[illumos-gate merge]release-20220224

commit f24fee035ef9b37d5a6868aed10261da6316a6b2
    14536 bhyve: viona uses wrong address for queue notify ioport
commit 8cbaa6a809af7f43b3da2420c9d29a3507893284
    14430 simplify bhyve vatpit
commit c5613aaa46cccb3791fcd4cf94667878c3ee155e
    14523 ficl: remove temporary warning gags
commit db1a8deb164e311ff6eed02e115664a901481118
    14518 loader: linker cleanup

16 files changed, 136 insertions, 102 deletions

diff --git a/usr/src/boot/Makefile.inc b/usr/src/boot/Makefile.inc
index 495bfab86b..de634f81ed 100644
--- a/usr/src/boot/Makefile.inc
+++ b/usr/src/boot/Makefile.inc
@@ -17,14 +17,11 @@
 
 # loader.help build needs better awk
 AWK=		/usr/xpg4/bin/awk
-LD=		$(GNU_ROOT)/bin/gld
+GLD=		$(GNU_ROOT)/bin/gld
 OBJCOPY=	$(GNU_ROOT)/bin/gobjcopy
 OBJDUMP=	$(GNU_ROOT)/bin/gobjdump
 GSTRIP=		$(GNU_ROOT)/bin/gstrip
 
-GLDTARGET=	-melf_i386_sol2
-LDFLAGS	+=	$(GLDTARGET)
-
 # Default Console font setup.
 # We want it to be the same as kernel.
 # We build compressed, stripped down version of the default font, so we have
diff --git a/usr/src/boot/efi/loader/Makefile.com b/usr/src/boot/efi/loader/Makefile.com
index 51edbced1e..963ea246e6 100644
--- a/usr/src/boot/efi/loader/Makefile.com
+++ b/usr/src/boot/efi/loader/Makefile.com
@@ -173,7 +173,7 @@ DPADD=		$(DPLIBFICL) $(DPLIBEFI) $(DPLIBSA) $(LDSCRIPT)
 LDADD=		$(LIBFICL) $(LIBEFI) $(LIBSA)
 
 loader.sym:	$(OBJS) $(DPADD)
-	$(LD) $(LDFLAGS) -o $@ $(OBJS) $(LDADD)
+	$(GLD) $(LDFLAGS) -o $@ $(OBJS) $(LDADD)
 
 machine:
 	$(RM) machine
diff --git a/usr/src/boot/i386/Makefile.inc b/usr/src/boot/i386/Makefile.inc
index 6deaf96b27..2fa89ae753 100644
--- a/usr/src/boot/i386/Makefile.inc
+++ b/usr/src/boot/i386/Makefile.inc
@@ -15,6 +15,7 @@
 
 # Common defines for all of /i386/
 
+GLDTARGET=	-melf_i386_sol2
 LOADER_ADDRESS=0x200000
 CFLAGS +=	-m32
 CCASFLAGS +=	-m32
diff --git a/usr/src/boot/i386/btx/btx/Makefile b/usr/src/boot/i386/btx/btx/Makefile
index 2157bf721e..1a4e446578 100644
--- a/usr/src/boot/i386/btx/btx/Makefile
+++ b/usr/src/boot/i386/btx/btx/Makefile
@@ -28,7 +28,7 @@ OBJS=	btx.o
 BOOT_BTX_FLAGS=0x0
 #.endif
 
-CPPFLAGS += -DBTX_FLAGS=${BOOT_BTX_FLAGS}
+CPPFLAGS += -DBTX_FLAGS=$(BOOT_BTX_FLAGS)
 CPPFLAGS += -I./../../common
 
 #.if defined(BTX_SERIAL)
@@ -42,12 +42,12 @@ CPPFLAGS += -I./../../common
 
 ORG=	0x9000
 
-LDFLAGS=-e start -Ttext ${ORG} -N -S --oformat binary $(GLDTARGET)
+LDFLAGS=-e start -Ttext $(ORG) -N -S --oformat binary $(GLDTARGET)
 
 all install:	$(PROG)
 
