[illumos-gate merge]

commit c12f119108dcac3bfe73ac01ce1bbc643a733ca2
    14390 av1394: build errors with gcc 11
commit 7daa540591d7332190b10fc3a818bfd5e7d536fe
    14367 bhyve gpt mishandles small mappings
commit 7ca35597a3c3894e7222816a3f7ed2be2a0686e8
    14373 ppt driver maps BAR to wrong ddi register
commit 123e0aa39ff14433d916a870ec23b74c77097914
    14345 Manual titles should be upper case
commit 8c2e120d86add3ec9062486352618e0fc4a2161c
    14381 libstmf: build error with gcc 11
commit f02e918df953cc4861bad053ba1e39dab00c3787
    14383 cfgadm_plugins: build errors with gcc 11
commit a34c59af58bf4fa531da3415d71025642c449143
    14387 i86pc: writing 1 byte into a region of size 0
commit 3cff04e70c85c3630e534a8583132f191d2fca92
    14379 libast: build errors with gcc 11
commit 19f828dfeb540cb7af7e68528aa8711911d3ed39
    14378 cmd-inet: build errors with gcc 11
commit 6a9d71e52548eedf5ce59148e7e6b8ce5f61a4a0
    14377 nsmb: 'find_mech' accessing 32 bytes in a region of size ...
commit eba274b9392a53f991f6ca04d624533172d46fd4
    14376 smbsrv: 'find_mech' accessing 32 bytes in a region of size ...
commit 2966a4e8bbd82f7bd6a8909e7c10b98f18fe7e84
    14375 dmu_zfetch: don't leak unreferenced stream when zfetch is freed

29 files changed, 547 insertions, 61 deletions

diff --git a/usr/src/cmd/ast/libast/Makefile.com b/usr/src/cmd/ast/libast/Makefile.com
index 112f741d28..a54d907edf 100644
--- a/usr/src/cmd/ast/libast/Makefile.com
+++ b/usr/src/cmd/ast/libast/Makefile.com
@@ -98,8 +98,15 @@ CERRWARN += -_gcc=-Wno-address
 # Since this is third party source, silencing this warning seems to be
 # reasonable path to take.
 pics/path/pathpath.o := CERRWARN += -_gcc10=-Wno-return-local-addr
+pics/path/pathpath.o := CERRWARN += -_gcc11=-Wno-return-local-addr
 pics/path/pathkey.o := CERRWARN += -_gcc10=-Wno-return-local-addr
+pics/path/pathkey.o := CERRWARN += -_gcc11=-Wno-return-local-addr
 pics/path/pathprobe.o := CERRWARN += -_gcc10=-Wno-return-local-addr
+pics/path/pathprobe.o := CERRWARN += -_gcc11=-Wno-return-local-addr
+
+# The code layout after macro expansion is upsetting gcc 11, silence it.
+pics/sfio/sfdisc.o := CERRWARN += -_gcc11=-Wno-misleading-indentation
+pics/sfio/sfstack.o := CERRWARN += -_gcc11=-Wno-misleading-indentation
 
 SMATCH= off
 
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/arp.c b/usr/src/cmd/cmd-inet/usr.sbin/arp.c
index aa9adac6ce..784e87ca6f 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/arp.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/arp.c
@@ -79,9 +79,10 @@ main(int argc, char *argv[])
 			if (nflags > 0) {	\
 				usage();	\
 				exit(1);	\
-			} else			\
+			} else {		\
 				y##_flag = 1;	\
-				nflags++;	\
+			}			\
+			nflags++;		\
 			break
 
 	while ((c = getopt(argc, argv, "nadfs")) != EOF) {
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_nfs4.c b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_nfs4.c
index 40a169e931..99dc870ecd 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_nfs4.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_nfs4.c
@@ -46,6 +46,7 @@
 
 #include <sys/stat.h>
 #include <sys/param.h>
+#include <sys/sysmacros.h>
 #include <rpcsvc/nfs_prot.h>
 /* use the same nfs4_prot.h as the xdr code */
 #include "rpcsvc/nfs4_prot.h"
@@ -248,7 +249,7 @@ static op_info_t cb_opcode_info[] = {
 		sumarg_cb_recall,	sum_nfsstat4,
 		dtlarg_cb_recall,	dtl_nfsstat4},
 };
-static uint_t cb_num_opcodes = sizeof (cb_opcode_info) / sizeof (op_info_t *);
+static uint_t cb_num_opcodes = ARRAY_SIZE(cb_opcode_info);
 
 static op_info_t opcode_info[] = {
 	{"OP_ZERO",	NULL,	NULL,	NULL,	NULL},	/* 0 */
@@ -339,7 +340,7 @@ static op_info_t opcode_info[] = {
 	sumarg_release_lkown, sum_nfsstat4,
 	dtlarg_release_lkown, dtl_nfsstat4},
 };
-static uint_t num_opcodes = sizeof (opcode_info) / sizeof (op_info_t *);
+static uint_t num_opcodes = ARRAY_SIZE(opcode_info);
 
