[illumos-gate merge]release-20200521

commit d5b4c61b9474779079c9ef8650d04dd7c8207a06
    12732 Update Intel microcode to 20200508
commit c61a1653a4d73dbc950dac7d96350fd6cb517486
    12676 want better offloads for vnics
    12677 simnet has bogus mi_tx_cksum_flags
    12678 mac_tx() is too eager to emulate hardware offloads
commit f13f199891d2a0440db0361743dd73527f565e89
    12729 bootadm set-menu timeout crashes without timeout value
commit c039d8138bcc82c8082abc5560e0293afb7994cf
    12741 Fix "more then" typo in dlopen(3c)
commit 109b65249647da8f2f4306cd9b3d2800b05fd59b
    12744 gfx_private: bitmap_cons_clear 8-bit mode is using wrong color
commit 3382f241dd77fdfc4a9c4b03092e328924cd0c65
    12707 Port OpenZFS Coverity Fixes
commit 0c268761780011e1de45099cf76b2ee464ea8f50
    12733 loader: autoboot_timeout greater than 10 is not shown

	Conflicts:
	usr/src/boot/sys/boot/forth/menu.4th
	usr/src/pkg/manifests/system-test-nettest.mf
	usr/src/test/net-tests/config/Makefile
	usr/src/test/net-tests/runfiles/default.run
	usr/src/test/net-tests/tests/forwarding/README
	usr/src/test/net-tests/tests/forwarding/ip_forwarding.ksh
	usr/src/test/net-tests/tests/net_common.ksh
	usr/src/uts/common/io/mac/mac.c
	usr/src/uts/common/io/mac/mac_client.c
	usr/src/uts/common/io/mac/mac_sched.c
	usr/src/uts/common/io/mac/mac_util.c
	usr/src/uts/common/io/simnet/simnet.c

27 files changed, 219 insertions, 158 deletions

diff --git a/usr/src/boot/sys/boot/forth/menu.4th b/usr/src/boot/sys/boot/forth/menu.4th
index 73a7cd44f9..262fd5ca03 100644
--- a/usr/src/boot/sys/boot/forth/menu.4th
+++ b/usr/src/boot/sys/boot/forth/menu.4th
@@ -571,8 +571,7 @@ also menu-infrastructure definitions
 \
 : menu-timeout-update ( N -- )
 
-	\ Enforce minimum/maximum
-	dup 9 > if drop 9 then
+	\ Enforce minimum
 	dup 0 < if drop 0 then
 
 	s" headnode" getenv? if
@@ -585,16 +584,13 @@ also menu-infrastructure definitions
 		s" Autoboot in N seconds. [Space] to pause" ( n -- n c-addr/u )
 	then
 
-	2 pick 0> if
-		rot 48 + -rot ( n c-addr/u -- n' c-addr/u ) \ convert to ASCII
-		12 +c!        ( n' c-addr/u -- c-addr/u )   \ replace 'N' above
-
-		menu_timeout_x @ menu_timeout_y @ at-xy \ position cursor
-		type ( c-addr/u -- ) \ print message
+	dup 0> if
+		s" Autoboot in " type
+		dup . s" second" type
+		1 > if [char] s emit then
+		s" . [Space] to pause " type
 	else
-		menu_timeout_x @ menu_timeout_y @ at-xy \ position cursor
-		spaces ( n c-addr/u -- n c-addr ) \ erase message
-		2drop ( n c-addr -- )
+		drop 40 spaces \ erase message
 	then
 
 	at-bl
diff --git a/usr/src/cmd/boot/bootadm/bootadm_loader.c b/usr/src/cmd/boot/bootadm/bootadm_loader.c
index 5755efd7d5..15bf160745 100644
--- a/usr/src/cmd/boot/bootadm/bootadm_loader.c
+++ b/usr/src/cmd/boot/bootadm/bootadm_loader.c
@@ -27,6 +27,7 @@
  * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
  * Copyright 2016 Toomas Soome <tsoome@me.com>
  * Copyright 2019 OmniOS Community Edition (OmniOSce) Association.
+ * Copyright 2020 2020 Data Direct Networks.
  */
 
 /*
@@ -616,6 +617,9 @@ set_option(struct menu_lst *menu, char *dummy, char *opt)
 	val = strchr(opt, '=');
 	if (val != NULL) {
 		*val++ = '\0';
+	} else {
+		bam_error(_("missing value in key=value\n"));
+		return (BAM_ERROR);
 	}
 
