diff --git a/sys/cam/ctl/ctl_cmd_table.c b/sys/cam/ctl/ctl_cmd_table.c
index 0e7268389c3..2e512ec11c8 100644
--- a/sys/cam/ctl/ctl_cmd_table.c
+++ b/sys/cam/ctl/ctl_cmd_table.c
@@ -786,7 +786,7 @@ const struct ctl_cmd_entry ctl_cmd_table_9e[32] =
 /* 0E */
 {NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
 
-/* 0F */
+/* 0F RECEIVE BINDING REPORT */
 {NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
 
 /* 10 READ CAPACITY(16) */
diff --git a/sys/cam/scsi/scsi_all.c b/sys/cam/scsi/scsi_all.c
index 729a2a06e61..6c56d4e3b23 100644
--- a/sys/cam/scsi/scsi_all.c
+++ b/sys/cam/scsi/scsi_all.c
@@ -418,6 +418,8 @@ static struct op_table_entry scsi_op_codes[] = {
 	{ 0x52,	D, "XDREAD(10)" },
 	/* 52       O          READ TRACK INFORMATION */
 	{ 0x52,	R, "READ TRACK INFORMATION" },
+	/* 53  O               XDWRITEREAD(10) */
+	{ 0x53,	D, "XDWRITEREAD(10)" },
 	/* 53       O          RESERVE TRACK */
 	{ 0x53,	R, "RESERVE TRACK" },
 	/* 54       O          SEND OPC INFORMATION */
@@ -461,6 +463,8 @@ static struct op_table_entry scsi_op_codes[] = {
 	{ 0x81,	T, "READ REVERSE(16)" },
 	/* 82  Z               REGENERATE(16) */
 	{ 0x82,	D, "REGENERATE(16)" },
+	/* 82   O              ALLOW OVERWRITE */
+	{ 0x82,	T, "ALLOW OVERWRITE" },
 	/* 83  OOOOO O    OO   EXTENDED COPY */
 	{ 0x83,	D | T | L | P | W | O | K | V, "EXTENDED COPY" },
 	/* 84  OOOOO O    OO   RECEIVE COPY RESULTS */
diff --git a/sys/dev/mpr/mpr_sas.c b/sys/dev/mpr/mpr_sas.c
index 3a0bf5aca70..9f934e19e76 100644
--- a/sys/dev/mpr/mpr_sas.c
+++ b/sys/dev/mpr/mpr_sas.c
@@ -1229,14 +1229,12 @@ static void
 mprsas_logical_unit_reset_complete(struct mpr_softc *sc, struct mpr_command *tm)
 {
 	MPI2_SCSI_TASK_MANAGE_REPLY *reply;
-	MPI2_SCSI_TASK_MANAGE_REQUEST *req;
 	unsigned int cm_count = 0;
 	struct mpr_command *cm;
 	struct mprsas_target *targ;
 
 	callout_stop(&tm->cm_callout);
 
-	req = (MPI2_SCSI_TASK_MANAGE_REQUEST *)tm->cm_req;
 	reply = (MPI2_SCSI_TASK_MANAGE_REPLY *)tm->cm_reply;
 	targ = tm->cm_targ;
 
