[OS-714] illumos merge

Merge git://github.com/illumos/illumos-gate

Conflicts:
	usr/src/uts/common/inet/tcp/tcp_timers.c
	usr/src/uts/common/io/mac/mac_sched.c

17 files changed, 415 insertions, 72 deletions

diff --git a/usr/src/cmd/sendmail/src/Makefile b/usr/src/cmd/sendmail/src/Makefile
index 31513f702f..e171e139d3 100644
--- a/usr/src/cmd/sendmail/src/Makefile
+++ b/usr/src/cmd/sendmail/src/Makefile
@@ -19,6 +19,8 @@
 # CDDL HEADER END
 #
 
+# Copyright (c) 2011 Gary Mills
+
 #
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
@@ -34,8 +36,8 @@ include 	../Makefile.cmd
 OBJS= alias.o arpadate.o bf.o collect.o conf.o control.o convtime.o daemon.o \
 	deliver.o domain.o envelope.o err.o headers.o macro.o main.o map.o \
 	mci.o milter.o mime.o parseaddr.o queue.o ratectrl.o readcf.o \
-	recipient.o savemail.o sfsasl.o sm_resolve.o srvrsmtp.o stab.o stats.o \
-	sysexits.o tls.o trace.o udb.o usersmtp.o util.o version.o
+	recipient.o sasl.o savemail.o sfsasl.o sm_resolve.o srvrsmtp.o stab.o \
+	stats.o sysexits.o tls.o trace.o udb.o usersmtp.o util.o version.o
 
 SRCS=	$(OBJS:%.o=%.c)
 
@@ -43,7 +45,7 @@ MAPFILES =	$(MAPFILE.INT) $(MAPFILE.NGB)
 LDFLAGS +=	$(MAPFILES:%=-M%)
 
 # EXPORT DELETE START
-CRYPTOLIBS=	-lssl -lcrypto
+CRYPTOLIBS=	-lssl -lcrypto -lsasl
 # EXPORT DELETE END
 LDLIBS += 	../libsmutil/libsmutil.a ../libsm/libsm.a -lresolv -lsocket \
 		-lnsl ../db/libdb.a -lldap -lsldap -lwrap -lumem \
@@ -52,7 +54,7 @@ LDLIBS += 	../libsmutil/libsmutil.a ../libsm/libsm.a -lresolv -lsocket \
 INCPATH=	-I. -I../include -I../db
 
