizeof(line) - alen,
+		    "%.15s ", sp ? sp->s_name : "*");
 	else
-		sprintf(cp, "%d ", ntohs((u_short)port));
+		snprintf(cp, sizeof(line) - alen,
+		    "%d ", ntohs((u_short)port));
 	width = Wflag ? 45 : 22;
 	xo_emit("{d:target/%-*.*s} ", width, width, line);
 
-	int alen = cp - line - 1, plen = strlen(cp) - 1;
+	plen = strlen(cp) - 1;
+	alen--;
 	xo_emit("{e:address/%*.*s}{e:port/%*.*s}", alen, alen, line, plen,
 	    plen, cp);
 
diff --git a/usr.bin/netstat/unix.c b/usr.bin/netstat/unix.c
index 29668a48cd68..b8cddc8d54d6 100644
--- a/usr.bin/netstat/unix.c
+++ b/usr.bin/netstat/unix.c
@@ -75,7 +75,7 @@ pcblist_sysctl(int type, char **bufp)
 	size_t	len;
 	char mibvar[sizeof "net.local.seqpacket.pcblist"];
 
-	sprintf(mibvar, "net.local.%s.pcblist", socktype[type]);
+	snprintf(mibvar, sizeof(mibvar), "net.local.%s.pcblist", socktype[type]);
 
 	len = 0;
 	if (sysctlbyname(mibvar, 0, &len, 0, 0) < 0) {
diff --git a/usr.bin/tail/reverse.c b/usr.bin/tail/reverse.c
index 511f88c02278..87269051ed68 100644
--- a/usr.bin/tail/reverse.c
+++ b/usr.bin/tail/reverse.c
@@ -117,6 +117,7 @@ r_reg(FILE *fp, const char *fn, enum STYLE style, off_t off, struct stat *sbp)
 	map.start = NULL;
 	map.mapoff = map.maxoff = size;
 	map.fd = fileno(fp);
+	map.maplen = 0;
 
 	/*
 	 * Last char is special, ignore whether newline or not. Note that
@@ -205,7 +206,13 @@ r_buf(FILE *fp, const char *fn)
 		    (tl->l = malloc(BSZ)) == NULL) {
 			if (!mark)
 				err(1, "malloc");
-			tl = enomem ? tl->next : mark;
+			if (enomem)
+				tl = tl->next;
+			else {
+				if (tl)
+					free(tl);
+				tl = mark;
+			}
 			enomem += tl->len;
 		} else if (mark) {
 			tl->next = mark;
diff --git a/usr.sbin/bsnmpd/modules/snmp_hostres/hostres_scalars.c b/usr.sbin/bsnmpd/modules/snmp_hostres/hostres_scalars.c
index f5c2e1107eee..6634ae271a45 100644
--- a/usr.sbin/bsnmpd/modules/snmp_hostres/hostres_scalars.c
+++ b/usr.sbin/bsnmpd/modules/snmp_hostres/hostres_scalars.c
@@ -33,7 +33,7 @@
  * Host Resources MIB scalars implementation for SNMPd.
  */
 
-#include <sys/types.h>
+#include <sys/param.h>
 #include <sys/sysctl.h>
 
 #include <pwd.h>
@@ -85,7 +85,7 @@ OS_getSystemUptime(uint32_t *ut)
 		int mib[2] = { CTL_KERN, KERN_BOOTTIME };
 		size_t len = sizeof(kernel_boot_timestamp);
 
-		if (sysctl(mib, 2, &kernel_boot_timestamp,
+		if (sysctl(mib, nitems(mib), &kernel_boot_timestamp,
 		    &len, NULL, 0) == -1) {
 			syslog(LOG_ERR, "sysctl KERN_BOOTTIME failed: %m");
 			return (SNMP_ERR_GENERR);
diff --git a/usr.sbin/inetd/inetd.c b/usr.sbin/inetd/inetd.c
index 134c7dbc7cf4..5788497c1e25 100644
--- a/usr.sbin/inetd/inetd.c
+++ b/usr.sbin/inetd/inetd.c
@@ -315,9 +315,11 @@ whichaf(struct request_info *req)
 	sa = (struct sockaddr *)req->client->sin;
 	if (sa == NULL)
 		return AF_UNSPEC;
+#ifdef INET6
 	if (sa->sa_family == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&satosin6(sa)->sin6_addr))
 		return AF_INET;
+#endif
 	return sa->sa_family;
 }
 
@@ -1283,6 +1285,7 @@ setsockopt(fd, SOL_SOCKET, opt, (char *)&on, sizeof (on))
 		syslog(LOG_ERR, "setsockopt (SO_PRIVSTATE): %m");
 #endif
 	/* tftpd opens a new connection then needs more infos */
+#ifdef INET6
 	if ((sep->se_family == AF_INET6) &&
 	    (strcmp(sep->se_proto, "udp") == 0) &&
 	    (sep->se_accept == 0) &&
@@ -1295,6 +1298,7 @@ setsockopt(fd, SOL_SOCKET, opt, (char *)&on, sizeof (on))
 			       (char *)&flag, sizeof (flag)) < 0)
 			syslog(LOG_ERR, "setsockopt (IPV6_V6ONLY): %m");
 	}
+#endif
 #undef turnon
 #ifdef IPSEC
 	ipsecsetup(sep);
@@ -1332,7 +1336,9 @@ setsockopt(fd, SOL_SOCKET, opt, (char *)&on, sizeof (on))
 		u_int i;
 		socklen_t len = sep->se_ctrladdr_size;
 		struct netconfig *netid, *netid2 = NULL;
+#ifdef INET6
 		struct sockaddr_in sock;
+#endif
 		struct netbuf nbuf, nbuf2;
 
                 if (getsockname(sep->se_fd,
@@ -1347,6 +1353,7 @@ setsockopt(fd, SOL_SOCKET, opt, (char *)&on, sizeof (on))
 		nbuf.len = sep->se_ctrladdr.sa_len;
 		if (sep->se_family == AF_INET)
 			netid = sep->se_socktype==SOCK_DGRAM? udpconf:tcpconf;
+#ifdef INET6
 		else  {
 			netid = sep->se_socktype==SOCK_DGRAM? udp6conf:tcp6conf;
 			if (!sep->se_nomapped) { /* INET and INET6 */
@@ -1358,6 +1365,7 @@ setsockopt(fd, SOL_SOCKET, opt, (char *)&on, sizeof (on))
 				sock.sin_port = sep->se_ctrladdr6.sin6_port;
 			}
 		}
+#endif
                 if (debug)
                         print_service("REG ", sep);
                 for (i = sep->se_rpc_lowvers; i <= sep->se_rpc_highvers; i++) {