[illumos-gate merge]

commit aa9ef484c6f8ecee85dfefdb4970c50cfa2db302
    9128 cw(1onbld) should be able to run multiple shadows
    9129 file-locking tests shouldn't build multiple source files in one compiler invocation
    9130 DTrace tst.gcc.d isn't useful
    9132 cw(1onbld) shouldn't shadow pure preprocessing
commit bdc560ab289d67ddebad9a2146fd36c2662d88b1
    5159 ipsec_libssl_setup.c loads libcrypto
commit 15aeb4d1148772724cf568e1f7a13fbb99f11ab8
    9848 libi386: pxe.h cstyle cleanup

25 files changed, 951 insertions, 1187 deletions

diff --git a/usr/src/Makefile b/usr/src/Makefile
index ce8962609a..8fea9a9e02 100644
--- a/usr/src/Makefile
+++ b/usr/src/Makefile
@@ -25,7 +25,7 @@
 # Copyright 2014 Garrett D'Amore <garrett@damore.org>
 # Copyright 2015 OmniTI Computer Consulting, Inc. All rights reserved.
 # Copyright 2016 Toomas Soome <tsoome@me.com>
-# Copyright 2017 Joyent, Inc.
+# Copyright 2018 Joyent, Inc.
 # Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
 #
 
@@ -240,47 +240,12 @@ cscope.out tags: FRC
 
 FRC:
 
-#
-# Targets for reporting compiler versions; nightly uses these.
-#
-
+# used by nightly
 cc-version:
-	@if $($(MACH)_CC) -_versions >/dev/null 2>/dev/null; then \
-		$(ECHO) 32-bit compiler;			\
-		$(ECHO) $($(MACH)_CC);				\
-		$($(MACH)_CC) -_versions 2>&1 |			\
-		    $(EGREP) '^(cw|cc|gcc|primary|shadow)';	\
-	else							\
-		__COMPILER=`$($(MACH)_CC) -_compiler 2>/dev/null || $(TRUE)`;\
-		if [ -z "$$__COMPILER" ]; then			\
-			$(ECHO) No 32-bit compiler found;	\
-			exit 1;					\
-		else						\
-			$(ECHO) 32-bit compiler;		\
-			$(ECHO) $($(MACH)_CC);			\
-			$(ECHO) $$__COMPILER;			\
-			$($(MACH)_CC) -V 2>&1 | head -1;	\
-		fi;						\
-	fi
+	@$(CW) --versions $(CW_CC_COMPILERS) 2>&1
 
+# for older nightlies
 cc64-version:
-	@if $($(MACH64)_CC) -_versions >/dev/null 2>/dev/null; then \
-		$(ECHO) 64-bit compiler;			\
-		$(ECHO) $($(MACH64)_CC);			\
-		$($(MACH64)_CC) -_versions 2>&1 |		\
-		    $(EGREP) '^(cw|cc|gcc|primary|shadow)';	\
-	else							\
-		__COMPILER=`$($(MACH64)_CC) -_compiler 2>/dev/null || $(TRUE)`;\
-		if [ -z "$$__COMPILER" ]; then			\
-			$(ECHO) No 64-bit compiler found;	\
-			exit 1;					\
-		else						\
-			$(ECHO) 64-bit compiler;		\
-			$(ECHO) $($(MACH64)_CC);		\
-			$(ECHO) $$__COMPILER;			\
-			$($(MACH64)_CC) -V 2>&1 | head -1;	\
-		fi;						\
-	fi
 
 java-version:
 	@if [ -x "$(JAVAC)" ]; then			\
diff --git a/usr/src/Makefile.master b/usr/src/Makefile.master
index e58b1fb519..3803e25067 100644
--- a/usr/src/Makefile.master
+++ b/usr/src/Makefile.master
@@ -510,15 +510,13 @@ CTF_FLAGS	= $(CTF_FLAGS_32)
 #
 # Flags used with genoffsets
 #
-GOFLAGS = -_noecho \
-	$(CALLSYMS) \
-	$(CDWARFSTR)
+GOFLAGS = $(CALLSYMS) $(CDWARFSTR)
 
 OFFSETS_CREATE = $(GENOFFSETS) -s $(CTFSTABS) -r $(CTFCONVERT) \
-	$(CC) $(GOFLAGS) $(CFLAGS) $(CPPFLAGS)
+	$(CW) --noecho $(CW_CC_COMPILERS) -- $(GOFLAGS) $(CFLAGS) $(CPPFLAGS)
 
 OFFSETS_CREATE64 = $(GENOFFSETS) -s $(CTFSTABS) -r $(CTFCONVERT) \
-	$(CC) $(GOFLAGS) $(CFLAGS64) $(CPPFLAGS)
+	$(CW) --noecho $(CW_CC_COMPILERS) -- $(GOFLAGS) $(CFLAGS64) $(CPPFLAGS)
 
 #
 # tradeoff time for space (smaller is better)
@@ -713,7 +711,7 @@ MAPFILE.INT =		mapfile-intf
 #
 LDLIBS32 =	$(ENVLDLIBS1) $(ENVLDLIBS2) $(ENVLDLIBS3)
 LDLIBS32 +=	$(ADJUNCT_PROTO:%=-L%/usr/lib -L%/lib)
-LDLIBS.cmd = 	$(LDLIBS32)
+LDLIBS.cmd =	$(LDLIBS32)
 LDLIBS.lib =	$(LDLIBS32)
 
 LDLIBS64 =	$(ENVLDLIBS1:%=%/$(MACH64)) \
@@ -806,6 +804,15 @@ SPRO_ROOT=		$(BUILD_TOOLS)/SUNWspro
 SPRO_VROOT=		$(SPRO_ROOT)/SS12
 GNU_ROOT=		/usr
 
+$(__GNUC)PRIMARY_CC=	gcc4,$(GNUC_ROOT)/bin/gcc,gnu
+$(__SUNC)PRIMARY_CC=	studio12,$(SPRO_VROOT)/bin/cc,sun
+$(__GNUC)PRIMARY_CCC=	gcc4,$(GNUC_ROOT)/bin/g++,gnu
+$(__SUNC)PRIMARY_CCC=	studio12,$(SPRO_VROOT)/bin/CC,sun
+
+CW_CC_COMPILERS=	$(PRIMARY_CC:%=--primary %) $(SHADOW_CCS:%=--shadow %)
+CW_CCC_COMPILERS=	$(PRIMARY_CCC:%=--primary %) $(SHADOW_CCCS:%=--shadow %)
+
+
 # Till SS12u1 formally becomes the NV CBE, LINT is hard
 # coded to be picked up from the $SPRO_ROOT/sunstudio12.1/
 # location. Impacted variables are sparc_LINT, sparcv9_LINT,
@@ -816,42 +823,31 @@ GNU_ROOT=		/usr
 # Specify platform compiler versions for languages
 # that we use (currently only c and c++).
 #
-sparc_CC=		$(ONBLD_TOOLS)/bin/$(MACH)/cw -_cc
-$(__GNUC)sparc_CC=	$(ONBLD_TOOLS)/bin/$(MACH)/cw -_gcc
-sparc_CCC=		$(ONBLD_TOOLS)/bin/$(MACH)/cw -_CC
-$(__GNUC)sparc_CCC=	$(ONBLD_TOOLS)/bin/$(MACH)/cw -_g++
-sparc_CPP=		/usr/ccs/lib/cpp
+CW=			$(ONBLD_TOOLS)/bin/$(MACH)/cw
+
+BUILD_CC=		$(CW) $(CW_CC_COMPILERS) --
+BUILD_CCC=		$(CW) -C $(CW_CCC_COMPILERS) --
+BUILD_CPP=		/usr/ccs/lib/cpp
+BUILD_LD=		/usr/ccs/bin/ld
+BUILD_LINT=		$(SPRO_ROOT)/sunstudio12.1/bin/lint
+
+$(MACH)_CC=		$(BUILD_CC)
+$(MACH)_CCC=		$(BUILD_CCC)
+$(MACH)_CPP=		$(BUILD_CPP)
+$(MACH)_LD=		$(BUILD_LD)
+$(MACH)_LINT=		$(BUILD_LINT)
+$(MACH64)_CC=		$(BUILD_CC)
+$(MACH64)_CCC=		$(BUILD_CCC)
+$(MACH64)_CPP=		$(BUILD_CPP)
+$(MACH64)_LD=		$(BUILD_LD)
+$(MACH64)_LINT=		$(BUILD_LINT)
+
 sparc_AS=		/usr/ccs/bin/as -xregsym=no
-sparc_LD=		/usr/ccs/bin/ld
-sparc_LINT=		$(SPRO_ROOT)/sunstudio12.1/bin/lint
-
-sparcv9_CC=		$(ONBLD_TOOLS)/bin/$(MACH)/cw -_cc
-$(__GNUC64)sparcv9_CC=	$(ONBLD_TOOLS)/bin/$(MACH)/cw -_gcc
-sparcv9_CCC=		$(ONBLD_TOOLS)/bin/$(MACH)/cw -_CC
-$(__GNUC64)sparcv9_CCC=	$(ONBLD_TOOLS)/bin/$(MACH)/cw -_g++
-sparcv9_CPP=		/usr/ccs/lib/cpp
-sparcv9_AS=		/usr/ccs/bin/as -xregsym=no
-sparcv9_LD=		/usr/ccs/bin/ld
-sparcv9_LINT=		$(SPRO_ROOT)/sunstudio12.1/bin/lint
-
-i386_CC=		$(ONBLD_TOOLS)/bin/$(MACH)/cw -_cc
-$(__GNUC)i386_CC=	$(ONBLD_TOOLS)/bin/$(MACH)/cw -_gcc
-i386_CCC=		$(ONBLD_TOOLS)/bin/$(MACH)/cw -_CC
-$(__GNUC)i386_CCC=	$(ONBLD_TOOLS)/bin/$(MACH)/cw -_g++
-i386_CPP=		/usr/ccs/lib/cpp
+sparcv9_AS=		$($(MACH)_AS)
+
 i386_AS=		/usr/ccs/bin/as
 $(__GNUC)i386_AS=	$(ONBLD_TOOLS)/bin/$(MACH)/aw
-i386_LD=		/usr/ccs/bin/ld
-i386_LINT=		$(SPRO_ROOT)/sunstudio12.1/bin/lint
-
-amd64_CC=		$(ONBLD_TOOLS)/bin/$(MACH)/cw -_cc
-$(__GNUC64)amd64_CC=	$(ONBLD_TOOLS)/bin/$(MACH)/cw -_gcc
-amd64_CCC=		$(ONBLD_TOOLS)/bin/$(MACH)/cw -_CC
-$(__GNUC64)amd64_CCC=	$(ONBLD_TOOLS)/bin/$(MACH)/cw -_g++
-amd64_CPP=		/usr/ccs/lib/cpp
 amd64_AS=		$(ONBLD_TOOLS)/bin/$(MACH)/aw
-amd64_LD=		/usr/ccs/bin/ld
-amd64_LINT=		$(SPRO_ROOT)/sunstudio12.1/bin/lint
 
 NATIVECC=		$($(NATIVE_MACH)_CC)
 NATIVECCC=		$($(NATIVE_MACH)_CCC)
@@ -870,12 +866,6 @@ AS=			$(NATIVEAS)
 LD=			$(NATIVELD)
 LINT=			$(NATIVELINT)
 
-# The real compilers used for this build
-CW_CC_CMD=		$(CC) -_compiler
-CW_CCC_CMD=		$(CCC) -_compiler
-REAL_CC=		$(CW_CC_CMD:sh)
-REAL_CCC=		$(CW_CCC_CMD:sh)
-
 # Pass -Y flag to cpp (method of which is release-dependent)
 CCYFLAG=		-Y I,
 
@@ -931,8 +921,8 @@ C_BIGPICFLAGS64 =	$($(MACH64)_C_BIGPICFLAGS)
 # CC requires there to be no space between '-K' and 'pic' or 'PIC'.
 sparc_CC_PICFLAGS =	-Kpic
 sparcv9_CC_PICFLAGS =	-KPIC
-i386_CC_PICFLAGS = 	-Kpic
-amd64_CC_PICFLAGS = 	-Kpic
+i386_CC_PICFLAGS =	-Kpic
+amd64_CC_PICFLAGS =	-Kpic
 CC_PICFLAGS =		$($(MACH)_CC_PICFLAGS)
 CC_PICFLAGS64 =		$($(MACH64)_CC_PICFLAGS)
 
@@ -992,7 +982,7 @@ CTFCONVERT_O		= $(CTFCONVERT) $(CTFCVTFLAGS) $@
 # The following list of macros are used in the definition of RELEASE_CM
 # which is used to label all binaries in the build:
 #
-# 	RELEASE		Specific release of the build, eg: 5.2
+#	RELEASE		Specific release of the build, eg: 5.2
 #	RELEASE_MAJOR	Major version number part of $(RELEASE)
 #	RELEASE_MINOR	Minor version number part of $(RELEASE)
 #	VERSION		Version of the build (alpha, beta, Generic)
@@ -1019,7 +1009,7 @@ $(RELEASE_BUILD)PROCESS_COMMENT=   @?${MCS} -d -a $(RELEASE_CM)
 STRIP_STABS=			   $(STRIP) -x $@
 $(SRCDBGBLD)STRIP_STABS=	   :
 
-POST_PROCESS_O=	
+POST_PROCESS_O=
 POST_PROCESS_A=
 POST_PROCESS_SO=	$(PROCESS_COMMENT) $@ ; $(STRIP_STABS) ; \
 			$(ELFSIGN_OBJECT)
@@ -1118,8 +1108,8 @@ PKGPUBLISHER_NONREDIST=	on-extra
 # build the catalogue with awk(1).
 
