diff --git a/bin/sh/main.c b/bin/sh/main.c
index d3250eb0eaea..d9629204647b 100644
--- a/bin/sh/main.c
+++ b/bin/sh/main.c
@@ -76,7 +76,7 @@ __FBSDID("$FreeBSD$");
 int rootpid;
 int rootshell;
 struct jmploc main_handler;
-int localeisutf8;
+int localeisutf8, initial_localeisutf8;
 
 static void read_profile(const char *);
 static char *find_dot_file(char *);
@@ -97,7 +97,7 @@ main(int argc, char *argv[])
 	char *shinit;
 
 	(void) setlocale(LC_ALL, "");
-	updatecharset();
+	initcharset();
 	state = 0;
 	if (setjmp(main_handler.loc)) {
 		switch (exception) {
diff --git a/bin/sh/parser.c b/bin/sh/parser.c
index 5133d67f9bfa..cc1860df22fd 100644
--- a/bin/sh/parser.c
+++ b/bin/sh/parser.c
@@ -1219,6 +1219,29 @@ readcstyleesc(char *out)
 		  if (v == 0 || (v >= 0xd800 && v <= 0xdfff))
 			  synerror("Bad escape sequence");
 		  /* We really need iconv here. */
+		  if (initial_localeisutf8 && v > 127) {
+			  CHECKSTRSPACE(4, out);
+			  /*
+			   * We cannot use wctomb() as the locale may have
+			   * changed.
+			   */
+			  if (v <= 0x7ff) {
+				  USTPUTC(0xc0 | v >> 6, out);
+				  USTPUTC(0x80 | (v & 0x3f), out);
+				  return out;
+			  } else if (v <= 0xffff) {
+				  USTPUTC(0xe0 | v >> 12, out);
+				  USTPUTC(0x80 | ((v >> 6) & 0x3f), out);
+				  USTPUTC(0x80 | (v & 0x3f), out);
+				  return out;
+			  } else if (v <= 0x10ffff) {
+				  USTPUTC(0xf0 | v >> 18, out);
+				  USTPUTC(0x80 | ((v >> 12) & 0x3f), out);
+				  USTPUTC(0x80 | ((v >> 6) & 0x3f), out);
+				  USTPUTC(0x80 | (v & 0x3f), out);
+				  return out;
+			  }
+		  }
 		  if (v > 127)
 			  v = '?';
 		  break;
diff --git a/bin/sh/sh.1 b/bin/sh/sh.1
index 5710060ca7f8..838cafeccf79 100644
--- a/bin/sh/sh.1
+++ b/bin/sh/sh.1
@@ -463,8 +463,8 @@ The Unicode code point
 (eight hexadecimal digits)
 .El
 .Pp
-The sequences for Unicode code points currently only provide useful results
-for values below 128.
+The sequences for Unicode code points are currently only useful with
+UTF-8 locales.
 They reject code point 0 and UTF-16 surrogates.
 .Pp
 If an escape sequence would produce a byte with value 0,
diff --git a/bin/sh/var.c b/bin/sh/var.c
index 5c87a1f63386..84b6dea66d4c 100644
--- a/bin/sh/var.c
+++ b/bin/sh/var.c
@@ -136,8 +136,8 @@ static const int locale_categories[7] = {
 	LC_COLLATE, LC_CTYPE, LC_MONETARY, LC_NUMERIC, LC_TIME, LC_MESSAGES, 0
 };
 
-static struct var **hashvar(const char *);
 static int varequal(const char *, const char *);
+static struct var *find_var(const char *, struct var ***, int *);
 static int localevar(const char *);
 
 /*
@@ -174,20 +174,18 @@ initvar(void)
 	struct var **vpp;
 
 	for (ip = varinit ; (vp = ip->var) != NULL ; ip++) {
-		if ((vp->flags & VEXPORT) == 0) {
-			vpp = hashvar(ip->text);
-			vp->next = *vpp;
-			*vpp = vp;
-			vp->text = __DECONST(char *, ip->text);
-			vp->flags = ip->flags | VSTRFIXED | VTEXTFIXED;
-			vp->func = ip->func;
-		}
+		if (find_var(ip->text, &vpp, &vp->name_len) != NULL)
+			continue;
+		vp->next = *vpp;
+		*vpp = vp;
+		vp->text = __DECONST(char *, ip->text);
+		vp->flags = ip->flags | VSTRFIXED | VTEXTFIXED;
+		vp->func = ip->func;
 	}
 	/*
 	 * PS1 depends on uid
 	 */
-	if ((vps1.flags & VEXPORT) == 0) {
-		vpp = hashvar("PS1=");
+	if (find_var("PS1", &vpp, &vps1.name_len) == NULL) {
 		vps1.next = *vpp;
 		*vpp = &vps1;
 		vps1.text = __DECONST(char *, geteuid() ? "PS1=$ " : "PS1=# ");
@@ -323,50 +321,46 @@ void
 setvareq(char *s, int flags)
 {
 	struct var *vp, **vpp;
-	int len;
+	int nlen;
 
 	if (aflag)
 		flags |= VEXPORT;
-	vpp = hashvar(s);
-	for (vp = *vpp ; vp ; vp = vp->next) {
-		if (varequal(s, vp->text)) {
-			if (vp->flags & VREADONLY) {
-				len = strchr(s, '=') - s;
-				error("%.*s: is read only", len, s);
-			}
-			if (flags & VNOSET)
-				return;
-			INTOFF;
-
-			if (vp->func && (flags & VNOFUNC) == 0)
-				(*vp->func)(strchr(s, '=') + 1);
-
-			if ((vp->flags & (VTEXTFIXED|VSTACK)) == 0)
-				ckfree(vp->text);
-
-			vp->flags &= ~(VTEXTFIXED|VSTACK|VUNSET);
-			vp->flags |= flags;
-			vp->text = s;
-
-			/*
-			 * We could roll this to a function, to handle it as
-			 * a regular variable function callback, but why bother?
-			 *
-			 * Note: this assumes iflag is not set to 1 initially.
-			 * As part of init(), this is called before arguments
-			 * are looked at.
-			 */
-			if ((vp == &vmpath || (vp == &vmail && ! mpathset())) &&
-			    iflag == 1)
-				chkmail(1);
-			if ((vp->flags & VEXPORT) && localevar(s)) {
-				change_env(s, 1);
-				(void) setlocale(LC_ALL, "");
-				updatecharset();
-			}
-			INTON;
+	vp = find_var(s, &vpp, &nlen);
+	if (vp != NULL) {
+		if (vp->flags & VREADONLY)
+			error("%.*s: is read only", vp->name_len, s);
+		if (flags & VNOSET)
 			return;
+		INTOFF;
+
+		if (vp->func && (flags & VNOFUNC) == 0)
+			(*vp->func)(s + vp->name_len + 1);
+
+		if ((vp->flags & (VTEXTFIXED|VSTACK)) == 0)
+			ckfree(vp->text);
+
+		vp->flags &= ~(VTEXTFIXED|VSTACK|VUNSET);
+		vp->flags |= flags;
+		vp->text = s;
+
+		/*
+		 * We could roll this to a function, to handle it as
+		 * a regular variable function callback, but why bother?
+		 *
+		 * Note: this assumes iflag is not set to 1 initially.
+		 * As part of init(), this is called before arguments
+		 * are looked at.
+		 */
+		if ((vp == &vmpath || (vp == &vmail && ! mpathset())) &&
+		    iflag == 1)
+			chkmail(1);
+		if ((vp->flags & VEXPORT) && localevar(s)) {
+			change_env(s, 1);
+			(void) setlocale(LC_ALL, "");
+			updatecharset();
 		}
+		INTON;
+		return;
 	}
 	/* not found */
 	if (flags & VNOSET)
@@ -374,6 +368,7 @@ setvareq(char *s, int flags)
 	vp = ckmalloc(sizeof (*vp));
 	vp->flags = flags;
 	vp->text = s;
+	vp->name_len = nlen;
 	vp->next = *vpp;
 	vp->func = NULL;
 	INTOFF;
@@ -415,14 +410,10 @@ lookupvar(const char *name)
 {
 	struct var *v;
 