 /*
  * File types.
diff --git a/usr/src/contrib/mDNSResponder/mDNSPosix/mDNSPosix.c b/usr/src/contrib/mDNSResponder/mDNSPosix/mDNSPosix.c
index 45e59a5728..107091456e 100755
--- a/usr/src/contrib/mDNSResponder/mDNSPosix/mDNSPosix.c
+++ b/usr/src/contrib/mDNSResponder/mDNSPosix/mDNSPosix.c
@@ -221,7 +221,7 @@ mDNSlocal void TCPReadCallback(int fd, void *context)
 {
     TCPSocket *sock = context;
     (void)fd;
-    
+
     if (sock->flags & kTCPSocketFlags_UseTLS)
     {
         // implement
@@ -258,7 +258,7 @@ mDNSlocal void tcpConnectCallback(int fd, void *context)
                         sock->events.fd, result, strerror(result));
             }
             else
-            { 
+            {
                 LogMsg("ERROR: TCPConnectCallback - connect failed: socket %d: Error %d (%s)",
                        sock->events.fd, result, strerror(result));
             }
@@ -386,14 +386,14 @@ mDNSexport TCPSocket *mDNSPlatformTCPSocket(TCPSocketFlags flags, mDNSAddr_Type
 {
     TCPSocket *sock;
     int len = sizeof (TCPSocket);
-    
+
     (void)useBackgroundTrafficClass;
 
     if (hostname)
     {
         len += sizeof (domainname);
     }
-    sock = malloc(len); 
+    sock = malloc(len);
 
     if (sock == NULL)
     {
@@ -401,14 +401,14 @@ mDNSexport TCPSocket *mDNSPlatformTCPSocket(TCPSocketFlags flags, mDNSAddr_Type
         return NULL;
     }
     memset(sock, 0, sizeof *sock);
-    
+
     if (hostname)
     {
         sock->hostname = (domainname *)(sock + 1);
         LogMsg("mDNSPlatformTCPSocket: hostname %##s", hostname->c);
         AssignDomainName(sock->hostname, hostname);
     }
-    
+
     sock->events.fd = -1;
     if (!mDNSPosixTCPSocketSetup(&sock->events.fd, addrType, port, &sock->port))
     {
@@ -459,7 +459,7 @@ mDNSlocal void tcpListenCallback(int fd, void *context)
 {
     TCPListener *listener = context;
     TCPSocket *sock;
-    
+
     sock = mDNSPosixDoTCPListenCallback(fd, listener->addressType, listener->socketFlags,
                                  listener->callback, listener->context);
     if (sock != NULL)
@@ -483,7 +483,7 @@ mDNSexport TCPListener *mDNSPlatformTCPListen(mDNSAddr_Type addrType, mDNSIPPort
         }
         return mDNSNULL;
     }
-    
+
     // Allocate a listener structure
     ret = (TCPListener *) mDNSPlatformMemAllocateClear(sizeof *ret);
     if (ret == NULL)
@@ -580,7 +580,7 @@ mDNSexport mStatus mDNSPlatformTCPConnect(TCPSocket *sock, const mDNSAddr *dst,
 #else
             (void)iface;
 #endif // IPV6_BOUND_IF
-        }           
+        }
 #endif // SO_BINDTODEVICE
     }
 
@@ -617,12 +617,12 @@ mDNSexport mStatus mDNSPlatformTCPConnect(TCPSocket *sock, const mDNSAddr *dst,
                     sock->events.fd, errno, strerror(errno));
         }
         else
-        { 
+        {
             LogMsg("ERROR: mDNSPlatformTCPConnect - connect failed: socket %d: Error %d (%s) length %d",
                    sock->events.fd, errno, strerror(errno), len);
         }
         return mStatus_ConnFailed;
-    }       
+    }
 
     LogMsg("NOTE: mDNSPlatformTCPConnect completed synchronously");
     return mStatus_NoError;
@@ -643,7 +643,7 @@ mDNSexport void mDNSPlatformTCPCloseConnection(TCPSocket *sock)
 mDNSexport long mDNSPlatformReadTCP(TCPSocket *sock, void *buf, unsigned long buflen, mDNSBool * closed)
 {
     ssize_t nread;
-    
+
     *closed = mDNSfalse;
     if (sock->flags & kTCPSocketFlags_UseTLS)
     {
@@ -1835,7 +1835,7 @@ mDNSexport mDNSu8 *DNSProxySetAttributes(DNSQuestion *q, DNSMessageHeader *h, DN
     return ptr;
 }
 
-mDNSexport void DNSProxyInit(mDNSu32 IpIfArr[], mDNSu32 OpIf)
+mDNSexport void DNSProxyInit(mDNSu32 IpIfArr[MaxIp], mDNSu32 OpIf)
 {
     (void) IpIfArr;
     (void) OpIf;
diff --git a/usr/src/lib/cfgadm_plugins/fp/common/cfga_fp.c b/usr/src/lib/cfgadm_plugins/fp/common/cfga_fp.c
index 6bb74889e7..4bd9c5e2a2 100644
--- a/usr/src/lib/cfgadm_plugins/fp/common/cfga_fp.c
+++ b/usr/src/lib/cfgadm_plugins/fp/common/cfga_fp.c
@@ -343,9 +343,8 @@ cfga_help(struct cfga_msg *msgp, const char *options, cfga_flags_t flags)
 