@@ -1678,19 +1676,19 @@ mprsas_scsiio_timeout(void *data)
 		/* target already in recovery, just queue up another
 		 * timedout command to be processed later.
 		 */
-		mpr_dprint(sc, MPR_RECOVERY, "queued timedout cm %p for "
-		    "processing by tm %p\n", cm, targ->tm);
-	}
-	else if ((targ->tm = mprsas_alloc_tm(sc)) != NULL) {
-		/* start recovery by aborting the first timedout command */
+		mpr_dprint(sc, MPR_RECOVERY,
+		    "queued timedout cm %p for processing by tm %p\n",
+		    cm, targ->tm);
+	} else if ((targ->tm = mprsas_alloc_tm(sc)) != NULL) {
 		mpr_dprint(sc, MPR_RECOVERY|MPR_INFO,
 		    "Sending abort to target %u for SMID %d\n", targ->tid,
 		    cm->cm_desc.Default.SMID);
 		mpr_dprint(sc, MPR_RECOVERY, "timedout cm %p allocated tm %p\n",
 		    cm, targ->tm);
+
+		/* start recovery by aborting the first timedout command */
 		mprsas_send_abort(sc, targ->tm, cm);
-	}
-	else {
+	} else {
 		/* XXX queue this target up for recovery once a TM becomes
 		 * available.  The firmware only has a limited number of
 		 * HighPriority credits for the high priority requests used
@@ -1839,10 +1837,11 @@ mprsas_build_nvme_unmap(struct mpr_softc *sc, struct mpr_command *cm,
 	mpr_build_nvme_prp(sc, cm, req,
 	    (void *)(uintptr_t)nvme_dsm_ranges_dma_handle, 0, data_length);
 	mpr_map_command(sc, cm);
+	res = 0;
 
 out:
 	free(plist, M_MPR);
-	return 0;
+	return (res);
 }
 
 static void
@@ -2919,11 +2918,9 @@ mprsas_send_smpcmd(struct mprsas_softc *sassc, union ccb *ccb, uint64_t sasaddr)
 	uint8_t *request, *response;
 	MPI2_SMP_PASSTHROUGH_REQUEST *req;
 	struct mpr_softc *sc;
-	struct sglist *sg;
 	int error;
 
 	sc = sassc->sc;
-	sg = NULL;
 	error = 0;
 
 	switch (ccb->ccb_h.flags & CAM_DATA_MASK) {
diff --git a/sys/dev/mpr/mpr_sas_lsi.c b/sys/dev/mpr/mpr_sas_lsi.c
index 025395f6eed..92b78c5e0d1 100644
--- a/sys/dev/mpr/mpr_sas_lsi.c
+++ b/sys/dev/mpr/mpr_sas_lsi.c
@@ -271,9 +271,6 @@ mprsas_fw_work(struct mpr_softc *sc, struct mpr_fw_event_work *fw_event)
 	}
 	case MPI2_EVENT_SAS_ENCL_DEVICE_STATUS_CHANGE:
 	{
-		Mpi2EventDataSasEnclDevStatusChange_t *data;
-		data = (Mpi2EventDataSasEnclDevStatusChange_t *)
-		    fw_event->event_data;
 		mpr_mapping_enclosure_dev_status_change_event(sc,
 		    fw_event->event_data);
 		break;
diff --git a/sys/dev/mpr/mpr_table.c b/sys/dev/mpr/mpr_table.c
index 719866b5fa7..7bc629be733 100644
--- a/sys/dev/mpr/mpr_table.c
+++ b/sys/dev/mpr/mpr_table.c
@@ -541,12 +541,10 @@ mpr_print_sgl(struct mpr_softc *sc, struct mpr_command *cm, int offset)
 	MPI2_IEEE_SGE_SIMPLE64 *ieee_sge;
 	MPI25_IEEE_SGE_CHAIN64 *ieee_sgc;
 	MPI2_SGE_SIMPLE64 *sge;
-	MPI2_REQUEST_HEADER *req;
 	struct mpr_chain *chain = NULL;
 	char *frame;
 	u_int i = 0, flags, length;
 
-	req = (MPI2_REQUEST_HEADER *)cm->cm_req;
 	frame = (char *)cm->cm_req;
 	ieee_sge = (MPI2_IEEE_SGE_SIMPLE64 *)&frame[offset * 4];
 	sge = (MPI2_SGE_SIMPLE64 *)&frame[offset * 4];
diff --git a/sys/dev/mps/mps_sas.c b/sys/dev/mps/mps_sas.c
index 136e3586ef2..d21cf1e2204 100644
--- a/sys/dev/mps/mps_sas.c
+++ b/sys/dev/mps/mps_sas.c
@@ -235,8 +235,6 @@ mpssas_alloc_tm(struct mps_softc *sc)
 void
 mpssas_free_tm(struct mps_softc *sc, struct mps_command *tm)
 {
-	int target_id = 0xFFFFFFFF;
-
 	if (tm == NULL)
 		return;
 