-	for (v = *hashvar(name) ; v ; v = v->next) {
-		if (varequal(v->text, name)) {
-			if (v->flags & VUNSET)
-				return NULL;
-			return strchr(v->text, '=') + 1;
-		}
-	}
-	return NULL;
+	v = find_var(name, NULL, NULL);
+	if (v == NULL || v->flags & VUNSET)
+		return NULL;
+	return v->text + v->name_len + 1;
 }
 
 
@@ -447,15 +438,12 @@ bltinlookup(const char *name, int doall)
 	}
 	if (result != NULL)
 		return result;
-	for (v = *hashvar(name) ; v ; v = v->next) {
-		if (varequal(v->text, name)) {
-			if ((v->flags & VUNSET)
-			 || (!doall && (v->flags & VEXPORT) == 0))
-				return NULL;
-			return strchr(v->text, '=') + 1;
-		}
-	}
-	return NULL;
+
+	v = find_var(name, NULL, NULL);
+	if (v == NULL || v->flags & VUNSET ||
+	    (!doall && (v->flags & VEXPORT) == 0))
+		return NULL;
+	return v->text + v->name_len + 1;
 }
 
 
@@ -529,6 +517,13 @@ updatecharset(void)
 	localeisutf8 = !strcmp(charset, "UTF-8");
 }
 
+void
+initcharset(void)
+{
+	updatecharset();
+	initial_localeisutf8 = localeisutf8;
+}
+
 /*
  * Generate a list of exported variables.  This routine is used to construct
  * the third argument to execve when executing a program.
@@ -665,22 +660,18 @@ exportcmd(int argc, char **argv)
 			if ((p = strchr(name, '=')) != NULL) {
 				p++;
 			} else {
-				vpp = hashvar(name);
-				for (vp = *vpp ; vp ; vp = vp->next) {
-					if (varequal(vp->text, name)) {
-
-						vp->flags |= flag;
-						if ((vp->flags & VEXPORT) && localevar(vp->text)) {
-							change_env(vp->text, 1);
-							(void) setlocale(LC_ALL, "");
-							updatecharset();
-						}
-						goto found;
+				vp = find_var(name, NULL, NULL);
+				if (vp != NULL) {
+					vp->flags |= flag;
+					if ((vp->flags & VEXPORT) && localevar(vp->text)) {
+						change_env(vp->text, 1);
+						(void) setlocale(LC_ALL, "");
+						updatecharset();
 					}
+					continue;
 				}
 			}
 			setvar(name, p, flag);
-found:;
 		}
 	} else {
 		for (vpp = vartab ; vpp < vartab + VTABSIZE ; vpp++) {
@@ -747,8 +738,7 @@ mklocal(char *name)
 		memcpy(lvp->text, optlist, sizeof optlist);
 		vp = NULL;
 	} else {
-		vpp = hashvar(name);
-		for (vp = *vpp ; vp && ! varequal(vp->text, name) ; vp = vp->next);
+		vp = find_var(name, &vpp, NULL);
 		if (vp == NULL) {
 			if (strchr(name, '='))
 				setvareq(savestr(name), VSTRFIXED);
@@ -761,7 +751,7 @@ mklocal(char *name)
 			lvp->text = vp->text;
 			lvp->flags = vp->flags;
 			vp->flags |= VSTRFIXED|VTEXTFIXED;
-			if (strchr(name, '='))
+			if (name[vp->name_len] == '=')
 				setvareq(savestr(name), 0);
 		}
 	}
@@ -857,54 +847,33 @@ unsetvar(const char *s)
 	struct var **vpp;
 	struct var *vp;
 
-	vpp = hashvar(s);
-	for (vp = *vpp ; vp ; vpp = &vp->next, vp = *vpp) {
-		if (varequal(vp->text, s)) {
-			if (vp->flags & VREADONLY)
-				return (1);
-			INTOFF;
-			if (*(strchr(vp->text, '=') + 1) != '\0')
-				setvar(s, nullstr, 0);
-			if ((vp->flags & VEXPORT) && localevar(vp->text)) {
-				change_env(s, 0);
-				setlocale(LC_ALL, "");
-				updatecharset();
-			}
-			vp->flags &= ~VEXPORT;
-			vp->flags |= VUNSET;
-			if ((vp->flags & VSTRFIXED) == 0) {
-				if ((vp->flags & VTEXTFIXED) == 0)
-					ckfree(vp->text);
-				*vpp = vp->next;
-				ckfree(vp);
-			}
-			INTON;
-			return (0);
-		}
+	vp = find_var(s, &vpp, NULL);
+	if (vp == NULL)
+		return (0);
+	if (vp->flags & VREADONLY)
+		return (1);
+	INTOFF;
+	if (vp->text[vp->name_len + 1] != '\0')
+		setvar(s, nullstr, 0);
+	if ((vp->flags & VEXPORT) && localevar(vp->text)) {
+		change_env(s, 0);
+		setlocale(LC_ALL, "");
+		updatecharset();
 	}
-
+	vp->flags &= ~VEXPORT;
+	vp->flags |= VUNSET;
+	if ((vp->flags & VSTRFIXED) == 0) {
+		if ((vp->flags & VTEXTFIXED) == 0)
+			ckfree(vp->text);
+		*vpp = vp->next;
+		ckfree(vp);
+	}
+	INTON;
 	return (0);
 }
 
 
 
-/*
- * Find the appropriate entry in the hash table from the name.
- */
-
-static struct var **
-hashvar(const char *p)
-{
-	unsigned int hashval;
-
-	hashval = ((unsigned char) *p) << 4;
-	while (*p && *p != '=')
-		hashval += (unsigned char) *p++;
-	return &vartab[hashval % VTABSIZE];
-}
-
-
-
 /*
  * Returns true if the two strings specify the same varable.  The first
  * variable name is terminated by '='; the second may be terminated by
@@ -922,3 +891,41 @@ varequal(const char *p, const char *q)
 		return 1;
 	return 0;
 }
+
+/*
+ * Search for a variable.
+ * 'name' may be terminated by '=' or a NUL.
+ * vppp is set to the pointer to vp, or the list head if vp isn't found
+ * lenp is set to the number of charactets in 'name'
+ */
+
+static struct var *
+find_var(const char *name, struct var ***vppp, int *lenp)
+{
+	unsigned int hashval;
+	int len;
+	struct var *vp, **vpp;
+	const char *p = name;
+
+	hashval = 0;
+	while (*p && *p != '=')
+		hashval = 2 * hashval + (unsigned char)*p++;
+	len = p - name;
+
+	if (lenp)
+		*lenp = len;
+	vpp = &vartab[hashval % VTABSIZE];
+	if (vppp)
+		*vppp = vpp;
+
+	for (vp = *vpp ; vp ; vpp = &vp->next, vp = *vpp) {
+		if (vp->name_len != len)
+			continue;
+		if (memcmp(vp->text, name, len) != 0)
+			continue;
+		if (vppp)
+			*vppp = vpp;
+		return vp;
+	}
+	return NULL;
+}
diff --git a/bin/sh/var.h b/bin/sh/var.h
index 4336562610bf..ff21c7da41fd 100644
--- a/bin/sh/var.h
+++ b/bin/sh/var.h
@@ -51,6 +51,7 @@
 struct var {
 	struct var *next;		/* next entry in hash list */
 	int flags;			/* flags are defined above */
+	int name_len;			/* length of name */
 	char *text;			/* name=value */
 	void (*func)(const char *);
 					/* function to be called when  */
@@ -82,6 +83,8 @@ extern struct var vterm;
 #endif
 
 extern int localeisutf8;
+/* The parser uses the locale that was in effect at startup. */
+extern int initial_localeisutf8;
 