 }
 
-/*ARGSUSED*/
 int
-cfga_ap_id_cmp(const char *ap_id1, const char *ap_id2)
+cfga_ap_id_cmp(const cfga_ap_log_id_t ap_id1, const cfga_ap_log_id_t ap_id2)
 {
 	int i = 0;
 	long long ret;
diff --git a/usr/src/lib/libstmf/common/stmf.c b/usr/src/lib/libstmf/common/stmf.c
index e12c189926..c77d1740c9 100644
--- a/usr/src/lib/libstmf/common/stmf.c
+++ b/usr/src/lib/libstmf/common/stmf.c
@@ -3445,7 +3445,7 @@ stmfDevidFromIscsiName(char *iscsiName, stmfDevid *devid)
  * devid - on success, contains the converted wwn
  */
 int
-stmfDevidFromWwn(uchar_t *wwn, stmfDevid *devid)
+stmfDevidFromWwn(uchar_t wwn[8], stmfDevid *devid)
 {
 	if (wwn == NULL || devid == NULL)
 		return (STMF_ERROR_INVALID_ARG);
diff --git a/usr/src/man/man1/zonestat.1 b/usr/src/man/man1/zonestat.1
index 39f2be5f61..505a4449c8 100644
--- a/usr/src/man/man1/zonestat.1
+++ b/usr/src/man/man1/zonestat.1
@@ -11,12 +11,12 @@
 .\" Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
 .\" Copyright 2019 OmniOS Community Edition (OmniOSce) Association.
 .\"
-.Dd April 04, 2019
-.Dt zonestat 1
+.Dd December 29, 2021
+.Dt ZONESTAT 1
 .Os
 .Sh NAME
 .Nm zonestat
-.Nd report active zone statistics.
+.Nd report active zone statistics
 .Sh SYNOPSIS
 .Nm
 .Op Fl z Ar zonelist
diff --git a/usr/src/man/man1m/zonestatd.1m b/usr/src/man/man1m/zonestatd.1m
index fb7760436b..65c559539e 100644
--- a/usr/src/man/man1m/zonestatd.1m
+++ b/usr/src/man/man1m/zonestatd.1m
@@ -11,8 +11,8 @@
 .\" Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
 .\" Copyright 2019 OmniOS Community Edition (OmniOSce) Association.
 .\"
-.Dd April 04, 2019
-.Dt zonestatd 1M
+.Dd December 29, 2021
+.Dt ZONESTATD 1M
 .Os
 .Sh NAME
 .Nm zonestatd
diff --git a/usr/src/man/man3head/timespec.3head b/usr/src/man/man3head/timespec.3head
index 54aaab14f5..b0fd87646f 100644
--- a/usr/src/man/man3head/timespec.3head
+++ b/usr/src/man/man3head/timespec.3head
@@ -11,8 +11,8 @@
 .\"
 .\" Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
 .\"
-.Dd Sep 06, 2020
-.Dt timespec 3HEAD
+.Dd December 29, 2021
+.Dt TIMESPEC 3HEAD
 .Os
 .Sh NAME
 .Nm timespec ,
diff --git a/usr/src/man/man3lib/libm.3lib b/usr/src/man/man3lib/libm.3lib
index 61ada1bbde..9cebc5b60f 100644
--- a/usr/src/man/man3lib/libm.3lib
+++ b/usr/src/man/man3lib/libm.3lib
@@ -4,7 +4,7 @@
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH libm 3LIB "Feb 27, 2020"
+.TH LIBM 3LIB "December 29, 2021"
 .SH NAME
 libm \- C math library
 .SH SYNOPSIS
diff --git a/usr/src/man/man3lib/libmvec.3lib b/usr/src/man/man3lib/libmvec.3lib
index 2be5fda4c7..917aefbd2f 100644
--- a/usr/src/man/man3lib/libmvec.3lib
+++ b/usr/src/man/man3lib/libmvec.3lib
@@ -4,7 +4,7 @@
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH libmvec 3LIB "Feb 27, 2020"
+.TH LIBMVEC 3LIB "December 29, 2021"
 .SH NAME
 libmvec \- vector math library
 .SH SYNOPSIS
diff --git a/usr/src/pkg/manifests/system-bhyve-tests.p5m b/usr/src/pkg/manifests/system-bhyve-tests.p5m
index d582b61df1..64dc7a7d98 100644
--- a/usr/src/pkg/manifests/system-bhyve-tests.p5m
+++ b/usr/src/pkg/manifests/system-bhyve-tests.p5m
@@ -15,6 +15,7 @@
 
 #
 # Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
+# Copyright 2022 Oxide Computer Company
 #
 
 set name=pkg.fmri value=pkg:/system/bhyve/tests@$(PKGVERS)
@@ -23,6 +24,13 @@ set name=pkg.description value="BSD hypervisor tests"
 set name=info.classification \
     value=org.opensolaris.category.2008:System/Virtualization
 set name=variant.arch value=i386
+dir  path=opt/bhyve-tests
+dir  path=opt/bhyve-tests/bin
+file path=opt/bhyve-tests/bin/bhyvetest mode=0555
+dir  path=opt/bhyve-tests/runfiles
+file path=opt/bhyve-tests/runfiles/default.run mode=0444
+dir  path=opt/bhyve-tests/tests
+file path=opt/bhyve-tests/tests/memmap mode=0555
 dir  path=opt/bhyvetest
 dir  path=opt/bhyvetest/bin
 file path=opt/bhyvetest/bin/bhyvetest mode=0555
@@ -33,3 +41,5 @@ file path=opt/bhyvetest/tst/mevent/read.disable.exe mode=0555
 file path=opt/bhyvetest/tst/mevent/read.pause.exe mode=0555
 file path=opt/bhyvetest/tst/mevent/read.requeue.exe mode=0555
 license lic_CDDL license=lic_CDDL
+depend type=require fmri=system/bhyve
+depend type=require fmri=system/test/testrunner
diff --git a/usr/src/test/Makefile b/usr/src/test/Makefile
index a6b51d88f7..a2d6343f76 100644
--- a/usr/src/test/Makefile
+++ b/usr/src/test/Makefile
@@ -14,11 +14,13 @@
 # Copyright 2014 Garrett D'Amore <garrett@damore.org>
 # Copyright 2019 Joyent, Inc.
 # Copyright 2020 Tintri by DDN, Inc. All rights reserved.
+# Copyright 2022 Oxide Computer Company
 #
 