 	if (strcmp(opt, "default") == 0) {
diff --git a/usr/src/cmd/zfs/zfs_main.c b/usr/src/cmd/zfs/zfs_main.c
index ecc049c1fc..6c53682364 100644
--- a/usr/src/cmd/zfs/zfs_main.c
+++ b/usr/src/cmd/zfs/zfs_main.c
@@ -4247,7 +4247,7 @@ zfs_do_send(int argc, char **argv)
 			 * Incremental source name begins with # or @.
 			 * Default to same fs as target.
 			 */
-			(void) strncpy(frombuf, argv[0], sizeof (frombuf));
+			(void) strlcpy(frombuf, argv[0], sizeof (frombuf));
 			cp = strchr(frombuf, '@');
 			if (cp != NULL)
 				*cp = '\0';
@@ -7480,7 +7480,7 @@ zfs_do_bookmark(int argc, char **argv)
 		*strchr(snapname, '#') = '\0';
 		(void) strlcat(snapname, argv[0], sizeof (snapname));
 	} else {
-		(void) strncpy(snapname, argv[0], sizeof (snapname));
+		(void) strlcpy(snapname, argv[0], sizeof (snapname));
 	}
 	zhp = zfs_open(g_zfs, snapname, ZFS_TYPE_SNAPSHOT);
 	if (zhp == NULL)
diff --git a/usr/src/cmd/zinject/zinject.c b/usr/src/cmd/zinject/zinject.c
index 6ab78ad46b..3ba2976df1 100644
--- a/usr/src/cmd/zinject/zinject.c
+++ b/usr/src/cmd/zinject/zinject.c
@@ -772,6 +772,7 @@ main(int argc, char **argv)
 
 	if ((zfs_fd = open(ZFS_DEV, O_RDWR)) < 0) {
 		(void) fprintf(stderr, "failed to open ZFS device\n");
+		libzfs_fini(g_zfs);
 		return (1);
 	}
 
@@ -787,6 +788,7 @@ main(int argc, char **argv)
 			    "information.\n");
 		}
 
+		libzfs_fini(g_zfs);
 		return (0);
 	}
 
@@ -805,6 +807,7 @@ main(int argc, char **argv)
 				(void) fprintf(stderr, "invalid action '%s': "
 				    "must be 'degrade' or 'fault'\n", optarg);
 				usage();
+				libzfs_fini(g_zfs);
 				return (1);
 			}
 			break;
@@ -835,6 +838,7 @@ main(int argc, char **argv)
 				(void) fprintf(stderr, "invalid i/o delay "
 				    "value: '%s'\n", optarg);
 				usage();
+				libzfs_fini(g_zfs);
 				return (1);
 			}
 			break;
@@ -864,6 +868,7 @@ main(int argc, char **argv)
 				    "be in the range [0.0001, 100.0]\n",
 				    ret == EINVAL ? "invalid value: " :
 				    ret == ERANGE ? "out of range: " : "");
+				libzfs_fini(g_zfs);
 				return (1);
 			}
 			break;
@@ -877,6 +882,7 @@ main(int argc, char **argv)
 				(void) fprintf(stderr, "invalid duration '%s': "
 				    "must be a positive integer\n", optarg);
 				usage();
+				libzfs_fini(g_zfs);
 				return (1);
 			}
 			/* store duration of txgs as its negative */
@@ -884,6 +890,7 @@ main(int argc, char **argv)
 			break;
 		case 'h':
 			usage();
+			libzfs_fini(g_zfs);
 			return (0);
 		case 'I':
 			/* default duration, if one hasn't yet been defined */
@@ -897,6 +904,7 @@ main(int argc, char **argv)
 				(void) fprintf(stderr, "invalid level '%s': "
 				    "must be an integer\n", optarg);
 				usage();
+				libzfs_fini(g_zfs);
 				return (1);
 			}
 			break;
@@ -922,6 +930,7 @@ main(int argc, char **argv)
 				(void) fprintf(stderr, "invalid duration '%s': "
 				    "must be a positive integer\n", optarg);
 				usage();
+				libzfs_fini(g_zfs);
 				return (1);
 			}
 			break;
@@ -941,6 +950,7 @@ main(int argc, char **argv)
 				    "'%s': must be 'read', 'write', 'free', "
 				    "'claim' or 'all'\n", optarg);
 				usage();
+				libzfs_fini(g_zfs);
 				return (1);
 			}
 			break;
@@ -950,6 +960,7 @@ main(int argc, char **argv)
 				(void) fprintf(stderr, "invalid type '%s'\n",
 				    optarg);
 				usage();
+				libzfs_fini(g_zfs);
 				return (1);
 			}
 			break;
@@ -962,6 +973,7 @@ main(int argc, char **argv)
 				(void) fprintf(stderr, "invalid label type "
 				    "'%s'\n", optarg);
 				usage();
+				libzfs_fini(g_zfs);
 				return (1);
 			}
 			break;
@@ -969,11 +981,13 @@ main(int argc, char **argv)
 			(void) fprintf(stderr, "option -%c requires an "
 			    "operand\n", optopt);
 			usage();
+			libzfs_fini(g_zfs);
 			return (1);
 		case '?':
 			(void) fprintf(stderr, "invalid option '%c'\n",
 			    optopt);
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 	}
@@ -994,11 +1008,13 @@ main(int argc, char **argv)
 			(void) fprintf(stderr, "cancel (-c) incompatible with "
 			    "any other options\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 		if (argc != 0) {
 			(void) fprintf(stderr, "extraneous argument to '-c'\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 
@@ -1010,6 +1026,7 @@ main(int argc, char **argv)
 				(void) fprintf(stderr, "invalid handle id '%s':"
 				    " must be an integer or 'all'\n", cancel);
 				usage();
+				libzfs_fini(g_zfs);
 				return (1);
 			}
 			return (cancel_handler(id));
@@ -1027,6 +1044,7 @@ main(int argc, char **argv)
 			(void) fprintf(stderr, "device (-d) incompatible with "
 			    "data error injection\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 
@@ -1034,21 +1052,25 @@ main(int argc, char **argv)
 			(void) fprintf(stderr, "device (-d) injection requires "
 			    "a single pool name\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 
-		(void) strcpy(pool, argv[0]);
+		(void) strlcpy(pool, argv[0], sizeof (pool));
 		dataset[0] = '\0';
 