 $(PROG): $(OBJS)
-	$(LD) $(LDFLAGS) -o $@ $(OBJS)
+	$(GLD) $(LDFLAGS) -o $@ $(OBJS)
 
 clobber: clean
 
diff --git a/usr/src/boot/i386/btx/btxldr/Makefile b/usr/src/boot/i386/btx/btxldr/Makefile
index 408db52b66..7fbf6a58e5 100644
--- a/usr/src/boot/i386/btx/btxldr/Makefile
+++ b/usr/src/boot/i386/btx/btxldr/Makefile
@@ -22,16 +22,16 @@ PROG=	btxldr
 SRCS=	btxldr.S
 OBJS=	btxldr.o
 
-CPPFLAGS += -DLOADER_ADDRESS=${LOADER_ADDRESS}
+CPPFLAGS += -DLOADER_ADDRESS=$(LOADER_ADDRESS)
 CPPFLAGS += -DBTXLDR_VERBOSE
 CPPFLAGS += -I./../../common
 
-LDFLAGS=-e start -Ttext ${LOADER_ADDRESS} -N -S --oformat binary $(GLDTARGET)
+LDFLAGS=-e start -Ttext $(LOADER_ADDRESS) -N -S --oformat binary $(GLDTARGET)
 
 all install:	$(PROG)
 
 $(PROG): $(OBJS)
-	$(LD) $(LDFLAGS) -o $@ $(OBJS)
+	$(GLD) $(LDFLAGS) -o $@ $(OBJS)
 
 clobber: clean
 
diff --git a/usr/src/boot/i386/btx/lib/Makefile b/usr/src/boot/i386/btx/lib/Makefile
index 5986c0d63f..49214e1a65 100644
--- a/usr/src/boot/i386/btx/lib/Makefile
+++ b/usr/src/boot/i386/btx/lib/Makefile
@@ -29,7 +29,7 @@ LDFLAGS = -r $(GLDTARGET)
 all install: $(PROG)
 
 $(PROG): $(OBJS)
-	$(LD) $(LDFLAGS) -o $@ $(OBJS)
+	$(GLD) $(LDFLAGS) -o $@ $(OBJS)
 
 clobber: clean
 
diff --git a/usr/src/boot/i386/cdboot/Makefile b/usr/src/boot/i386/cdboot/Makefile
index ac6beb0e41..d9461b42e7 100644
--- a/usr/src/boot/i386/cdboot/Makefile
+++ b/usr/src/boot/i386/cdboot/Makefile
@@ -22,19 +22,19 @@ CPPFLAGS +=	-I../common
 
 PROG=	cdboot
 FILEMODE=0444
-SRCS=	${PROG}.S
+SRCS=	$(PROG).S
 OBJS=	$(SRCS:%.S=%.o)
 
 ORG=	0x7c00
 
 LDFLAGS=-e start -Ttext $(ORG) -N -S --oformat binary $(GLDTARGET)
 
-all:	${PROG}
+all:	$(PROG)
 
 install: $(PROG:%=$(ROOT_BOOT)/%)
 
-${PROG}: ${OBJS}
-	${LD} ${LDFLAGS} -o $@ $^
+$(PROG): $(OBJS)
+	$(GLD) $(LDFLAGS) -o $@ $^
 
 clobber: clean
 clean:
diff --git a/usr/src/boot/i386/gptzfsboot/Makefile b/usr/src/boot/i386/gptzfsboot/Makefile
index 4e457fbaf8..ad97283ca4 100644
--- a/usr/src/boot/i386/gptzfsboot/Makefile
+++ b/usr/src/boot/i386/gptzfsboot/Makefile
@@ -71,7 +71,7 @@ zfs_cmd.o := CPPFLAGS += -I$(SRC)/uts/common
 part.o := CPPFLAGS += -I$(ZLIB)
 smbios.o := CPPFLAGS += -DSMBIOS_SERIAL_NUMBERS
 smbios.o := CPPFLAGS += -DSMBIOS_LITTLE_ENDIAN_UUID
-gptldr.out := LD_FLAGS += -m elf_i386_sol2
+gptldr.out := LD_FLAGS += $(GLDTARGET)
 
 CLEANFILES=	gptzfsboot $(OBJS)
 
@@ -85,7 +85,7 @@ gptldr.bin: gptldr.out
 	$(OBJCOPY) -S -O binary gptldr.out $@
 
 gptldr.out: gptldr.o
-	$(LD) $(LD_FLAGS) -e start -Ttext $(ORG1) -o $@ gptldr.o
+	$(GLD) $(LD_FLAGS) -e start -Ttext $(ORG1) -o $@ gptldr.o
 