 .sh.po .ksh.po:
-	$(SED) -n -e ":a" 				\
-		  -e "h" 					\
+	$(SED) -n -e ":a"					\
+		  -e "h"					\
 		  -e "s/.*gettext *\(\"[^\"]*\"\).*/\1/p"	\
 		  -e "x"					\
 		  -e "s/\(.*\)gettext *\"[^\"]*\"\(.*\)/\1\2/"	\
diff --git a/usr/src/Makefile.master.64 b/usr/src/Makefile.master.64
index 704a0411a4..77d7114882 100644
--- a/usr/src/Makefile.master.64
+++ b/usr/src/Makefile.master.64
@@ -64,9 +64,6 @@ AS=		$($(MACH64)_AS)
 LD=		$($(MACH64)_LD)
 LINT=		$($(MACH64)_LINT)
 
-REAL_CC=	$(CW_CC_CMD:sh)
-REAL_CCC=	$(CW_CCC_CMD:sh)
-
 BUILD.SO=	$(CC) $(CFLAGS) -o $@ $(GSHARED) $(DYNFLAGS) \
 		$(PICS) $(EXTPICS) $(USDT_PICS) -L $(ROOTLIBDIR64) $(LDLIBS)
 
diff --git a/usr/src/boot/sys/boot/i386/libi386/pxe.h b/usr/src/boot/sys/boot/i386/libi386/pxe.h
index 67e2c643d8..f4bf388aa8 100644
--- a/usr/src/boot/sys/boot/i386/libi386/pxe.h
+++ b/usr/src/boot/sys/boot/i386/libi386/pxe.h
@@ -36,7 +36,8 @@
  * It's for your own good. :)
  */
 
-/* It seems that intel didn't think about ABI,
+/*
+ * It seems that intel didn't think about ABI,
  * either that or 16bit ABI != 32bit ABI (which seems reasonable)
  * I have to thank Intel for the hair loss I incurred trying to figure
  * out why PXE was mis-reading structures I was passing it (at least
@@ -48,7 +49,7 @@
  */
 #define	PACKED		__packed
 
-#define	S_SIZE(s)	s, sizeof(s) - 1
+#define	S_SIZE(s)	s, sizeof (s) - 1
 
 #define	PXENFSROOTPATH	"/pxeroot"
 
@@ -92,8 +93,8 @@ typedef struct {
 	uint16_t	UNDIDataSize;	/* UNDI Data segment size (bytes) */
 	SEGSEL_t	UNDICodeSeg;	/* UNDI Code segment address */
 	uint16_t	UNDICodeSize;	/* UNDI Code segment size (bytes) */
-	SEGOFF16_t	PXEPtr;		/* SEG:OFF to !PXE struct, 
-					   only present when Version > 2.1 */
+	/* SEG:OFF to !PXE struct, only present when Version > 2.1 */
+	SEGOFF16_t	PXEPtr;
 } PACKED pxenv_t;
 
 /* !PXE */
@@ -143,7 +144,8 @@ typedef struct {
 #define	PXENV_UNDI_INITIALIZE		0x0003
 typedef struct {
 	PXENV_STATUS_t	Status;
-	ADDR32_t	ProtocolIni;	/* Phys addr of a copy of the driver module */
+	/* Phys addr of a copy of the driver module */
+	ADDR32_t	ProtocolIni;
 	uint8_t		reserved[8];
 } PACKED t_PXENV_UNDI_INITIALIZE;
 
@@ -155,7 +157,7 @@ typedef struct {
 	MAC_ADDR	McastAddr[MAXNUM_MCADDR];
 } PACKED t_PXENV_UNDI_MCAST_ADDRESS;
 
-#define	PXENV_UNDI_RESET_ADAPTER	0x0004		
+#define	PXENV_UNDI_RESET_ADAPTER	0x0004
 typedef struct {
 	PXENV_STATUS_t	Status;
 	t_PXENV_UNDI_MCAST_ADDRESS R_Mcast_Buf;
@@ -171,10 +173,10 @@ typedef struct {
 	PXENV_STATUS_t	Status;
 	uint16_t	OpenFlag;
 	uint16_t	PktFilter;
-#	define FLTR_DIRECTED	0x0001
-#	define FLTR_BRDCST	0x0002
-#	define FLTR_PRMSCS	0x0004
-#	define FLTR_SRC_RTG	0x0008
+#define	FLTR_DIRECTED	0x0001
+#define	FLTR_BRDCST	0x0002
+#define	FLTR_PRMSCS	0x0004
+#define	FLTR_SRC_RTG	0x0008
 
 	t_PXENV_UNDI_MCAST_ADDRESS R_Mcast_Buf;
 } PACKED t_PXENV_UNDI_OPEN;
@@ -188,14 +190,14 @@ typedef struct {
 typedef struct {
 	PXENV_STATUS_t	Status;
 	uint8_t		Protocol;
-#	define P_UNKNOWN	0
-#	define P_IP		1
-#	define P_ARP		2
-#	define P_RARP		3
+#define	P_UNKNOWN	0
+#define	P_IP		1
+#define	P_ARP		2
+#define	P_RARP		3
 
 	uint8_t		XmitFlag;
-#	define XMT_DESTADDR	0x0000
-#	define XMT_BROADCAST	0x0001
+#define	XMT_DESTADDR	0x0000
+#define	XMT_BROADCAST	0x0001
 
 	SEGOFF16_t	DestAddr;
 	SEGOFF16_t	TBD;
@@ -236,30 +238,30 @@ typedef struct {
 #define	PXENV_UNDI_GET_INFORMATION	0x000C
 typedef struct {
 	PXENV_STATUS_t	Status;
-	uint16_t	BaseIo;			/* Adapter base I/O address */
-	uint16_t	IntNumber;		/* Adapter IRQ number */
-	uint16_t	MaxTranUnit;		/* Adapter maximum transmit unit */
-	uint16_t	HwType;			/* Type of protocol at the hardware addr */
-#	define ETHER_TYPE	1
-#	define EXP_ETHER_TYPE	2
-#	define IEEE_TYPE	6
-#	define ARCNET_TYPE	7
-
-	uint16_t	HwAddrLen;		/* Length of hardware address */
-	MAC_ADDR	CurrentNodeAddress;	/* Current hardware address */
-	MAC_ADDR	PermNodeAddress;	/* Permanent hardware address */
-	SEGSEL_t	ROMAddress;		/* Real mode ROM segment address */
-	uint16_t	RxBufCt;		/* Receive queue length */
-	uint16_t	TxBufCt;		/* Transmit queue length */
+	uint16_t BaseIo;		/* Adapter base I/O address */
+	uint16_t IntNumber;		/* Adapter IRQ number */
+	uint16_t MaxTranUnit;		/* Adapter maximum transmit unit */
+	uint16_t HwType;	/* Type of protocol at the hardware addr */
+#define	ETHER_TYPE	1
+#define	EXP_ETHER_TYPE	2
+#define	IEEE_TYPE	6
+#define	ARCNET_TYPE	7
+
+	uint16_t HwAddrLen;		/* Length of hardware address */
+	MAC_ADDR CurrentNodeAddress;	/* Current hardware address */
+	MAC_ADDR PermNodeAddress;	/* Permanent hardware address */
+	SEGSEL_t ROMAddress;		/* Real mode ROM segment address */
+	uint16_t RxBufCt;		/* Receive queue length */
+	uint16_t TxBufCt;		/* Transmit queue length */
 } PACKED t_PXENV_UNDI_GET_INFORMATION;
 
 #define	PXENV_UNDI_GET_STATISTICS	0x000D
 typedef struct {
 	PXENV_STATUS_t	Status;
-	uint32_t	XmitGoodFrames;		/* Number of successful transmissions */
-	uint32_t	RcvGoodFrames;		/* Number of good frames received */
-	uint32_t	RcvCRCErrors;		/* Number of frames with CRC errors */
-	uint32_t	RcvResourceErrors;	/* Number of frames dropped */
+	uint32_t XmitGoodFrames;	/* Number of successful transmissions */
+	uint32_t RcvGoodFrames;		/* Number of good frames received */
+	uint32_t RcvCRCErrors;		/* Number of frames with CRC errors */
+	uint32_t RcvResourceErrors;	/* Number of frames dropped */
 } PACKED t_PXENV_UNDI_GET_STATISTICS;
 
 #define	PXENV_UNDI_CLEAR_STATISTICS	0x000E
@@ -288,9 +290,9 @@ typedef struct {
 typedef struct {
 	PXENV_STATUS_t	Status;
 	uint8_t		NicType;		/* Type of NIC */
-#	define PCI_NIC		2
-#	define PnP_NIC		3
-#	define CardBus_NIC	4
+#define	PCI_NIC		2
+#define	PnP_NIC		3
+#define	CardBus_NIC	4
 
 	union {
 		struct {
@@ -326,29 +328,29 @@ typedef struct {
 #define	PXENV_UNDI_ISR			0x0014
 typedef struct {
 	PXENV_STATUS_t	Status;
-	uint16_t	FuncFlag;		/* PXENV_UNDI_ISR_OUT_xxx */
-	uint16_t	BufferLength;		/* Length of Frame */
-	uint16_t	FrameLength;		/* Total length of receiver frame */
-	uint16_t	FrameHeaderLength;	/* Length of the media header in Frame */
-	SEGOFF16_t	Frame;			/* receive buffer */
-	uint8_t		ProtType;		/* Protocol type */
-	uint8_t		PktType;		/* Packet Type */
-#	define PXENV_UNDI_ISR_IN_START		1
-#	define PXENV_UNDI_ISR_IN_PROCESS	2
-#	define PXENV_UNDI_ISR_IN_GET_NEXT	3
+	uint16_t FuncFlag;		/* PXENV_UNDI_ISR_OUT_xxx */
+	uint16_t BufferLength;		/* Length of Frame */
+	uint16_t FrameLength;		/* Total length of receiver frame */
+	uint16_t FrameHeaderLength; /* Length of the media header in Frame */
+	SEGOFF16_t Frame;		/* receive buffer */
+	uint8_t	ProtType;		/* Protocol type */
+	uint8_t	PktType;		/* Packet Type */
+#define	PXENV_UNDI_ISR_IN_START		1
+#define	PXENV_UNDI_ISR_IN_PROCESS	2
+#define	PXENV_UNDI_ISR_IN_GET_NEXT	3
 
 	/* one of these will be returned for PXENV_UNDI_ISR_IN_START */
-#	define PXENV_UNDI_ISR_OUT_OURS		0
-#	define PXENV_UNDI_ISR_OUT_NOT_OUTS	1
+#define	PXENV_UNDI_ISR_OUT_OURS		0
+#define	PXENV_UNDI_ISR_OUT_NOT_OUTS	1
 
 	/*
 	 * one of these will be returned for PXEND_UNDI_ISR_IN_PROCESS
 	 * and PXENV_UNDI_ISR_IN_GET_NEXT
 	 */
-#	define PXENV_UNDI_ISR_OUT_DONE		0
-#	define PXENV_UNDI_ISR_OUT_TRANSMIT	2
-#	define PXENV_UNDI_ISR_OUT_RECEIVE	3
-#	define PXENV_UNDI_ISR_OUT_BUSY		4
+#define	PXENV_UNDI_ISR_OUT_DONE		0
+#define	PXENV_UNDI_ISR_OUT_TRANSMIT	2
+#define	PXENV_UNDI_ISR_OUT_RECEIVE	3
+#define	PXENV_UNDI_ISR_OUT_BUSY		4
 } PACKED t_PXENV_UNDI_ISR;
 
 #define	PXENV_STOP_UNDI			0x0015
@@ -417,12 +419,12 @@ typedef struct {
 #define	PXENV_UDP_READ			0x0032
 typedef struct {
 	PXENV_STATUS_t	status;
-	IP4_t		src_ip;		/* IP of sender */
-	IP4_t		dest_ip;	/* Only accept packets sent to this IP */
-	UDP_PORT_t	s_port;		/* UDP source port of sender */
-	UDP_PORT_t	d_port;		/* Only accept packets sent to this port */
-	uint16_t	buffer_size;	/* Size of the packet buffer */
-	SEGOFF16_t	buffer;		/* SEG:OFF to the packet buffer */
+	IP4_t	src_ip;		/* IP of sender */
+	IP4_t	dest_ip;	/* Only accept packets sent to this IP */
+	UDP_PORT_t s_port;	/* UDP source port of sender */
+	UDP_PORT_t d_port;	/* Only accept packets sent to this port */
+	uint16_t buffer_size;	/* Size of the packet buffer */
+	SEGOFF16_t buffer;	/* SEG:OFF to the packet buffer */
 } PACKED t_PXENV_UDP_READ;
 
 #define	PXENV_UDP_WRITE			0x0033
@@ -446,53 +448,55 @@ typedef struct {
 #define	PXENV_GET_CACHED_INFO		0x0071
 typedef struct {
 	PXENV_STATUS_t	Status;
-	uint16_t	PacketType;	/* type (defined right here) */
-#	define PXENV_PACKET_TYPE_DHCP_DISCOVER  1
-#	define PXENV_PACKET_TYPE_DHCP_ACK       2
-#	define PXENV_PACKET_TYPE_BINL_REPLY     3
-	uint16_t	BufferSize;	/* max to copy, leave at 0 for pointer */
-	SEGOFF16_t	Buffer;		/* copy to, leave at 0 for pointer */
-	uint16_t	BufferLimit;	/* max size of buffer in BC dataseg ? */
+	uint16_t PacketType;	/* type (defined right here) */
+#define	PXENV_PACKET_TYPE_DHCP_DISCOVER	1
+#define	PXENV_PACKET_TYPE_DHCP_ACK	2
+#define	PXENV_PACKET_TYPE_BINL_REPLY	3
+	uint16_t BufferSize;	/* max to copy, leave at 0 for pointer */
+	SEGOFF16_t Buffer;	/* copy to, leave at 0 for pointer */
+	uint16_t BufferLimit;	/* max size of buffer in BC dataseg ? */
 } PACKED t_PXENV_GET_CACHED_INFO;
 
 
-/* structure filled in by PXENV_GET_CACHED_INFO 
+/*
+ * structure filled in by PXENV_GET_CACHED_INFO
  * (how we determine which IP we downloaded the initial bootstrap from)
  * words can't describe...
  */
 typedef struct {
-	uint8_t		opcode;
-#	define BOOTP_REQ	1
-#	define BOOTP_REP	2
-	uint8_t		Hardware;	/* hardware type */
-	uint8_t		Hardlen;	/* hardware addr len */
-	uint8_t		Gatehops;	/* zero it */
-	uint32_t	ident;		/* random number chosen by client */
-	uint16_t	seconds;	/* seconds since did initial bootstrap */
-	uint16_t	Flags;		/* seconds since did initial bootstrap */
-#	define BOOTP_BCAST	0x8000		/* ? */
-	IP4_t		cip;		/* Client IP */
-	IP4_t		yip;		/* Your IP */
-	IP4_t		sip;		/* IP to use for next boot stage */
-	IP4_t		gip;		/* Relay IP ? */
-	MAC_ADDR	CAddr;		/* Client hardware address */
-	uint8_t		Sname[64];	/* Server's hostname (Optional) */
-	uint8_t		bootfile[128];	/* boot filename */
+	uint8_t	 opcode;
+#define	BOOTP_REQ	1
+#define	BOOTP_REP	2
+	uint8_t Hardware;	/* hardware type */
+	uint8_t Hardlen;	/* hardware addr len */
+	uint8_t Gatehops;	/* zero it */
+	uint32_t ident;		/* random number chosen by client */
+	uint16_t seconds;	/* seconds since did initial bootstrap */
+	uint16_t Flags;		/* seconds since did initial bootstrap */
+#define	BOOTP_BCAST	0x8000	/* ? */
+	IP4_t	cip;		/* Client IP */
+	IP4_t	yip;		/* Your IP */
+	IP4_t	sip;		/* IP to use for next boot stage */
+	IP4_t	gip;		/* Relay IP ? */
+	MAC_ADDR CAddr;		/* Client hardware address */
+	uint8_t	Sname[64];	/* Server's hostname (Optional) */
+	uint8_t	bootfile[128];	/* boot filename */
 	union {
-#		if 1
-#		define BOOTP_DHCPVEND  1024    /* DHCP extended vendor field size */
-#		else
-#		define BOOTP_DHCPVEND  312	/* DHCP standard vendor field size */
-#		endif
-		uint8_t		d[BOOTP_DHCPVEND];	/* raw array of vendor/dhcp options */
+#if 1
+#define	BOOTP_DHCPVEND  1024    /* DHCP extended vendor field size */
+#else
+#define	BOOTP_DHCPVEND  312	/* DHCP standard vendor field size */
+#endif
+		/* raw array of vendor/dhcp options */
+		uint8_t d[BOOTP_DHCPVEND];
 		struct {
-			uint8_t		magic[4];	/* DHCP magic cookie */
-#			ifndef		VM_RFC1048
-#			define		VM_RFC1048	0x63825363L	/* ? */
-#			endif
-			uint32_t	flags;		/* bootp flags/opcodes */
-			uint8_t		pad[56];	/* I don't think intel knows what a
-							   union does... */
+			uint8_t magic[4]; /* DHCP magic cookie */
+#ifndef	VM_RFC1048
+#define	VM_RFC1048	0x63825363L	/* ? */
+#endif
+			uint32_t flags;	/* bootp flags/opcodes */
+			/* I don't think intel knows what a union does... */
+			uint8_t pad[56];
 		} v;
 	} vendor;
 } PACKED BOOTPLAYER;
diff --git a/usr/src/cmd/dtrace/test/tst/common/Makefile b/usr/src/cmd/dtrace/test/tst/common/Makefile
index 32d6a1db05..dd4d9d4b5d 100644
--- a/usr/src/cmd/dtrace/test/tst/common/Makefile
+++ b/usr/src/cmd/dtrace/test/tst/common/Makefile
@@ -57,8 +57,6 @@ sysevent/tst.post_chan.exe := LDLIBS += -lsysevent
 
 ustack/tst.bigstack.exe := COPTFLAG += -xO1
 
-GCC = $(ONBLD_TOOLS)/bin/$(MACH)/cw -_gcc
-
 nfs/%.o: $(SNOOPDIR)/%.c
 	$(COMPILE.c) -o $@ $< -I$(SNOOPDIR)
 	$(POST_PROCESS_O)
@@ -75,10 +73,6 @@ nfs/tst.call3.exe: nfs/tst.call3.o nfs/$(RPCSVCOBJS)
 	$(LDLIBS) -lnsl -lrpcsvc
 	$(POST_PROCESS) ; $(STRIP_STABS)
 