 # EXPORT DELETE START
-CRYPTOENVDEF=	-DSTARTTLS
+CRYPTOENVDEF=	-DSTARTTLS -DSASL=20115
 # EXPORT DELETE END
 ENVDEF=		-DNETINET6 -DTCPWRAPPERS $(CRYPTOENVDEF)
 SUNENVDEF=	-DSUN_EXTENSIONS -DVENDOR_DEFAULT=VENDOR_SUN \
diff --git a/usr/src/cmd/sendmail/src/sasl.c b/usr/src/cmd/sendmail/src/sasl.c
new file mode 100644
index 0000000000..6f9e4a50df
--- /dev/null
+++ b/usr/src/cmd/sendmail/src/sasl.c
@@ -0,0 +1,287 @@
+/*
+ * Copyright (c) 2001-2002 Sendmail, Inc. and its suppliers.
+ *	All rights reserved.
+ *
+ * By using this file, you agree to the terms and conditions set
+ * forth in the LICENSE file which can be found at the top level of
+ * the sendmail distribution.
+ *
+ */
+
+#include <sm/gen.h>
+SM_RCSID("@(#)$Id: sasl.c,v 8.22 2006/08/15 23:24:57 ca Exp $")
+
+#if SASL
+# include <stdlib.h>
+# include <sendmail.h>
+# include <errno.h>
+
+/*
+**  In order to ensure that storage leaks are tracked, and to prevent
+**  conflicts between the sm_heap package and sasl, we tell sasl to
+**  use the following heap allocation functions.  Unfortunately,
+**  the sasl package incorrectly specifies the size of a block
+**  using unsigned long: for portability, it should be size_t.
+*/
+
+void *sm_sasl_malloc __P((unsigned long));
+static void *sm_sasl_calloc __P((unsigned long, unsigned long));
+static void *sm_sasl_realloc __P((void *, unsigned long));
+void sm_sasl_free __P((void *));
+
+/*
+**  SASLv1:
+**  We can't use an rpool for Cyrus-SASL memory management routines,
+**	since the encryption/decryption routines in Cyrus-SASL
+**	allocate/deallocate a buffer each time. Since rpool
+**	don't release memory until the very end, memory consumption is
+**	proportional to the size of an e-mail, which is unacceptable.
+*/
+
+/*
+**  SM_SASL_MALLOC -- malloc() for SASL
+**
+**	Parameters:
+**		size -- size of requested memory.
+**
+**	Returns:
+**		pointer to memory.
+*/
+
+void *
+sm_sasl_malloc(size)
+	unsigned long size;
+{
+	return sm_malloc((size_t) size);
+}
+
+/*
+**  SM_SASL_CALLOC -- calloc() for SASL
+**
+**	Parameters:
+**		nelem -- number of elements.
+**		elemsize -- size of each element.
+**
+**	Returns:
+**		pointer to memory.
+**
+**	Notice:
+**		this isn't currently used by SASL.
+*/
+
+static void *
+sm_sasl_calloc(nelem, elemsize)
+	unsigned long nelem;
+	unsigned long elemsize;
+{
+	size_t size;
+	void *p;
+
+	size = (size_t) nelem * (size_t) elemsize;
+	p = sm_malloc(size);
+	if (p == NULL)
+		return NULL;
+	memset(p, '\0', size);
+	return p;
+}
+
+/*
+**  SM_SASL_REALLOC -- realloc() for SASL
+**
+**	Parameters:
+**		p -- pointer to old memory.
+**		size -- size of requested memory.
+**
+**	Returns:
+**		pointer to new memory.
+*/
+
+static void *
+sm_sasl_realloc(o, size)
+	void *o;
+	unsigned long size;
+{
+	return sm_realloc(o, (size_t) size);
+}
+
+/*
+**  SM_SASL_FREE -- free() for SASL
+**
+**	Parameters:
+**		p -- pointer to free.
+**
+**	Returns:
+**		none
+*/
+
+void
+sm_sasl_free(p)
+	void *p;
+{
+	sm_free(p);
+}
+
+/*
+**  SM_SASL_INIT -- sendmail specific SASL initialization
+**
+**	Parameters:
+**		none.
+**
+**	Returns:
+**		none
+**
+**	Side Effects:
+**		installs memory management routines for SASL.
+*/
+
+void
+sm_sasl_init()
+{
+	sasl_set_alloc(sm_sasl_malloc, sm_sasl_calloc,
+		       sm_sasl_realloc, sm_sasl_free);
+}
+/*
+**  INTERSECT -- create the intersection between two lists
+**
+**	Parameters:
+**		s1, s2 -- lists of items (separated by single blanks).
+**		rpool -- resource pool from which result is allocated.
+**
+**	Returns:
+**		the intersection of both lists.
+*/
+
+char *
+intersect(s1, s2, rpool)
+	char *s1, *s2;
+	SM_RPOOL_T *rpool;
+{
+	char *hr, *h1, *h, *res;
+	int l1, l2, rl;
+
+	if (s1 == NULL || s2 == NULL)	/* NULL string(s) -> NULL result */
+		return NULL;
+	l1 = strlen(s1);
+	l2 = strlen(s2);
+	rl = SM_MIN(l1, l2);
+	res = (char *) sm_rpool_malloc(rpool, rl + 1);
+	if (res == NULL)
+		return NULL;
+	*res = '\0';
+	if (rl == 0)	/* at least one string empty? */
+		return res;
+	hr = res;
+	h1 = s1;
+	h = s1;
+
+	/* walk through s1 */
+	while (h != NULL && *h1 != '\0')
+	{
+		/* is there something after the current word? */
+		if ((h = strchr(h1, ' ')) != NULL)
+			*h = '\0';
+		l1 = strlen(h1);
+
+		/* does the current word appear in s2 ? */
+		if (iteminlist(h1, s2, " ") != NULL)
+		{
+			/* add a blank if not first item */
+			if (hr != res)
+				*hr++ = ' ';
+
+			/* copy the item */
+			memcpy(hr, h1, l1);
+
+			/* advance pointer in result list */
+			hr += l1;
+			*hr = '\0';
+		}
+		if (h != NULL)
+		{
+			/* there are more items */
+			*h = ' ';
+			h1 = h + 1;
+		}
+	}
+	return res;
+}
+# if SASL >= 20000
+/*
+**  IPTOSTRING -- create string for SASL_IP*PORT property
+**		(borrowed from lib/iptostring.c in Cyrus-IMAP)
+**
+**	Parameters:
+**		addr -- (pointer to) socket address
+**		addrlen -- length of socket address
+**		out -- output string (result)
+**		outlen -- maximum length of output string
+**
+**	Returns:
+**		true iff successful.
+**
+**	Side Effects:
+**		creates output string if successful.
+**		sets errno if unsuccessful.
+*/
+
+#  include <arpa/inet.h>
+
+#  ifndef NI_MAXHOST
+#   define NI_MAXHOST	1025
+#  endif
+#  ifndef NI_MAXSERV
+#   define NI_MAXSERV	32
+#  endif
+
+bool
+iptostring(addr, addrlen, out, outlen)
+	SOCKADDR *addr;
+	SOCKADDR_LEN_T addrlen;
+	char *out;
+	unsigned outlen;
+{
+	char hbuf[NI_MAXHOST], pbuf[NI_MAXSERV];
+#  if NETINET6
+	int niflags;
+#  endif /* NETINET6 */
+
+	if (addr == NULL || out == NULL)
+	{
+		errno = EINVAL;
+		return false;
+	}
+
+#  if NETINET6
+	niflags = (NI_NUMERICHOST | NI_NUMERICSERV);
+#   ifdef NI_WITHSCOPEID
+	if (addr->sa.sa_family == AF_INET6)
+		niflags |= NI_WITHSCOPEID;
+#   endif /* NI_WITHSCOPEID */
+	if (getnameinfo((struct sockaddr *) addr, addrlen,
+			hbuf, sizeof(hbuf), pbuf, sizeof(pbuf), niflags) != 0)
+		return false;
+#  else /* NETINET6 */
+	if (addr->sa.sa_family != AF_INET)
+	{
+		errno = EINVAL;
+		return false;
+	}
+	if (sm_strlcpy(hbuf, inet_ntoa(addr->sin.sin_addr), sizeof(hbuf))
+	    >= sizeof(hbuf))
+	{
+		errno = ENOMEM;
+		return false;
+	}
+	sm_snprintf(pbuf, sizeof(pbuf), "%d", ntohs(addr->sin.sin_port));
+#  endif /* NETINET6 */
+
+	if (outlen < strlen(hbuf) + strlen(pbuf) + 2)
+	{
+		errno = ENOMEM;
+		return false;
+	}
+	sm_snprintf(out, outlen, "%s;%s", hbuf, pbuf);
+	return true;
+}
+# endif /* SASL >= 20000 */
+#endif /* SASL */
diff --git a/usr/src/cmd/tr/str.c b/usr/src/cmd/tr/str.c
index 6219e7819c..40d8ae44ad 100644
--- a/usr/src/cmd/tr/str.c
+++ b/usr/src/cmd/tr/str.c
@@ -82,10 +82,8 @@ next(s)
 		default:
 			clen = mbrtowc(&wch, s->str, MB_LEN_MAX, NULL);
 			if (clen == (size_t)-1 || clen == (size_t)-2 ||
-			    clen == 0) {
-				(void) fprintf(stderr, "Illegal seqeunce.\n");
-				exit(1);
-			}
+			    clen == 0)
+				errx(1, "illegal sequence");
 			is_octal = 0;
 			s->lastch = wch;
 			s->str += clen;
diff --git a/usr/src/lib/smbsrv/libsmb/common/smb_lgrp.c b/usr/src/lib/smbsrv/libsmb/common/smb_lgrp.c
index 8435a20c32..406d7c5db0 100644
--- a/usr/src/lib/smbsrv/libsmb/common/smb_lgrp.c
+++ b/usr/src/lib/smbsrv/libsmb/common/smb_lgrp.c
@@ -1104,16 +1104,21 @@ smb_lgrp_start(void)
 	(void) mutex_unlock(&smb_localgrp.lg_mutex);
 