 CLEANFILES +=	gptzfsboot.bin gptzfsboot.out
 
@@ -93,7 +93,7 @@ gptzfsboot.bin: gptzfsboot.out
 	$(OBJCOPY) -S -O binary gptzfsboot.out $@
 
 gptzfsboot.out: $(BTXCRT) $(OBJS) $(DPADD)
-	$(LD) $(LD_FLAGS) -T $(LDSCRIPT) -o $@ $(BTXCRT) $(OBJS) $(LIBS)
+	$(GLD) $(LD_FLAGS) -T $(LDSCRIPT) -o $@ $(BTXCRT) $(OBJS) $(LIBS)
 
 machine:
 	$(RM) machine
diff --git a/usr/src/boot/i386/isoboot/Makefile b/usr/src/boot/i386/isoboot/Makefile
index 08a803f44e..39b56debf6 100644
--- a/usr/src/boot/i386/isoboot/Makefile
+++ b/usr/src/boot/i386/isoboot/Makefile
@@ -46,7 +46,7 @@ LDSCRIPT=	../boot.ldscript
 LD_FLAGS=	-static -N --gc-sections
 LIBSTAND=	../../libsa/$(MACH)/libsa.a
 
-gptldr.out := LD_FLAGS += -m elf_i386_sol2
+gptldr.out := LD_FLAGS += $(GLDTARGET)
 
 isoboot.o := SMOFF += unreachable
 
@@ -61,7 +61,7 @@ OBJS= mb_header.o isoboot.o sio.o drv.o cons.o gptldr.o
 CLEANFILES += isoboot
 
 isoboot: gptldr.bin isoboot.bin $(BTXKERN)
-	btxld -v -E $(ORG2) -f bin -b $(BTXKERN) -V $(BOOT_VERSION) -l \
+	$(BTXLD) -v -E $(ORG2) -f bin -b $(BTXKERN) -V $(BOOT_VERSION) -l \
 		gptldr.bin -o $@ isoboot.bin
 	@set -- `ls -l $@`; x=$$(($(ISOBOOTSIZE)-$$5)); \
 	    echo "$$x bytes available"; test $$x -ge 0
@@ -72,7 +72,7 @@ gptldr.bin: gptldr.out
 	$(OBJCOPY) -S -O binary gptldr.out $@
 
 gptldr.out:	gptldr.o
-	$(LD) $(LD_FLAGS) -e start -Ttext $(ORG1) -o $@ gptldr.o
+	$(GLD) $(LD_FLAGS) -e start -Ttext $(ORG1) -o $@ gptldr.o
 
 CLEANFILES += isoboot.bin isoboot.out $(OBJS)
 
@@ -80,7 +80,7 @@ isoboot.bin: isoboot.out
 	$(OBJCOPY) -S -O binary isoboot.out $@
 
 isoboot.out: $(BTXCRT) $(OBJS)
-	$(LD) $(LD_FLAGS) -T $(LDSCRIPT) -o $@ $(BTXCRT) $(OBJS) $(LIBSTAND)
+	$(GLD) $(LD_FLAGS) -T $(LDSCRIPT) -o $@ $(BTXCRT) $(OBJS) $(LIBSTAND)
 
 machine:
 	$(RM) machine
diff --git a/usr/src/boot/i386/loader/Makefile b/usr/src/boot/i386/loader/Makefile
index 8a124cd603..f0a1a2e43b 100644
--- a/usr/src/boot/i386/loader/Makefile
+++ b/usr/src/boot/i386/loader/Makefile
@@ -145,7 +145,7 @@ OBJS=		$(SRCS:%.c=%.o)
 $(OBJS): machine x86
 
 $(PROG): $(OBJS) $(DPADD)
-	$(LD) $(LDFLAGS) -o $@ $(BTXCRT) $(OBJS) $(LDADD)
+	$(GLD) $(LDFLAGS) -o $@ $(BTXCRT) $(OBJS) $(LDADD)
 
 clean: clobber
 clobber:
diff --git a/usr/src/boot/i386/pmbr/Makefile b/usr/src/boot/i386/pmbr/Makefile
index dccd6d09f1..62855ed602 100644
--- a/usr/src/boot/i386/pmbr/Makefile
+++ b/usr/src/boot/i386/pmbr/Makefile
@@ -36,7 +36,7 @@ all: $(PROG)
 install: $(PROG:%=$(ROOT_BOOT)/%)
 