 /*
  * The following macros access the values of the above variables.
@@ -115,6 +118,7 @@ char *bltinlookup(const char *, int);
 void bltinsetlocale(void);
 void bltinunsetlocale(void);
 void updatecharset(void);
+void initcharset(void);
 char **environment(void);
 int showvarscmd(int, char **);
 int exportcmd(int, char **);
diff --git a/sys/dev/ath/ath_hal/ah_internal.h b/sys/dev/ath/ath_hal/ah_internal.h
index c4ffe745f850..1dd8dcdce52f 100644
--- a/sys/dev/ath/ath_hal/ah_internal.h
+++ b/sys/dev/ath/ath_hal/ah_internal.h
@@ -205,7 +205,8 @@ typedef struct {
 			halMbssidAggrSupport		: 1,
 			halBssidMatchSupport		: 1,
 			hal4kbSplitTransSupport		: 1,
-			halHasRxSelfLinkedTail		: 1;
+			halHasRxSelfLinkedTail		: 1,
+			halSupportsFastClock5GHz	: 1;	/* Hardware supports 5ghz fast clock; check eeprom/channel before using */
 	uint32_t	halWirelessModes;
 	uint16_t	halTotalQueues;
 	uint16_t	halKeyCacheSize;
@@ -807,10 +808,21 @@ extern	HAL_BOOL ath_ee_FillVpdTable(uint8_t pwrMin, uint8_t pwrMax,
 extern	int16_t ath_ee_interpolate(uint16_t target, uint16_t srcLeft,
 	uint16_t srcRight, int16_t targetLeft, int16_t targetRight);
 
-/* Whether 5ghz fast clock is needed for Merlin and later */
+/* Whether 5ghz fast clock is needed */
+/*
+ * The chipset (Merlin, AR9300/later) should set the capability flag below;
+ * this flag simply says that the hardware can do it, not that the EEPROM
+ * says it can.
+ *
+ * Merlin 2.0/2.1 chips with an EEPROM version > 16 do 5ghz fast clock
+ *   if the relevant eeprom flag is set.
+ * Merlin 2.0/2.1 chips with an EEPROM version <= 16 do 5ghz fast clock
+ *   by default.
+ */
 #define	IS_5GHZ_FAST_CLOCK_EN(_ah, _c) \
 	(IEEE80211_IS_CHAN_5GHZ(_c) && \
-	ath_hal_eepromGetFlag(ah, AR_EEP_FSTCLK_5G))
+	 AH_PRIVATE((_ah))->ah_caps.halSupportsFastClock5GHz && \
+	ath_hal_eepromGetFlag((_ah), AR_EEP_FSTCLK_5G))
 
 
 #endif /* _ATH_AH_INTERAL_H_ */
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416reg.h b/sys/dev/ath/ath_hal/ar5416/ar5416reg.h
index 65a0a635fab3..88d7e02a22b6 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416reg.h
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416reg.h
@@ -701,7 +701,7 @@
 
 #define	AR_SREV_MERLIN_20(_ah) \
 	(AR_SREV_MERLIN(_ah) && \
-	 AH_PRIVATE((_ah))->ah_macRev == AR_XSREV_REVISION_MERLIN_20)
+	 AH_PRIVATE((_ah))->ah_macRev >= AR_XSREV_REVISION_MERLIN_20)
 
 #define	AR_SREV_MERLIN_20_OR_LATER(_ah) \
 	((AH_PRIVATE((_ah))->ah_macVersion > AR_XSREV_VERSION_MERLIN) ||	\
@@ -741,5 +741,6 @@
 /* Not yet implemented chips */
 #define	AR_SREV_9271(_ah)	0
 #define	AR_SREV_9287_11_OR_LATER(_ah)	0
+#define	AR_SREV_KIWI_10_OR_LATER(_ah)	0
 
 #endif /* _DEV_ATH_AR5416REG_H */
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9280_attach.c b/sys/dev/ath/ath_hal/ar9002/ar9280_attach.c
index 5e44cc573e11..b4aaa7b60e42 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9280_attach.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9280_attach.c
@@ -787,8 +787,14 @@ ar9280FillCapabilityInfo(struct ath_hal *ah)
 	pCap->halMbssidAggrSupport = AH_TRUE;
 	pCap->hal4AddrAggrSupport = AH_TRUE;
 
-	if (AR_SREV_MERLIN_20_OR_LATER(ah))
+	if (AR_SREV_MERLIN_20(ah)) {
 		pCap->halPSPollBroken = AH_FALSE;
+		/*
+		 * This just enables the support; it doesn't
+		 * state 5ghz fast clock will always be used.
+		 */
+		pCap->halSupportsFastClock5GHz = AH_TRUE;
+	}
 	pCap->halRxStbcSupport = 1;
 	pCap->halTxStbcSupport = 1;
 
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9285.h b/sys/dev/ath/ath_hal/ar9002/ar9285.h
index 7e296a69d2e3..3f6b48143c43 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9285.h
+++ b/sys/dev/ath/ath_hal/ar9002/ar9285.h
@@ -21,10 +21,10 @@
 #include "ar5416/ar5416.h"
 
 enum ar9285_ant_div_comb_lna_conf {
-	ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2,
-	ATH_ANT_DIV_COMB_LNA2,
-	ATH_ANT_DIV_COMB_LNA1,
-	ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2,
+	ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2 = 0,
+	ATH_ANT_DIV_COMB_LNA2 = 1,
+	ATH_ANT_DIV_COMB_LNA1 = 2,
+	ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2 = 3,
 };
 
 struct ar9285_ant_comb {
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9285_attach.c b/sys/dev/ath/ath_hal/ar9002/ar9285_attach.c
index 7aebc960a35b..653b586e77fb 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9285_attach.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9285_attach.c
@@ -407,15 +407,6 @@ ar9285FillCapabilityInfo(struct ath_hal *ah)
 	return AH_TRUE;
 }
 
-/*
- * Antenna selection is not (currently) done this way.
- */
-HAL_BOOL
-ar9285SetAntennaSwitch(struct ath_hal *ah, HAL_ANT_SETTING settings)
-{
-	return AH_TRUE;
-}
-
 static const char*
 ar9285Probe(uint16_t vendorid, uint16_t devid)
 {
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9285_cal.c b/sys/dev/ath/ath_hal/ar9002/ar9285_cal.c
index 1ce95a633425..bcb5959c2cc7 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9285_cal.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9285_cal.c
@@ -263,7 +263,5 @@ ar9285InitCalHardware(struct ath_hal *ah,
 	if (! ar9285_hw_clc(ah, chan))
 		return AH_FALSE;
 
-	ar9285_hw_pa_cal(ah, AH_TRUE);
-
 	return AH_TRUE;
 }
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9285_diversity.c b/sys/dev/ath/ath_hal/ar9002/ar9285_diversity.c
index d19e3def1900..a1c2bd26f0fe 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9285_diversity.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9285_diversity.c
@@ -374,11 +374,19 @@ ar9285_ant_comb_scan(struct ath_hal *ah, struct ath_rx_status *rs,
 	if (! ar9285_check_div_comb(ah))
 		return;
 
+	if (AH5212(ah)->ah_diversity == AH_FALSE)
+		return;
+
 	rx_ant_conf = (rs->rs_rssi_ctl[2] >> ATH_ANT_RX_CURRENT_SHIFT) &
 		       ATH_ANT_RX_MASK;
 	main_ant_conf = (rs->rs_rssi_ctl[2] >> ATH_ANT_RX_MAIN_SHIFT) &
 			 ATH_ANT_RX_MASK;
 