 .PARALLEL: $(SUBDIRS)
 
 SUBDIRS = \
+	bhyve-tests \
 	crypto-tests \
 	elf-tests \
 	libc-tests \
diff --git a/usr/src/test/bhyve-tests/Makefile b/usr/src/test/bhyve-tests/Makefile
new file mode 100644
index 0000000000..eb23d83252
--- /dev/null
+++ b/usr/src/test/bhyve-tests/Makefile
@@ -0,0 +1,20 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2022 Oxide Computer Company
+#
+
+.PARALLEL: $(SUBDIRS)
+
+SUBDIRS = cmd runfiles tests
+
+include $(SRC)/test/Makefile.com
diff --git a/usr/src/test/bhyve-tests/cmd/Makefile b/usr/src/test/bhyve-tests/cmd/Makefile
new file mode 100644
index 0000000000..da80c05d56
--- /dev/null
+++ b/usr/src/test/bhyve-tests/cmd/Makefile
@@ -0,0 +1,37 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2022 Oxide Computer Company
+#
+
+include $(SRC)/Makefile.master
+include $(SRC)/test/Makefile.com
+
+ROOTOPTPKG = $(ROOT)/opt/bhyve-tests
+ROOTBIN = $(ROOTOPTPKG)/bin
+
+PROGS = bhyvetest
+
+CMDS = $(PROGS:%=$(ROOTBIN)/%)
+$(CMDS) := FILEMODE = 0555
+
+all lint clean clobber:
+
+install: $(CMDS)
+
+$(CMDS): $(ROOTBIN)
+
+$(ROOTBIN):
+	$(INS.dir)
+
+$(ROOTBIN)/%: %.ksh
+	$(INS.rename)
diff --git a/usr/src/test/bhyve-tests/cmd/bhyvetest.ksh b/usr/src/test/bhyve-tests/cmd/bhyvetest.ksh
new file mode 100644
index 0000000000..78deed0dfb
--- /dev/null
+++ b/usr/src/test/bhyve-tests/cmd/bhyvetest.ksh
@@ -0,0 +1,38 @@
+#!/usr/bin/ksh
+
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2022 Oxide Computer Company
+#
+
+TEST_DIR="/opt/bhyve-tests"
+RUNNER="/opt/test-runner/bin/run"
+
+while getopts c: c; do
+	case $c in
+	'c')
+		RUN_FILE=$OPTARG
+		if [[ ! -f $RUN_FILE ]]; then
+			echo "Cannot read file: $RUN_FILE"
+			exit 1
+		fi
+		;;
+	esac
+done
+shift $((OPTIND - 1))
+
+if [[ -z $RUN_FILE ]]; then
+	RUN_FILE="$TEST_DIR/runfiles/default.run"
+fi
+
+exec $RUNNER -c $RUN_FILE
diff --git a/usr/src/test/bhyve-tests/runfiles/Makefile b/usr/src/test/bhyve-tests/runfiles/Makefile
new file mode 100644
index 0000000000..19750ee019
--- /dev/null
+++ b/usr/src/test/bhyve-tests/runfiles/Makefile
@@ -0,0 +1,38 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2022 Oxide Computer Company
+#
+
+include $(SRC)/Makefile.master
+
+SRCS = default.run
+
+ROOTOPTPKG = $(ROOT)/opt/bhyve-tests
+RUNFILES = $(ROOTOPTPKG)/runfiles
+
+OUTPUTS = $(SRCS:%=$(RUNFILES)/%)
+$(OUTPUTS) := FILEMODE = 0444
+
+all: $(SRCS)
+
+install: $(OUTPUTS)
+
+clean lint clobber:
+
+$(OUTPUTS): $(RUNFILES) $(SRCS)
+
+$(RUNFILES):
+	$(INS.dir)
+
+$(RUNFILES)/%: %
+	$(INS.file)
diff --git a/usr/src/test/bhyve-tests/runfiles/default.run b/usr/src/test/bhyve-tests/runfiles/default.run
new file mode 100644
index 0000000000..8e0969f874
--- /dev/null
+++ b/usr/src/test/bhyve-tests/runfiles/default.run
@@ -0,0 +1,23 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+# Copyright 2022 Oxide Computer Company
+
+[DEFAULT]
+pre =
+verbose = False
+quiet = False
+timeout = 60
+post =
+outputdir = /var/tmp/test_results
+
+[/opt/bhyve-tests/tests]
+tests = ['memmap']
diff --git a/usr/src/test/bhyve-tests/tests/Makefile b/usr/src/test/bhyve-tests/tests/Makefile
new file mode 100644
index 0000000000..5edb6d2be4
--- /dev/null
+++ b/usr/src/test/bhyve-tests/tests/Makefile
@@ -0,0 +1,48 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+# Copyright 2022 Oxide Computer Company
+
+include $(SRC)/cmd/Makefile.cmd
+include $(SRC)/cmd/Makefile.cmd.64
+include $(SRC)/test/Makefile.com
+
+PROG =	memmap
+
+ROOTOPTPKG = $(ROOT)/opt/bhyve-tests
+TESTDIR = $(ROOTOPTPKG)/tests
+
+CMDS = $(PROG:%=$(TESTDIR)/%)
+$(CMDS) := FILEMODE = 0555
+
+CSTD=		$(CSTD_GNU99)
+CPPFLAGS =	-I$(COMPAT)/bhyve -I$(CONTRIB)/bhyve \
+		-I$(COMPAT)/bhyve/amd64 -I$(CONTRIB)/bhyve/amd64 \
+		$(CPPFLAGS.master) \
+		-I$(SRC)/uts/i86pc/io/vmm \
+		-I$(SRC)/uts/i86pc
+$(PROG) := LDLIBS += \
+	-lvmmapi
+
+all: $(PROG)
+
+install: all $(CMDS)
+
+clobber: clean
+	-$(RM) $(PROG)
+
+$(CMDS): $(TESTDIR) $(PROG)
+
+$(TESTDIR):
+	$(INS.dir)
+
+$(TESTDIR)/%: %
+	$(INS.file)
diff --git a/usr/src/test/bhyve-tests/tests/memmap.c b/usr/src/test/bhyve-tests/tests/memmap.c
new file mode 100644
index 0000000000..c5c2f179da
--- /dev/null
+++ b/usr/src/test/bhyve-tests/tests/memmap.c
@@ -0,0 +1,226 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2022 Oxide Computer Company
+ */
+
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <strings.h>
+#include <signal.h>
+#include <setjmp.h>
+
+#include <sys/vmm.h>
+#include <sys/vmm_dev.h>
+#include <sys/mman.h>
+#include <vmmapi.h>
+
+/* Half of a leaf page table is 256 pages */
+#define	LOWER_SZ	(256 * 4096)
+#define	UPPER_SZ	LOWER_SZ
+#define	TOTAL_SZ	(LOWER_SZ + UPPER_SZ)
+
+#define	LOWER_OFF	0
+#define	UPPER_OFF	LOWER_SZ
+