 $(PROG): $(OBJS)
-	$(LD) $(LDFLAGS) -o $(PROG) $(OBJS)
+	$(GLD) $(LDFLAGS) -o $(PROG) $(OBJS)
 
 clobber: clean
 
diff --git a/usr/src/boot/i386/pxeldr/Makefile b/usr/src/boot/i386/pxeldr/Makefile
index 32b6ee2f0c..0547a23c45 100644
--- a/usr/src/boot/i386/pxeldr/Makefile
+++ b/usr/src/boot/i386/pxeldr/Makefile
@@ -29,13 +29,13 @@ include ../Makefile.inc
 
 BTXDIR= ../btx
 
-PROG=	${LDR}
+PROG=	$(LDR)
 INTERNALPROG=
-FILES=	${BOOT}
-MAN=	${BOOT}.8
-SRCS=	${LDR}.S
-OBJS=	${LDR}.o
-CLEANFILES= ${BOOT} ${OBJS}
+FILES=	$(BOOT)
+MAN=	$(BOOT).8
+SRCS=	$(LDR).S
+OBJS=	$(LDR).o
+CLEANFILES= $(BOOT) $(OBJS)
 
 BOOT=	pxeboot
 LDR=	pxeldr
@@ -51,25 +51,25 @@ FILEMODE=0444
 
 LOADERBIN= ../loader/loader.bin
 
-CLEANFILES += ${BOOT}.tmp
+CLEANFILES += $(BOOT).tmp
 
-${BOOT}: ${LDR} ${LOADER}
-	$(CAT) ${LDR} ${LOADER} > $@.tmp
+$(BOOT): $(LDR) $(LOADER)
+	$(CAT) $(LDR) $(LOADER) > $@.tmp
 	$(DD) if=$@.tmp of=$@ obs=2k conv=sync
 	$(RM) $@.tmp
 
-LDFLAGS +=-e start -Ttext ${ORG} -N -S --oformat binary
+LDFLAGS += $(GLDTARGET) -e start -Ttext $(ORG) -N -S --oformat binary
 
-CLEANFILES += ${LOADER} ${LDR}
+CLEANFILES += $(LOADER) $(LDR)
 
-${LDR}: ${OBJS}
-	${LD} ${LDFLAGS} -o $@ $^
+$(LDR): $(OBJS)
+	$(GLD) $(LDFLAGS) -o $@ $^
 
-${LOADER}: ${LOADERBIN} ${BTXLDR} ${BTXKERN}
-	$(BTXLD) -f aout -e ${LOADER_ADDRESS} -o $@ -l ${BTXLDR} \
-	    -b ${BTXKERN} ${LOADERBIN}
+$(LOADER): $(LOADERBIN) $(BTXLDR) $(BTXKERN)
+	$(BTXLD) -f aout -e $(LOADER_ADDRESS) -o $@ -l $(BTXLDR) \
+	    -b $(BTXKERN) $(LOADERBIN)
 
-all: ${BOOT}
+all: $(BOOT)
 
 install: $(BOOT:%=$(ROOT_BOOT)/%)
 
diff --git a/usr/src/boot/libficl/Makefile.com b/usr/src/boot/libficl/Makefile.com
index 822e5d79fe..6948a521a9 100644
--- a/usr/src/boot/libficl/Makefile.com
+++ b/usr/src/boot/libficl/Makefile.com
@@ -40,9 +40,6 @@ pics/vm.o := SMOFF += check_check_deref
 MAJOR = 4
 MINOR = 1.0
 
-objs/vm.o := CFLAGS += -_gcc=-Wno-clobbered
-pics/vm.o := CFLAGS += -_gcc=-Wno-clobbered
-
 machine:
 	$(RM) machine
 	$(SYMLINK) ../../sys/$(MACHINE)/include machine
diff --git a/usr/src/cmd/bhyve/pci_virtio_viona.c b/usr/src/cmd/bhyve/pci_virtio_viona.c
index 62f194293d..8ee3880100 100644
--- a/usr/src/cmd/bhyve/pci_virtio_viona.c
+++ b/usr/src/cmd/bhyve/pci_virtio_viona.c
@@ -35,6 +35,7 @@
  *
  * Copyright 2015 Pluribus Networks Inc.
  * Copyright 2019 Joyent, Inc.
+ * Copyright 2022 OmniOS Community Edition (OmniOSce) Association.
  */
 