+#if 0
+	HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: main: %d, alt: %d, rx_ant_conf: %x, main_ant_conf: %x\n",
+	    __func__, main_rssi, alt_rssi, rx_ant_conf, main_ant_conf);
+#endif
+
 	/* Record packet only when alt_rssi is positive */
 	if (alt_rssi > 0) {
 		antcomb->total_pkt_count++;
@@ -587,6 +595,24 @@ ar9285_ant_comb_scan(struct ath_hal *ah, struct ath_rx_status *rs,
 
 	ar9285_antdiv_comb_conf_set(ah, &div_ant_conf);
 
+	HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: total_pkt_count=%d\n",
+	   __func__, antcomb->total_pkt_count);
+
+	HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: main_total_rssi=%d\n",
+	   __func__, antcomb->main_total_rssi);
+	HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: alt_total_rssi=%d\n",
+	   __func__, antcomb->alt_total_rssi);
+
+	HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: main_rssi_avg=%d\n",
+	   __func__, main_rssi_avg);
+	HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: alt_alt_rssi_avg=%d\n",
+	   __func__, alt_rssi_avg);
+
+	HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: main_recv_cnt=%d\n",
+	   __func__, antcomb->main_recv_cnt);
+	HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: alt_recv_cnt=%d\n",
+	   __func__, antcomb->alt_recv_cnt);
+
 	if (curr_alt_set != div_ant_conf.alt_lna_conf)
 		HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: lna_conf: %x -> %x\n",
 		    __func__, curr_alt_set, div_ant_conf.alt_lna_conf);
@@ -604,3 +630,117 @@ ar9285_ant_comb_scan(struct ath_hal *ah, struct ath_rx_status *rs,
 	antcomb->main_recv_cnt = 0;
 	antcomb->alt_recv_cnt = 0;
 }
+
+/*
+ * Set the antenna switch to control RX antenna diversity.
+ *
+ * If a fixed configuration is used, the LNA and div bias
+ * settings are fixed and the antenna diversity scanning routine
+ * is disabled.
+ *
+ * If a variable configuration is used, a default is programmed
+ * in and sampling commences per RXed packet.
+ *
+ * Since this is called from ar9285SetBoardValues() to setup
+ * diversity, it means that after a reset or scan, any current
+ * software diversity combining settings will be lost and won't
+ * re-appear until after the first successful sample run.
+ * Please keep this in mind if you're seeing weird performance
+ * that happens to relate to scan/diversity timing.
+ */
+HAL_BOOL
+ar9285SetAntennaSwitch(struct ath_hal *ah, HAL_ANT_SETTING settings)
+{
+	int regVal;
+	const HAL_EEPROM_v4k *ee = AH_PRIVATE(ah)->ah_eeprom;
+	const MODAL_EEP4K_HEADER *pModal = &ee->ee_base.modalHeader;
+	uint8_t ant_div_control1, ant_div_control2;
+
+	if (pModal->version < 3) {
+		HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: not supported\n",
+	    __func__);
+		return AH_FALSE;	/* Can't do diversity */
+	}
+
+	/* Store settings */
+	AH5212(ah)->ah_antControl = settings;
+	AH5212(ah)->ah_diversity = (settings == HAL_ANT_VARIABLE);
+	
+	/* XXX don't fiddle if the PHY is in sleep mode or ! chan */
+
+	/* Begin setting the relevant registers */
+
+	ant_div_control1 = pModal->antdiv_ctl1;
+	ant_div_control2 = pModal->antdiv_ctl2;
+
+	regVal = OS_REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
+	regVal &= (~(AR_PHY_9285_ANT_DIV_CTL_ALL));
+
+	/* enable antenna diversity only if diversityControl == HAL_ANT_VARIABLE */
+	if (settings == HAL_ANT_VARIABLE)
+	    regVal |= SM(ant_div_control1, AR_PHY_9285_ANT_DIV_CTL);
+
+	if (settings == HAL_ANT_VARIABLE) {
+	    HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: HAL_ANT_VARIABLE\n",
+	      __func__);
+	    regVal |= SM(ant_div_control2, AR_PHY_9285_ANT_DIV_ALT_LNACONF);
+	    regVal |= SM((ant_div_control2 >> 2), AR_PHY_9285_ANT_DIV_MAIN_LNACONF);
+	    regVal |= SM((ant_div_control1 >> 1), AR_PHY_9285_ANT_DIV_ALT_GAINTB);
+	    regVal |= SM((ant_div_control1 >> 2), AR_PHY_9285_ANT_DIV_MAIN_GAINTB);
+	} else {
+	    if (settings == HAL_ANT_FIXED_A) {
+		/* Diversity disabled, RX = LNA1 */
+		HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: HAL_ANT_FIXED_A\n",
+		    __func__);
+		regVal |= SM(ATH_ANT_DIV_COMB_LNA2, AR_PHY_9285_ANT_DIV_ALT_LNACONF);
+		regVal |= SM(ATH_ANT_DIV_COMB_LNA1, AR_PHY_9285_ANT_DIV_MAIN_LNACONF);
+		regVal |= SM(AR_PHY_9285_ANT_DIV_GAINTB_0, AR_PHY_9285_ANT_DIV_ALT_GAINTB);
+		regVal |= SM(AR_PHY_9285_ANT_DIV_GAINTB_1, AR_PHY_9285_ANT_DIV_MAIN_GAINTB);
+	    }
+	    else if (settings == HAL_ANT_FIXED_B) {
+		/* Diversity disabled, RX = LNA2 */
+		HALDEBUG(ah, HAL_DEBUG_DIVERSITY, "%s: HAL_ANT_FIXED_B\n",
+		    __func__);
+		regVal |= SM(ATH_ANT_DIV_COMB_LNA1, AR_PHY_9285_ANT_DIV_ALT_LNACONF);
+		regVal |= SM(ATH_ANT_DIV_COMB_LNA2, AR_PHY_9285_ANT_DIV_MAIN_LNACONF);
+		regVal |= SM(AR_PHY_9285_ANT_DIV_GAINTB_1, AR_PHY_9285_ANT_DIV_ALT_GAINTB);
+		regVal |= SM(AR_PHY_9285_ANT_DIV_GAINTB_0, AR_PHY_9285_ANT_DIV_MAIN_GAINTB);
+	    }
+	}
+
+	OS_REG_WRITE(ah, AR_PHY_MULTICHAIN_GAIN_CTL, regVal);
+	regVal = OS_REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
+	regVal = OS_REG_READ(ah, AR_PHY_CCK_DETECT);
+	regVal &= (~AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
+	if (settings == HAL_ANT_VARIABLE)
+	    regVal |= SM((ant_div_control1 >> 3), AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
+
+	OS_REG_WRITE(ah, AR_PHY_CCK_DETECT, regVal);
+	regVal = OS_REG_READ(ah, AR_PHY_CCK_DETECT);
+
+	/*
+	 * If Diversity combining is available and the diversity setting
+	 * is to allow variable diversity, enable it by default.
+	 *
+	 * This will be eventually overridden by the software antenna
+	 * diversity logic.
+	 *
+	 * Note that yes, this following section overrides the above
+	 * settings for the LNA configuration and fast-bias.
+	 */
+	if (ar9285_check_div_comb(ah) && AH5212(ah)->ah_diversity == AH_TRUE) {
+		// If support DivComb, set MAIN to LNA1 and ALT to LNA2 at the first beginning
+		HALDEBUG(ah, HAL_DEBUG_DIVERSITY,
+		    "%s: Enable initial settings for combined diversity\n",
+		    __func__);
+		regVal = OS_REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
+		regVal &= (~(AR_PHY_9285_ANT_DIV_MAIN_LNACONF | AR_PHY_9285_ANT_DIV_ALT_LNACONF));
+		regVal |= (ATH_ANT_DIV_COMB_LNA1 << AR_PHY_9285_ANT_DIV_MAIN_LNACONF_S);
+		regVal |= (ATH_ANT_DIV_COMB_LNA2 << AR_PHY_9285_ANT_DIV_ALT_LNACONF_S);
+		regVal &= (~(AR_PHY_9285_FAST_DIV_BIAS));
+		regVal |= (0 << AR_PHY_9285_FAST_DIV_BIAS_S);
+		OS_REG_WRITE(ah, AR_PHY_MULTICHAIN_GAIN_CTL, regVal);
+	}
+
+	return AH_TRUE;
+}
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9285_reset.c b/sys/dev/ath/ath_hal/ar9002/ar9285_reset.c
index 68c8ceaeaec3..bf0347bd1572 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9285_reset.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9285_reset.c
@@ -237,8 +237,6 @@ ar9285SetBoardValues(struct ath_hal *ah, const struct ieee80211_channel *chan)
 	const MODAL_EEP4K_HEADER *pModal;
 	uint8_t txRxAttenLocal;
 	uint8_t ob[5], db1[5], db2[5];
-	uint8_t ant_div_control1, ant_div_control2;
-	uint32_t regVal;
 