 	for (i = 0; i < ngrp; i++) {
+		char	*tname;
+
 		if ((wka = smb_wka_lookup_name(builtin[i])) == NULL)
 			continue;
 
-		if (!smb_lgrp_exists(wka->wka_name)) {
-			rc = smb_lgrp_add(wka->wka_name, wka->wka_desc);
+		if ((tname = strdup(wka->wka_name)) == NULL)
+			return (SMB_LGRP_NO_MEMORY);
+		if (!smb_lgrp_exists(tname)) {
+			rc = smb_lgrp_add(tname, wka->wka_desc);
 			if (rc != SMB_LGRP_SUCCESS) {
 				syslog(LOG_DEBUG, "failed to add %s",
-				    wka->wka_name);
+				    tname);
 			}
 		}
+		free(tname);
 	}
 
 	return (SMB_LGRP_SUCCESS);
diff --git a/usr/src/lib/smbsrv/libsmbns/common/smbns_ads.c b/usr/src/lib/smbsrv/libsmbns/common/smbns_ads.c
index 0dbde7ff3d..5626d270ab 100644
--- a/usr/src/lib/smbsrv/libsmbns/common/smbns_ads.c
+++ b/usr/src/lib/smbsrv/libsmbns/common/smbns_ads.c
@@ -2217,7 +2217,7 @@ smb_ads_join(char *domain, char *user, char *usr_passwd, char *machine_passwd,
 	int dclevel, num, usrctl_flags = 0;
 	smb_ads_qstat_t qstat;
 	char dn[SMB_ADS_DN_MAX];
-	char *tmpfile;
+	char tmpfile[] = SMBNS_KRB5_KEYTAB_TMP;
 	int cnt;
 	smb_krb5_pn_set_t spns;
 
@@ -2332,9 +2332,10 @@ smb_ads_join(char *domain, char *user, char *usr_passwd, char *machine_passwd,
 		goto adjoin_cleanup;
 	}
 