@@ -245,13 +243,11 @@ mpssas_free_tm(struct mps_softc *sc, struct mps_command *tm)
 	 * free the resources used for freezing the devq.  Must clear the
 	 * INRESET flag as well or scsi I/O will not work.
 	 */
-	if (tm->cm_targ != NULL) {
-		tm->cm_targ->flags &= ~MPSSAS_TARGET_INRESET;
-		target_id = tm->cm_targ->tid;
-	}
 	if (tm->cm_ccb) {
-		mps_dprint(sc, MPS_INFO, "Unfreezing devq for target ID %d\n",
-		    target_id);
+		mps_dprint(sc, MPS_XINFO | MPS_RECOVERY,
+		    "Unfreezing devq for target ID %d\n",
+		    tm->cm_targ->tid);
+		tm->cm_targ->flags &= ~MPSSAS_TARGET_INRESET;
 		xpt_release_devq(tm->cm_ccb->ccb_h.path, 1, TRUE);
 		xpt_free_path(tm->cm_ccb->ccb_h.path);
 		xpt_free_ccb(tm->cm_ccb);
@@ -1180,14 +1176,12 @@ static void
 mpssas_logical_unit_reset_complete(struct mps_softc *sc, struct mps_command *tm)
 {
 	MPI2_SCSI_TASK_MANAGE_REPLY *reply;
-	MPI2_SCSI_TASK_MANAGE_REQUEST *req;
 	unsigned int cm_count = 0;
 	struct mps_command *cm;
 	struct mpssas_target *targ;
 
 	callout_stop(&tm->cm_callout);
 
-	req = (MPI2_SCSI_TASK_MANAGE_REQUEST *)tm->cm_req;
 	reply = (MPI2_SCSI_TASK_MANAGE_REPLY *)tm->cm_reply;
 	targ = tm->cm_targ;
 
@@ -1560,7 +1554,7 @@ mpssas_scsiio_timeout(void *data)
 	MPS_FUNCTRACE(sc);
 	mtx_assert(&sc->mps_mtx, MA_OWNED);
 
-	mps_dprint(sc, MPS_XINFO|MPS_RECOVERY, "Timeout checking cm %p\n", sc);
+	mps_dprint(sc, MPS_XINFO|MPS_RECOVERY, "Timeout checking cm %p\n", cm);
 
 	/*
 	 * Run the interrupt handler to make sure it's not pending.  This
@@ -1701,11 +1695,11 @@ mpssas_action_scsiio(struct mpssas_softc *sassc, union ccb *ccb)
 	}
 
 	/*
-	 * If target has a reset in progress, freeze the devq and return.  The
-	 * devq will be released when the TM reset is finished.
+	 * If target has a reset in progress, the devq should be frozen.
+	 * Geting here we likely hit a race, so just requeue.
 	 */
 	if (targ->flags & MPSSAS_TARGET_INRESET) {
-		ccb->ccb_h.status = CAM_BUSY | CAM_DEV_QFRZN;
+		ccb->ccb_h.status = CAM_REQUEUE_REQ | CAM_DEV_QFRZN;
 		mps_dprint(sc, MPS_INFO, "%s: Freezing devq for target ID %d\n",
 		    __func__, targ->tid);
 		xpt_freeze_devq(ccb->ccb_h.path, 1);
@@ -3245,11 +3239,15 @@ mpssas_async(void *callback_arg, uint32_t code, struct cam_path *path,
 }
 