 	pModal = &eep->modalHeader;
 	txRxAttenLocal = 23;
@@ -248,36 +246,10 @@ ar9285SetBoardValues(struct ath_hal *ah, const struct ieee80211_channel *chan)
 	/* Single chain for 4K EEPROM*/
 	ar9285SetBoardGain(ah, pModal, eep, txRxAttenLocal);
 
-	/* Initialize Ant Diversity settings from EEPROM */
-	if (pModal->version >= 3) {
-		ant_div_control1 = pModal->antdiv_ctl1;
-		ant_div_control2 = pModal->antdiv_ctl2;
-
-		regVal = OS_REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
-		regVal &= (~(AR_PHY_9285_ANT_DIV_CTL_ALL));
-
-		regVal |= SM(ant_div_control1,
-			     AR_PHY_9285_ANT_DIV_CTL);
-		regVal |= SM(ant_div_control2,
-			     AR_PHY_9285_ANT_DIV_ALT_LNACONF);
-		regVal |= SM((ant_div_control2 >> 2),
-			     AR_PHY_9285_ANT_DIV_MAIN_LNACONF);
-		regVal |= SM((ant_div_control1 >> 1),
-			     AR_PHY_9285_ANT_DIV_ALT_GAINTB);
-		regVal |= SM((ant_div_control1 >> 2),
-			     AR_PHY_9285_ANT_DIV_MAIN_GAINTB);
-
-		OS_REG_WRITE(ah, AR_PHY_MULTICHAIN_GAIN_CTL, regVal);
-		regVal = OS_REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
-		regVal = OS_REG_READ(ah, AR_PHY_CCK_DETECT);
-		regVal &= (~AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
-		regVal |= SM((ant_div_control1 >> 3),
-			     AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
-
-		OS_REG_WRITE(ah, AR_PHY_CCK_DETECT, regVal);
-		regVal = OS_REG_READ(ah, AR_PHY_CCK_DETECT);
-	}
+	/* Initialize Ant Diversity settings if supported */
+	(void) ar9285SetAntennaSwitch(ah, AH5212(ah)->ah_antControl);
 
+	/* Configure TX power calibration */
 	if (pModal->version >= 2) {
 		ob[0] = pModal->ob_0;
 		ob[1] = pModal->ob_1;
@@ -379,6 +351,7 @@ ar9285SetBoardValues(struct ath_hal *ah, const struct ieee80211_channel *chan)
 	if (AR_SREV_9271(ah) || AR_SREV_KITE(ah)) {
 		uint8_t bb_desired_scale = (pModal->bb_scale_smrt_antenna & EEP_4K_BB_DESIRED_SCALE_MASK);
 		if ((eep->baseEepHeader.txGainType == 0) && (bb_desired_scale != 0)) {
+			ath_hal_printf(ah, "[ath]: adjusting cck tx gain factor\n");
 			uint32_t pwrctrl, mask, clr;
 
 			mask = (1<<0) | (1<<5) | (1<<10) | (1<<15) | (1<<20) | (1<<25);
diff --git a/sys/dev/sound/usb/uaudio.c b/sys/dev/sound/usb/uaudio.c
index 79bfc136ff24..8fbb7a6bdfec 100644
--- a/sys/dev/sound/usb/uaudio.c
+++ b/sys/dev/sound/usb/uaudio.c
@@ -789,6 +789,46 @@ uaudio_chan_dump_ep_desc(const usb_endpoint_descriptor_audio_t *ed)
 
 #endif
 
+/*
+ * The following is a workaround for broken no-name USB audio devices
+ * sold by dealextreme called "3D sound". The problem is that the
+ * manufacturer computed wMaxPacketSize is too small to hold the
+ * actual data sent. In other words the device sometimes sends more
+ * data than it actually reports it can send in a single isochronous
+ * packet.
+ */
+static void
+uaudio_record_fix_fs(usb_endpoint_descriptor_audio_t *ep,
+    uint32_t xps, uint32_t add)
+{
+	uint32_t mps;
+
+	mps = UGETW(ep->wMaxPacketSize);
+
+	/*
+	 * If the device indicates it can send more data than what the
+	 * sample rate indicates, we apply the workaround.
+	 */
+	if (mps > xps) {
+
+		/* allow additional data */
+		xps += add;
+
+		/* check against the maximum USB 1.x length */
+		if (xps > 1023)
+			xps = 1023;
+
+		/* check if we should do an update */
+		if (mps < xps) {
+			/* simply update the wMaxPacketSize field */
+			USETW(ep->wMaxPacketSize, xps);
+			DPRINTF("Workaround: Updated wMaxPacketSize "
+			    "from %d to %d bytes.\n",
+			    (int)mps, (int)xps);
+		}
+	}
+}
+
 static void
 uaudio_chan_fill_info_sub(struct uaudio_softc *sc, struct usb_device *udev,
     uint32_t rate, uint8_t channels, uint8_t bit_resolution)
@@ -797,7 +837,7 @@ uaudio_chan_fill_info_sub(struct uaudio_softc *sc, struct usb_device *udev,
 	const struct usb_audio_streaming_interface_descriptor *asid = NULL;
 	const struct usb_audio_streaming_type1_descriptor *asf1d = NULL;
 	const struct usb_audio_streaming_endpoint_descriptor *sed = NULL;
-	const usb_endpoint_descriptor_audio_t *ed1 = NULL;
+	usb_endpoint_descriptor_audio_t *ed1 = NULL;
 	const usb_endpoint_descriptor_audio_t *ed2 = NULL;
 	struct usb_config_descriptor *cd = usbd_get_config_descriptor(udev);
 	struct usb_interface_descriptor *id;
@@ -999,6 +1039,13 @@ uaudio_chan_fill_info_sub(struct uaudio_softc *sc, struct usb_device *udev,
 					    UAUDIO_MAX_CHAN(chan->p_asf1d->bNrChannels) *
 					    chan->p_asf1d->bBitResolution) / 8);
 