-	tmpfile = mktemp(SMBNS_KRB5_KEYTAB_TMP);
-	if (tmpfile == NULL)
-		tmpfile = SMBNS_KRB5_KEYTAB_TMP;
+	if (mktemp(tmpfile) == NULL) {
+		rc = SMB_ADJOIN_ERR_WRITE_KEYTAB;
+		goto adjoin_cleanup;
+	}
 
 	encptr = smb_ads_get_enctypes(dclevel, &num);
 	if (smb_krb5_kt_populate(ctx, ah->domain, krb5princs, cnt,
diff --git a/usr/src/man/man1m/zfs.1m b/usr/src/man/man1m/zfs.1m
index 8a8e9e59ca..1548d0b148 100644
--- a/usr/src/man/man1m/zfs.1m
+++ b/usr/src/man/man1m/zfs.1m
@@ -7,6 +7,7 @@
 .\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
 .\" Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
 .\" Copyright 2011 by Delphix.  All rights reserved.
+.\" Copyright 2011 Joshua M. Clulow <josh@sysmgr.org>
 .TH ZFS 1M "28 Jul 2011"
 .SH NAME
 zfs \- configures ZFS file systems
@@ -154,7 +155,7 @@ zfs \- configures ZFS file systems
 
 .LP
 .nf
-\fBzfs\fR \fBreceive\fR [\fB-vnFu\fR] \fB-d\fR \fIfilesystem\fR
+\fBzfs\fR \fBreceive\fR [\fB-vnFu\fR] [\fB-d\fR|\fB-e\fR] \fIfilesystem\fR
 .fi
 
 .LP
@@ -2862,7 +2863,7 @@ on future versions of \fBZFS\fR.
 .ad
 .br
 .na
-\fB\fBzfs receive\fR [\fB-vnFu\fR] \fB-d\fR \fIfilesystem\fR\fR
+\fB\fBzfs receive\fR [\fB-vnFu\fR] [\fB-d\fR|\fB-e\fR] \fIfilesystem\fR\fR
 .ad
 .sp .6
 .RS 4n
@@ -2884,15 +2885,23 @@ on the sending location are destroyed by using the \fBzfs destroy\fR \fB-d\fR
 command.
 .sp
 The name of the snapshot (and file system, if a full stream is received) that
-this subcommand creates depends on the argument type and the \fB-d\fR option.
+this subcommand creates depends on the argument type and the use of the
+\fB-d\fR or \fB-e\fR options.
 .sp
 If the argument is a snapshot name, the specified \fIsnapshot\fR is created. If
 the argument is a file system or volume name, a snapshot with the same name as
 the sent snapshot is created within the specified \fIfilesystem\fR or
-\fIvolume\fR. If the \fB-d\fR option is specified, the snapshot name is
-determined by appending the sent snapshot's name to the specified
-\fIfilesystem\fR. If the \fB-d\fR option is specified, any required file
-systems within the specified one are created.
+\fIvolume\fR.  If neither of the \fB-d\fR or \fB-e\fR options are specified,
+the provided target snapshot name is used exactly as provided.
+.sp
+The \fB-d\fR and \fB-e\fR options cause the file system name of the target
+snapshot to be determined by appending a portion of the sent snapshot's name to
+the specified target \fIfilesystem\fR. If the \fB-d\fR option is specified, all
+but the first element of the sent snapshot's file system path (usually the
+pool name) is used and any required intermediate file systems within the
+specified one are created.  If the \fB-e\fR option is specified, then only the
+last element of the sent snapshot's file system name (i.e. the name of the
+source file system itself) is used as the target file system name.
 .sp
 .ne 2
 .na
@@ -2900,8 +2909,21 @@ systems within the specified one are created.
 .ad
 .sp .6
 .RS 4n
-Use the name of the sent snapshot to determine the name of the new snapshot as
-described in the paragraph above.
+Discard the first element of the sent snapshot's file system name, using
+the remaining elements to determine the name of the target file system for
+the new snapshot as described in the paragraph above.
+.RE
+
+.sp
+.ne 2
+.na
+\fB\fB-e\fR\fR
+.ad
+.sp .6
+.RS 4n
+Discard all but the last element of the sent snapshot's file system name,
+using that element to determine the name of the target file system for
+the new snapshot as described in the paragraph above.
 .RE
 