-pid/tst.gcc.exe: pid/tst.gcc.c
-	$(GCC) -o pid/tst.gcc.exe pid/tst.gcc.c $(LDFLAGS) $(LDLIBS)
-	$(POST_PROCESS) ; $(STRIP_STABS)
-
 json/tst.usdt.o: json/usdt.h
 
 json/usdt.h: json/usdt.d
diff --git a/usr/src/cmd/dtrace/test/tst/common/pid/tst.gcc.c b/usr/src/cmd/dtrace/test/tst/common/pid/tst.gcc.c
deleted file mode 100644
index 4fe7bb45cb..0000000000
--- a/usr/src/cmd/dtrace/test/tst/common/pid/tst.gcc.c
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * CDDL HEADER START
- *
- * The contents of this file are subject to the terms of the
- * Common Development and Distribution License (the "License").
- * You may not use this file except in compliance with the License.
- *
- * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
- * or http://www.opensolaris.org/os/licensing.
- * See the License for the specific language governing permissions
- * and limitations under the License.
- *
- * When distributing Covered Code, include this CDDL HEADER in each
- * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
- * If applicable, add the following below this CDDL HEADER, with the
- * fields enclosed by brackets "[]" replaced with your own identifying
- * information: Portions Copyright [yyyy] [name of copyright owner]
- *
- * CDDL HEADER END
- */
-
-/*
- * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
- */
-
-#include <spawn.h>
-#include <signal.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-
-void
-go(void)
-{
-	pid_t pid;
-
-	(void) posix_spawn(&pid, "/usr/bin/ls", NULL, NULL, NULL, NULL);
-
-	(void) waitpid(pid, NULL, 0);
-}
-
-void
-intr(int sig)
-{
-}
-
-int
-main(int argc, char **argv)
-{
-	struct sigaction sa;
-
-	sa.sa_handler = intr;
-	sigfillset(&sa.sa_mask);
-	sa.sa_flags = 0;
-
-	(void) sigaction(SIGUSR1, &sa, NULL);
-
-	for (;;) {
-		go();
-	}
-
-	return (0);
-}
diff --git a/usr/src/cmd/dtrace/test/tst/common/pid/tst.gcc.d b/usr/src/cmd/dtrace/test/tst/common/pid/tst.gcc.d
deleted file mode 100644
index f119098f03..0000000000
--- a/usr/src/cmd/dtrace/test/tst/common/pid/tst.gcc.d
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * CDDL HEADER START
- *
- * The contents of this file are subject to the terms of the
- * Common Development and Distribution License (the "License").
- * You may not use this file except in compliance with the License.
- *
- * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
- * or http://www.opensolaris.org/os/licensing.
- * See the License for the specific language governing permissions
- * and limitations under the License.
- *
- * When distributing Covered Code, include this CDDL HEADER in each
- * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
- * If applicable, add the following below this CDDL HEADER, with the
- * fields enclosed by brackets "[]" replaced with your own identifying
- * information: Portions Copyright [yyyy] [name of copyright owner]
- *
- * CDDL HEADER END
- */
-
-/*
- * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
- */
-
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
-/*
- * ASSERTION: test that we can trace every instruction safely for gcc
- * compiled apps.
- *
- * SECTION: pid provider
- *
- */
-
-BEGIN
-{
-	/*
-	 * Let's just do this for 2 seconds.
-	 */
-	timeout = timestamp + 2000000000;
-}
-
-pid$1:a.out::
-{}
-
-profile:::tick-4
-/timestamp > timeout/
-{
-	exit(0);
-}
diff --git a/usr/src/common/mapfiles/gen/Makefile b/usr/src/common/mapfiles/gen/Makefile
index 6990ae59f9..6b22b34116 100644
--- a/usr/src/common/mapfiles/gen/Makefile
+++ b/usr/src/common/mapfiles/gen/Makefile
@@ -27,13 +27,12 @@
 
 include		$(SRC)/Makefile.master
 
-FILES=	\
-		$(MACH)_cc_map.noexeglobs \
-		$(MACH)_gcc_map.noexeglobs
 
-$(BUILD64)FILES += \
-		$(MACH64)_cc_map.noexeglobs \
-		$(MACH64)_gcc_map.noexeglobs
+$(__GNUC)FILES=	$(MACH)_gcc_map.noexeglobs
+$(__SUNC)FILES= $(MACH)_cc_map.noexeglobs
+
+$(__GNUC)$(BUILD64)FILES += $(MACH64)_gcc_map.noexeglobs
+$(__SUNC)$(BUILD64)FILES += $(MACH64)_cc_map.noexeglobs
 
 SYMS1=		syms.1
 SYMS2=		syms.2
@@ -73,12 +72,9 @@ clobber:	clean
 
 $(MACH)_cc_map.noexeglobs :=	LINK =	$(LINK.c)
 $(MACH64)_cc_map.noexeglobs :=	LINK =	$(LINK64.c)
-
-$(MACH)_gcc_map.noexeglobs :=	CC =	$(ONBLD_TOOLS)/bin/$(MACH)/cw -_gcc
 $(MACH)_gcc_map.noexeglobs :=	LINK =	$(LINK.c)
-$(MACH64)_gcc_map.noexeglobs :=	CC =	$(ONBLD_TOOLS)/bin/$(MACH)/cw -_gcc
 $(MACH64)_gcc_map.noexeglobs :=	LINK =	$(LINK64.c)
- 
+
 # This generic target creates two dynamic executables from an empty "main"
 # program.  These objects are not executed, but are analyzed to determine the
 # global symbols each provides.
diff --git a/usr/src/lib/Makefile b/usr/src/lib/Makefile
index 654a35dd5d..bdff519dd6 100644
--- a/usr/src/lib/Makefile
+++ b/usr/src/lib/Makefile
@@ -635,9 +635,9 @@ libinetsvc:	libscf
 libinstzones:	libzonecfg libcontract
 libipadm:	libinetutil libdlpi libdhcpagent libdladm libsecdb libdhcputil
 libipmp:	libinetutil
-libipsecutil:	libtecla libtsol
+libipsecutil:	libtecla libtsol libkmf
 libiscsit:	libstmf libuuid
-libkmf:		libcryptoutil pkcs11
+libkmf:		libcryptoutil pkcs11 libcustr
 libkvm:		../cmd/sgs/libelf
 libldap5:	libsasl
 libmapid:	libresolv2 libscf
diff --git a/usr/src/lib/libipsecutil/Makefile.com b/usr/src/lib/libipsecutil/Makefile.com
index de17899c49..aef11c9c76 100644
--- a/usr/src/lib/libipsecutil/Makefile.com
+++ b/usr/src/lib/libipsecutil/Makefile.com
@@ -20,11 +20,12 @@
 #
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
+# Copyright 2018, Joyent, Inc.
 #
 
 LIBRARY =	libipsecutil.a
 VERS =		.1
-OBJECTS =	ipsec_util.o algs.o ipsec_libssl_setup.o
+OBJECTS =	ipsec_util.o algs.o
 
 include ../../Makefile.lib
 
@@ -32,14 +33,16 @@ LIBS +=		$(DYNLIB) $(LINTLIB)
 
 SRCDIR =	../common
 
+BERDIR = $(SRC)/lib/libkmf/ber_der/inc
+
 $(LINTLIB):=	SRCS = $(SRCDIR)/$(LINTSRC)
-LDLIBS +=	-ltecla -lsocket -lnsl -lc
+LDLIBS +=	-ltecla -lsocket -lnsl -lc -lkmf -lkmfberder
 LAZYLIBS = $(ZLAZYLOAD) -ltsol $(ZNOLAZYLOAD)
 lint := LAZYLIBS = -ltsol
 LDLIBS += $(LAZYLIBS)
 
 CFLAGS +=	$(CCVERBOSE)
-CPPFLAGS +=	-I$(SRCDIR)
+CPPFLAGS +=	-I$(SRCDIR) -I$(BERDIR)
 
 CERRWARN +=	-_gcc=-Wno-unused-function
 CERRWARN +=	-_gcc=-Wno-uninitialized
diff --git a/usr/src/lib/libipsecutil/common/ipsec_libssl_setup.c b/usr/src/lib/libipsecutil/common/ipsec_libssl_setup.c
deleted file mode 100644
index e63c1b51be..0000000000
--- a/usr/src/lib/libipsecutil/common/ipsec_libssl_setup.c
+++ /dev/null
@@ -1,326 +0,0 @@
-/*
- * Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-/*
- * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
- */
-
-/*
- * Thread setup portions of this code derived from
- * OpenSSL 0.9.x file mt/mttest.c examples
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <errno.h>
-#include <libintl.h>
-#include <synch.h>
-#include <thread.h>
-#include <dlfcn.h>
-#include <openssl/lhash.h>
-#include <openssl/crypto.h>
-#include <openssl/ssl.h>
-#include <openssl/err.h>
-#include "ipsec_util.h"
-
-/* OpenSSL function pointers */
-static X509_NAME *(*d2i_X509_NAME_fn)() = NULL;
-static int (*X509_NAME_print_ex_fp_fn)() = NULL;
-static char *(*ERR_get_error_fn)() = NULL;
-static char *(*ERR_error_string_fn)() = NULL;
-static void (*SSL_load_error_strings_fn)() = NULL;
-static void (*ERR_free_strings_fn)() = NULL;
-static void (*CRYPTO_set_locking_callback_fn)() = NULL;
-static void (*CRYPTO_set_id_callback_fn)() = NULL;
-static void (*X509_NAME_free_fn)() = NULL;
-static int (*CRYPTO_num_locks_fn)() = NULL;
-static void *(*OPENSSL_malloc_fn)() = NULL;
-static void (*OPENSSL_free_fn)() = NULL;
-
-static void solaris_locking_callback(int, int, char *, int);
-static unsigned long solaris_thread_id(void);
-static boolean_t thread_setup(void);
-/* LINTED E_STATIC_UNUSED */
-static void thread_cleanup(void);
-
-mutex_t init_lock = DEFAULTMUTEX;
-static mutex_t *lock_cs;
-static long *lock_count;
-
-static boolean_t libssl_loaded = B_FALSE;
-static boolean_t libcrypto_loaded = B_FALSE;
-
-void
-libssl_load()
-{
-	void *dldesc;
-
-	(void) mutex_lock(&init_lock);
-	if (libssl_loaded) {
-		(void) mutex_unlock(&init_lock);
-		return;
-	}
-
-	dldesc = dlopen(LIBSSL, RTLD_LAZY);
-	if (dldesc != NULL) {
-		d2i_X509_NAME_fn = (X509_NAME*(*)())dlsym(dldesc,
-		    "d2i_X509_NAME");
-		if (d2i_X509_NAME_fn == NULL)
-			goto libssl_err;
-
-		X509_NAME_print_ex_fp_fn = (int(*)())dlsym(dldesc,
-		    "X509_NAME_print_ex_fp");
-		if (X509_NAME_print_ex_fp_fn == NULL)
-			goto libssl_err;
-
-		ERR_get_error_fn = (char *(*)())dlsym(dldesc,
-		    "ERR_get_error");
-		if (ERR_get_error_fn == NULL)
-			goto libssl_err;
-
-		ERR_error_string_fn = (char *(*)())dlsym(dldesc,
-		    "ERR_error_string");
-		if (ERR_error_string_fn == NULL)
-			goto libssl_err;
-
-		SSL_load_error_strings_fn = (void(*)())dlsym(dldesc,
-		    "SSL_load_error_strings");
-		if (SSL_load_error_strings_fn == NULL)
-			goto libssl_err;
-
-		ERR_free_strings_fn = (void(*)())dlsym(dldesc,
-		    "ERR_free_strings");
-		if (ERR_free_strings_fn == NULL)
-			goto libssl_err;
-
-		CRYPTO_set_locking_callback_fn = (void(*)())dlsym(dldesc,
-		    "CRYPTO_set_locking_callback");
-		if (CRYPTO_set_locking_callback_fn == NULL)
-			goto libssl_err;
-
-		CRYPTO_set_id_callback_fn = (void(*)())dlsym(dldesc,
-		    "CRYPTO_set_id_callback");
-		if (CRYPTO_set_id_callback_fn == NULL)
-			goto libssl_err;
-
-		X509_NAME_free_fn = (void(*)())dlsym(dldesc,
-		    "X509_NAME_free");
-		if (X509_NAME_free_fn == NULL)
-			goto libssl_err;
-
-		if (thread_setup() == B_FALSE)
-			goto libssl_err;
-
-		libssl_loaded = B_TRUE;
-	}
-	(void) mutex_unlock(&init_lock);
-	return;
-libssl_err:
-	(void) dlclose(dldesc);
-	(void) mutex_unlock(&init_lock);
-}
-
-void
-libcrypto_load()
-{
-	void *dldesc;
-
-	(void) mutex_lock(&init_lock);
-	if (libcrypto_loaded) {
-		(void) mutex_unlock(&init_lock);
-		return;
-	}
-
-	dldesc = dlopen(LIBCRYPTO, RTLD_LAZY);
-	if (dldesc != NULL) {
-		CRYPTO_num_locks_fn = (int(*)())dlsym(dldesc,
-		    "CRYPTO_num_locks");
-		if (CRYPTO_num_locks_fn == NULL)
-			goto libcrypto_err;
-
-		/*
-		 * OPENSSL_free is really a macro, so we
-		 * need to reference the actual symbol,
-		 * which is CRYPTO_free.
-		 */
-		OPENSSL_free_fn = (void(*)())dlsym(dldesc,
-		    "CRYPTO_free");
-		if (OPENSSL_free_fn == NULL)
-			goto libcrypto_err;
-
-		/*
-		 * OPENSSL_malloc is really a macro, so we
-		 * need to reference the actual symbol,
-		 * which is CRYPTO_malloc.
-		 */
-		OPENSSL_malloc_fn = (void *(*)())dlsym(dldesc,
-		    "CRYPTO_malloc");
-		if (OPENSSL_malloc_fn == NULL)
-			goto libcrypto_err;
-
-		libcrypto_loaded = B_TRUE;
-	}
-	(void) mutex_unlock(&init_lock);
-	return;
-libcrypto_err:
-	(void) dlclose(dldesc);
-	(void) mutex_unlock(&init_lock);
-}
-
-static boolean_t
-thread_setup(void)
-{
-	int i;
-
-	if ((lock_cs = OPENSSL_malloc_fn(CRYPTO_num_locks_fn() *
-	    sizeof (mutex_t))) == NULL)
-		return (B_FALSE);
-	if ((lock_count = OPENSSL_malloc_fn(CRYPTO_num_locks_fn() *
-	    sizeof (long))) == NULL) {
-		OPENSSL_free_fn(lock_cs);
-		return (B_FALSE);
-	}
-
-	for (i = 0; i < CRYPTO_num_locks_fn(); i++) {
-		lock_count[i] = 0;
-		(void) mutex_init(&(lock_cs[i]), USYNC_THREAD, NULL);
-	}
-
-	CRYPTO_set_id_callback_fn((unsigned long (*)())solaris_thread_id);
-	CRYPTO_set_locking_callback_fn((void (*)())solaris_locking_callback);
-	return (B_TRUE);
-}
-
-static void
-thread_cleanup(void)
-{
-	int i;
-
-	(void) mutex_lock(&init_lock);
-	CRYPTO_set_locking_callback_fn(NULL);
-	CRYPTO_set_id_callback_fn(NULL);
-	for (i = 0; i < CRYPTO_num_locks_fn(); i++)
-		(void) mutex_destroy(&(lock_cs[i]));
-	OPENSSL_free_fn(lock_cs);
-	OPENSSL_free_fn(lock_count);
-	(void) mutex_unlock(&init_lock);
-}
-
-/* ARGSUSED */
-static void
-solaris_locking_callback(int mode, int type, char *file, int line)
-{
-	if (mode & CRYPTO_LOCK) {
-		(void) mutex_lock(&(lock_cs[type]));
-		lock_count[type]++;
-	} else {
-		(void) mutex_unlock(&(lock_cs[type]));
-	}
-}
-
-static unsigned long
-solaris_thread_id(void)
-{
-	unsigned long ret;
-
-	ret = (unsigned long)thr_self();
-	return (ret);
-}
-
-void
-print_asn1_name(FILE *file, const unsigned char *buf, long buflen)
-{
-	libcrypto_load();
-	if (libcrypto_loaded)
-		libssl_load();
-
-	if (libssl_loaded && libcrypto_loaded) {
-		X509_NAME *x509name = NULL;
-		const unsigned char *p;
-
-		/* Make an effort to decode the ASN1 encoded name */
-		SSL_load_error_strings_fn();
-
-		/*
-		 * Temporary variable is mandatory per d2i_X509(3). Upcoming
-		 * call to d2i_X509_NAME_fn() will change the 'p' pointer.
-		 */
-		p = buf;
-
-		x509name = d2i_X509_NAME_fn(NULL, &p, buflen);
-		if (x509name != NULL) {
-			(void) X509_NAME_print_ex_fp_fn(file, x509name, 0,
-			    (ASN1_STRFLGS_RFC2253 | ASN1_STRFLGS_ESC_QUOTE |
-			    XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN));
-			X509_NAME_free_fn(x509name);
-			(void) fprintf(file, "\n");
-		} else {
-			char errbuf[80];
-
-			(void) fprintf(file, "\n# %s\n",
-			    ERR_error_string_fn(ERR_get_error_fn(), errbuf));
-			(void) fprintf(file, dgettext(TEXT_DOMAIN,
-			    "<cannot interpret>\n"));
-		}
-		ERR_free_strings_fn();
-	} else {
-		(void) fprintf(file, dgettext(TEXT_DOMAIN, "<cannot print>\n"));
-	}
-}
diff --git a/usr/src/lib/libipsecutil/common/ipsec_util.c b/usr/src/lib/libipsecutil/common/ipsec_util.c
index 017259967c..e27a47e63b 100644
--- a/usr/src/lib/libipsecutil/common/ipsec_util.c
+++ b/usr/src/lib/libipsecutil/common/ipsec_util.c
@@ -24,6 +24,7 @@
  * Use is subject to license terms.
  * Copyright 2012 Milan Juri. All rights reserved.
  * Copyright 2018 Joyent, Inc.
+ * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
  */
 