+					if (ep_dir == UE_DIR_IN &&
+					    usbd_get_speed(udev) == USB_SPEED_FULL) {
+						uaudio_record_fix_fs(ed1,
+						    chan->sample_size * (rate / 1000),
+						    chan->sample_size * (rate / 4000));
+					}
+
 					if (sc->sc_sndstat_valid) {
 						sbuf_printf(&sc->sc_sndstat, "\n\t"
 						    "mode %d.%d:(%s) %dch, %d/%dbit, %s, %dHz",
diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c
index eafcb3dc315a..2c013bed8768 100644
--- a/sys/netinet/tcp_subr.c
+++ b/sys/netinet/tcp_subr.c
@@ -224,7 +224,6 @@ VNET_DEFINE(uma_zone_t, sack_hole_zone);
 VNET_DEFINE(struct hhook_head *, tcp_hhh[HHOOK_TCP_LAST+1]);
 
 static struct inpcb *tcp_notify(struct inpcb *, int);
-static void	tcp_isn_tick(void *);
 static char *	tcp_log_addr(struct in_conninfo *inc, struct tcphdr *th,
 		    void *ip4hdr, const void *ip6hdr);
 
@@ -255,7 +254,6 @@ static VNET_DEFINE(uma_zone_t, tcpcb_zone);
 #define	V_tcpcb_zone			VNET(tcpcb_zone)
 
 MALLOC_DEFINE(M_TCPLOG, "tcplog", "TCP address and flags print buffers");
-struct callout isn_callout;
 static struct mtx isn_mtx;
 
 #define	ISN_LOCK_INIT()	mtx_init(&isn_mtx, "isn_mtx", NULL, MTX_DEF)
@@ -358,8 +356,6 @@ tcp_init(void)
 #undef TCP_MINPROTOHDR
 
 	ISN_LOCK_INIT();
-	callout_init(&isn_callout, CALLOUT_MPSAFE);
-	callout_reset(&isn_callout, hz/100, tcp_isn_tick, NULL);
 	EVENTHANDLER_REGISTER(shutdown_pre_sync, tcp_fini, NULL,
 		SHUTDOWN_PRI_DEFAULT);
 	EVENTHANDLER_REGISTER(maxsockets_change, tcp_zone_change, NULL,
@@ -385,7 +381,6 @@ void
 tcp_fini(void *xtp)
 {
 
-	callout_stop(&isn_callout);
 }
 
 /*
@@ -1571,11 +1566,13 @@ tcp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
 #define ISN_RANDOM_INCREMENT (4096 - 1)
 
 static VNET_DEFINE(u_char, isn_secret[32]);
+static VNET_DEFINE(int, isn_last);
 static VNET_DEFINE(int, isn_last_reseed);
 static VNET_DEFINE(u_int32_t, isn_offset);
 static VNET_DEFINE(u_int32_t, isn_offset_old);
 
 #define	V_isn_secret			VNET(isn_secret)
+#define	V_isn_last			VNET(isn_last)
 #define	V_isn_last_reseed		VNET(isn_last_reseed)
 #define	V_isn_offset			VNET(isn_offset)
 #define	V_isn_offset_old		VNET(isn_offset_old)
@@ -1586,6 +1583,7 @@ tcp_new_isn(struct tcpcb *tp)
 	MD5_CTX isn_ctx;
 	u_int32_t md5_buffer[4];
 	tcp_seq new_isn;
+	u_int32_t projected_offset;
 
 	INP_WLOCK_ASSERT(tp->t_inpcb);
 
@@ -1621,40 +1619,19 @@ tcp_new_isn(struct tcpcb *tp)
 	new_isn = (tcp_seq) md5_buffer[0];
 	V_isn_offset += ISN_STATIC_INCREMENT +
 		(arc4random() & ISN_RANDOM_INCREMENT);
+	if (ticks != V_isn_last) {
+		projected_offset = V_isn_offset_old +
+		    ISN_BYTES_PER_SECOND / hz * (ticks - V_isn_last);
+		if (SEQ_GT(projected_offset, V_isn_offset))
+			V_isn_offset = projected_offset;
+		V_isn_offset_old = V_isn_offset;
+		V_isn_last = ticks;
+	}
 	new_isn += V_isn_offset;
 	ISN_UNLOCK();
 	return (new_isn);
 }
 
-/*
- * Increment the offset to the next ISN_BYTES_PER_SECOND / 100 boundary
- * to keep time flowing at a relatively constant rate.  If the random
- * increments have already pushed us past the projected offset, do nothing.
- */
-static void
-tcp_isn_tick(void *xtp)
-{
-	VNET_ITERATOR_DECL(vnet_iter);
-	u_int32_t projected_offset;
-
-	VNET_LIST_RLOCK_NOSLEEP();
-	ISN_LOCK();
-	VNET_FOREACH(vnet_iter) {
-		CURVNET_SET(vnet_iter); /* XXX appease INVARIANTS */
-		projected_offset =
-		    V_isn_offset_old + ISN_BYTES_PER_SECOND / 100;
-
-		if (SEQ_GT(projected_offset, V_isn_offset))
-			V_isn_offset = projected_offset;
-
-		V_isn_offset_old = V_isn_offset;
-		CURVNET_RESTORE();
-	}
-	ISN_UNLOCK();
-	VNET_LIST_RUNLOCK_NOSLEEP();
-	callout_reset(&isn_callout, hz/100, tcp_isn_tick, NULL);
-}
-
 /*
  * When a specific ICMP unreachable message is received and the
  * connection state is SYN-SENT, drop the connection.  This behavior
diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c
index 2c3f11106e00..aefc0ca99ece 100644
--- a/sys/netipsec/key.c
+++ b/sys/netipsec/key.c
@@ -2283,6 +2283,7 @@ key_spdget(so, m, mhp)
 	}
 
 	n = key_setdumpsp(sp, SADB_X_SPDGET, 0, mhp->msg->sadb_msg_pid);
+	KEY_FREESP(&sp);
 	if (n != NULL) {
 		m_freem(m);
 		return key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
diff --git a/sys/teken/Makefile b/sys/teken/Makefile
deleted file mode 100644
index cbdd12bb509a..000000000000
--- a/sys/teken/Makefile
+++ /dev/null
@@ -1,13 +0,0 @@
-# $FreeBSD$
-
-PROG=		teken_demo
-SRCS=		teken_demo.c teken.c teken_state.h
-CLEANFILES=	teken_state.h teken.log
-LDADD=		-lncurses -lutil
-NO_MAN=
-WARNS?=		6
-
-teken_state.h: gensequences sequences
-	awk -f gensequences sequences > ${.TARGET}
-
-.include <bsd.prog.mk>
diff --git a/sys/teken/demo/Makefile b/sys/teken/demo/Makefile
new file mode 100644
index 000000000000..ebf40ab30170
--- /dev/null
+++ b/sys/teken/demo/Makefile
@@ -0,0 +1,9 @@
+# $FreeBSD$
+
+PROG=	teken_demo
+LDADD=	-lncurses -lteken -lutil
+MAN=
+
+WARNS?=	6
+
+.include <bsd.prog.mk>
diff --git a/sys/teken/teken_demo.c b/sys/teken/demo/teken_demo.c
similarity index 99%
rename from sys/teken/teken_demo.c
rename to sys/teken/demo/teken_demo.c
index 49397a6c2653..070076379d46 100644
--- a/sys/teken/teken_demo.c
+++ b/sys/teken/demo/teken_demo.c
@@ -45,7 +45,7 @@
 #include <util.h>
 #endif
 