 		if (error == ECKSUM) {
 			(void) fprintf(stderr, "device error type must be "
 			    "'io' or 'nxio'\n");
+			libzfs_fini(g_zfs);
 			return (1);
 		}
 
 		record.zi_iotype = io_type;
-		if (translate_device(pool, device, label, &record) != 0)
+		if (translate_device(pool, device, label, &record) != 0) {
+			libzfs_fini(g_zfs);
 			return (1);
+		}
 		if (!error)
 			error = ENXIO;
 
@@ -1062,6 +1084,7 @@ main(int argc, char **argv)
 			(void) fprintf(stderr, "raw (-b) format with "
 			    "any other options\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 
@@ -1069,21 +1092,25 @@ main(int argc, char **argv)
 			(void) fprintf(stderr, "raw (-b) format expects a "
 			    "single pool name\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 
-		(void) strcpy(pool, argv[0]);
+		(void) strlcpy(pool, argv[0], sizeof (pool));
 		dataset[0] = '\0';
 
 		if (error == ENXIO) {
 			(void) fprintf(stderr, "data error type must be "
 			    "'checksum' or 'io'\n");
+			libzfs_fini(g_zfs);
 			return (1);
 		}
 
 		record.zi_cmd = ZINJECT_DATA_FAULT;
-		if (translate_raw(raw, &record) != 0)
+		if (translate_raw(raw, &record) != 0) {
+			libzfs_fini(g_zfs);
 			return (1);
+		}
 		if (!error)
 			error = EIO;
 	} else if (record.zi_cmd == ZINJECT_PANIC) {
@@ -1093,6 +1120,7 @@ main(int argc, char **argv)
 			(void) fprintf(stderr, "panic (-p) incompatible with "
 			    "other options\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 
@@ -1100,10 +1128,11 @@ main(int argc, char **argv)
 			(void) fprintf(stderr, "panic (-p) injection requires "
 			    "a single pool name and an optional id\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 
-		(void) strcpy(pool, argv[0]);
+		(void) strlcpy(pool, argv[0], sizeof (pool));
 		if (argv[1] != NULL)
 			record.zi_type = atoi(argv[1]);
 		dataset[0] = '\0';
@@ -1121,21 +1150,24 @@ main(int argc, char **argv)
 			(void) fprintf(stderr, "-s or -g meaningless "
 			    "without -I (ignore writes)\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		} else if (dur_secs && dur_txg) {
 			(void) fprintf(stderr, "choose a duration either "
 			    "in seconds (-s) or a number of txgs (-g) "
 			    "but not both\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		} else if (argc != 1) {
 			(void) fprintf(stderr, "ignore writes (-I) "
 			    "injection requires a single pool name\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 
-		(void) strcpy(pool, argv[0]);
+		(void) strlcpy(pool, argv[0], sizeof (pool));
 		dataset[0] = '\0';
 	} else if (type == TYPE_INVAL) {
 		if (flags == 0) {
@@ -1143,16 +1175,18 @@ main(int argc, char **argv)
 			    "'-t', '-a', '-p', '-I' or '-u' "
 			    "must be specified\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 
 		if (argc == 1 && (flags & ZINJECT_UNLOAD_SPA)) {
-			(void) strcpy(pool, argv[0]);
+			(void) strlcpy(pool, argv[0], sizeof (pool));
 			dataset[0] = '\0';
 		} else if (argc != 0) {
 			(void) fprintf(stderr, "extraneous argument for "
 			    "'-f'\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 
@@ -1161,12 +1195,14 @@ main(int argc, char **argv)
 		if (argc != 1) {
 			(void) fprintf(stderr, "missing object\n");
 			usage();
+			libzfs_fini(g_zfs);
 			return (2);
 		}
 
 		if (error == ENXIO) {
 			(void) fprintf(stderr, "data error type must be "
 			    "'checksum' or 'io'\n");
+			libzfs_fini(g_zfs);
 			return (1);
 		}
 