 /*
- * Set the INRESET flag for this target so that no I/O will be sent to
- * the target until the reset has completed.  If an I/O request does
- * happen, the devq will be frozen.  The CCB holds the path which is
- * used to release the devq.  The devq is released and the CCB is freed
+ * Freeze the devq and set the INRESET flag so that no I/O will be sent to
+ * the target until the reset has completed.  The CCB holds the path which
+ * is used to release the devq.  The devq is released and the CCB is freed
  * when the TM completes.
+ * We only need to do this when we're entering reset, not at each time we
+ * need to send an abort (which will happen if multiple commands timeout
+ * while we're sending the abort). We do not release the queue for each
+ * command we complete (just at the end when we free the tm), so freezing
+ * it each time doesn't make sense.
  */
 void
 mpssas_prepare_for_tm(struct mps_softc *sc, struct mps_command *tm,
@@ -3267,7 +3265,13 @@ mpssas_prepare_for_tm(struct mps_softc *sc, struct mps_command *tm,
 		} else {
 			tm->cm_ccb = ccb;
 			tm->cm_targ = target;
-			target->flags |= MPSSAS_TARGET_INRESET;
+			if ((target->flags & MPSSAS_TARGET_INRESET) == 0) {
+				mps_dprint(sc, MPS_XINFO | MPS_RECOVERY,
+				    "%s: Freezing devq for target ID %d\n",
+				    __func__, target->tid);
+				xpt_freeze_devq(ccb->ccb_h.path, 1);
+				target->flags |= MPSSAS_TARGET_INRESET;
+			}
 		}
 	}
 }
diff --git a/sys/dev/mps/mps_sas_lsi.c b/sys/dev/mps/mps_sas_lsi.c
index 8cfb1700c70..dc22af1e47d 100644
--- a/sys/dev/mps/mps_sas_lsi.c
+++ b/sys/dev/mps/mps_sas_lsi.c
@@ -268,9 +268,6 @@ mpssas_fw_work(struct mps_softc *sc, struct mps_fw_event_work *fw_event)
 	}
 	case MPI2_EVENT_SAS_ENCL_DEVICE_STATUS_CHANGE:
 	{
-		Mpi2EventDataSasEnclDevStatusChange_t *data;
-		data = (Mpi2EventDataSasEnclDevStatusChange_t *)
-		    fw_event->event_data;
 		mps_mapping_enclosure_dev_status_change_event(sc,
 		    fw_event->event_data);
 		break;
diff --git a/sys/dev/mps/mps_table.c b/sys/dev/mps/mps_table.c
index e3254570b49..aec97327e6b 100644
--- a/sys/dev/mps/mps_table.c
+++ b/sys/dev/mps/mps_table.c
@@ -519,12 +519,10 @@ mps_print_sgl(struct mps_softc *sc, struct mps_command *cm, int offset)
 {
 	MPI2_SGE_SIMPLE64 *sge;
 	MPI2_SGE_CHAIN32 *sgc;
-	MPI2_REQUEST_HEADER *req;
 	struct mps_chain *chain = NULL;
 	char *frame;
 	u_int i = 0, flags;
 
-	req = (MPI2_REQUEST_HEADER *)cm->cm_req;
 	frame = (char *)cm->cm_req;
 	sge = (MPI2_SGE_SIMPLE64 *)&frame[offset * 4];
 	printf("SGL for command %p\n", cm);
diff --git a/sys/x86/x86/tsc.c b/sys/x86/x86/tsc.c
index 6debe3ecca6..3a1377ff427 100644
--- a/sys/x86/x86/tsc.c
+++ b/sys/x86/x86/tsc.c
@@ -708,7 +708,14 @@ tsc_calibrate(void)
 	if (tsc_disabled)
 		return;
 
+	/*
+	 * Avoid using a low-quality timecounter to re-calibrate.  In
+	 * particular, old 32-bit platforms might only have the 8254 timer to
+	 * calibrate against.
+	 */
 	tc = atomic_load_ptr(&timecounter);
+	if (tc->tc_quality <= 0)
+		goto calibrated;
 
 	flags = intr_disable();
 	cpu = curcpu;
@@ -737,6 +744,7 @@ tsc_calibrate(void)
 	freq_khz = tc->tc_frequency * (tsc_end - tsc_start) / (t_end - t_start);
 
 	tsc_update_freq(freq_khz);
+calibrated:
 	tc_init(&tsc_timecounter);
 	set_cputicker(rdtsc, tsc_freq, !tsc_is_invariant);
 }