 .sp
diff --git a/usr/src/man/man3c/mktemp.3c b/usr/src/man/man3c/mktemp.3c
index 2a280330cd..ea14551e0d 100644
--- a/usr/src/man/man3c/mktemp.3c
+++ b/usr/src/man/man3c/mktemp.3c
@@ -32,8 +32,8 @@ created for each unique \fItemplate\fR.
 .SH RETURN VALUES
 .sp
 .LP
-The \fBmktemp()\fR function returns the pointer \fItemplate\fR. If a unique
-name cannot be created, \fItemplate\fR points to a null string.
+The \fBmktemp()\fR function returns a pointer to the \fItemplate\fR on success
+and \fBNULL\fR if unique name cannot be created.
 .SH ERRORS
 .sp
 .LP
@@ -52,7 +52,7 @@ pointer to the "template" string that contains the new filename.
 .nf
 #include <stdlib.h>
 \&...
-char *template = "/tmp/fileXXXXXX";
+char template[] = "/tmp/fileXXXXXX";
 char *ptr;
 ptr = mktemp(template);
 .fi
diff --git a/usr/src/man/man3tecla/gl_get_line.3tecla b/usr/src/man/man3tecla/gl_get_line.3tecla
index 4d0cfd0e8c..f85a1ed7e6 100644
--- a/usr/src/man/man3tecla/gl_get_line.3tecla
+++ b/usr/src/man/man3tecla/gl_get_line.3tecla
@@ -942,7 +942,7 @@ Resume command-line editing.
 .LP
 Note that the \fIname\fR argument of \fBgl_register_action()\fR specifies the
 name by which a user can refer to the action in their configuration file. This
-allows them to re-bind the action to an alternate key-seqeunce. In order for
+allows them to re-bind the action to an alternate key-sequence. In order for
 this to work, it is necessary to call \fBgl_register_action()\fR between
 calling \fBnew_GetLine()\fR and the first call to \fBgl_get_line()\fR.
 .SS "History Files"
diff --git a/usr/src/uts/common/disp/cmt.c b/usr/src/uts/common/disp/cmt.c
index 3aa3b67e29..7e46509fce 100644
--- a/usr/src/uts/common/disp/cmt.c
+++ b/usr/src/uts/common/disp/cmt.c
@@ -1263,6 +1263,9 @@ cmt_pad_enable(pghw_type_t type)
 	ASSERT(PGHW_IS_PM_DOMAIN(type));
 	ASSERT(MUTEX_HELD(&cpu_lock));
 
+	if (cmt_sched_disabled == 1)
+		return (-1);
+
 	if ((hwset = pghw_set_lookup(type)) == NULL ||
 	    cmt_hw_blacklisted[type]) {
 		/*
@@ -1313,6 +1316,9 @@ cmt_pad_disable(pghw_type_t type)
 	ASSERT(PGHW_IS_PM_DOMAIN(type));
 	ASSERT(MUTEX_HELD(&cpu_lock));
 
+	if (cmt_sched_disabled == 1)
+		return (-1);
+
 	if ((hwset = pghw_set_lookup(type)) == NULL) {
 		/*
 		 * Unable to find any instances of the specified type of
diff --git a/usr/src/uts/common/fs/smbsrv/smb_tree.c b/usr/src/uts/common/fs/smbsrv/smb_tree.c
index 24dd27cdc5..a31b536236 100644
--- a/usr/src/uts/common/fs/smbsrv/smb_tree.c
+++ b/usr/src/uts/common/fs/smbsrv/smb_tree.c
@@ -232,7 +232,7 @@ smb_tree_connect_core(smb_request_t *sr)
 	(void) smb_strlwr(unc_path);
 
 	if ((name = smb_tree_get_sharename(unc_path)) == NULL) {
-		smb_tree_log(sr, name, "invalid UNC path");
+		smb_tree_log(sr, unc_path, "invalid UNC path");
 		smbsr_error(sr, 0, ERRSRV, ERRinvnetname);
 		return (NULL);
 	}
diff --git a/usr/src/uts/common/inet/tcp/tcp_timers.c b/usr/src/uts/common/inet/tcp/tcp_timers.c
index a18c7dd8b1..6dbf02a9e5 100644
--- a/usr/src/uts/common/inet/tcp/tcp_timers.c
+++ b/usr/src/uts/common/inet/tcp/tcp_timers.c
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved.
+ * Copyright 2011 Joyent, Inc.  All rights reserved.
  */
 
 #include <sys/types.h>
@@ -250,8 +251,11 @@ tcp_timeout_cancel(conn_t *connp, timeout_id_t id)
 		/*
 		 * If we were unable to untimeout successfully, it has already
 		 * been enqueued on the squeue; mark the ID with the free
-		 * bit.  This bit can never be set in a valid identifier, and
+		 * bit.	 This bit can never be set in a valid identifier, and
 		 * we'll use it to prevent the timeout from being executed.
+		 * And note that we're within the squeue perimeter here, so
+		 * we don't need to worry about racing with timer handling
+		 * (which also executes within the perimeter).
 		 */
 		tcpt->tcpt_tid |= CALLOUT_ID_FREE;
 		delta = 0;
diff --git a/usr/src/uts/common/io/dld/dld_proto.c b/usr/src/uts/common/io/dld/dld_proto.c
index 2fba6f2a25..3ef3ce1eaf 100644
--- a/usr/src/uts/common/io/dld/dld_proto.c
+++ b/usr/src/uts/common/io/dld/dld_proto.c
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2012, Nexenta Systems, Inc. All rights reserved.
  */
 
 /*
@@ -573,7 +574,7 @@ proto_promiscon_req(dld_str_t *dsp, mblk_t *mp)
 	dl_promiscon_req_t *dlp = (dl_promiscon_req_t *)mp->b_rptr;
 	int		err = 0;
 	t_uscalar_t	dl_err;
-	uint32_t	promisc_saved;
+	uint32_t	new_flags, promisc_saved;
 	queue_t		*q = dsp->ds_wq;
 	mac_perim_handle_t	mph;
 