@@ -1199,8 +1235,10 @@ main(int argc, char **argv)
 		}
 
 		if (translate_record(type, argv[0], range, level, &record, pool,
-		    dataset) != 0)
+		    dataset) != 0) {
+			libzfs_fini(g_zfs);
 			return (1);
+		}
 		if (!error)
 			error = EIO;
 	}
@@ -1211,11 +1249,16 @@ main(int argc, char **argv)
 	 * time we access the pool.
 	 */
 	if (dataset[0] != '\0' && domount) {
-		if ((zhp = zfs_open(g_zfs, dataset, ZFS_TYPE_DATASET)) == NULL)
+		if ((zhp = zfs_open(g_zfs, dataset,
+		    ZFS_TYPE_DATASET)) == NULL) {
+			libzfs_fini(g_zfs);
 			return (1);
+		}
 
-		if (zfs_unmount(zhp, NULL, 0) != 0)
+		if (zfs_unmount(zhp, NULL, 0) != 0) {
+			libzfs_fini(g_zfs);
 			return (1);
+		}
 	}
 
 	record.zi_error = error;
diff --git a/usr/src/data/ucode/README.ucode b/usr/src/data/ucode/README.ucode
index fa2ea2269d..03dcde42f0 100644
--- a/usr/src/data/ucode/README.ucode
+++ b/usr/src/data/ucode/README.ucode
@@ -38,4 +38,4 @@ of updating the manifest as necessary. Be careful about new files.
 AMD: Updated in March 2012 as part of illumos#2546. Exact revision
 unknown.
 
-Intel: Linux 20191115 release
+Intel: Linux 20200508 release
diff --git a/usr/src/data/ucode/intel/000706E5-80 b/usr/src/data/ucode/intel/000706E5-80
index 1339fd29ed..5924718b16 100644
--- a/usr/src/data/ucode/intel/000706E5-80
+++ b/usr/src/data/ucode/intel/000706E5-80
diff --git a/usr/src/data/ucode/intel/THIRDPARTYLICENSE b/usr/src/data/ucode/intel/THIRDPARTYLICENSE
index 707d09081e..8fbad3dd21 100644
--- a/usr/src/data/ucode/intel/THIRDPARTYLICENSE
+++ b/usr/src/data/ucode/intel/THIRDPARTYLICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2018-2019 Intel Corporation.

+Copyright (c) 2018-2020 Intel Corporation.

 All rights reserved.

 

 Redistribution.

diff --git a/usr/src/man/man3c/dlopen.3c b/usr/src/man/man3c/dlopen.3c
index b72d070579..4836a95562 100644
--- a/usr/src/man/man3c/dlopen.3c
+++ b/usr/src/man/man3c/dlopen.3c
@@ -3,11 +3,10 @@
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH DLOPEN 3C "Sep 7, 2015"
+.TH DLOPEN 3C "May 16, 2020"
 .SH NAME
 dlopen, dlmopen \- gain access to an executable object file
 .SH SYNOPSIS
-.LP
 .nf
 #include <dlfcn.h>
 #include <link.h>
@@ -21,7 +20,6 @@ dlopen, dlmopen \- gain access to an executable object file
 .fi
 
 .SH DESCRIPTION
-.LP
 The \fBdlopen()\fR function makes an executable object file available to a
 running process. \fBdlopen()\fR returns to the process a \fIhandle\fR that the
 process can use on subsequent calls to \fBdlsym\fR(3C), \fBdladdr\fR(3C),
@@ -130,7 +128,7 @@ of other objects that include the same group.
 The program image file and any objects loaded at program startup have the mode
 \fBRTLD_GLOBAL\fR. The mode \fBRTLD_LOCAL\fR is the default mode for any
 objects that are acquired with \fBdlopen()\fR. A local object can be a
-dependency of more then one group. Any object of mode \fBRTLD_LOCAL\fR that is
+dependency of more than one group. Any object of mode \fBRTLD_LOCAL\fR that is
 referenced as a dependency of an object of mode \fBRTLD_GLOBAL\fR is promoted
 to \fBRTLD_GLOBAL\fR. In other words, the \fBRTLD_LOCAL\fR mode is ignored.
 .sp
@@ -273,7 +271,6 @@ are opened on a new link-map list must express all of their dependencies.
 .RE
 
 .SH RETURN VALUES
-.LP
 The \fBdlopen()\fR function returns \fINULL\fR if \fIpathname\fR cannot be
 found, cannot be opened for reading, or is not a shared object or a relocatable
 object. \fBdlopen()\fR also returns \fINULL\fR if an error occurs during the
@@ -281,13 +278,11 @@ process of loading \fIpathname\fR or relocating its symbolic references. See
 \fBNOTES\fR. Additional diagnostic information is available through
 \fBdlerror()\fR.
 .SH USAGE
-.LP
 The \fBdlopen()\fR and \fBdlmopen()\fR functions are members of a family of
 functions that give the user direct access to the dynamic linking facilities.
 This family of functions is available only to dynamically-linked processes. See
 the \fILinker and Libraries Guide\fR.
 .SH ATTRIBUTES
-.LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
 