 #include <unistd.h>
@@ -47,6 +48,8 @@
 #include <setjmp.h>
 #include <libgen.h>
 #include <libscf.h>
+#include <kmfapi.h>
+#include <ber_der.h>
 
 #include "ipsec_util.h"
 #include "ikedoor.h"
@@ -3475,3 +3478,28 @@ ipsecutil_exit(exit_type_t type, char *fmri, FILE *fp, const char *fmt, ...)
 	(void) fclose(fp);
 	exit(exit_status);
 }
+
+void
+print_asn1_name(FILE *file, const unsigned char *buf, long buflen)
+{
+	KMF_X509_NAME name = { 0 };
+	KMF_DATA data = { 0 };
+	char *str = NULL;
+
+	data.Data = (unsigned char *)buf;
+	data.Length = buflen;
+
+	if (DerDecodeName(&data, &name) != KMF_OK)
+		goto fail;
+
+	if (kmf_dn_to_string(&name, &str) != KMF_OK)
+		goto fail;
+
+	(void) fprintf(file, "%s\n", str);
+	kmf_free_dn(&name);
+	free(str);
+	return;
+fail:
+	kmf_free_dn(&name);
+	(void) fprintf(file, dgettext(TEXT_DOMAIN, "<cannot interpret>\n"));
+}
diff --git a/usr/src/lib/libipsecutil/common/ipsec_util.h b/usr/src/lib/libipsecutil/common/ipsec_util.h
index 44154e5c33..7f779bb95f 100644
--- a/usr/src/lib/libipsecutil/common/ipsec_util.h
+++ b/usr/src/lib/libipsecutil/common/ipsec_util.h
@@ -23,7 +23,7 @@
  * Use is subject to license terms.
  */
 /*
- * Copyright 2017 Joyent, Inc.
+ * Copyright 2018 Joyent, Inc.
  */
 
 #ifndef	_IPSEC_UTIL_H
@@ -214,20 +214,6 @@ extern int dbgstr2num(char *);
 extern int parsedbgopts(char *);
 
 /*
- * SSL library (OpenSSL)
- */
-#define	LIBSSL	"libssl.so"
-
-void libssl_load(void);
-
-/*
- * crypto library (OpenSSL)
- */
-#define	LIBCRYPTO	"libcrypto.so"
-
-void libcrypto_load(void);
-
-/*
  * functions to manipulate the IKEv1 kmcookie-label mapping file
  */
 
diff --git a/usr/src/lib/libkmf/include/kmfapi.h b/usr/src/lib/libkmf/include/kmfapi.h
index 9aeb0ca202..dbe09b2db6 100644
--- a/usr/src/lib/libkmf/include/kmfapi.h
+++ b/usr/src/lib/libkmf/include/kmfapi.h
@@ -19,6 +19,7 @@
  * CDDL HEADER END
  *
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018, Joyent, Inc.
  *
  * Constant definitions and function prototypes for the KMF library.
  * Commonly used data types are defined in "kmftypes.h".
@@ -275,6 +276,7 @@ extern KMF_RETURN kmf_get_kmf_error_str(KMF_RETURN, char **);
  * Miscellaneous
  */
 extern KMF_RETURN kmf_dn_parser(char *, KMF_X509_NAME *);
+extern KMF_RETURN kmf_dn_to_string(KMF_X509_NAME *, char **);
 extern KMF_RETURN kmf_read_input_file(KMF_HANDLE_T, char *, KMF_DATA *);
 extern KMF_RETURN kmf_der_to_pem(KMF_OBJECT_TYPE, unsigned char *,
 	int, unsigned char **, int *);
diff --git a/usr/src/lib/libkmf/libkmf/Makefile.com b/usr/src/lib/libkmf/libkmf/Makefile.com
index a704d1e5a8..43de43cb1d 100644
--- a/usr/src/lib/libkmf/libkmf/Makefile.com
+++ b/usr/src/lib/libkmf/libkmf/Makefile.com
@@ -19,6 +19,7 @@
 # CDDL HEADER END
 #
 # Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2018, Joyent, Inc.
 #
 
 LIBRARY= libkmf.a
@@ -56,8 +57,8 @@ LIBS=	$(DYNLIB) $(LINTLIB)
 
 $(LINTLIB) := SRCS = $(SRCDIR)/$(LINTSRC)
 
-LDLIBS	+=	$(BERDERLIB) $(CRYPTOUTILLIB) -lmd -lpkcs11 -lnsl -lsocket -lc 
-LDLIBS6	+=	$(BERDERLIB64) $(CRYPTOUTILLIB64) -lmd -lpkcs11 -lnsl -lsocket -lc 
+LDLIBS	+=	$(BERDERLIB) $(CRYPTOUTILLIB) -lmd -lpkcs11 -lnsl -lsocket -lc
+LDLIBS	+=	-lcustr
 
 # DYNLIB libraries do not have lint libs and are not linted
 $(DYNLIB) :=    LDLIBS += -lxml2
diff --git a/usr/src/lib/libkmf/libkmf/common/mapfile-vers b/usr/src/lib/libkmf/libkmf/common/mapfile-vers
index 4e8d0d848d..977112d733 100644
--- a/usr/src/lib/libkmf/libkmf/common/mapfile-vers
+++ b/usr/src/lib/libkmf/libkmf/common/mapfile-vers
@@ -19,6 +19,7 @@
 # CDDL HEADER END
 #
 # Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright 2018, Joyent, Inc.
 #
 #
 # MAPFILE HEADER START
@@ -401,6 +402,7 @@ SYMBOL_VERSION SUNWprivate_1.1 {
 	GetIDFromSPKI;
 	IsEqualOid;
 	kmf_create_pk11_session;
+	kmf_dn_to_string;
 	kmf_select_token;
 	parsePolicyElement;
 	PKCS_DigestData;
diff --git a/usr/src/lib/libkmf/libkmf/common/rdn_parser.c b/usr/src/lib/libkmf/libkmf/common/rdn_parser.c
index 5cc22146d8..3e23c0ac56 100644
--- a/usr/src/lib/libkmf/libkmf/common/rdn_parser.c
+++ b/usr/src/lib/libkmf/libkmf/common/rdn_parser.c
@@ -33,6 +33,8 @@
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  *
+ * Copyright 2018, Joyent, Inc.
+ *
  * File: rdn_parser.c
  */
 
@@ -44,6 +46,7 @@
 #include <rdn_parser.h>
 #include <stdio.h>
 #include <values.h>
+#include <libcustr.h>
 