@@ -588,18 +589,20 @@ proto_promiscon_req(dld_str_t *dsp, mblk_t *mp)
 		goto failed;
 	}
 
-	promisc_saved = dsp->ds_promisc;
+	mac_perim_enter_by_mh(dsp->ds_mh, &mph);
+
+	new_flags = promisc_saved = dsp->ds_promisc;
 	switch (dlp->dl_level) {
 	case DL_PROMISC_SAP:
-		dsp->ds_promisc |= DLS_PROMISC_SAP;
+		new_flags |= DLS_PROMISC_SAP;
 		break;
 
 	case DL_PROMISC_MULTI:
-		dsp->ds_promisc |= DLS_PROMISC_MULTI;
+		new_flags |= DLS_PROMISC_MULTI;
 		break;
 
 	case DL_PROMISC_PHYS:
-		dsp->ds_promisc |= DLS_PROMISC_PHYS;
+		new_flags |= DLS_PROMISC_PHYS;
 		break;
 
 	default:
@@ -607,10 +610,8 @@ proto_promiscon_req(dld_str_t *dsp, mblk_t *mp)
 		goto failed;
 	}
 
-	mac_perim_enter_by_mh(dsp->ds_mh, &mph);
-
 	if ((promisc_saved == 0) && (err = dls_active_set(dsp)) != 0) {
-		dsp->ds_promisc = promisc_saved;
+		ASSERT(dsp->ds_promisc == promisc_saved);
 		dl_err = DL_SYSERR;
 		goto failed2;
 	}
@@ -618,7 +619,7 @@ proto_promiscon_req(dld_str_t *dsp, mblk_t *mp)
 	/*
 	 * Adjust channel promiscuity.
 	 */
-	err = dls_promisc(dsp, promisc_saved);
+	err = dls_promisc(dsp, new_flags);
 
 	if (err != 0) {
 		dl_err = DL_SYSERR;
@@ -648,7 +649,7 @@ proto_promiscoff_req(dld_str_t *dsp, mblk_t *mp)
 	dl_promiscoff_req_t *dlp = (dl_promiscoff_req_t *)mp->b_rptr;
 	int		err = 0;
 	t_uscalar_t	dl_err;
-	uint32_t	promisc_saved;
+	uint32_t	new_flags;
 	queue_t		*q = dsp->ds_wq;
 	mac_perim_handle_t	mph;
 
@@ -663,14 +664,16 @@ proto_promiscoff_req(dld_str_t *dsp, mblk_t *mp)
 		goto failed;
 	}
 
-	promisc_saved = dsp->ds_promisc;
+	mac_perim_enter_by_mh(dsp->ds_mh, &mph);
+
+	new_flags = dsp->ds_promisc;
 	switch (dlp->dl_level) {
 	case DL_PROMISC_SAP:
 		if (!(dsp->ds_promisc & DLS_PROMISC_SAP)) {
 			dl_err = DL_NOTENAB;
 			goto failed;
 		}
-		dsp->ds_promisc &= ~DLS_PROMISC_SAP;
+		new_flags &= ~DLS_PROMISC_SAP;
 		break;
 
 	case DL_PROMISC_MULTI:
@@ -678,7 +681,7 @@ proto_promiscoff_req(dld_str_t *dsp, mblk_t *mp)
 			dl_err = DL_NOTENAB;
 			goto failed;
 		}
-		dsp->ds_promisc &= ~DLS_PROMISC_MULTI;
+		new_flags &= ~DLS_PROMISC_MULTI;
 		break;
 
 	case DL_PROMISC_PHYS:
@@ -686,7 +689,7 @@ proto_promiscoff_req(dld_str_t *dsp, mblk_t *mp)
 			dl_err = DL_NOTENAB;
 			goto failed;
 		}
-		dsp->ds_promisc &= ~DLS_PROMISC_PHYS;
+		new_flags &= ~DLS_PROMISC_PHYS;
 		break;
 
 	default:
@@ -694,11 +697,10 @@ proto_promiscoff_req(dld_str_t *dsp, mblk_t *mp)
 		goto failed;
 	}
 
-	mac_perim_enter_by_mh(dsp->ds_mh, &mph);
 	/*
 	 * Adjust channel promiscuity.
 	 */
-	err = dls_promisc(dsp, promisc_saved);
+	err = dls_promisc(dsp, new_flags);
 
 	if (err != 0) {
 		mac_perim_exit(mph);
@@ -706,6 +708,7 @@ proto_promiscoff_req(dld_str_t *dsp, mblk_t *mp)
 		goto failed;
 	}
 
+	ASSERT(dsp->ds_promisc == new_flags);
 	if (dsp->ds_promisc == 0)
 		dls_active_clear(dsp, B_FALSE);
 
diff --git a/usr/src/uts/common/io/dls/dls.c b/usr/src/uts/common/io/dls/dls.c
index e2367f9e4a..d35c1e4bbf 100644
--- a/usr/src/uts/common/io/dls/dls.c
+++ b/usr/src/uts/common/io/dls/dls.c
@@ -21,6 +21,7 @@
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2012, Nexenta Systems, Inc. All rights reserved.
  */
 