@@ -304,7 +299,6 @@ MT\(miLevel	MT\(miSafe
 .TE
 
 .SH SEE ALSO
-.LP
 \fBld\fR(1), \fBld.so.1\fR(1), \fBdladdr\fR(3C), \fBdlclose\fR(3C),
 \fBdldump\fR(3C), \fBdlerror\fR(3C), \fBdlinfo\fR(3C), \fBdlsym\fR(3C),
 \fBattributes\fR(5), \fBstandards\fR(5)
@@ -312,7 +306,6 @@ MT\(miLevel	MT\(miSafe
 .LP
 \fILinker and Libraries Guide\fR
 .SH NOTES
-.LP
 If \fIpathname\fR has dependencies on other objects, these objects are
 automatically loaded by \fBdlopen()\fR. The directory search path used to find
 \fIpathname\fR and any dependencies can be affected by setting the environment
diff --git a/usr/src/pkg/manifests/system-microcode-intel.mf b/usr/src/pkg/manifests/system-microcode-intel.mf
index cafafa2448..bac6419d24 100644
--- a/usr/src/pkg/manifests/system-microcode-intel.mf
+++ b/usr/src/pkg/manifests/system-microcode-intel.mf
@@ -25,7 +25,7 @@
 # Copyright 2014 Gary Mills
 # Copyright 2019 Peter Tribble.
 # Copyright 2019 Joyent, Inc.
-# Copyright 2019 OmniOS Community Edition (OmniOSce) Association.
+# Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
 #
 
 #
@@ -35,7 +35,7 @@
 #
 <include global_zone_only_component>
 set name=pkg.fmri \
-    value=pkg:/system/microcode/intel@20191115,$(PKGVERS_BUILTON)-$(PKGVERS_BRANCH)
+    value=pkg:/system/microcode/intel@20200508,$(PKGVERS_BUILTON)-$(PKGVERS_BRANCH)
 set name=pkg.description value="Microcode for Intel CPUs"
 set name=org.opensolaris.incorp-facet value=true
 set name=variant.arch value=i386
diff --git a/usr/src/pkg/manifests/system-test-nettest.mf b/usr/src/pkg/manifests/system-test-nettest.mf
index acc4cab0c6..0d938e4fd3 100644
--- a/usr/src/pkg/manifests/system-test-nettest.mf
+++ b/usr/src/pkg/manifests/system-test-nettest.mf
@@ -11,11 +11,12 @@
 
 #
 # Copyright 2019 Joyent, Inc.
+# Copyright 2020 Oxide Computer Company
 #
 
 set name=pkg.fmri value=pkg:/system/test/nettest@$(PKGVERS)
-set name=pkg.description value="net-tests"
-set name=pkg.summary value="net-tests execution"
+set name=pkg.description value="Miscellaneous Network Unit Tests"
+set name=pkg.summary value="Network Unit Test Suite"
 set name=info.classification \
     value=org.opensolaris.category.2008:Development/System
 set name=variant.arch value=$(ARCH)
@@ -26,8 +27,10 @@ dir path=opt/net-tests/runfiles
 dir path=opt/net-tests/tests
 dir path=opt/net-tests/tests/forwarding
 file path=opt/net-tests/bin/nettest mode=0555
-file path=opt/net-tests/config/ip_forwarding.config
-file path=opt/net-tests/runfiles/default.run
+file path=opt/net-tests/config/ip_forwarding.config mode=0644 \
+    preserve=renamenew
+file path=opt/net-tests/runfiles/default.run mode=0444
+file path=opt/net-tests/tests/forwarding/README mode=0444
 file path=opt/net-tests/tests/forwarding/ip_forwarding mode=0555
 file path=opt/net-tests/tests/forwarding/ip_fwd_001 mode=0555
 file path=opt/net-tests/tests/forwarding/ip_fwd_002 mode=0555
@@ -50,5 +53,6 @@ file path=opt/net-tests/tests/forwarding/ip_fwd_018 mode=0555
 file path=opt/net-tests/tests/forwarding/ip_fwd_019 mode=0555
 file path=opt/net-tests/tests/forwarding/ip_fwd_020 mode=0555
 file path=opt/net-tests/tests/forwarding/ip_fwd_suite mode=0555
-file path=opt/net-tests/tests/forwarding/README
-file path=opt/net-tests/tests/net_common
+file path=opt/net-tests/tests/net_common mode=0555
+license lic_CDDL license=lic_CDDL
+depend fmri=system/test/testrunner type=require
diff --git a/usr/src/test/net-tests/config/Makefile b/usr/src/test/net-tests/config/Makefile
index c1d3f8c285..7151577083 100644
--- a/usr/src/test/net-tests/config/Makefile
+++ b/usr/src/test/net-tests/config/Makefile
@@ -20,7 +20,7 @@ ROOTOPTPKG = $(ROOT)/opt/net-tests
 ROOTOPTPKGCFG = $(ROOT)/opt/net-tests/config
 ROOTOPTPKGDIRS = $(ROOTOPTPKG) $(ROOTOPTPKGCFG)
 FILES = $(CFGS:%=$(ROOTOPTPKGCFG)/%)
-$(FILES) := FILEMODE = 0555
+$(FILES) := FILEMODE = 0644
 