 /*
  * The order here is important.  The OIDs are arranged in order of
@@ -535,3 +538,218 @@ kmf_dn_parser(char *string, KMF_X509_NAME *name)
 	err = ParseDistinguishedName(string, (int)strlen(string), name);
 	return (err);
 }
+
+static const char hexdigits[] = "0123456789abcdef";
+
+static KMF_RETURN
+binvalue_to_string(KMF_DATA *data, custr_t *str)
+{
+	size_t i;
+	uchar_t c;
+
+	if (custr_appendc(str, '#') != 0)
+		return (KMF_ERR_MEMORY);
+
+	for (i = 0; i < data->Length; i++) {
+		c = data->Data[i];
+		if (custr_appendc(str, hexdigits[(c >> 4) & 0xf]) != 0 ||
+		    custr_appendc(str, hexdigits[(c & 0xf)]) != 0) {
+			return (KMF_ERR_MEMORY);
+		}
+	}
+
+	return (KMF_OK);
+}
+
+/*
+ * Convert an RDN value into a printable name with appropriate escaping.
+ * The rules are taken from RFC4514.  While it is dealing with LDAP
+ * distinguished names, both LDAP and x509 certificates are based on the
+ * same underlying ITU standards, and as far as I can determine, the same
+ * rules apply (or at least the rules for LDAP DNs apply the same to x509
+ * DNs).
+ */
+static KMF_RETURN
+value_to_string(KMF_DATA *data, custr_t *str)
+{
+	size_t i;
+	uchar_t c;
+
+	for (i = 0; i < data->Length; i++) {
+		c = data->Data[i];
+
+		/*
+		 * While technically not required, it is suggested that
+		 * printable non-ascii characters (e.g. multi-byte UTF-8
+		 * characters) are converted as escaped hex (as well as
+		 * unprintable characters).  AFAIK there is no one canonical
+		 * string representation (e.g. attribute names are case
+		 * insensitive, so 'CN=foo' and 'cn=foo' convert to the same
+		 * binary representation, but there is nothing to say if
+		 * either string form is canonical), so this shouldn't
+		 * pose a problem.
+		 */
+		if (c < ' ' || c >= 0x7f) {
+			/*
+			 * RFC4514 specifies the hex form in a DN string as
+			 * \{hex}{hex}. OpenSSL uses capitals for A-F so we
+			 * do the same.
+			 */
+			if (custr_append_printf(str, "\\%02hhX", c) != 0)
+				return (KMF_ERR_MEMORY);
+			continue;
+		}
+
+		switch (c) {
+		case '#':
+			/* Escape # if at the start of a value */
+			if (i != 0)
+				break;
+			/* FALLTHROUGH */
+		case ' ':
+			/* Escape ' ' if at the start or end of a value */
+			if (i != 0 && i + 1 != data->Length)
+				break;
+			/* FALLTHROUGH */
+		case '"':
+		case '+':
+		case ',':
+		case ';':
+		case '<':
+		case '>':
+		case '\\':
+			/* Escape these */
+			if (custr_appendc(str, '\\') != 0)
+				return (KMF_ERR_MEMORY);
+		}
+
+		if (custr_appendc(str, c) != 0)
+			return (KMF_ERR_MEMORY);
+	}
+
+	return (KMF_OK);
+}
+
+/*
+ * Translate an attribute/value pair into a string.  If the attribute OID
+ * is a well known OID (in name2kinds) we use the name instead of the OID.
+ */
+static KMF_RETURN
+ava_to_string(KMF_X509_TYPE_VALUE_PAIR *tvp, custr_t *str)
+{
+	KMF_OID *kind_oid;
+	KMF_OID *rdn_oid = &tvp->type;
+	const char *attr = NULL;
+	size_t i;
+	KMF_RETURN ret = KMF_OK;
+	boolean_t found = B_FALSE;
+
+	for (i = 0; name2kinds[i].name != NULL; i++) {
+		kind_oid = name2kinds[i].OID;
+
+		if (!IsEqualOid(kind_oid, rdn_oid))
+			continue;
+
+		attr = name2kinds[i].name;
+		found = B_TRUE;
+		break;
+	}
+
+	if (!found && (attr = kmf_oid_to_string(rdn_oid)) == NULL) {
+		ret = KMF_ERR_MEMORY;
+		goto done;
+	}
+	if (custr_append(str, attr) != 0) {
+		ret = KMF_ERR_MEMORY;
+		goto done;
+	}
+	if (custr_appendc(str, '=') != 0) {
+		ret = KMF_ERR_MEMORY;
+		goto done;
+	}
+
+	/*
+	 * RFC4514 indicates that an oid=value pair should have the value
+	 * printed as #xxxxxx.  In addition, we also print as a binary
+	 * value if the BER tag does not indicate the value is some sort
+	 * of printable string.
+	 */
+	switch (tvp->valueType) {
+	case BER_UTF8_STRING:
+	case BER_PRINTABLE_STRING:
+	case BER_T61STRING:
+	case BER_IA5STRING:
+		if (found) {
+			ret = value_to_string(&tvp->value, str);
+			break;
+		}
+		/*FALLTHROUGH*/
+	default:
+		ret = binvalue_to_string(&tvp->value, str);
+		break;
+	}
+
+done:
+	if (!found)
+		free((void *)attr);
+
+	return (ret);
+}
+
+static KMF_RETURN
+rdn_to_string(KMF_X509_RDN *rdn, custr_t *str)
+{
+	KMF_RETURN ret;
+	size_t i;
+
+	for (i = 0; i < rdn->numberOfPairs; i++) {
+		if (i > 0 && custr_appendc(str, '+') != 0)
+			return (KMF_ERR_MEMORY);
+
+		ret = ava_to_string(&rdn->AttributeTypeAndValue[i], str);
+		if (ret != KMF_OK)
+			return (ret);
+	}
+
+	return (KMF_OK);
+}
+
+/*
+ * kmf_dn_to_string
+ *
+ * Take a binary KMF_X509_NAME and convert it into a human readable string.
+ */
+KMF_RETURN
+kmf_dn_to_string(KMF_X509_NAME *name, char **string)
+{
+	custr_t *str = NULL;
+	KMF_RETURN err = KMF_OK;
+	size_t i;
+
+	if (name == NULL || string == NULL)
+		return (KMF_ERR_BAD_PARAMETER);
+
+	*string = NULL;
+
+	if (custr_alloc(&str) != 0)
+		return (KMF_ERR_MEMORY);
+
+	for (i = 0; i < name->numberOfRDNs; i++) {
+		KMF_X509_RDN *rdn = &name->RelativeDistinguishedName[i];
+
+		if (i > 0 && custr_append(str, ", ") != 0) {
+			err = KMF_ERR_MEMORY;
+			goto done;
+		}
+
+		if ((err = rdn_to_string(rdn, str)) != KMF_OK)
+			goto done;
+	}
+
+	if ((*string = strdup(custr_cstr(str))) == NULL)
+		err = KMF_ERR_MEMORY;
+
+done:
+	custr_free(str);
+	return (err);
+}
diff --git a/usr/src/man/man3lib/libkmf.3lib b/usr/src/man/man3lib/libkmf.3lib
index 8c5fa00144..2c69a23f07 100644
--- a/usr/src/man/man3lib/libkmf.3lib
+++ b/usr/src/man/man3lib/libkmf.3lib
@@ -1,9 +1,10 @@
 '\" te
 .\" Copyright (c) 2008, Sun Microsystems, Inc.  All Rights Reserved.
+.\" Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH LIBKMF 3LIB "Feb 7, 2008"
+.TH LIBKMF 3LIB "Mar 21, 2018"
 .SH NAME
 libkmf \- Key Management Framework library
 .SH SYNOPSIS
@@ -14,7 +15,6 @@ cc [ \fIflag\fR... ] \fIfile\fR... \fB-lkmf\fR [ \fIlibrary\fR... ]
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
 These functions comprise the Key Management Framework library.  They are
 intended to be used by applications that need to perform operations involving
@@ -22,7 +22,6 @@ the creation and management of public key objects such as public/private key
 pairs, certificates, certificate signing requests, certificate validation,
 certificate revocation lists, and OCSP response processing.
 .SH INTERFACES
-.sp
 .LP
 The shared object \fBlibkmf.so.1\fR provides the public interfaces defined
 below. See \fBIntro\fR(3) for additional information on shared object
@@ -43,70 +42,69 @@ l l .
 \fBkmf_decrypt\fR	\fBkmf_delete_cert_from_keystore\fR
 \fBkmf_delete_crl\fR	\fBkmf_delete_key_from_keystore\fR
 \fBkmf_delete_policy_from_db\fR	\fBkmf_der_to_pem\fR
-\fBkmf_dn_parser\fR	\fBkmf_download_cert\fR
-\fBkmf_download_crl\fR	\fBkmf_ekuname_to_oid\fR
-\fBkmf_encode_cert_record\fR	\fBkmf_encrypt\fR
-\fBkmf_export_pk12\fR	\fBkmf_finalize\fR
-\fBkmf_find_attr\fR	\fBkmf_find_cert\fR
-\fBkmf_find_cert_in_crl\fR	\fBkmf_find_crl\fR
-\fBkmf_find_key\fR	\fBkmf_find_prikey_by_cert\fR
-\fBkmf_free_algoid\fR	\fBkmf_free_bigint\fR
-\fBkmf_free_crl_dist_pts\fR	\fBkmf_free_data\fR
-\fBkmf_free_dn\fR	\fBkmf_free_eku\fR
-\fBkmf_free_eku_policy\fR	\fBkmf_free_extn\fR
-\fBkmf_free_kmf_cert\fR	\fBkmf_free_kmf_key\fR
-\fBkmf_free_policy_record\fR	\fBkmf_free_raw_key\fR
-\fBkmf_free_raw_sym_key\fR	\fBkmf_free_signed_cert\fR
-\fBkmf_free_signed_csr\fR	\fBkmf_free_spki\fR
-\fBkmf_free_str\fR	\fBkmf_free_tbs_cert\fR
-\fBkmf_free_tbs_csr\fR	\fBkmf_get_attr\fR
-\fBkmf_get_attr_ptr\fR	\fBkmf_get_cert_auth_info_access\fR
-\fBkmf_get_cert_basic_constraint\fR	\fBkmf_get_cert_crl_dist_pts\fR
-\fBkmf_get_cert_eku\fR	\fBkmf_get_cert_email_str\fR
-\fBkmf_get_cert_end_date_str\fR	\fBkmf_get_cert_extn\fR
-\fBkmf_get_cert_extn_str\fR	\fBkmf_get_cert_id_data\fR
-\fBkmf_get_cert_id_str\fR	\fBkmf_get_cert_issuer_str\fR
-\fBkmf_get_cert_ku\fR	\fBkmf_get_cert_policies\fR
-\fBkmf_get_cert_pubkey_alg_str\fR	\fBkmf_get_cert_pubkey_str\fR
-\fBkmf_get_cert_serial_str\fR	\fBkmf_get_cert_sig_alg_str\fR
-\fBkmf_get_cert_start_date_str\fR	\fBkmf_get_cert_subject_str\fR
-\fBkmf_get_cert_validity\fR	\fBkmf_get_cert_version_str\fR
-\fBkmf_get_data_format\fR	\fBkmf_get_encoded_ocsp_response\fR
-\fBkmf_get_file_format\fR	\fBkmf_get_kmf_error_str\fR
-\fBkmf_get_ocsp_for_cert\fR	\fBkmf_get_ocsp_status_for_cert\fR
-\fBkmf_get_pk11_handle\fR	\fBkmf_get_plugin_error_str\fR
-\fBkmf_get_policy\fR	\fBkmf_get_string_attr\fR
-\fBkmf_get_sym_key_value\fR	\fBkmf_hexstr_to_bytes\fR
-\fBkmf_import_crl\fR	\fBkmf_import_cert\fR
-\fBkmf_import_objects\fR	\fBkmf_initialize\fR
-\fBkmf_is_cert_data\fR	\fBkmf_is_cert_file\fR
-\fBkmf_is_crl_file\fR	\fBkmf_ku_to_string\fR
-\fBkmf_list_crl\fR	\fBkmf_oid_to_ekuname\fR
-\fBkmf_oid_to_string\fR	\fBkmf_pem_to_der\fR
-\fBkmf_pk11_token_lookup\fR	\fBkmf_read_input_file\fR
-\fBkmf_select_token\fR	\fBkmf_set_attr\fR
-\fBkmf_set_attr_at_index\fR	\fBkmf_set_cert_basic_constraint\fR
-\fBkmf_set_cert_extn\fR	\fBkmf_set_cert_issuer\fR
-\fBkmf_set_cert_issuer_altname\fR	\fBkmf_set_cert_ku\fR
-\fBkmf_set_cert_pubkey\fR	\fBkmf_set_cert_serial\fR
-\fBkmf_set_cert_sig_alg\fR	\fBkmf_set_cert_subject\fR
-\fBkmf_set_cert_subject_altname\fR	\fBkmf_set_cert_validity\fR
-\fBkmf_set_cert_version\fR	\fBkmf_set_csr_extn\fR
-\fBkmf_set_csr_ku\fR	\fBkmf_set_csr_pubkey\fR
-\fBkmf_set_csr_sig_alg\fR	\fBkmf_set_csr_subject\fR
-\fBkmf_set_csr_subject_altname\fR	\fBkmf_set_csr_version\fR
-\fBkmf_set_policy\fR	\fBkmf_set_token_pin\fR
-\fBkmf_sign_cert\fR	\fBkmf_sign_csr\fR
-\fBkmf_sign_data\fR	\fBkmf_store_cert\fR
-\fBkmf_store_key\fR	\fBkmf_string_to_ku\fR
-\fBkmf_string_to_oid\fR	\fBkmf_validate_cert\fR
-\fBkmf_verify_cert\fR	\fBkmf_verify_crl_file\fR
-\fBkmf_verify_csr\fR	\fBkmf_verify_data\fR
-\fBkmf_verify_policy\fR	
+\fBkmf_dn_parser\fR	\fBkmf_dn_to_string\fR
+\fBkmf_download_cert\fR	\fBkmf_download_crl\fR
+\fBkmf_ekuname_to_oid\fR	\fBkmf_encode_cert_record\fR
+\fBkmf_encrypt\fR	\fBkmf_export_pk12\fR
+\fBkmf_finalize\fR	\fBkmf_find_attr\fR
+\fBkmf_find_cert\fR	\fBkmf_find_cert_in_crl\fR
+\fBkmf_find_crl\fR	\fBkmf_find_key\fR
+\fBkmf_find_prikey_by_cert\fR	\fBkmf_free_algoid\fR
+\fBkmf_free_bigint\fR	\fBkmf_free_crl_dist_pts\fR
+\fBkmf_free_data\fR	\fBkmf_free_dn\fR
+\fBkmf_free_eku\fR	\fBkmf_free_eku_policy\fR
+\fBkmf_free_extn\fR	\fBkmf_free_kmf_cert\fR
+\fBkmf_free_kmf_key\fR	\fBkmf_free_policy_record\fR
+\fBkmf_free_raw_key\fR	\fBkmf_free_raw_sym_key\fR
+\fBkmf_free_signed_cert\fR	\fBkmf_free_signed_csr\fR
+\fBkmf_free_spki\fR	\fBkmf_free_str\fR
+\fBkmf_free_tbs_cert\fR	\fBkmf_free_tbs_csr\fR
+\fBkmf_get_attr\fR	\fBkmf_get_attr_ptr\fR
+\fBkmf_get_cert_auth_info_access\fR	\fBkmf_get_cert_basic_constraint\fR
+\fBkmf_get_cert_crl_dist_pts\fR	\fBkmf_get_cert_eku\fR
+\fBkmf_get_cert_email_str\fR	\fBkmf_get_cert_end_date_str\fR
+\fBkmf_get_cert_extn\fR	\fBkmf_get_cert_extn_str\fR
+\fBkmf_get_cert_id_data\fR	\fBkmf_get_cert_id_str\fR
+\fBkmf_get_cert_issuer_str\fR	\fBkmf_get_cert_ku\fR
+\fBkmf_get_cert_policies\fR	\fBkmf_get_cert_pubkey_alg_str\fR
+\fBkmf_get_cert_pubkey_str\fR	\fBkmf_get_cert_serial_str\fR
+\fBkmf_get_cert_sig_alg_str\fR	\fBkmf_get_cert_start_date_str\fR
+\fBkmf_get_cert_subject_str\fR	\fBkmf_get_cert_validity\fR
+\fBkmf_get_cert_version_str\fR	\fBkmf_get_data_format\fR
+\fBkmf_get_encoded_ocsp_response\fR	\fBkmf_get_file_format\fR
+\fBkmf_get_kmf_error_str\fR	\fBkmf_get_ocsp_for_cert\fR
+\fBkmf_get_ocsp_status_for_cert\fR	\fBkmf_get_pk11_handle\fR
+\fBkmf_get_plugin_error_str\fR	\fBkmf_get_policy\fR
+\fBkmf_get_string_attr\fR	\fBkmf_get_sym_key_value\fR
+\fBkmf_hexstr_to_bytes\fR	\fBkmf_import_crl\fR
+\fBkmf_import_cert\fR	\fBkmf_import_objects\fR
+\fBkmf_initialize\fR	\fBkmf_is_cert_data\fR
+\fBkmf_is_cert_file\fR	\fBkmf_is_crl_file\fR
+\fBkmf_ku_to_string\fR	\fBkmf_list_crl\fR
+\fBkmf_oid_to_ekuname\fR	\fBkmf_oid_to_string\fR
+\fBkmf_pem_to_der\fR	\fBkmf_pk11_token_lookup\fR
+\fBkmf_read_input_file\fR	\fBkmf_select_token\fR
+\fBkmf_set_attr\fR	\fBkmf_set_attr_at_index\fR
+\fBkmf_set_cert_basic_constraint\fR	\fBkmf_set_cert_extn\fR
+\fBkmf_set_cert_issuer\fR	\fBkmf_set_cert_issuer_altname\fR
+\fBkmf_set_cert_ku\fR	\fBkmf_set_cert_pubkey\fR
+\fBkmf_set_cert_serial\fR	\fBkmf_set_cert_sig_alg\fR
+\fBkmf_set_cert_subject\fR	\fBkmf_set_cert_subject_altname\fR
+\fBkmf_set_cert_validity\fR	\fBkmf_set_cert_version\fR
+\fBkmf_set_csr_extn\fR	\fBkmf_set_csr_ku\fR
+\fBkmf_set_csr_pubkey\fR	\fBkmf_set_csr_sig_alg\fR
+\fBkmf_set_csr_subject\fR	\fBkmf_set_csr_subject_altname\fR
+\fBkmf_set_csr_version\fR	\fBkmf_set_policy\fR
+\fBkmf_set_token_pin\fR	\fBkmf_sign_cert\fR
+\fBkmf_sign_csr\fR	\fBkmf_sign_data\fR
+\fBkmf_store_cert\fR	\fBkmf_store_key\fR
+\fBkmf_string_to_ku\fR	\fBkmf_string_to_oid\fR
+\fBkmf_validate_cert\fR	\fBkmf_verify_cert\fR
+\fBkmf_verify_crl_file\fR	\fBkmf_verify_csr\fR
+\fBkmf_verify_data\fR	\fBkmf_verify_policy\fR
 .TE
 
 .SH FILES
-.sp
 .ne 2
 .na
 \fB\fB/lib/libkmf.so.1\fR\fR
@@ -143,7 +141,6 @@ KMF structures and types.
 .RE
 
 .SH ATTRIBUTES
-.sp
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
@@ -160,7 +157,6 @@ MT-Level	Safe
 .TE
 
 .SH SEE ALSO
-.sp
 .LP
 \fBkmfcfg\fR(1), \fBpktool\fR(1), \fBattributes\fR(5)
 .sp
diff --git a/usr/src/pkg/manifests/system-dtrace-tests.mf b/usr/src/pkg/manifests/system-dtrace-tests.mf
index 72099167b7..c8f831aaed 100644
--- a/usr/src/pkg/manifests/system-dtrace-tests.mf
+++ b/usr/src/pkg/manifests/system-dtrace-tests.mf
@@ -1154,8 +1154,6 @@ file path=opt/SUNWdtrt/tst/common/pid/tst.float.d mode=0444
 file path=opt/SUNWdtrt/tst/common/pid/tst.float.exe mode=0555
 file path=opt/SUNWdtrt/tst/common/pid/tst.fork.d mode=0444
 file path=opt/SUNWdtrt/tst/common/pid/tst.fork.exe mode=0555
-file path=opt/SUNWdtrt/tst/common/pid/tst.gcc.d mode=0444
-file path=opt/SUNWdtrt/tst/common/pid/tst.gcc.exe mode=0555
 file path=opt/SUNWdtrt/tst/common/pid/tst.killonerror.ksh mode=0444
 file path=opt/SUNWdtrt/tst/common/pid/tst.main.ksh mode=0444
 file path=opt/SUNWdtrt/tst/common/pid/tst.manypids.ksh mode=0444
diff --git a/usr/src/test/os-tests/tests/file-locking/Makefile b/usr/src/test/os-tests/tests/file-locking/Makefile
index 79f44472ee..64011074c5 100644
--- a/usr/src/test/os-tests/tests/file-locking/Makefile
+++ b/usr/src/test/os-tests/tests/file-locking/Makefile
@@ -16,7 +16,7 @@
 include $(SRC)/cmd/Makefile.cmd
 include $(SRC)/test/Makefile.com
 
-UTILS = util.c
+OBJECTS=util.o runtests.32.o runtests.64.o acquire-lock.32.o acquire-lock.64.o
 
 PROGS = \
 	runtests \
@@ -24,7 +24,7 @@ PROGS = \
 
 CSTD = $(CSTD_GNU99)
 
-SRCS = $(PROGS:%=%.c) $(UTILS)
+SRCS = $(PROGS:%=%.c) $(UTILS:%.o=%.c)
 PROGS32 = $(PROGS:%=%.32)
 PROGS64 = $(PROGS:%=%.64)
 
@@ -70,12 +70,18 @@ $(ROOTOPTDIR)/%: %.ksh
 %.ln: %.c
 	$(LINT.c) $< $(UTILS) $(LDLIBS)
 
-%.64: %.c
-	$(LINK64.c) -o $@ $< $(UTILS) $(LDLIBS64)
+%.64.o: %.c
+	$(COMPILE64.c) $< -o $@
+
+%.32.o: %.c
+	$(COMPILE.c) $< -o $@
+
+%.64: %.64.o util.64.o
+	$(LINK64.c) -o $@ $< util.64.o $(LDLIBS64)
 	$(POST_PROCESS)
 
-%.32: %.c
-	$(LINK.c) -o $@ $< $(UTILS) $(LDLIBS)
+%.32: %.32.o util.32.o
+	$(LINK.c) -o $@ $< util.32.o $(LDLIBS)
 	$(POST_PROCESS)
 
 clobber:
diff --git a/usr/src/tools/cw/Makefile b/usr/src/tools/cw/Makefile
index 8764d1cd18..e5100189d2 100644
--- a/usr/src/tools/cw/Makefile
+++ b/usr/src/tools/cw/Makefile
@@ -22,6 +22,7 @@
 # Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
+# Copyright 2018 Joyent, Inc.
 