-#include "teken.h"
+#include <teken.h>
 
 static tf_bell_t	test_bell;
 static tf_cursor_t	test_cursor;
diff --git a/sys/teken/libteken/Makefile b/sys/teken/libteken/Makefile
new file mode 100644
index 000000000000..d1c9d3c9da70
--- /dev/null
+++ b/sys/teken/libteken/Makefile
@@ -0,0 +1,39 @@
+# $FreeBSD$
+
+LIB=	teken
+SHLIB_MAJOR= 0
+
+CFLAGS+=-I.
+WARNS?=	6
+
+SRCDIR=	${.CURDIR}/..
+.PATH: ${SRCDIR}
+
+SRCS=	teken.c teken_state.h
+INCS=	teken.h
+CLEANFILES=teken_state.h
+
+MAN=	teken.3
+MLINKS=	teken.3 teken_256to8.3 \
+	teken.3 teken_get_curattr.3 \
+	teken.3 teken_get_cursor.3 \
+	teken.3 teken_get_defattr.3 \
+	teken.3 teken_get_defattr_cons25.3 \
+	teken.3 teken_get_sequence.3 \
+	teken.3 teken_get_winsize.3 \
+	teken.3 teken_init.3 \
+	teken.3 teken_input.3 \
+	teken.3 teken_set_8bit.3 \
+	teken.3 teken_set_cons25.3 \
+	teken.3 teken_set_curattr.3 \
+	teken.3 teken_set_cursor.3 \
+	teken.3 teken_set_defattr.3 \
+	teken.3 teken_set_winsize.3
+
+teken_state.h: ${SRCDIR}/gensequences ${SRCDIR}/sequences
+	awk -f ${SRCDIR}/gensequences ${SRCDIR}/sequences > ${.TARGET}
+
+VERSION_DEF=	${.CURDIR}/../../../lib/libc/Versions.def
+SYMBOL_MAPS=	${.CURDIR}/Symbol.map
+
+.include <bsd.lib.mk>
diff --git a/sys/teken/libteken/Symbol.map b/sys/teken/libteken/Symbol.map
new file mode 100644
index 000000000000..9a10aba7acfc
--- /dev/null
+++ b/sys/teken/libteken/Symbol.map
@@ -0,0 +1,21 @@
+/*
+ * $FreeBSD$
+ */	
+
+FBSD_1.2 {
+	teken_256to8;
+	teken_get_curattr;
+	teken_get_cursor;
+	teken_get_defattr;
+	teken_get_defattr_cons25;
+	teken_get_sequence;
+	teken_get_winsize;
+	teken_init;
+	teken_input;
+	teken_set_8bit;
+	teken_set_cons25;
+	teken_set_curattr;
+	teken_set_cursor;
+	teken_set_defattr;
+	teken_set_winsize;
+};
diff --git a/sys/teken/libteken/teken.3 b/sys/teken/libteken/teken.3
new file mode 100644
index 000000000000..bcc0db0ac8da
--- /dev/null
+++ b/sys/teken/libteken/teken.3
@@ -0,0 +1,220 @@
+.\" Copyright (c) 2011 Ed Schouten <ed@FreeBSD.org>
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.\"
+.Dd May 9, 2011
+.Dt TEKEN 3
+.Os
+.Sh NAME
+.Nm teken
+.Nd xterm-like terminal emulation interface
+.Sh LIBRARY
+.Lb libteken
+.Sh SYNOPSIS
+.In teken.h
+.Ft void
+.Fn teken_init "teken_t *t" "const teken_funcs_t *funcs" "void *thunk"
+.Ft void
+.Fn teken_input "teken_t *t" "const void *buf" "size_t nbytes"
+.Ft const teken_pos_t *
+.Fn teken_get_winsize "teken_t *t"
+.Ft void
+.Fn teken_set_winsize "teken_t *t" "const teken_pos_t *size"
+.Ft const teken_pos_t *
+.Fn teken_get_cursor "teken_t *t"
+.Ft void
+.Fn teken_set_cursor "teken_t *t" "const teken_pos_t *pos"
+.Ft const teken_attr_t *
+.Fn teken_get_curattr "teken_t *t"
+.Ft void
+.Fn teken_set_curattr "teken_t *t" "const teken_attr_t *attr"
+.Ft const teken_attr_t *
+.Fn teken_get_defattr "teken_t *t"
+.Ft void
+.Fn teken_set_defattr "teken_t *t" "const teken_attr_t *attr"
+.Ft const char *
+.Fn teken_get_sequence "teken_t *t" "unsigned int id"
+.Ft teken_color_t
+.Fn teken_256to8 "teken_color_t color"
+.Ft void
+.Fn teken_get_defattr_cons25 "teken_t *t" "int *fg" "int *bg"
+.Ft void
+.Fn teken_set_8bit "teken_t *t"
+.Ft void
+.Fn teken_set_cons25 "teken_t *t"
+.Sh DESCRIPTION
+The
+.Nm
+library implements the input parser of a 256-color xterm-like terminal.
+It converts a stream of UTF-8 encoded characters into a series of
+primitive drawing instructions that can be used by a console driver or
+terminal emulator to render a terminal application.
+.Pp
+The
+.Fn teken_init
+function is used to initialize terminal state object
+.Fa t ,
+having type
+.Vt teken_t .
+The supplied
+.Vt teken_funcs_t
+structure
+.Fa funcs
+contains a set of callback functions, which are called when supplying
+data to
+.Fn teken_input .
+The
+.Fa thunk
+argument stores an arbitrary pointer, which is passed to each invocation
+of the callback functions.
+.Pp
+The
+.Vt teken_funcs_t
+structure stores the following callbacks:
+.Bd -literal -offset indent
+typedef struct {
+	tf_bell_t     *tf_bell;     /* Audible/visible bell. */
+	tf_cursor_t   *tf_cursor;   /* Move cursor to x/y. */
+	tf_putchar_t  *tf_putchar;  /* Put Unicode character at x/y. */
+	tf_fill_t     *tf_fill;     /* Fill rectangle with character. */
+	tf_copy_t     *tf_copy;     /* Copy rectangle to new location. */
+	tf_param_t    *tf_param;    /* Miscellaneous options. */
+	tf_respond_t  *tf_respond;  /* Send response string to user. */
+} teken_funcs_t;
+.Ed
+.Pp
+All callbacks must be provided, though unimplemented callbacks may some
+times be sufficient.
+The actual types of these callbacks can be found in
+.In teken.h .
+.Pp
+By default,
+.Fn teken_init
+initializes the
+.Vt teken_t
+structure to emulate a terminal having 24 rows and 80 columns.
+The
+.Fn teken_get_winsize
+and
+.Fn teken_set_winsize
+functions can be used to obtain and modify the dimensions of the
+terminal.
+.Pp
+Even though the cursor position is normally controlled by input of data
+through
+.Fn teken_input
+and returned by the
+.Fn tf_cursor
+callback, it can be obtained and modified manually using the
+.Fn teken_get_cursor
+and
+.Fn teken_set_cursor
+functions.
+The same holds for
+.Fn teken_get_curattr
+and
+.Fn teken_set_curattr ,
+which can be used to change the currently selected font attributes and
+foreground and background color.
+.Pp
+By default,
+.Nm
+emulates a white-on-black terminal, which means the default foreground
+color is white, while the background color is black.
+These defaults can be modified using
+.Fn teken_get_defattr
+and
+.Fn teken_set_defattr .
+.Pp
+The 
+.Fn teken_get_sequence
+function is a utility function that can be used to obtain escape
+sequences of special keyboard keys, generated by user input.
+The
+.Fa id
+parameter must be one of the
+.Dv TKEY_*
+parameters listed in
+.In teken.h .
+.Sh LEGACY FEATURES
+This library also provides a set of functions that shouldn't be used in
+any modern applications.
+.Pp
+The
+.Fn teken_256to8
+function converts a color code to one of the 8 primary colors, allowing
+the terminal to be rendered on graphics hardware that only supports 8 or
+16 colors (e.g. VGA).
+.Pp
+The
+.Fn teken_get_defattr_cons25
+function obtains the default terminal attributes as a pair of foreground
+and background colors, using ANSI color numbering.
+.Pp
+The
+.Fn teken_set_8bit
+function disables UTF-8 processing and switches to 8-bit character mode,
+which can be used to support character sets like CP437 and ISO-8859-1.
+.Pp
+The
+.Fn teken_set_cons25
+function switches terminal emulation to
+.Dv cons25 ,
+which is used by versions of
+.Fx
+prior to 9.0.
+.Sh SECURITY CONSIDERATIONS
+The
+.Fn tf_respond
+callback is used to respond to device status requests commands generated
+by an application.
+In the past, there have been various security issues, where a malicious
+application sends a device status request before termination, causing
+the generated response to be interpreted by applications such as
+.Xr sh 1 .
+.Pp
+.Nm
+only implements a small subset of responses which are unlikely to cause
+any harm.
+Still, it is advised to leave
+.Fn tf_respond
+unimplemented.
+.Sh SEE ALSO
+.Xr ncurses 3 ,
+.Xr termcap 3 ,
+.Xr syscons 4 .
+.Sh HISTORY
+The
+.Nm
+library appeared in
+.Fx 8.0 ,
+though it was only available and used inside the kernel.
+In
+.Fx 9.0 ,
+the
+.Nm
+library appeared in userspace.
+.Sh AUTHORS
+.An Ed Schouten Aq ed@FreeBSD.org
diff --git a/sys/teken/stress/Makefile b/sys/teken/stress/Makefile
new file mode 100644
index 000000000000..7216da0bd60d
--- /dev/null
+++ b/sys/teken/stress/Makefile
@@ -0,0 +1,9 @@
+# $FreeBSD$
+
+PROG=	teken_stress
+LDADD=	-lteken
+MAN=
+
+WARNS?=	6
+
+.include <bsd.prog.mk>
diff --git a/sys/teken/teken_stress.c b/sys/teken/stress/teken_stress.c
similarity index 99%
rename from sys/teken/teken_stress.c
rename to sys/teken/stress/teken_stress.c
index 1f1c57253f09..203c35b12892 100644
--- a/sys/teken/teken_stress.c
+++ b/sys/teken/stress/teken_stress.c
@@ -34,7 +34,7 @@
 #include <stdlib.h>
 #include <unistd.h>
 