 #include <sys/cdefs.h>
@@ -395,7 +396,6 @@ pci_viona_init(struct vmctx *ctx, struct pci_devinst *pi, nvlist_t *nvl)
 	char			tname[MAXCOMLEN + 1];
 	int error, i;
 	struct pci_viona_softc *sc;
-	uint64_t ioport;
 	const char *vnic;
 	pthread_t tid;
 
@@ -482,15 +482,6 @@ pci_viona_init(struct vmctx *ctx, struct pci_devinst *pi, nvlist_t *nvl)
 		return (1);
 	}
 
-	/* Install ioport hook for virtqueue notification */
-	ioport = pi->pi_bar[0].addr + VIRTIO_PCI_QUEUE_NOTIFY;
-	error = ioctl(sc->vsc_vnafd, VNA_IOC_SET_NOTIFY_IOP, ioport);
-	if (error != 0) {
-		WPRINTF(("could not install ioport hook at %x\n", ioport));
-		free(sc);
-		return (1);
-	}
-
 	/*
 	 * Need a legacy interrupt for virtio compliance, even though MSI-X
 	 * operation is _strongly_ suggested for adequate performance.
@@ -621,6 +612,37 @@ pci_viona_qnotify(struct pci_viona_softc *sc, int ring)
 }
 
 static void
+pci_viona_baraddr(struct vmctx *ctx, struct pci_devinst *pi, int baridx,
+    int enabled, uint64_t address)
+{
+	struct pci_viona_softc *sc = pi->pi_arg;
+	uint64_t ioport;
+	int error;
+
+	if (baridx != 0)
+		return;
+
+	if (enabled == 0) {
+		error = ioctl(sc->vsc_vnafd, VNA_IOC_SET_NOTIFY_IOP, 0);
+		if (error != 0)
+			WPRINTF(("uninstall ioport hook failed %d\n", errno));
+		return;
+	}
+
+	/*
+	 * Install ioport hook for virtqueue notification.
+	 * This is part of the virtio common configuration area so the
+	 * address does not change with MSI-X status.
+	 */
+	ioport = address + VIRTIO_PCI_QUEUE_NOTIFY;
+	error = ioctl(sc->vsc_vnafd, VNA_IOC_SET_NOTIFY_IOP, ioport);
+	if (error != 0) {
+		WPRINTF(("install ioport hook at %x failed %d\n",
+		    ioport, errno));
+	}
+}
+
+static void
 pci_viona_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
     int baridx, uint64_t offset, int size, uint64_t value)
 {
@@ -842,6 +864,7 @@ struct pci_devemu pci_de_viona = {
 	.pe_legacy_config = pci_viona_legacy_config,
 	.pe_barwrite =	pci_viona_write,
 	.pe_barread =	pci_viona_read,
+	.pe_baraddr =	pci_viona_baraddr,
 	.pe_lintrupdate = pci_viona_lintrupdate
 };
 PCI_EMUL_SET(pci_de_viona);
diff --git a/usr/src/lib/libficl/Makefile.com b/usr/src/lib/libficl/Makefile.com
index 9502a28def..238468b2a1 100644
--- a/usr/src/lib/libficl/Makefile.com
+++ b/usr/src/lib/libficl/Makefile.com
@@ -36,11 +36,6 @@ CPPFLAGS +=	-I$(PNGLITE) -I$(LZ4)
 CFLAGS += $(C_BIGPICFLAGS)
 CFLAGS64 += $(C_BIGPICFLAGS64)
 