 PROG	= cw
 
@@ -39,18 +40,13 @@ CFLAGS += $(CCVERBOSE)
 
 # Override CFLAGS.  This is needed only for bootstrap of cw.
 $(__GNUC)CFLAGS=	-O -D__sun -Wall -Wno-unknown-pragmas -Werror \
-			-std=gnu89 -nodefaultlibs
-$(__SUNC)CFLAGS=	-xspace -Xa  -xildoff -errtags=yes -errwarn=%all \
-			-xc99=%none    -W0,-xglobalstatic -v
+			-std=gnu99 -nodefaultlibs
+$(__SUNC)CFLAGS=	-xspace -Xa -xildoff -errtags=yes -errwarn=%all \
+			-xc99=%all -W0,-xglobalstatic -v
 
 
 $(__GNUC)LDLIBS +=	-lc
-$(__GNUC)LDFLAGS= 	$(MAPFILE.NES:%=-Wl,-M%)
-
-CPPFLAGS += -DDEFAULT_CC_DIR='"$(SPRO_VROOT)/bin"'
-CPPFLAGS += -DDEFAULT_GCC_DIR='"$(GNUC_ROOT)/bin"'
-CPPFLAGS += -DDEFAULT_CPLUSPLUS_DIR='"$(SPRO_VROOT)/bin"'
-CPPFLAGS += -DDEFAULT_GPLUSPLUS_DIR='"$(GNUC_ROOT)/bin"'
+$(__GNUC)LDFLAGS=	$(MAPFILE.NES:%=-Wl,-M%)
 
 $(ROOTONBLDMAN1ONBLDFILES) := FILEMODE=      644
 
@@ -67,4 +63,9 @@ lint: lint_PROG
 
 clean:
 
+#
+# Not run by default: bootstrap...
+check:
+	$(ROOTONBLDBINMACH)/mandoc -Tlint -Wwarning $(MAN1ONBLDFILES)
+
 include ../Makefile.targ
diff --git a/usr/src/tools/cw/cw.1onbld b/usr/src/tools/cw/cw.1onbld
index 86923029d2..da3f224cd2 100644
--- a/usr/src/tools/cw/cw.1onbld
+++ b/usr/src/tools/cw/cw.1onbld
@@ -21,215 +21,201 @@
 .\" Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 .\" Use is subject to license terms.
 .\"
-.TH CW 1ONBLD "August 16, 2018"
-.SH NAME
-.I cw
-\- invoke one or more compilers with argument translation
-.SH SYNOPSIS
-\fBcw {-_cc|-_gcc|-_CC|-_g++} [options] [compiler args...]\fP
-.SH DESCRIPTION
-.LP
-.I cw
-is a facility for invoking one or more compilers, providing
-translation from Sun Studio arguments as appropriate.  This allows
-the use of arbitrary compilers without the need to alter large
-numbers of makefiles.  A mode called shadow compilation, the default,
-invokes two different compilers so that warnings and errors may be
-obtained from both.  See SHADOW COMPILATION for details.  This version
-of cw supports Sun Studio 10 and 11 and gcc 3.4.3 as shipped in
-Solaris.
-.SH ARGUMENTS
-.LP
-Exactly one of the following arguments is required, and must appear
-immediately following \fBcw\fP in the argument list:
-.TP 4
-.B \-_cc
-Select Sun Studio C (cc) as the primary compiler.
-.TP 4
-.B \-_gcc
-Select GNU C (gcc) as the primary compiler.
-.TP 4
-.B \-_CC
-Select Sun Studio C++ (CC) as the primary compiler.
-.TP 4
-.B \-_g++
-Select GNU C++ (g++) as the primary compiler.
-.SH OPTIONS
-.LP
-The following options are supported:
-.TP 4
-.B \-_compiler
-Do not invoke any compiler; instead, write to standard output the
-full path to the primary compiler that would be invoked.  If this
-option is given, it must appear immediately following the compiler
-selection argument, and all other options will be disregarded.
-.TP 4
-.B \-_versions
-Print the cw version, followed in turn by the path to and versions
-of each compiler which would be invoked.  If this option is given,
-it must appear immediately following the compiler selection argument,
-and all other options will be disregarded.
-.TP 4
-.B \-_noecho
-Normally, cw writes to standard error the actual compiler commands
-invoked, each prefixed with '+'.  This option suppresses these
-messages.
-.TP 4
-.B \-_cc=,\-_gcc=,\-_CC=,\-g++=
-Pass compiler-dependent options.  See ARGUMENT TRANSLATION.
-.SH SHADOW COMPILATION
-.LP
-Unless otherwise directed by environment variables (see ENVIRONMENT),
-\fBcw\fP will invoke both the compiler specified by its first argument
-(primary) and a designated alternate compiler (shadow).  The primary
-compiler will be invoked with the arguments given to cw, translated
-as described in ARGUMENT TRANSLATION.  The secondary compiler will be
-invoked in parallel with the primary (but see ENVIRONMENT); its
-arguments will likewise be translated.  However, the shadow compiler's
-arguments will also be modified as follows:
-.TP 4
-.B 1.
-If none of \fI-c\fP, \fI-E\fP, \fI-P\fP, or \fI-S\fP appears in the
-argument list (that is, linking is attempted), the shadow compiler
-will not be invoked.  This is because the objects built with that
-compiler which would be linked have been previously discarded.
-.TP 4
-.B 2.
-If an option of the form \fI-ofilename\fP was provided, it will be
-replaced by two options of the form \fI-o\fP \fItempfile\fP.
-.TP 4
-.B 3.
-If the option \fI-o\fP was provided, its following argument will be
-replaced by \fItempfile\fP.
-.TP 4
-.B 4.
-If neither of the above options was provided, two options of the
-form \fI-o\fP \fItempfile\fP will be added to the end of the argument
-list used to invoke the shadow compiler.
-.LP
-In all three cases, \fItempfile\fP is the name of a temporary file
-which will be removed by \fBcw\fP before it terminates.
-.LP
-When shadow compilation is in effect, \fBcw\fP writes to standard error
-each compiler's standard error output following its argument list.
-Messages from the two compilers will not be interleaved.  If \fBcw\fP
+.\" Copyright 2018 Joyent, Inc.
+.\"
+.Dd September 4, 2018
+.Dt CW 1ONBLD
+.Os
+.Sh NAME
+.Nm cw
+.Nd invoke one or more compilers with argument translation
+.Sh SYNOPSIS
+.Nm cw
+.Op Fl C
+.Op Fl -versions
+.Op Fl -noecho
+.Fl -primary Ar compiler
+.Op Fl -shadow Ar compiler ...
+.Fl -
+.Ar compiler args ...
+.Sh DESCRIPTION
+.Nm cw
+is a facility for invoking one or more compilers, providing translation from
+Sun style arguments as appropriate.
+This allows the use of arbitrary compilers without the need to alter large
+numbers of makefiles.
+A mode called shadow compilation invokes multiple compilers so that warnings
+and errors may be obtained from all of them.
+See
+.Sx SHADOW COMPILATION
+for details.
+This version of cw supports compilers with both Sun Studio 12 and GCC-style
+command lines.
+.Sh ARGUMENTS
+Both the
+.Fl -primary
+and
+.Fl -shadow
+parameters take a
+.Em compiler specification .
+This is a comma-separated list of the form
+.Ar name,executable,style
+Where
+.Ar name
+is a name for the compiler,
+.Ar executable
+is the full path to the compiler executable, and
+.Ar style
+is the style of command-line options the compiler expects, either
+.Em sun
+or
+.Em gnu .
+.Bl -tag -width indent
+.It Fl -primary Ar compiler
+Specify the compiler to be used primarily (that which is used for link-editing
+and pre-processing, and whos objects we deliver).
+.It Fl -shadow Ar compiler
+Specify a shadow compiler, which builds sources for the sake of checking code
+quality and compatibility, but has its output discarded.
+.It Fl -noecho
+Do not echo the actual command line of any compilers invoked.
+.It Fl -versions
+Request from each configured primary and shadow compiler its version
+information.
+.It Fl C
+The sources being compiled are C++.  This is necessary as it affects the
+translation of compiler arguments.
+.It Fl -
+Arguments intended for the compilers themselves must be separated from those
+of
+.Nm cw
+by a
+.Fl - .
+.It Fl _name=
+.It Fl _style=
+Parameters intended for the compiler be guarded with options of the form
+.Fl _name=
+and
+.Fl _style=
+Where
+.Em name
+and
+.Em style
+are those passed to
+.Fl -primary
+and
+.Fl -shadow
+this allows certain flags to be passed only to certain classes of compiler.
+.Pp
+For historical reasons, the
+.Fl _style=
+option is also translated such that a style of
+.Em sun
+may use the flag
+.Fl _cc=
+and a style of
+.Em gnu
+may use the flag
+.Fl _gcc= ,
+and when the
+.Fl C
+option is given and C++ is in use the style of
+.Em sun
+may use the flag
+.Fl _CC=
+and the style of
+.Em gnu
+may use the flag
+.Fl _g++= .
+.El
+.Sh SHADOW COMPILATION
+If
+.Fl -shadow
+compilers are specified
+.Nm cw
+will invoke each shadow compiler, with the outputs modified (as well as any
+translation for compiler style) as follows:
+.Bl -enum
+.It
+If neither of
+.Fl c ,
+.Fl S
+appears in the argument list (that is, linking is attempted or only the
+pre-processor is invoked), the shadow compilers will not be invoked.
+.It
+If the
+.Fl o Ar filename
+option was provided, with or without a separating space, it will be replaced with
+.Fl o Ar tempfile
+.It
+If the option
+.Fl o
+was not provided,
+.Fl o Ar tempfile
+will be added to the end of the argument list used to invoke
+the shadow compilers.
+.El
+When shadow compilation is in effect,
+.Nm cw
+writes to standard error each compiler's standard error output following its
+argument list.
+Messages from the compilers will not be interleaved.
+If
+.Nm cw
 is used to invoke the preprocessor and no output location is specified,
-\fBcw\fP will write to standard output the primary compiler's
-standard output, and the secondary compiler's standard output will
-be discarded.
-.LP
-Because the Studio compilers write intermediate objects to fixed
+.Nm cw
+will write to standard output the primary compiler's standard output.
+.Pp
+Because the Sun compilers write intermediate objects to fixed
 filenames in the current directory when instructed to compile and
 link multiple source files via a single command line, it would be
-unsafe to invoke more than one compiler in this fashion.  Therefore
-\fBcw\fP does not accept multiple source files unless the
-preprocessor is to be invoked.  An attempt to invoke \fBcw\fP in
-this manner will result in an error.
-.SH ARGUMENT TRANSLATION
-.LP
-The arguments provided to \fBcw\fP will be passed through to each
-compiler invoked, altered as follows:
-.TP 4
-.B 1.
-Options intended for \fBcw\fP itself are removed.
-.TP 4
-.B 2.
-The shadow compiler's arguments are modified as described in
-SHADOW COMPILATION so that its output is discarded.
-.TP 4
-.B 3.
-If the compiler to be invoked is a GNU C or C++ compiler, a set of
+unsafe to invoke more than one compiler in this fashion.
+Therefore
+.Nm cw
+does not accept multiple source files unless the preprocessor is to be
+invoked.
+An attempt to invoke
+.Nm cw
+in this manner will result in an error.
+.Sh ARGUMENT TRANSLATION
+If the compiler to be invoked is a GNU-style C or C++ compiler, a set of
 default flags is added to the beginning of the argument list, and the
 remaining arguments are translated to their closest appropriate
 semantic equivalents and passed in the same order as their
-counterparts given to \fBcw\fP.  Arguments which begin with
-\fI-_gcc=\fP or \fI-_g++=\fP will be passed in place with the
-leading portion removed.  Arguments which begin with \fI-_cc=\fP or
-\fI-_CC=\fP will be discarded.  See the comments at the head of
-\fIusr/src/tools/cw/cw.c\fP for a detailed list of translations.
-.TP 4
-.B 4.
-If the compiler to be invoked is a Studio C or C++ compiler, the
-remaining arguments are passed unmodified and in the same order as
-given to \fBcw\fP.  Arguments which begin with \fI-_cc=\fP or
-\fI-_CC=\fP will be passed in place with the leading portion removed.
-Arguments which begin with \fI-_gcc=\fP or \fI-_g++=\fP will be
-discarded.
-.SH ENVIRONMENT
-.TP 4
-.B CW_NO_SHADOW
-If this variable is set in the environment, invoke only the
-primary compiler.
-.TP 4
-.B CW_SHADOW_SERIAL
-If this variable is set in the environment, invoke the primary compiler,
-wait for it to complete, then invoke the shadow compiler.  Normally
-the two compilers are invoked in parallel.  If CW_NO_SHADOW is set,
-this has no effect.
-.TP 4
-.B CW_NO_EXEC
-If this variable is set in the environment, write the usual output to
-standard error but do not actually invoke any compiler.  This is
-useful for debugging the translation engine.
-.TP 4
-.B CW_CC, CW_CPLUSPLUS
-If these variables are set in the environment, they specify the full
-pathname for the Studio C and C++ compilers, respectively.
-.TP 4
-.B CW_CC_DIR, CW_CPLUSPLUS_DIR, SPRO_VROOT, SPRO_ROOT, BUILD_TOOLS
-If CW_CC or CW_CPLUSPLUS are not set,
-these variables define the search path for Studio compilers as
-follows:
-.B
-If CW_CC_DIR is set, the Studio C compiler in \fI$CW_CC_DIR\fP
-will be used.  Likewise, if CW_CPLUSPLUS_DIR is set, the Studio C++
-compiler in \fI$CW_CPLUSPLUS_DIR\fP will be used.
-Otherwise, if SPRO_VROOT is set, the Studio C and C++ compilers
-in \fI$SPRO_VROOT/bin\fP will be used.
-Otherwise, if SPRO_ROOT is set, the Studio C and C++ compilers
-in \fI$SPRO_ROOT/SS12/bin\fP will be used.
-Otherwise, if BUILD_TOOLS is set, the Studio C and C++ compilers
-in \fI$BUILD_TOOLS/SUNWspro/SS12/bin\fP will be used.
-Otherwise, the Studio compilers in a predefined default location
-will be used.
-.TP 4
-.B CW_GCC, CW_GPLUSPLUS
-If these variables are set in the environment, they specify the full
-pathname for the GNU C and C++ compilers, respectively.
-.TP 4
-.B CW_GCC_DIR, CW_GPLUSPLUS_DIR, GNUC_ROOT
-If CW_GCC or CW_GPLUSPLUS are not set,
-these variables alter the search path for GNU compilers in a manner
-similar to that described above for the Studio compilers.  Specifically:
-.LP
-If CW_GCC_DIR is set, the GNU C compiler in \fI$CW_GCC_DIR\fP
-will be used.  Likewise, if CW_GPLUSPLUS_DIR is set, the GNU C++
-compiler in \fI$CW_GPLUSPLUS_DIR\fP will be used.
-Otherwise, if GNUC_ROOT is set, the GNU C and C++ compilers
-in \fI$GNUC_ROOT/bin\fP will be used. Previously \fI$GCC_ROOT\fP was
-used to in place of \fI$GNUC_ROOT\fP; however, because that environment
-variable has special meaning to gcc, if it is encountered in bldenv or
-nightly(1ONBLD), it will be translated to \fI$GNUC_ROOT\fP.
-.LP
-If none of the aforementioned environment variables are set, the GNU
-compilers in a predefined default location will be used.
-.SH EXIT STATUS
-.LP
+counterparts given to
+.Nm cw .
+See the comments at the head of
+.Pa usr/src/tools/cw/cw.c
+for a detailed list of translations.
+.Sh ENVIRONMENT
+.Bl -tag -width indent
+.It CW_SHADOW_SERIAL
+If this variable is set in the environment, invoke the primary compiler, wait
+for it to complete, then invoke the shadow compilers.
+Normally the primary and shadow compilers are invoked in parallel.
+.It CW_NO_EXEC
+f this variable is set in the environment, write the usual output to
+standard error but do not actually invoke any compiler.
+This is useful for debugging the translation engine.
+.El
+.Sh EXIT STATUS
 The following exit status values are returned:
-.IP "\fB0\fR" 4
-The primary compiler, and shadow compiler if invoked, both completed
+.Bl -tag -width indent
+.It 0
+The primary compiler, and shadow compilers if invoked, all completed
 successfully.
-.IP "\fB>0\fR" 4
+.It >0
 A usage error occurred, or one or more compilers returned a nonzero
 exit status.
-.SH BUGS
-.LP
-The translations provided for gcc are not always exact and in some
-cases reflect local ON policy rather than actual equivalence.
-.LP
+.El
+.Sh SEE ALSO
+.Xr cc 1 ,
+.Xr CC 1 ,
+.Xr gcc 1
+.Sh BUGS
+The translations provided for gcc are not always exact and in some cases
+reflect local policy rather than actual equivalence.
+.Pp
 Additional compiler types should be supported.
-.LP
+.Pp
 The translation engine is hacky.
-.SH SEE ALSO
-.LP
-cc(1), CC(1), gcc(1)
diff --git a/usr/src/tools/cw/cw.c b/usr/src/tools/cw/cw.c
index 33a23ddee8..a8c2cfb4f3 100644
--- a/usr/src/tools/cw/cw.c
+++ b/usr/src/tools/cw/cw.c
@@ -1,3 +1,4 @@
+
 /*
  * CDDL HEADER START
  *
@@ -20,7 +21,7 @@
  */
 