 /*
@@ -86,7 +87,6 @@ dls_close(dld_str_t *dsp)
 	dls_link_t		*dlp = dsp->ds_dlp;
 	dls_multicst_addr_t	*p;
 	dls_multicst_addr_t	*nextp;
-	uint32_t		old_flags;
 
 	ASSERT(dsp->ds_datathr_cnt == 0);
 	ASSERT(MAC_PERIM_HELD(dsp->ds_mh));
@@ -123,9 +123,7 @@ dls_close(dld_str_t *dsp)
 	 * If the MAC has been set in promiscuous mode then disable it.
 	 * This needs to be done before resetting ds_rx.
 	 */
-	old_flags = dsp->ds_promisc;
-	dsp->ds_promisc = 0;
-	(void) dls_promisc(dsp, old_flags);
+	(void) dls_promisc(dsp, 0);
 
 	/*
 	 * At this point we have cutoff inbound packet flow from the mac
@@ -238,51 +236,60 @@ dls_unbind(dld_str_t *dsp)
 	dsp->ds_sap = 0;
 }
 
+/*
+ * In order to prevent promiscuous-mode processing with dsp->ds_promisc
+ * set to inaccurate values, this function sets dsp->ds_promisc with new
+ * flags.  For enabling (mac_promisc_add), the flags are set prior to the
+ * actual enabling.  For disabling (mac_promisc_remove), the flags are set
+ * after the actual disabling.
+ */
 int
-dls_promisc(dld_str_t *dsp, uint32_t old_flags)
+dls_promisc(dld_str_t *dsp, uint32_t new_flags)
 {
-	int		err = 0;
+	int err = 0;
+	uint32_t old_flags = dsp->ds_promisc;
 
 	ASSERT(MAC_PERIM_HELD(dsp->ds_mh));
-	ASSERT(!(dsp->ds_promisc & ~(DLS_PROMISC_SAP | DLS_PROMISC_MULTI |
+	ASSERT(!(new_flags & ~(DLS_PROMISC_SAP | DLS_PROMISC_MULTI |
 	    DLS_PROMISC_PHYS)));
 
-	if (old_flags == 0 && dsp->ds_promisc != 0) {
+	if (dsp->ds_promisc == 0 && new_flags != 0) {
 		/*
 		 * If only DLS_PROMISC_SAP, we don't turn on the
 		 * physical promisc mode
 		 */
+		dsp->ds_promisc = new_flags;
 		err = mac_promisc_add(dsp->ds_mch, MAC_CLIENT_PROMISC_ALL,
 		    dls_rx_promisc, dsp, &dsp->ds_mph,
-		    (dsp->ds_promisc != DLS_PROMISC_SAP) ? 0 :
+		    (new_flags != DLS_PROMISC_SAP) ? 0 :
 		    MAC_PROMISC_FLAGS_NO_PHYS);
-		if (err != 0)
+		if (err != 0) {
+			dsp->ds_promisc = old_flags;
 			return (err);
+		}
 
 		/* Remove vlan promisc handle to avoid sending dup copy up */
 		if (dsp->ds_vlan_mph != NULL) {
 			mac_promisc_remove(dsp->ds_vlan_mph);
 			dsp->ds_vlan_mph = NULL;
 		}
-	} else if (old_flags != 0 && dsp->ds_promisc == 0) {
+	} else if (dsp->ds_promisc != 0 && new_flags == 0) {
 		ASSERT(dsp->ds_mph != NULL);
 
 		mac_promisc_remove(dsp->ds_mph);
+		dsp->ds_promisc = new_flags;
 		dsp->ds_mph = NULL;
 
 		if (dsp->ds_sap == ETHERTYPE_VLAN &&
 		    dsp->ds_dlstate != DL_UNBOUND) {
-			int err;
-
 			if (dsp->ds_vlan_mph != NULL)
 				return (EINVAL);
 			err = mac_promisc_add(dsp->ds_mch,
 			    MAC_CLIENT_PROMISC_ALL, dls_rx_vlan_promisc, dsp,
 			    &dsp->ds_vlan_mph, MAC_PROMISC_FLAGS_NO_PHYS);
-			return (err);
 		}
-	} else if (old_flags == DLS_PROMISC_SAP && dsp->ds_promisc != 0 &&
-	    dsp->ds_promisc != old_flags) {
+	} else if (dsp->ds_promisc == DLS_PROMISC_SAP && new_flags != 0 &&
+	    new_flags != dsp->ds_promisc) {
 		/*
 		 * If the old flag is PROMISC_SAP, but the current flag has
 		 * changed to some new non-zero value, we need to turn the
@@ -290,8 +297,15 @@ dls_promisc(dld_str_t *dsp, uint32_t old_flags)
 		 */
 		ASSERT(dsp->ds_mph != NULL);
 		mac_promisc_remove(dsp->ds_mph);
+		/* Honors both after-remove and before-add semantics! */
+		dsp->ds_promisc = new_flags;
 		err = mac_promisc_add(dsp->ds_mch, MAC_CLIENT_PROMISC_ALL,
 		    dls_rx_promisc, dsp, &dsp->ds_mph, 0);
+		if (err != 0)
+			dsp->ds_promisc = old_flags;
+	} else {
+		/* No adding or removing, but record the new flags anyway. */
+		dsp->ds_promisc = new_flags;
 	}
 