+#define	PROT_ALL	(PROT_READ | PROT_WRITE | PROT_EXEC)
+
+enum test_memsegs {
+	MSEG_LOW = 0,
+	MSEG_HIGH = 1,
+};
+
+struct vmctx *
+create_test_vm()
+{
+	char name[VM_MAX_NAMELEN];
+	int res;
+
+	(void) snprintf(name, sizeof (name), "bhyve-test-memmap-%d", getpid());
+
+	res = vm_create(name, 0);
+	if (res != 0) {
+		return (NULL);
+	}
+
+	return (vm_open(name));
+}
+
+int
+alloc_memseg(struct vmctx *ctx, int segid, size_t len, const char *name)
+{
+	struct vm_memseg memseg = {
+		.segid = segid,
+		.len = len,
+	};
+	(void) strlcpy(memseg.name, name, sizeof (memseg.name));
+
+	int fd = vm_get_device_fd(ctx);
+
+	return (ioctl(fd, VM_ALLOC_MEMSEG, &memseg));
+}
+
+static sigjmp_buf segv_env;
+
+void
+sigsegv_handler(int sig)
+{
+	siglongjmp(segv_env, 1);
+}
+
+
+int
+main(int argc, char *argv[])
+{
+	struct vmctx *ctx;
+	int res, fd;
+	void *guest_mem;
+
+	ctx = create_test_vm();
+	fd = vm_get_device_fd(ctx);
+
+	res = alloc_memseg(ctx, MSEG_LOW, LOWER_SZ, "mseg_low");
+	if (res != 0) {
+		perror("could not alloc low memseg");
+		goto bail;
+	}
+	res = alloc_memseg(ctx, MSEG_HIGH, UPPER_SZ, "mseg_high");
+	if (res != 0) {
+		perror("could not alloc high memseg");
+		goto bail;
+	}
+
+
+	res = vm_mmap_memseg(ctx, LOWER_OFF, MSEG_LOW, 0, LOWER_SZ, PROT_ALL);
+	if (res != 0) {
+		perror("could not map low memseg");
+		goto bail;
+	}
+	res = vm_mmap_memseg(ctx, UPPER_OFF, MSEG_HIGH, 0, UPPER_SZ, PROT_ALL);
+	if (res != 0) {
+		perror("could not map high memseg");
+		goto bail;
+	}
+
+	guest_mem = mmap(NULL, TOTAL_SZ, PROT_READ | PROT_WRITE, MAP_SHARED,
+	    fd, 0);
+	if (guest_mem == MAP_FAILED) {
+		perror("could not mmap guest memory");
+		goto bail;
+	}
+
+	/* Fill memory with 0xff */
+	for (uintptr_t gpa = 0; gpa < TOTAL_SZ; gpa++) {
+		uint8_t *ptr = guest_mem + gpa;
+		*ptr = 0xff;
+	}
+
+	/* Unmap the lower memseg */
+	res = vm_munmap_memseg(ctx, LOWER_OFF, LOWER_SZ);
+	if (guest_mem == NULL) {
+		perror("could not unmap lower memseg");
+		goto bail;
+	}
+
+	/* Confirm upper contents are still correct/accessible */
+	for (uintptr_t gpa = UPPER_OFF; gpa < UPPER_OFF + UPPER_SZ; gpa++) {
+		uint8_t *ptr = guest_mem + gpa;
+		if (*ptr != 0xff) {
+			(void) printf("invalid mem contents at GPA %lx: %x\n",
+			    gpa, *ptr);
+			goto bail;
+		}
+		*ptr = 0xee;
+	}
+
+	/*
+	 * Attempt to access the lower contents, which should result in an
+	 * expected (and thus handled) SIGSEGV.
+	 */
+	struct sigaction sa = {
+		.sa_handler = sigsegv_handler,
+	};
+	struct sigaction old_sa;
+	res = sigaction(SIGSEGV, &sa, &old_sa);
+	if (res != 0) {
+		perror("could not prep signal handling for bad access");
+		goto bail;
+	}
+
+	if (sigsetjmp(segv_env, 1) == 0) {
+		volatile uint8_t *ptr = guest_mem;
+
+		/*
+		 * This access to the guest space should fail, since the memseg
+		 * covering the lower part of the VM space has been unmapped.
+		 */
+		uint8_t tmp = *ptr;
+
+		(void) printf("access to %p (%x) should have failed\n", tmp);
+		goto bail;
+	}
+
+	/*
+	 * Unmap and remap the space so any cached entries are dropped for the
+	 * portion we expect is still accessible.
+	 */
+	res = munmap(guest_mem, TOTAL_SZ);
+	if (res != 0) {
+		perror("could not unmap lower memseg");
+		goto bail;
+	}
+	guest_mem = mmap(NULL, TOTAL_SZ, PROT_READ | PROT_WRITE, MAP_SHARED,
+	    fd, 0);
+	if (guest_mem == MAP_FAILED) {
+		perror("could not re-mmap guest memory");
+		goto bail;
+	}
+
+	/* Check the upper portion for accessibility. */
+	if (sigsetjmp(segv_env, 1) == 0) {
+		volatile uint8_t *ptr = guest_mem + UPPER_OFF;
+
+		uint8_t tmp = *ptr;
+		if (tmp != 0xee) {
+			(void) printf("unexpected value at %p (%x)\n", ptr,
+			    tmp);
+			goto bail;
+		}
+
+		res = sigaction(SIGSEGV, &old_sa, NULL);
+		if (res != 0) {
+			perror("could not restore SIGSEGV handler");
+			goto bail;
+		}
+	} else {
+		(void) printf("unexpected fault in upper mapping\n");
+		goto bail;
+	}
+
+
+	/* Unmap the upper memseg */
+	res = vm_munmap_memseg(ctx, UPPER_OFF, UPPER_SZ);
+	if (guest_mem == NULL) {
+		perror("could not unmap upper memseg");
+		goto bail;
+	}
+
+	/* mission accomplished */
+	vm_destroy(ctx);
+	return (0);
+
+bail:
+	vm_destroy(ctx);
+	return (1);
+}
diff --git a/usr/src/uts/common/fs/smbclnt/netsmb/nsmb_sign_kcf.c b/usr/src/uts/common/fs/smbclnt/netsmb/nsmb_sign_kcf.c
index 4235c94a06..f1a24bfeff 100644
--- a/usr/src/uts/common/fs/smbclnt/netsmb/nsmb_sign_kcf.c
+++ b/usr/src/uts/common/fs/smbclnt/netsmb/nsmb_sign_kcf.c
@@ -32,7 +32,7 @@
  * Common function to see if a mech is available.
  */
 static int
-find_mech(smb_sign_mech_t *mech, crypto_mech_name_t name)
+find_mech(smb_sign_mech_t *mech, const char *name)
 {
 	crypto_mech_type_t t;
 