 /*
- * Copyright 2011, Richard Lowe.
+ * Copyright 2018, Richard Lowe.
  */
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
@@ -36,7 +37,7 @@
  */
 
 /* If you modify this file, you must increment CW_VERSION */
-#define	CW_VERSION	"1.30"
+#define	CW_VERSION	"2.0"
 
 /*
  * -#		Verbose mode
@@ -291,20 +292,21 @@
  * -YS,<dir>			error
  */
 
-#include <stdio.h>
-#include <sys/types.h>
-#include <unistd.h>
-#include <string.h>
-#include <stdlib.h>
 #include <ctype.h>
-#include <fcntl.h>
+#include <err.h>
 #include <errno.h>
-#include <stdarg.h>
-#include <sys/utsname.h>
+#include <fcntl.h>
+#include <getopt.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
 #include <sys/param.h>
-#include <sys/isa_defs.h>
-#include <sys/wait.h>
 #include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/utsname.h>
+#include <sys/wait.h>
 
 #define	CW_F_CXX	0x01
 #define	CW_F_SHADOW	0x02
@@ -313,29 +315,6 @@
 #define	CW_F_XLATE	0x10
 #define	CW_F_PROG	0x20
 
-typedef enum cw_compiler {
-	CW_C_CC = 0,
-	CW_C_GCC
-} cw_compiler_t;
-
-static const char *cmds[] = {
-	"cc", "CC",
-	"gcc", "g++"
-};
-
-static char default_dir[2][MAXPATHLEN] = {
-	DEFAULT_CC_DIR,
-	DEFAULT_GCC_DIR,
-};
-
-#define	CC(ctx) \
-	(((ctx)->i_flags & CW_F_SHADOW) ? \
-	    ((ctx)->i_compiler == CW_C_CC ? CW_C_GCC : CW_C_CC) : \
-	    (ctx)->i_compiler)
-
-#define	CIDX(compiler, flags)	\
-	((int)(compiler) << 1) + ((flags) & CW_F_CXX ? 1 : 0)
-
 typedef enum cw_op {
 	CW_O_NONE = 0,
 	CW_O_PREPROCESS,
@@ -351,8 +330,20 @@ struct aelist {
 	int ael_argc;
 };
 
+typedef enum {
+	GNU,
+	SUN
+} compiler_style_t;
+
+typedef struct {
+	char *c_name;
+	char *c_path;
+	compiler_style_t c_style;
+} cw_compiler_t;
+
 typedef struct cw_ictx {
-	cw_compiler_t	i_compiler;
+	struct cw_ictx	*i_next;
+	cw_compiler_t	*i_compiler;
 	struct aelist	*i_ae;
 	uint32_t	i_flags;
 	int		i_oldargc;
@@ -390,7 +381,7 @@ typedef struct xarch_table {
  */
 static const xarch_table_t xtbl[] = {
 #if defined(__x86)
-	{ "generic",	SS11 },
+	{ "generic",	SS11, {NULL} },
 	{ "generic64",	(SS11|M64), { "-m64", "-mtune=opteron" } },
 	{ "amd64",	(SS11|M64), { "-m64", "-mtune=opteron" } },
 	{ "386",	SS11,	{ "-march=i386" } },
@@ -417,8 +408,6 @@ static const xarch_table_t xtbl[] = {
 
 static int xtbl_size = sizeof (xtbl) / sizeof (xarch_table_t);
 
-static const char *progname;
-
 static const char *xchip_tbl[] = {
 #if defined(__x86)
 	"386",		"-mtune=i386", NULL,
@@ -464,23 +453,7 @@ static const char *xregs_tbl[] = {
 static void
 nomem(void)
 {
-	(void) fprintf(stderr, "%s: error: out of memory\n", progname);
-	exit(1);
-}
-
-static void
-cw_perror(const char *fmt, ...)
-{
-	va_list ap;
-	int saved_errno = errno;
-
-	(void) fprintf(stderr, "%s: error: ", progname);
-
-	va_start(ap, fmt);
-	(void) vfprintf(stderr, fmt, ap);
-	va_end(ap);
-
-	(void) fprintf(stderr, " (%s)\n", strerror(saved_errno));
+	errx(1, "out of memory");
 }
 
 static void
@@ -515,9 +488,7 @@ newictx(void)
 static void
 error(const char *arg)
 {
-	(void) fprintf(stderr,
-	    "%s: error: mapping failed at or near arg '%s'\n", progname, arg);
-	exit(2);
+	errx(2, "error: mapping failed at or near arg '%s'", arg);
 }
 
 /*
@@ -551,7 +522,7 @@ optim_disable(struct aelist *h, int level)
 
 /* ARGSUSED */
 static void
-Xamode(struct aelist *h)
+Xamode(struct aelist __unused *h)
 {
 }
 
@@ -582,9 +553,15 @@ Xsmode(struct aelist *h)
 static void
 usage()
 {
+	extern char *__progname;
 	(void) fprintf(stderr,
-	    "usage: %s { -_cc | -_gcc | -_CC | -_g++ } [ -_compiler | ... ]\n",
-	    progname);
+	    "usage: %s [-C] [--versions] --primary <compiler> "
+	    "[--shadow <compiler>]... -- cflags...\n",
+	    __progname);
+	(void) fprintf(stderr, "compilers take the form: name,path,style\n"
+	    " - name: a unique name usable in flag specifiers\n"
+	    " - path: path to the compiler binary\n"
+	    " - style: the style of flags expected: either sun or gnu\n");
 	exit(2);
 }
 
@@ -643,6 +620,7 @@ do_gcc(cw_ictx_t *ctx)
 	int in_output = 0, seen_o = 0, c_files = 0;
 	cw_op_t op = CW_O_LINK;
 	char *model = NULL;
+	char *nameflag;
 	int	mflag = 0;
 
 	if (ctx->i_flags & CW_F_PROG) {
@@ -679,10 +657,12 @@ do_gcc(cw_ictx_t *ctx)
 	 */
 	newae(ctx->i_ae, "-D__sun");
 
+	if (asprintf(&nameflag, "-_%s=", ctx->i_compiler->c_name) == -1)
+		nomem();
+
 	/*
 	 * Walk the argument list, translating as we go ..
 	 */
-
 	while (--ctx->i_oldargc > 0) {
 		char *arg = *++ctx->i_oldargv;
 		size_t arglen = strlen(arg);
@@ -718,6 +698,10 @@ do_gcc(cw_ictx_t *ctx)
 		}
 
 		if (ctx->i_flags & CW_F_CXX) {
+			if (strncmp(arg, "-_g++=", 6) == 0) {
+				newae(ctx->i_ae, strchr(arg, '=') + 1);
+				continue;
+			}
 			if (strncmp(arg, "-compat=", 8) == 0) {
 				/* discard -compat=4 and -compat=5 */
 				continue;
@@ -772,16 +756,11 @@ do_gcc(cw_ictx_t *ctx)
 
 		switch ((c = arg[1])) {
 		case '_':
-			if (strcmp(arg, "-_noecho") == 0)
-				ctx->i_flags &= ~CW_F_ECHO;
-			else if (strncmp(arg, "-_cc=", 5) == 0 ||
-			    strncmp(arg, "-_CC=", 5) == 0)
-				/* EMPTY */;
-			else if (strncmp(arg, "-_gcc=", 6) == 0 ||
-			    strncmp(arg, "-_g++=", 6) == 0)
-				newae(ctx->i_ae, arg + 6);
-			else
-				error(arg);
+			if ((strncmp(arg, nameflag, strlen(nameflag)) == 0) ||
+			    (strncmp(arg, "-_gcc=", 6) == 0) ||
+			    (strncmp(arg, "-_gnu=", 6) == 0)) {
+				newae(ctx->i_ae, strchr(arg, '=') + 1);
+			}
 			break;
 		case '#':
 			if (arglen == 1) {
@@ -1421,11 +1400,12 @@ do_gcc(cw_ictx_t *ctx)
 		}
 	}
 
+	free(nameflag);
+
 	if (c_files > 1 && (ctx->i_flags & CW_F_SHADOW) &&
 	    op != CW_O_PREPROCESS) {
-		(void) fprintf(stderr, "%s: error: multiple source files are "
-		    "allowed only with -E or -P\n", progname);
-		exit(2);
+		errx(2, "multiple source files are "
+		    "allowed only with -E or -P");
 	}
 
 	/*
@@ -1434,9 +1414,8 @@ do_gcc(cw_ictx_t *ctx)
 	 * used.
 	 */
 	if ((mflag & (SS11|SS12)) == (SS11|SS12)) {
-		(void) fprintf(stderr,
+		errx(2,
 		    "Conflicting \"-xarch=\" flags (both Studio 11 and 12)\n");
-		exit(2);
 	}
 
 	switch (mflag) {
@@ -1491,7 +1470,9 @@ do_gcc(cw_ictx_t *ctx)
 		    "Incompatible -xarch= and/or -m32/-m64 options used.\n");
 		exit(2);
 	}
-	if (op == CW_O_LINK && (ctx->i_flags & CW_F_SHADOW))
+
+	if ((op == CW_O_LINK || op == CW_O_PREPROCESS) &&
+	    (ctx->i_flags & CW_F_SHADOW))
 		exit(0);
 
 	if (model && !pic)
@@ -1509,15 +1490,24 @@ do_cc(cw_ictx_t *ctx)
 {
 	int in_output = 0, seen_o = 0;
 	cw_op_t op = CW_O_LINK;
+	char *nameflag;
 
 	if (ctx->i_flags & CW_F_PROG) {
 		newae(ctx->i_ae, "-V");
 		return;
 	}
 
+	if (asprintf(&nameflag, "-_%s=", ctx->i_compiler->c_name) == -1)
+		nomem();
+
 	while (--ctx->i_oldargc > 0) {
 		char *arg = *++ctx->i_oldargv;
 
+		if (strncmp(arg, "-_CC=", 5) == 0) {
+			newae(ctx->i_ae, strchr(arg, '=') + 1);
+			continue;
+		}
+
 		if (*arg != '-') {
 			if (in_output == 0 || !(ctx->i_flags & CW_F_SHADOW)) {
 				newae(ctx->i_ae, arg);
@@ -1529,19 +1519,13 @@ do_cc(cw_ictx_t *ctx)
 		}
 		switch (*(arg + 1)) {
 		case '_':
-			if (strcmp(arg, "-_noecho") == 0) {
-				ctx->i_flags &= ~CW_F_ECHO;
-			} else if (strncmp(arg, "-_cc=", 5) == 0 ||
-			    strncmp(arg, "-_CC=", 5) == 0) {
-				newae(ctx->i_ae, arg + 5);
-			} else if (strncmp(arg, "-_gcc=", 6) != 0 &&
-			    strncmp(arg, "-_g++=", 6) != 0) {
-				(void) fprintf(stderr,
-				    "%s: invalid argument '%s'\n", progname,
-				    arg);
-				exit(2);
+			if ((strncmp(arg, nameflag, strlen(nameflag)) == 0) ||
+			    (strncmp(arg, "-_cc=", 5) == 0) ||
+			    (strncmp(arg, "-_sun=", 6) == 0)) {
+				newae(ctx->i_ae, strchr(arg, '=') + 1);
 			}
 			break;
+
 		case 'V':
 			ctx->i_flags &= ~CW_F_ECHO;
 			newae(ctx->i_ae, arg);
@@ -1574,6 +1558,8 @@ do_cc(cw_ictx_t *ctx)
 		}
 	}
 
+	free(nameflag);
+
 	if ((op == CW_O_LINK || op == CW_O_PREPROCESS) &&
 	    (ctx->i_flags & CW_F_SHADOW))
 		exit(0);
@@ -1587,55 +1573,22 @@ do_cc(cw_ictx_t *ctx)
 static void
 prepctx(cw_ictx_t *ctx)
 {
-	const char *dir = NULL, *cmd;
-	char *program = NULL;
-	size_t len;
-
-	switch (CIDX(CC(ctx), ctx->i_flags)) {
-		case CIDX(CW_C_CC, 0):
-			program = getenv("CW_CC");
-			dir = getenv("CW_CC_DIR");
-			break;
-		case CIDX(CW_C_CC, CW_F_CXX):
-			program = getenv("CW_CPLUSPLUS");
-			dir = getenv("CW_CPLUSPLUS_DIR");
-			break;
-		case CIDX(CW_C_GCC, 0):
-			program = getenv("CW_GCC");
-			dir = getenv("CW_GCC_DIR");
-			break;
-		case CIDX(CW_C_GCC, CW_F_CXX):
-			program = getenv("CW_GPLUSPLUS");
-			dir = getenv("CW_GPLUSPLUS_DIR");
-			break;
-	}
-
-	if (program == NULL) {
-		if (dir == NULL)
-			dir = default_dir[CC(ctx)];
-		cmd = cmds[CIDX(CC(ctx), ctx->i_flags)];
-		len = strlen(dir) + strlen(cmd) + 2;
-		if ((program = malloc(len)) == NULL)
-			nomem();
-		(void) snprintf(program, len, "%s/%s", dir, cmd);
-	}
-
-	newae(ctx->i_ae, program);
+	newae(ctx->i_ae, ctx->i_compiler->c_path);
 
 	if (ctx->i_flags & CW_F_PROG) {
 		(void) printf("%s: %s\n", (ctx->i_flags & CW_F_SHADOW) ?
-		    "shadow" : "primary", program);
+		    "shadow" : "primary", ctx->i_compiler->c_path);
 		(void) fflush(stdout);
 	}
 
 	if (!(ctx->i_flags & CW_F_XLATE))
 		return;
 
-	switch (CC(ctx)) {
-	case CW_C_CC:
+	switch (ctx->i_compiler->c_style) {
+	case SUN:
 		do_cc(ctx);
 		break;
-	case CW_C_GCC:
+	case GNU:
 		do_gcc(ctx);
 		break;
 	}
@@ -1672,19 +1625,22 @@ invoke(cw_ictx_t *ctx)
 		return (0);
 