 include $(SRC)/test/Makefile.com
 
diff --git a/usr/src/test/net-tests/runfiles/default.run b/usr/src/test/net-tests/runfiles/default.run
index c5c6c7dc91..cfc1a3df8d 100644
--- a/usr/src/test/net-tests/runfiles/default.run
+++ b/usr/src/test/net-tests/runfiles/default.run
@@ -16,7 +16,7 @@
 [DEFAULT]
 outputdir = /var/tmp/test_results
 quiet = False
-timeout = 60
+timeout = 300
 
 [/opt/net-tests/tests/forwarding]
 tests = [
diff --git a/usr/src/test/net-tests/tests/forwarding/README b/usr/src/test/net-tests/tests/forwarding/README
index b291d5d45b..dbe8774a22 100644
--- a/usr/src/test/net-tests/tests/forwarding/README
+++ b/usr/src/test/net-tests/tests/forwarding/README
@@ -101,9 +101,6 @@ to router via mac-loopback.
 Requirements
 ------------
 
-* These tests are currently SmartOS specific as they rely on simnet
-  extensions only found in illumos-joyent.
-
 * The client and server zones must provide `/usr/bin/socat`. It would
   be nice to use netcat but our native version is missing features
   like connection timeout.
diff --git a/usr/src/test/net-tests/tests/forwarding/ip_forwarding.ksh b/usr/src/test/net-tests/tests/forwarding/ip_forwarding.ksh
index d93260f86d..bf7a2255af 100644
--- a/usr/src/test/net-tests/tests/forwarding/ip_forwarding.ksh
+++ b/usr/src/test/net-tests/tests/forwarding/ip_forwarding.ksh
@@ -18,7 +18,7 @@
 #
 #     ip_forwarding.ksh -bcflnpuv <client> <router> <server>
 #
-#     Where client, router, and server are the UUIDs of three native
+#     Where client, router, and server are the names of three native
 #     zones. The user must create and start these zones; but other
 #     than that there is no special configuration required for them.
 #
@@ -113,7 +113,7 @@ nt_rx_ip_cksum=0
 nt_cleanup=1
 nt_cleanup_only=0
 
-nt_tdirprefix=/tmp/${nt_tname}
+nt_tdirprefix=/var/tmp/${nt_tname}
 nt_tdir=${nt_tdirprefix}.$$
 nt_dfile=${nt_tdir}/${nt_tname}.data
 nt_efile=${nt_tdir}/${nt_tname}-expected-sha1
@@ -230,9 +230,18 @@ if ((nt_cleanup_only == 1)); then
 	exit 0
 fi
 
-mkdir $nt_tdir
-zlogin $nt_client mkdir $nt_tdir
-zlogin $nt_server mkdir $nt_tdir
+if ! mkdir $nt_tdir; then
+	fail "failed to mkdir $nt_tdir in GZ"
+fi
+dbg "created dir $nt_tdir in GZ"
+if ! zlogin $nt_client mkdir $nt_tdir; then
+	fail "failed to mkdir $nt_tdir in $nt_client"
+fi
+dbg "created dir $nt_tdir in $nt_client"
+if ! zlogin $nt_server mkdir $nt_tdir; then
+	fail "failed to mkdir $nt_tdir in $nt_server"
+fi
+dbg "created dir $nt_tdir in $nt_server"
 
 trap cleanup ERR
 
diff --git a/usr/src/test/net-tests/tests/net_common.ksh b/usr/src/test/net-tests/tests/net_common.ksh
index 0742775193..b83cda8c97 100644
--- a/usr/src/test/net-tests/tests/net_common.ksh
+++ b/usr/src/test/net-tests/tests/net_common.ksh
@@ -178,10 +178,13 @@ function vnic_exists
 		fail "$0: incorrect number of args provided"
 	fi
 