-#include "teken.h"
+#include <teken.h>
 
 static tf_bell_t	stress_bell;
 static tf_cursor_t	stress_cursor;
diff --git a/sys/teken/teken.c b/sys/teken/teken.c
index 91d706f3c328..cdc2cb32e2b2 100644
--- a/sys/teken/teken.c
+++ b/sys/teken/teken.c
@@ -32,7 +32,6 @@
 #include <sys/lock.h>
 #include <sys/systm.h>
 #define	teken_assert(x)		MPASS(x)
-#define	teken_printf(x,...)
 #else /* !(__FreeBSD__ && _KERNEL) */
 #include <sys/types.h>
 #include <assert.h>
@@ -40,14 +39,11 @@
 #include <stdio.h>
 #include <string.h>
 #define	teken_assert(x)		assert(x)
-#define	teken_printf(x,...)	do { \
-	if (df != NULL) \
-		fprintf(df, x, ## __VA_ARGS__); \
-} while (0)
-/* debug messages */
-static FILE *df;
 #endif /* __FreeBSD__ && _KERNEL */
 
+/* debug messages */
+#define	teken_printf(x,...)
+
 /* Private flags for t_stateflags. */
 #define	TS_FIRSTDIGIT	0x0001	/* First numeric digit in escape sequence. */
 #define	TS_INSERT	0x0002	/* Insert mode. */
@@ -153,12 +149,6 @@ teken_init(teken_t *t, const teken_funcs_t *tf, void *softc)
 {
 	teken_pos_t tp = { .tp_row = 24, .tp_col = 80 };
 
-#if !(defined(__FreeBSD__) && defined(_KERNEL))
-	df = fopen("teken.log", "w");
-	if (df != NULL)
-		setvbuf(df, NULL, _IOLBF, BUFSIZ);
-#endif /* !(__FreeBSD__ && _KERNEL) */
-
 	t->t_funcs = tf;
 	t->t_softc = softc;
 
diff --git a/sys/teken/teken.h b/sys/teken/teken.h
index 36cb71aa1d04..2feef6e0ddba 100644
--- a/sys/teken/teken.h
+++ b/sys/teken/teken.h
@@ -29,6 +29,8 @@
 #ifndef _TEKEN_H_
 #define	_TEKEN_H_
 
+#include <sys/types.h>
+
 /*
  * libteken: terminal emulation library.
  *
diff --git a/tools/regression/bin/sh/parser/dollar-quote10.0 b/tools/regression/bin/sh/parser/dollar-quote10.0
new file mode 100644
index 000000000000..ad166da23ffe
--- /dev/null
+++ b/tools/regression/bin/sh/parser/dollar-quote10.0
@@ -0,0 +1,10 @@
+# $FreeBSD$
+
+# a umlaut
+s=$(printf '\303\244')
+# euro sign
+s=$s$(printf '\342\202\254')
+
+# Start a new shell so the locale change is picked up.
+ss="$(LC_ALL=en_US.UTF-8 ${SH} -c "printf %s \$'\u00e4\u20ac'")"
+[ "$s" = "$ss" ]
diff --git a/tools/regression/bin/sh/parser/dollar-quote11.0 b/tools/regression/bin/sh/parser/dollar-quote11.0
new file mode 100644
index 000000000000..2e872abfe5b0
--- /dev/null
+++ b/tools/regression/bin/sh/parser/dollar-quote11.0
@@ -0,0 +1,8 @@
+# $FreeBSD$
+
+# some sort of 't' outside BMP
+s=$s$(printf '\360\235\225\245')
+
+# Start a new shell so the locale change is picked up.
+ss="$(LC_ALL=en_US.UTF-8 ${SH} -c "printf %s \$'\U0001d565'")"
+[ "$s" = "$ss" ]
diff --git a/tools/tools/ath/ath_ee_v4k_print/v4k.c b/tools/tools/ath/ath_ee_v4k_print/v4k.c
index 440ddb56d0ab..a3a8e6d28b3b 100644
--- a/tools/tools/ath/ath_ee_v4k_print/v4k.c
+++ b/tools/tools/ath/ath_ee_v4k_print/v4k.c
@@ -89,7 +89,7 @@ eeprom_v4k_modal_print(uint16_t *buf)
 	MODAL_EEP4K_HEADER *mh = &eep->ee_base.modalHeader;
 	int i;
 
-	printf("| antCtrlCommon: 0x%.4x |\n", mh->antCtrlCommon);
+	printf("| antCtrlCommon: 0x%.8x |\n", mh->antCtrlCommon);
 	printf("| switchSettling: 0x%.2x |\n", mh->switchSettling);
 	printf("| adcDesiredSize: %d |\n| pgaDesiredSize: %.2f dBm |\n",
 	    mh->adcDesiredSize, (float) mh->pgaDesiredSize / 2.0);
diff --git a/usr.sbin/jail/jail.8 b/usr.sbin/jail/jail.8
index b3f0b03cfea6..893efd84da56 100644
--- a/usr.sbin/jail/jail.8
+++ b/usr.sbin/jail/jail.8
@@ -34,7 +34,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd May 8, 2011
+.Dd January 17, 2010
 .Dt JAIL 8
 .Os
 .Sh NAME
@@ -431,7 +431,7 @@ command script can be used:
 .Bd -literal
 D=/here/is/the/jail
 cd /usr/src
-mkdir -p -m 0700 $D
+mkdir -p $D
 make world DESTDIR=$D
 make distribution DESTDIR=$D
 mount -t devfs devfs $D/dev
@@ -448,10 +448,6 @@ in the per-jail devfs.
 A simple devfs ruleset for jails is available as ruleset #4 in
 .Pa /etc/defaults/devfs.rules .
 .Pp
-Non-superusers in the host system should not be able to access the 
-jail's files; otherwise an attacker with root access to the jail
-could obtain elevated privileges on the host.
-.Pp
 In many cases this example would put far more in the jail than needed.
 In the other extreme case a jail might contain only one file:
 the executable to be run in the jail.