diff --git a/usr/src/uts/common/fs/smbsrv/smb3_encrypt_kcf.c b/usr/src/uts/common/fs/smbsrv/smb3_encrypt_kcf.c
index 17b07072f9..c4392feb01 100644
--- a/usr/src/uts/common/fs/smbsrv/smb3_encrypt_kcf.c
+++ b/usr/src/uts/common/fs/smbsrv/smb3_encrypt_kcf.c
@@ -32,7 +32,7 @@
  * Common function to see if a mech is available.
  */
 static int
-find_mech(smb_crypto_mech_t *mech, crypto_mech_name_t name)
+find_mech(smb_crypto_mech_t *mech, const char *name)
 {
 	crypto_mech_type_t t;
 
diff --git a/usr/src/uts/common/fs/smbsrv/smb_sign_kcf.c b/usr/src/uts/common/fs/smbsrv/smb_sign_kcf.c
index 55f4bc9d0e..44aa6ba117 100644
--- a/usr/src/uts/common/fs/smbsrv/smb_sign_kcf.c
+++ b/usr/src/uts/common/fs/smbsrv/smb_sign_kcf.c
@@ -32,7 +32,7 @@
  * Common function to see if a mech is available.
  */
 static int
-find_mech(smb_crypto_mech_t *mech, crypto_mech_name_t name)
+find_mech(smb_crypto_mech_t *mech, const char *name)
 {
 	crypto_mech_type_t t;
 
diff --git a/usr/src/uts/common/fs/zfs/dmu_zfetch.c b/usr/src/uts/common/fs/zfs/dmu_zfetch.c
index 8c3799d8ba..08af78d620 100644
--- a/usr/src/uts/common/fs/zfs/dmu_zfetch.c
+++ b/usr/src/uts/common/fs/zfs/dmu_zfetch.c
@@ -162,8 +162,12 @@ dmu_zfetch_fini(zfetch_t *zf)
 	ASSERT(!RW_LOCK_HELD(&zf->zf_rwlock));
 