-# As variable "count" is marked volatile, gcc 4.4.4 will complain about
-# function argument. So we switch this warning off
-# for time being, till gcc 4.4.4 will be replaced.
-pics/vm.o := CERRWARN += -_gcc=-Wno-clobbered
-
 LDLIBS +=	-lumem -luuid -lz -lc -lm
 NATIVE_LIBS +=	libz.so
 
diff --git a/usr/src/uts/i86pc/io/vmm/io/vatpit.c b/usr/src/uts/i86pc/io/vmm/io/vatpit.c
index cb815fd9c5..501884e0df 100644
--- a/usr/src/uts/i86pc/io/vmm/io/vatpit.c
+++ b/usr/src/uts/i86pc/io/vmm/io/vatpit.c
@@ -77,18 +77,23 @@ struct vatpit_callout_arg {
 };
 
 struct channel {
-	int		mode;
+	uint8_t		mode;
 	uint16_t	initial;	/* initial counter value */
-	struct bintime	now_bt;		/* uptime when counter was loaded */
-	uint8_t		cr[2];
-	uint8_t		ol[2];
+
+	uint8_t		reg_cr[2];
+	uint8_t		reg_ol[2];
+	uint8_t		reg_status;
+
 	bool		slatched;	/* status latched */
-	uint8_t		status;
-	int		crbyte;
-	int		olbyte;
-	int		frbyte;
-	struct callout	callout;
+	bool		olatched;	/* output latched */
+	bool		cr_sel;		/* read MSB from control register */
+	bool		ol_sel;		/* read MSB from output latch */
+	bool		fr_sel;		/* read MSB from free-running timer */
+
+	struct bintime	load_bt;	/* time when counter was loaded */
 	struct bintime	callout_bt;	/* target time */
+
+	struct callout	callout;
 	struct vatpit_callout_arg callout_arg;
 };
 
@@ -110,7 +115,7 @@ vatpit_delta_ticks(struct vatpit *vatpit, struct channel *c)
 	uint64_t result;
 
 	binuptime(&delta);
-	bintime_sub(&delta, &c->now_bt);
+	bintime_sub(&delta, &c->load_bt);
 
 	result = delta.sec * PIT_8254_FREQ;
 	result += delta.frac / vatpit->freq_bt.frac;
@@ -213,7 +218,7 @@ pit_update_counter(struct vatpit *vatpit, struct channel *c, bool latch)
 	uint64_t delta_ticks;
 
 	/* cannot latch a new value until the old one has been consumed */
-	if (latch && c->olbyte != 0)
+	if (latch && c->olatched)
 		return (0);
 
 	if (c->initial == 0) {
@@ -226,17 +231,18 @@ pit_update_counter(struct vatpit *vatpit, struct channel *c, bool latch)
 		 * here.
 		 */
 		c->initial = TIMER_DIV(PIT_8254_FREQ, 100);
-		binuptime(&c->now_bt);
-		c->status &= ~TIMER_STS_NULLCNT;
+		binuptime(&c->load_bt);
+		c->reg_status &= ~TIMER_STS_NULLCNT;
 	}
 
 	delta_ticks = vatpit_delta_ticks(vatpit, c);
 	lval = c->initial - delta_ticks % c->initial;
 
 	if (latch) {
-		c->olbyte = 2;
-		c->ol[1] = lval;		/* LSB */
-		c->ol[0] = lval >> 8;		/* MSB */
+		c->olatched = true;
+		c->ol_sel = true;
+		c->reg_ol[1] = lval;		/* LSB */
+		c->reg_ol[0] = lval >> 8;	/* MSB */
 	}
 
 	return (lval);
@@ -253,11 +259,11 @@ pit_readback1(struct vatpit *vatpit, int channel, uint8_t cmd)
 	 * Latch the count/status of the timer if not already latched.
 	 * N.B. that the count/status latch-select bits are active-low.
 	 */
-	if (!(cmd & TIMER_RB_LCTR) && !c->olbyte) {
+	if ((cmd & TIMER_RB_LCTR) == 0 && !c->olatched) {
 		(void) pit_update_counter(vatpit, c, true);
 	}
 