-	if dladm show-vnic -z $zone $name > /dev/null 2>&1; then
-		typeset avid=$(dladm show-vnic -z $zone -p -o vid $name)
-		typeset aover=$(dladm show-vnic -z $zone -p -o over $name)
-		if (($avid == $vid)) && [ $aover == $over ]; then
+	if dladm show-vnic $name > /dev/null 2>&1; then
+		typeset avid=$(dladm show-vnic -p -o vid $name)
+		typeset aover=$(dladm show-vnic -p -o over $name)
+		typeset azone=$(dladm show-linkprop -cp zone -o value $name)
+		if (($avid == $vid)) && [ $aover == $over ] && \
+			   [ $azone == $zone ]
+		then
 			return 0
 		else
 			return 1
@@ -211,14 +214,31 @@ function create_vnic
 	fi
 
 	dbg "creating VNIC: $vnic_info"
-	if dladm create-vnic -t -p zone=$zone -l $over \
-		 $vid_opt $name > /dev/null 2>&1
+	if ! dladm create-vnic -t -l $over $vid_opt $name > /dev/null 2>&1
 	then
-		dbg "created VNIC: $vnic_info"
+		maybe_fail "$err"
+		return 1
+	fi
+
+	dbg "created VNIC: $vnic_info"
+	if ! zonecfg -z $zone "add net; set physical=$name; end"; then
+		maybe_fail "failed to assign $name to $zone"
+		return 1
+	fi
+
+	dbg "assigned VNIC $name to $zone"
+	if zoneadm -z $zone reboot; then
+		dbg "rebooted $zone"
+		#
+		# Make sure the vnic is visible before returning. Without this
+		# a create_addr command following immediately afterwards could
+		# fail because the zone is up but the vnic isn't visible yet.
+		#
+		sleep 1
 		return 0
 	fi
 
-	maybe_fail "$err"
+	maybe_fail "failed to reboot $zone"
 }
 
 function delete_vnic
@@ -235,8 +255,13 @@ function delete_vnic
 	fi
 
 	dbg "assigning VNIC $name from $zone to GZ"
-	if ! dladm set-linkprop -t -z $zone -p zone=global $name; then
-		maybe_fail "$err1"
+
+	if ! zonecfg -z $zone "remove net physical=$name"; then
+		maybe_fail "failed to remove $name from $zone"
+		return 1
+	fi
+	if ! zoneadm -z $zone reboot; then
+		maybe_fail "failed to reboot $zone"
 		return 1
 	fi
 
diff --git a/usr/src/test/zfs-tests/cmd/dir_rd_update/dir_rd_update.c b/usr/src/test/zfs-tests/cmd/dir_rd_update/dir_rd_update.c
index bca365c524..0283bc9644 100644
--- a/usr/src/test/zfs-tests/cmd/dir_rd_update/dir_rd_update.c
+++ b/usr/src/test/zfs-tests/cmd/dir_rd_update/dir_rd_update.c
@@ -63,6 +63,11 @@ main(int argc, char **argv)
 	}
 
 	cp1 = argv[1];
+	if (strlen(cp1) >= (sizeof (dirpath) - strlen("TMP_DIR"))) {
+		(void) printf("The string length of mount point is "
+		    "too large\n");
+		exit(-1);
+	}
 	(void) strcpy(&dirpath[0], (const char *)cp1);
 	(void) strcat(&dirpath[strlen(dirpath)], "TMP_DIR");
 
diff --git a/usr/src/uts/common/io/mac/mac.c b/usr/src/uts/common/io/mac/mac.c
index ee50778ebb..7d88ea2572 100644
--- a/usr/src/uts/common/io/mac/mac.c
+++ b/usr/src/uts/common/io/mac/mac.c
@@ -1753,7 +1753,7 @@ mac_client_clear_flow_cb(mac_client_handle_t mch)
 	flow_entry_t		*flent = mcip->mci_flent;
 
 	mutex_enter(&flent->fe_lock);
-	flent->fe_cb_fn = (flow_fn_t)mac_pkt_drop;
+	flent->fe_cb_fn = (flow_fn_t)mac_rx_def;
 	flent->fe_cb_arg1 = NULL;
 	flent->fe_cb_arg2 = NULL;
 	flent->fe_flags |= FE_MC_NO_DATAPATH;
@@ -4741,7 +4741,7 @@ mac_bridge_tx(mac_impl_t *mip, mac_ring_handle_t rh, mblk_t *mp)
 		 * The bridge may place this mblk on a provider's Tx
 		 * path, a mac's Rx path, or both. Since we don't have
 		 * enough information at this point, we can't be sure
-		 * that the desination(s) are capable of handling the
+		 * that the destination(s) are capable of handling the
 		 * hardware offloads requested by the mblk. We emulate
 		 * them here as it is the safest choice. In the
 		 * future, if bridge performance becomes a priority,
diff --git a/usr/src/uts/common/io/mac/mac_client.c b/usr/src/uts/common/io/mac/mac_client.c
index 1cb001fa6a..b166e7987a 100644
--- a/usr/src/uts/common/io/mac/mac_client.c
+++ b/usr/src/uts/common/io/mac/mac_client.c
@@ -1358,7 +1358,7 @@ mac_client_open(mac_handle_t mh, mac_client_handle_t *mchp, char *name,
 