 	return (err);
diff --git a/usr/src/uts/common/io/mac/mac_sched.c b/usr/src/uts/common/io/mac/mac_sched.c
index f1fb0420b1..06a5ac8cbf 100644
--- a/usr/src/uts/common/io/mac/mac_sched.c
+++ b/usr/src/uts/common/io/mac/mac_sched.c
@@ -430,15 +430,16 @@ int mac_srs_worker_wakeup_ticks = 0;
  * dynamically tuned in the field if and as needed.
  */
 static uintptr_t mac_rx_srs_stack_needed = 10240;
-static int mac_rx_srs_stack_toodeep;
+static uint_t mac_rx_srs_stack_toodeep;
 
 #ifndef STACK_GROWTH_DOWN
 #error Downward stack growth assumed.
 #endif
 
 #define	MAC_RX_SRS_TOODEEP() (STACK_BIAS + (uintptr_t)getfp() - \
-	    (uintptr_t)curthread->t_stkbase < mac_rx_srs_stack_needed && \
-	    ++mac_rx_srs_stack_toodeep)
+	(uintptr_t)curthread->t_stkbase < mac_rx_srs_stack_needed && \
+	++mac_rx_srs_stack_toodeep)
+
 
 /*
  * Drop the rx packet and advance to the next one in the chain.
@@ -2531,9 +2532,9 @@ mac_rx_srs_process(void *arg, mac_resource_handle_t srs, mblk_t *mp_chain,
 
 	if (!(mac_srs->srs_state & SRS_PROC)) {
 		/*
-		 * If we are coming via loopback or if we are not optimizing
-		 * for latency or if our stack is running deep, we should
-		 * signal the worker thread.
+		 * If we are coming via loopback, if we are not optimizing for
+		 * latency, or if our stack is running deep, we should signal
+		 * the worker thread.
 		 */
 		if (loopback || !(mac_srs->srs_state & SRS_LATENCY_OPT) ||
 		    MAC_RX_SRS_TOODEEP()) {
diff --git a/usr/src/uts/common/io/sata/impl/sata.c b/usr/src/uts/common/io/sata/impl/sata.c
index d6229aa9c5..90ff93a284 100644
--- a/usr/src/uts/common/io/sata/impl/sata.c
+++ b/usr/src/uts/common/io/sata/impl/sata.c
@@ -18451,7 +18451,7 @@ sata_process_port_failed_event(sata_hba_inst_t *sata_hba_inst,
 
 /*
  * Device Reset Event processing.
- * The seqeunce is managed by 3 stage flags:
+ * The sequence is managed by 3 stage flags:
  * - reset event reported,
  * - reset event being processed,
  * - request to clear device reset state.
diff --git a/usr/src/uts/intel/io/intel_nb5000/nb5000.h b/usr/src/uts/intel/io/intel_nb5000/nb5000.h
index 6af11ea0b1..266d0d0c4a 100644
--- a/usr/src/uts/intel/io/intel_nb5000/nb5000.h
+++ b/usr/src/uts/intel/io/intel_nb5000/nb5000.h
@@ -68,8 +68,8 @@ extern "C" {
 #define	TLOW_MAX	0x100000000ULL
 
 #define	MTR_PRESENT(mtr) \
-	((mtr) & (nb_chipset == INTEL_NB_5400 || nb_chipset == INTEL_NB_5100 ? \
-	0x0400 : 0x0100))
+	(((mtr) & (nb_chipset == INTEL_NB_5400 || nb_chipset == INTEL_NB_5100) \
+	? 0x0400 : 0x0100) != 0)
 #define	MTR_ETHROTTLE(mtr) \
 	((mtr) & (nb_chipset == INTEL_NB_5400 || nb_chipset == INTEL_NB_5100 ? \
 	? 0x0200 : 0x0080))
diff --git a/usr/src/uts/intel/io/intel_nb5000/nb5000_init.c b/usr/src/uts/intel/io/intel_nb5000/nb5000_init.c
index 752a90c048..e3afa38bb8 100644
--- a/usr/src/uts/intel/io/intel_nb5000/nb5000_init.c
+++ b/usr/src/uts/intel/io/intel_nb5000/nb5000_init.c
@@ -389,7 +389,7 @@ nb_dimm_present(int channel, int dimm)
 			return (B_FALSE);
 		rc = (t & 0xf) == SPD_DDR2;
 	} else {
-		rc = MTR_PRESENT(MTR_RD(channel, dimm)) != 0;
+		rc = MTR_PRESENT(MTR_RD(channel, dimm));
 	}
 
 	return (rc);