 	rw_enter(&zf->zf_rwlock, RW_WRITER);
-	while ((zs = list_head(&zf->zf_stream)) != NULL)
-		dmu_zfetch_stream_orphan(zf, zs);
+	while ((zs = list_head(&zf->zf_stream)) != NULL) {
+		if (zfs_refcount_count(&zs->zs_blocks) != 0)
+			dmu_zfetch_stream_orphan(zf, zs);
+		else
+			dmu_zfetch_stream_remove(zf, zs);
+	}
 	rw_exit(&zf->zf_rwlock);
 	list_destroy(&zf->zf_stream);
 	rw_destroy(&zf->zf_rwlock);
diff --git a/usr/src/uts/common/io/1394/targets/av1394/av1394_isoch.c b/usr/src/uts/common/io/1394/targets/av1394/av1394_isoch.c
index b4902b0f55..8e05ffcf9b 100644
--- a/usr/src/uts/common/io/1394/targets/av1394/av1394_isoch.c
+++ b/usr/src/uts/common/io/1394/targets/av1394/av1394_isoch.c
@@ -589,7 +589,7 @@ av1394_ioctl_isoch_handle2ic(av1394_inst_t *avp, void *arg)
 	int		num = (int)(intptr_t)arg;
 	av1394_isoch_t	*ip = &avp->av_i;
 
-	if (num >= (sizeof (ip->i_ic) / sizeof (av1394_ic_t))) {
+	if (num >= NELEM(ip->i_ic)) {
 		TNF_PROBE_0(av1394_ioctl_isoch_handle2ic_error_range,
 		    AV1394_TNF_ISOCH_ERROR, "");
 		return (NULL);
@@ -665,7 +665,7 @@ av1394_ioctl_recv(av1394_inst_t *avp, void *arg, int mode)
 		return (EFAULT);
 	}
 	num = recv.rx_handle;
-	if (num >= (sizeof (ip->i_ic) / sizeof (av1394_ic_t))) {
+	if (num >= NELEM(ip->i_ic)) {
 		TNF_PROBE_0(av1394_ioctl_recv_error_range,
 		    AV1394_TNF_ISOCH_ERROR, "");
 		return (EINVAL);
@@ -707,7 +707,7 @@ av1394_ioctl_xmit(av1394_inst_t *avp, void *arg, int mode)
 		return (EFAULT);
 	}
 	num = xmit.tx_handle;
-	if (num >= (sizeof (ip->i_ic) / sizeof (av1394_ic_t))) {
+	if (num >= NELEM(ip->i_ic)) {
 		TNF_PROBE_0(av1394_ioctl_xmit_error_range,
 		    AV1394_TNF_ISOCH_ERROR, "");
 		return (EINVAL);
diff --git a/usr/src/uts/i86pc/boot/boot_keyboard.c b/usr/src/uts/i86pc/boot/boot_keyboard.c
index 3bf27243aa..e568a7bd9b 100644
--- a/usr/src/uts/i86pc/boot/boot_keyboard.c
+++ b/usr/src/uts/i86pc/boot/boot_keyboard.c
@@ -80,8 +80,9 @@ extern unsigned short *kb_status;
 #else /* __xpv && _BOOT */
 
 /* Device memory addresses */
-#define	kb_flag		((unsigned char *)BIOS_KB_FLAG)
-#define	kb_flag_1	((unsigned char *)BIOS_KB_FLAG_1)
+static unsigned char *kb_status = ((unsigned char *)BIOS_KB_FLAG);
+#define	kb_flag		(&kb_status[0])
+#define	kb_flag_1	(&kb_status[1])
 
 #endif /* __xpv && _BOOT */
 
diff --git a/usr/src/uts/i86pc/io/vmm/io/ppt.c b/usr/src/uts/i86pc/io/vmm/io/ppt.c
index 96cc728a74..fcb10716a8 100644
--- a/usr/src/uts/i86pc/io/vmm/io/ppt.c
+++ b/usr/src/uts/i86pc/io/vmm/io/ppt.c
@@ -30,6 +30,7 @@
 
 /*
  * Copyright 2019 Joyent, Inc.
+ * Copyright 2022 OmniOS Community Edition (OmniOSce) Association.
  */
 
 #include <sys/cdefs.h>
@@ -97,6 +98,7 @@ struct pptbar {
 	uint_t type;
 	ddi_acc_handle_t io_handle;
 	caddr_t io_ptr;
+	uint_t ddireg;
 };
 
 struct pptdev {
@@ -343,8 +345,8 @@ ppt_devmap(dev_t dev, devmap_cookie_t dhp, offset_t off, size_t len,
 {
 	minor_t minor;
 	struct pptdev *ppt;
-	int err;
-	int bar;
+	int err, bar;
+	uint_t ddireg;
 
 	minor = getminor(dev);
 
@@ -362,13 +364,12 @@ ppt_devmap(dev_t dev, devmap_cookie_t dhp, offset_t off, size_t len,
 	if ((bar = ppt_find_pba_bar(ppt)) == -1)
 		return (EINVAL);
 
-	/*
-	 * Add 1 to the BAR number to get the register number used by DDI.
-	 * Register 0 corresponds to PCI config space, the PCI BARs start at 1.
-	 */
-	bar += 1;
+	ddireg = ppt->pptd_bars[bar].ddireg;
+
+	if (ddireg == 0)
+		return (EINVAL);
 