 	/*
-	 * We must fix up the environment here so that the
-	 * dependency files are not trampled by the shadow compiler.
+	 * We must fix up the environment here so that the dependency files are
+	 * not trampled by the shadow compiler. Also take care of GCC
+	 * environment variables that will throw off gcc. This assumes a primary
+	 * gcc.
 	 */
 	if ((ctx->i_flags & CW_F_SHADOW) &&
 	    (unsetenv("SUNPRO_DEPENDENCIES") != 0 ||
-	    unsetenv("DEPENDENCIES_OUTPUT") != 0)) {
+	    unsetenv("DEPENDENCIES_OUTPUT") != 0 ||
+	    unsetenv("GCC_ROOT") != 0)) {
 		(void) fprintf(stderr, "error: environment setup failed: %s\n",
 		    strerror(errno));
 		return (-1);
 	}
 
 	(void) execv(newargv[0], newargv);
-	cw_perror("couldn't run %s", newargv[0]);
+	warn("couldn't run %s", newargv[0]);
 
 	return (-1);
 }
@@ -1704,7 +1660,7 @@ reap(cw_ictx_t *ctx)
 
 	do {
 		if (waitpid(ctx->i_pid, &status, 0) < 0) {
-			cw_perror("cannot reap child");
+			warn("cannot reap child");
 			return (-1);
 		}
 		if (status != 0) {
@@ -1721,7 +1677,7 @@ reap(cw_ictx_t *ctx)
 	(void) unlink(ctx->i_discard);
 
 	if (stat(ctx->i_stderr, &s) < 0) {
-		cw_perror("stat failed on child cleanup");
+		warn("stat failed on child cleanup");
 		return (-1);
 	}
 	if (s.st_size != 0) {
@@ -1774,26 +1730,23 @@ exec_ctx(cw_ictx_t *ctx, int block)
 		(void) fclose(stderr);
 		if ((fd = open(ctx->i_stderr, O_WRONLY | O_CREAT | O_EXCL,
 		    0666)) < 0) {
-			cw_perror("open failed for standard error");
-			exit(1);
+			err(1, "open failed for standard error");
 		}
 		if (dup2(fd, 2) < 0) {
-			cw_perror("dup2 failed for standard error");
-			exit(1);
+			err(1, "dup2 failed for standard error");
 		}
 		if (fd != 2)
 			(void) close(fd);
 		if (freopen("/dev/fd/2", "w", stderr) == NULL) {
-			cw_perror("freopen failed for /dev/fd/2");
-			exit(1);
+			err(1, "freopen failed for /dev/fd/2");
 		}
+
 		prepctx(ctx);
 		exit(invoke(ctx));
 	}
 
 	if (ctx->i_pid < 0) {
-		cw_perror("fork failed");
-		return (1);
+		err(1, "fork failed");
 	}
 
 	if (block)
@@ -1802,115 +1755,169 @@ exec_ctx(cw_ictx_t *ctx, int block)
 	return (0);
 }
 
-int
-main(int argc, char **argv)
+static void
+parse_compiler(const char *spec, cw_compiler_t *compiler)
 {
-	cw_ictx_t *ctx = newictx();
-	cw_ictx_t *ctx_shadow = newictx();
-	const char *dir;
-	int do_serial, do_shadow;
-	int ret = 0;
+	char *tspec, *token;
 
-	if ((progname = strrchr(argv[0], '/')) == NULL)
-		progname = argv[0];
-	else
-		progname++;
-
-	if (ctx == NULL || ctx_shadow == NULL)
+	if ((tspec = strdup(spec)) == NULL)
 		nomem();
 
-	ctx->i_flags = CW_F_ECHO|CW_F_XLATE;
+	if ((token = strsep(&tspec, ",")) == NULL)
+		errx(1, "Compiler is missing a name: %s", spec);
+	compiler->c_name = token;
 
-	/*
-	 * Figure out where to get our tools from.  This depends on
-	 * the environment variables set at run time.
-	 */
-	if ((dir = getenv("SPRO_VROOT")) != NULL) {
-		(void) snprintf(default_dir[CW_C_CC], MAXPATHLEN,
-		    "%s/bin", dir);
-	} else if ((dir = getenv("SPRO_ROOT")) != NULL) {
-		(void) snprintf(default_dir[CW_C_CC], MAXPATHLEN,
-		    "%s/SS12/bin", dir);
-	} else if ((dir = getenv("BUILD_TOOLS")) != NULL) {
-		(void) snprintf(default_dir[CW_C_CC], MAXPATHLEN,
-		    "%s/SUNWspro/SS12/bin", dir);
-	}
+	if ((token = strsep(&tspec, ",")) == NULL)
+		errx(1, "Compiler is missing a path: %s", spec);
+	compiler->c_path = token;
 
-	if ((dir = getenv("GNUC_ROOT")) != NULL) {
-		(void) snprintf(default_dir[CW_C_GCC], MAXPATHLEN,
-		    "%s/bin", dir);
-	}
+	if ((token = strsep(&tspec, ",")) == NULL)
+		errx(1, "Compiler is missing a style: %s", spec);
 
-	do_shadow = (getenv("CW_NO_SHADOW") ? 0 : 1);
-	do_serial = (getenv("CW_SHADOW_SERIAL") ? 1 : 0);
+	if ((strcasecmp(token, "gnu") == 0) ||
+	    (strcasecmp(token, "gcc") == 0))
+		compiler->c_style = GNU;
+	else if ((strcasecmp(token, "sun") == 0) ||
+	    (strcasecmp(token, "cc") == 0))
+		compiler->c_style = SUN;
+	else
+		errx(1, "unknown compiler style: %s", token);
 
-	if (getenv("CW_NO_EXEC") == NULL)
-		ctx->i_flags |= CW_F_EXEC;
+	if (tspec != NULL)
+		errx(1, "Excess tokens in compiler: %s", spec);
+}
 
-	/*
-	 * The first argument must be one of "-_cc", "-_gcc", "-_CC", or "-_g++"
-	 */
-	if (argc == 1)
+int
+main(int argc, char **argv)
+{
+	int ch;
+	cw_compiler_t primary = { NULL, NULL, 0 };
+	cw_compiler_t shadows[10];
+	int nshadows = 0;
+	int ret = 0;
+	boolean_t do_serial = B_FALSE;
+	boolean_t do_exec = B_FALSE;
+	boolean_t vflg = B_FALSE;
+	boolean_t Cflg = B_FALSE;
+	boolean_t cflg = B_FALSE;
+	boolean_t nflg = B_FALSE;
+
+	cw_ictx_t *main_ctx;
+
+	static struct option longopts[] = {
+		{ "compiler", no_argument, NULL, 'c' },
+		{ "noecho", no_argument, NULL, 'n' },
+		{ "primary", required_argument, NULL, 'p' },
+		{ "shadow", required_argument, NULL, 's' },
+		{ "versions", no_argument, NULL, 'v' },
+		{ NULL, 0, NULL, 0 },
+	};
+
+
+	if ((main_ctx = newictx()) == NULL)
+		nomem();
+
+	while ((ch = getopt_long(argc, argv, "C", longopts, NULL)) != -1) {
+		switch (ch) {
+		case 'c':
+			cflg = B_TRUE;
+			break;
+		case 'C':
+			Cflg = B_TRUE;
+			break;
+		case 'n':
+			nflg = B_TRUE;
+			break;
+		case 'p':
+			if (primary.c_path != NULL) {
+				warnx("Only one primary compiler may "
+				    "be specified");
+				usage();
+			}
+
+			parse_compiler(optarg, &primary);
+			break;
+		case 's':
+			if (nshadows >= 10)
+				errx(1, "May only use 10 shadows at "
+				    "the moment");
+			parse_compiler(optarg, &shadows[nshadows]);
+			nshadows++;
+			break;
+		case 'v':
+			vflg = B_TRUE;
+			break;
+		default:
+			(void) fprintf(stderr, "Did you forget '--'?\n");
+			usage();
+		}
+	}
+
+	if (primary.c_path == NULL) {
+		warnx("A primary compiler must be specified");
 		usage();
-	argc--;
-	argv++;
-	if (strcmp(argv[0], "-_cc") == 0) {
-		ctx->i_compiler = CW_C_CC;
-	} else if (strcmp(argv[0], "-_gcc") == 0) {
-		ctx->i_compiler = CW_C_GCC;
-	} else if (strcmp(argv[0], "-_CC") == 0) {
-		ctx->i_compiler = CW_C_CC;
-		ctx->i_flags |= CW_F_CXX;
-	} else if (strcmp(argv[0], "-_g++") == 0) {
-		ctx->i_compiler = CW_C_GCC;
-		ctx->i_flags |= CW_F_CXX;
-	} else {
-		/* assume "-_gcc" by default */
-		argc++;
-		argv--;
-		ctx->i_compiler = CW_C_GCC;
 	}
 
-	/*
-	 * -_compiler - tell us the path to the primary compiler only
-	 */
-	if (argc > 1 && strcmp(argv[1], "-_compiler") == 0) {
-		ctx->i_flags &= ~CW_F_XLATE;
-		prepctx(ctx);
-		(void) printf("%s\n", ctx->i_ae->ael_head->ae_arg);
-		return (0);
+	do_serial = (getenv("CW_SHADOW_SERIAL") == NULL) ? B_FALSE : B_TRUE;
+	do_exec = (getenv("CW_NO_EXEC") == NULL) ? B_TRUE : B_FALSE;
+
+	/* Leave room for argv[0] */
+	argc -= (optind - 1);
+	argv += (optind - 1);
+
+	main_ctx->i_oldargc = argc;
+	main_ctx->i_oldargv = argv;
+	main_ctx->i_flags = CW_F_XLATE;
+	if (nflg == 0)
+		main_ctx->i_flags |= CW_F_ECHO;
+	if (do_exec)
+		main_ctx->i_flags |= CW_F_EXEC;
+	if (Cflg)
+		main_ctx->i_flags |= CW_F_CXX;
+	main_ctx->i_compiler = &primary;
+
+	if (cflg) {
+		(void) fputs(primary.c_path, stdout);
 	}
 
-	/*
-	 * -_versions - tell us the cw version, paths to all compilers, and
-	 *		ask each for its version if we know how.
-	 */
-	if (argc > 1 && strcmp(argv[1], "-_versions") == 0) {
-		(void) printf("cw version %s", CW_VERSION);
-		if (!do_shadow)
-			(void) printf(" (SHADOW MODE DISABLED)");
-		(void) printf("\n");
+	if (vflg) {
+		(void) printf("cw version %s\n", CW_VERSION);
 		(void) fflush(stdout);
-		ctx->i_flags &= ~CW_F_ECHO;
-		ctx->i_flags |= CW_F_PROG|CW_F_EXEC;
-		argc--;
-		argv++;
+		main_ctx->i_flags &= ~CW_F_ECHO;
+		main_ctx->i_flags |= CW_F_PROG | CW_F_EXEC;
 		do_serial = 1;
 	}
 
-	ctx->i_oldargc = argc;
-	ctx->i_oldargv = argv;
+	ret |= exec_ctx(main_ctx, do_serial);
 
-	ret |= exec_ctx(ctx, do_serial);
+	for (int i = 0; i < nshadows; i++) {
+		int r;
+		cw_ictx_t *shadow_ctx;
 
-	if (do_shadow) {
-		(void) memcpy(ctx_shadow, ctx, sizeof (cw_ictx_t));
-		ctx_shadow->i_flags |= CW_F_SHADOW;
-		ret |= exec_ctx(ctx_shadow, 1);
+		if ((shadow_ctx = newictx()) == NULL)
+			nomem();
+
+		memcpy(shadow_ctx, main_ctx, sizeof (cw_ictx_t));
+
+		shadow_ctx->i_flags |= CW_F_SHADOW;
+		shadow_ctx->i_compiler = &shadows[i];
+
+		r = exec_ctx(shadow_ctx, do_serial);
+		if (r == 0) {
+			shadow_ctx->i_next = main_ctx->i_next;
+			main_ctx->i_next = shadow_ctx;
+		}
+		ret |= r;
 	}
 
-	if (!do_serial)
-		ret |= reap(ctx);
+	if (!do_serial) {
+		cw_ictx_t *next = main_ctx;
+		while (next != NULL) {
+			cw_ictx_t *toreap = next;
+			next = next->i_next;
+			ret |= reap(toreap);
+		}
+	}
 
 	return (ret);
 }
diff --git a/usr/src/tools/env/illumos.sh b/usr/src/tools/env/illumos.sh
index 0b5234aa6d..bc223c4fd3 100644
--- a/usr/src/tools/env/illumos.sh
+++ b/usr/src/tools/env/illumos.sh
@@ -40,7 +40,7 @@
 #       checks for changes in ELF runpaths (-r)
 #       build and use this workspace's tools in $SRC/tools (-t)
 #
-# - This file is sourced by "bldenv.sh" and "nightly.sh" and should not 
+# - This file is sourced by "bldenv.sh" and "nightly.sh" and should not
 #   be executed directly.
 # - This script is only interpreted by ksh93 and explicitly allows the
 #   use of ksh93 language extensions.
@@ -61,7 +61,7 @@ function maxjobs
 
 	ncpu=$(builtin getconf ; getconf 'NPROCESSORS_ONLN')
 	(( maxjobs=ncpu + 2 ))
-	
+
 	# Throttle number of parallel jobs launched by dmake to a value which
 	# gurantees that all jobs have enough memory. This was added to avoid
 	# excessive paging/swapping in cases of virtual machine installations
@@ -76,7 +76,7 @@ function maxjobs
 		# the value matched by ([[:digit:]]+), i.e. the amount of
 		# memory installed
 		physical_memory="10#${.sh.match[1]}"
-		
+
 		((
 			max_jobs_per_memory=round(physical_memory/min_mem_per_job) ,
 			maxjobs=fmax(2, fmin(maxjobs, max_jobs_per_memory))
@@ -196,8 +196,33 @@ export BUILD_TOOLS='/opt'
 export SPRO_ROOT='/opt/SUNWspro'
 export SPRO_VROOT="$SPRO_ROOT"
 
-# Disable shadow compilation by default.
-export CW_NO_SHADOW='1'
+# Compilers may be specified using the following variables:
+# PRIMARY_CC	- primary C compiler
+# PRIMARY_CCC	- primary C++ compiler
+#
+# SHADOW_CCS    - list of shadow C compilers
+# SHADOW_CCCS	- list of shadow C++ compilers
+#
+# Each entry has the form <name>,<path to binary>,<style> where name is a
+# free-form name (possibly used in the makefiles to guard options), path is
+# the path to the executable.  style is the 'style' of command line taken by
+# the compiler, currently either gnu (or gcc) or sun (or cc), which is also
+# used by Makefiles to guard options.
+#
+# __SUNC and __GNUC must still be set to reflect the style of the primary
+# compiler (and to influence the default primary, otherwise)
+#
+# for example:
+# export PRIMARY_CC=gcc4,/opt/gcc/4.4.4/bin/gcc,gnu
+# export PRIMARY_CCC=gcc4,/opt/gcc/4.4.4/bin/g++,gnu
+# export SHADOW_CCS=studio12,/opt/SUNWspro/bin/cc,sun
+# export SHADOW_CCCS=studio12,/opt/SUNWspro/bin/CC,sun
+#
+# There can be several space-separated entries in SHADOW_* to run multiple
+# shadow compilers.
+#
+# To disable shadow compilation, unset SHADOW_* or set them to the empty string.
+#
 
 # This goes along with lint - it is a series of the form "A [y|n]" which
 # means "go to directory A and run 'make lint'" Then mail me (y) the
diff --git a/usr/src/tools/scripts/nightly.sh b/usr/src/tools/scripts/nightly.sh
index b2186e701b..cb863bc352 100644
--- a/usr/src/tools/scripts/nightly.sh
+++ b/usr/src/tools/scripts/nightly.sh
@@ -1674,7 +1674,7 @@ if [[ ! -f $SRC/Makefile ]]; then
 fi
 
 ( cd $SRC
-  for target in cc-version cc64-version java-version openssl-version; do
+  for target in cc-version java-version openssl-version; do
 	echo
 	#
 	# Put statefile somewhere we know we can write to rather than trip