-	if (!(cmd & TIMER_RB_LSTATUS) && !c->slatched) {
+	if ((cmd & TIMER_RB_LSTATUS) == 0 && !c->slatched) {
 		c->slatched = true;
 		/*
 		 * For mode 0, see if the elapsed time is greater
@@ -265,9 +271,9 @@ pit_readback1(struct vatpit *vatpit, int channel, uint8_t cmd)
 		 * output pin being set to 1 in the status byte.
 		 */
 		if (c->mode == TIMER_INTTC && vatpit_get_out(vatpit, channel))
-			c->status |= TIMER_STS_OUT;
+			c->reg_status |= TIMER_STS_OUT;
 		else
-			c->status &= ~TIMER_STS_OUT;
+			c->reg_status &= ~TIMER_STS_OUT;
 	}
 
 	return (0);
@@ -296,12 +302,18 @@ static int
 vatpit_update_mode(struct vatpit *vatpit, uint8_t val)
 {
 	struct channel *c;
-	int sel, rw, mode;
+	int sel, rw;
+	uint8_t mode;
 
 	sel = val & TIMER_SEL_MASK;
 	rw = val & TIMER_RW_MASK;
 	mode = val & TIMER_MODE_MASK;
 
+	/* Clear don't-care bit (M2) when M1 is set */
+	if ((mode & TIMER_RATEGEN) != 0) {
+		mode &= ~TIMER_SWSTROBE;
+	}
+
 	if (sel == TIMER_SEL_READBACK)
 		return (pit_readback(vatpit, val));
 
@@ -321,12 +333,12 @@ vatpit_update_mode(struct vatpit *vatpit, uint8_t val)
 	}
 
 	c = &vatpit->channel[sel >> 6];
-	if (rw == TIMER_LATCH)
+	if (rw == TIMER_LATCH) {
 		pit_update_counter(vatpit, c, true);
-	else {
+	} else {
 		c->mode = mode;
-		c->olbyte = 0;	/* reset latch after reprogramming */
-		c->status |= TIMER_STS_NULLCNT;
+		c->olatched = false;	/* reset latch after reprogramming */
+		c->reg_status |= TIMER_STS_NULLCNT;
 	}
 
 	return (0);
@@ -365,12 +377,10 @@ vatpit_handler(void *arg, bool in, uint16_t port, uint8_t bytes, uint32_t *eax)
 
 	VATPIT_LOCK(vatpit);
 	if (in && c->slatched) {
-		/*
-		 * Return the status byte if latched
-		 */
-		*eax = c->status;
+		/* Return the status byte if latched */
+		*eax = c->reg_status;
 		c->slatched = false;
-		c->status = 0;
+		c->reg_status = 0;
 	} else if (in) {
 		/*
 		 * The spec says that once the output latch is completely
@@ -379,29 +389,40 @@ vatpit_handler(void *arg, bool in, uint16_t port, uint8_t bytes, uint32_t *eax)
 		 * TSC calibration). Assuming the access mode is 16-bit,
 		 * toggle the MSB/LSB bit on each read.
 		 */
-		if (c->olbyte == 0) {
+		if (!c->olatched) {
 			uint16_t tmp;
 
 			tmp = pit_update_counter(vatpit, c, false);
-			if (c->frbyte)
+			if (c->fr_sel) {
 				tmp >>= 8;
+			}
 			tmp &= 0xff;
 			*eax = tmp;
-			c->frbyte ^= 1;
+			c->fr_sel = !c->fr_sel;
 		} else {
-			*eax = c->ol[--c->olbyte];
+			if (c->ol_sel) {
+				*eax = c->reg_ol[1];
+				c->ol_sel = false;
+			} else {
+				*eax = c->reg_ol[0];
+				c->olatched = false;
+			}
 		}
 	} else {
-		c->cr[c->crbyte++] = *eax;
-		if (c->crbyte == 2) {
-			c->status &= ~TIMER_STS_NULLCNT;
-			c->frbyte = 0;
-			c->crbyte = 0;
-			c->initial = c->cr[0] | (uint16_t)c->cr[1] << 8;
-			binuptime(&c->now_bt);
+		if (!c->cr_sel) {
+			c->reg_cr[0] = *eax;
+			c->cr_sel = true;
+		} else {
+			c->reg_cr[1] = *eax;
+			c->cr_sel = false;
+
+			c->reg_status &= ~TIMER_STS_NULLCNT;
+			c->fr_sel = false;
+			c->initial = c->reg_cr[0] | (uint16_t)c->reg_cr[1] << 8;
+			binuptime(&c->load_bt);
 			/* Start an interval timer for channel 0 */
 			if (port == TIMER_CNTR0) {
-				c->callout_bt = c->now_bt;
+				c->callout_bt = c->load_bt;
 				pit_timer_start_cntr0(vatpit);
 			}
 			if (c->initial == 0)