-	err = devmap_devmem_setup(dhp, ppt->pptd_dip, NULL, bar, off, len,
+	err = devmap_devmem_setup(dhp, ppt->pptd_dip, NULL, ddireg, off, len,
 	    PROT_USER | PROT_READ | PROT_WRITE, IOMEM_DATA_CACHED, &ppt_attr);
 
 	if (err == DDI_SUCCESS)
@@ -425,6 +426,13 @@ ppt_bar_crawl(struct pptdev *ppt)
 			break;
 		}
 
+		/*
+		 * Register 0 corresponds to the PCI config space.
+		 * The registers which match the assigned-addresses list are
+		 * offset by 1.
+		 */
+		pbar->ddireg = i + 1;
+
 		pbar->type = reg->pci_phys_hi & PCI_ADDR_MASK;
 		pbar->base = ((uint64_t)reg->pci_phys_mid << 32) |
 		    (uint64_t)reg->pci_phys_low;
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_gpt.c b/usr/src/uts/i86pc/io/vmm/vmm_gpt.c
index 146ad958a8..586b994d56 100644
--- a/usr/src/uts/i86pc/io/vmm/vmm_gpt.c
+++ b/usr/src/uts/i86pc/io/vmm/vmm_gpt.c
@@ -11,7 +11,7 @@
 
 /*
  * Copyright 2019 Joyent, Inc.
- * Copyright 2021 Oxide Computer Company
+ * Copyright 2022 Oxide Computer Company
  */
 
 #include <sys/types.h>
@@ -80,6 +80,12 @@
  * each node contains the host PFN of the page that it links into the page
  * table, as well as a kernel pointer to table.
  *
+ * On leaf nodes, the reference count tracks how many entries in the table are
+ * covered by mapping from the containing vmspace.  This is maintained during
+ * calls to vmm_populate_region() and vmm_gpt_vacate_region() as part of vmspace
+ * map/unmap operations, rather than in the data path of faults populating the
+ * PTEs themselves.
+ *
  * Note, this is carefully sized to fit exactly into a 64-byte cache line.
  */
 typedef struct vmm_gpt_node vmm_gpt_node_t;
@@ -346,6 +352,14 @@ vmm_gpt_populate_entry(vmm_gpt_t *gpt, uint64_t gpa)
 		}
 		node = child;
 	}
+
+	/*
+	 * Bump the reference count for this leaf for the PTE that is now usable
+	 * by the mapping covering its GPA.
+	 */
+	ASSERT3U(node->vgn_level, ==, LEVEL1);
+	ASSERT3U(node->vgn_ref_cnt, <, 512);
+	node->vgn_ref_cnt++;
 }
 
 /*
@@ -437,15 +451,26 @@ vmm_gpt_vacate_entry(vmm_gpt_t *gpt, uint64_t gpa)
 		nodes[i] = node;
 		node = vmm_gpt_node_find_child(node, gpa);
 	}
-	if (nodes[LEVEL1] != NULL) {
-		uint64_t *ptes = nodes[LEVEL1]->vgn_entries;
-		for (uint_t i = 0; i < (PAGESIZE / sizeof (uint64_t)); i++)
-			ASSERT3U(ptes[i], ==, 0);
-	}
 	for (uint_t i = LEVEL1; i > 0; i--) {
-		if (nodes[i] == NULL)
+		node = nodes[i];
+
+		if (node == NULL)
 			continue;
-		if (nodes[i]->vgn_ref_cnt != 0)
+
+		if (i == LEVEL1) {
+			ASSERT0(node->vgn_entries[vmm_gpt_node_index(gpa, i)]);
+			ASSERT3U(node->vgn_ref_cnt, !=, 0);
+
+			/*
+			 * Just as vmm_gpt_populate_entry() increments the
+			 * reference count for leaf PTEs which become usable,
+			 * here we decrement it as they become unusable as the
+			 * mapping covering its GPA is removed.
+			 */
+			node->vgn_ref_cnt--;
+		}
+
+		if (node->vgn_ref_cnt != 0)
 			break;
 		vmm_gpt_node_remove_child(nodes[i - 1], nodes[i]);
 	}
diff --git a/usr/src/uts/i86pc/io/vmm/vmm_vm.c b/usr/src/uts/i86pc/io/vmm/vmm_vm.c
index 5565116d4f..e37488900b 100644
--- a/usr/src/uts/i86pc/io/vmm/vmm_vm.c
+++ b/usr/src/uts/i86pc/io/vmm/vmm_vm.c
@@ -12,7 +12,7 @@
 
 /*
  * Copyright 2019 Joyent, Inc.
- * Copyright 2021 Oxide Computer Company
+ * Copyright 2022 Oxide Computer Company
  * Copyright 2021 OmniOS Community Edition (OmniOSce) Association.
  */
 
@@ -741,12 +741,10 @@ vmspace_lookup_map(vmspace_t *vms, uintptr_t gpa, int req_prot, pfn_t *pfnp,
 		vmspace_mapping_t *vmsm;
 		vm_object_t *vmo;
 
-		/*
-		 * Because of the prior leaf check, we should be confident that
-		 * _some_ mapping covers this GPA
-		 */
 		vmsm = vm_mapping_find(vms, gpa, PAGESIZE);
-		VERIFY(vmsm != NULL);
+		if (vmsm == NULL) {
+			return (FC_NOMAP);
+		}
 
 		if ((req_prot & vmsm->vmsm_prot) != req_prot) {
 			return (FC_PROT);