 	mcip->mci_mip = mip;
 	mcip->mci_upper_mip = NULL;
-	mcip->mci_rx_fn = mac_pkt_drop;
+	mcip->mci_rx_fn = mac_rx_def;
 	mcip->mci_rx_arg = NULL;
 	mcip->mci_rx_p_fn = NULL;
 	mcip->mci_rx_p_arg = NULL;
@@ -1630,7 +1630,7 @@ mac_rx_set(mac_client_handle_t mch, mac_rx_t rx_fn, void *arg)
 void
 mac_rx_clear(mac_client_handle_t mch)
 {
-	mac_rx_set(mch, mac_pkt_drop, NULL);
+	mac_rx_set(mch, mac_rx_def, NULL);
 }
 
 void
@@ -1642,7 +1642,7 @@ mac_rx_barrier(mac_client_handle_t mch)
 	i_mac_perim_enter(mip);
 
 	/* If a RX callback is set, quiesce and restart that datapath */
-	if (mcip->mci_rx_fn != mac_pkt_drop) {
+	if (mcip->mci_rx_fn != mac_rx_def) {
 		mac_rx_client_quiesce(mch);
 		mac_rx_client_restart(mch);
 	}
@@ -2999,7 +2999,7 @@ mac_client_datapath_teardown(mac_client_handle_t mch, mac_unicast_impl_t *muip,
 	mac_misc_stat_delete(flent);
 
 	/* Initialize the receiver function to a safe routine */
-	flent->fe_cb_fn = (flow_fn_t)mac_pkt_drop;
+	flent->fe_cb_fn = (flow_fn_t)mac_rx_def;
 	flent->fe_cb_arg1 = NULL;
 	flent->fe_cb_arg2 = NULL;
 
@@ -4243,7 +4243,7 @@ mac_promisc_dispatch(mac_impl_t *mip, mblk_t *mp_chain,
 			    mpip->mpi_type == MAC_CLIENT_PROMISC_ALL ||
 			    is_mcast) {
 				mac_promisc_dispatch_one(mpip, mp, is_sender,
-					local);
+				    local);
 			}
 		}
 	}
@@ -4274,7 +4274,7 @@ mac_promisc_client_dispatch(mac_client_impl_t *mcip, mblk_t *mp_chain)
 			if (mpip->mpi_type == MAC_CLIENT_PROMISC_FILTERED &&
 			    !is_mcast) {
 				mac_promisc_dispatch_one(mpip, mp, B_FALSE,
-					B_FALSE);
+				    B_FALSE);
 			}
 		}
 	}
diff --git a/usr/src/uts/common/io/mac/mac_datapath_setup.c b/usr/src/uts/common/io/mac/mac_datapath_setup.c
index 46a58dbfaa..e1dbf9a953 100644
--- a/usr/src/uts/common/io/mac/mac_datapath_setup.c
+++ b/usr/src/uts/common/io/mac/mac_datapath_setup.c
@@ -3494,7 +3494,7 @@ mac_srs_free(mac_soft_ring_set_t *mac_srs)
 	ASSERT((mac_srs->srs_state & (SRS_CONDEMNED | SRS_CONDEMNED_DONE |
 	    SRS_PROC | SRS_PROC_FAST)) == (SRS_CONDEMNED | SRS_CONDEMNED_DONE));
 
-	mac_pkt_drop(NULL, NULL, mac_srs->srs_first, B_FALSE);
+	mac_drop_chain(mac_srs->srs_first, "SRS free");
 	mac_srs_ring_free(mac_srs);
 	mac_srs_soft_rings_free(mac_srs);
 	mac_srs_fanout_list_free(mac_srs);
diff --git a/usr/src/uts/common/io/mac/mac_flow.c b/usr/src/uts/common/io/mac/mac_flow.c
index 3813da7119..62612122d6 100644
--- a/usr/src/uts/common/io/mac/mac_flow.c
+++ b/usr/src/uts/common/io/mac/mac_flow.c
@@ -230,7 +230,7 @@ mac_flow_create(flow_desc_t *fd, mac_resource_props_t *mrp, char *name,
 		cv_init(&flent->fe_cv, NULL, CV_DEFAULT, NULL);
 
 		/* Initialize the receiver function to a safe routine */
-		flent->fe_cb_fn = (flow_fn_t)mac_pkt_drop;
+		flent->fe_cb_fn = (flow_fn_t)mac_rx_def;
 		flent->fe_index = -1;
 	}
 	(void) strlcpy(flent->fe_flow_name, name, MAXFLOWNAMELEN);
diff --git a/usr/src/uts/common/io/mac/mac_sched.c b/usr/src/uts/common/io/mac/mac_sched.c
index 3502911efc..8f983e50e4 100644
--- a/usr/src/uts/common/io/mac/mac_sched.c
+++ b/usr/src/uts/common/io/mac/mac_sched.c
@@ -1328,7 +1328,7 @@ int mac_srs_worker_wakeup_ticks = 0;
 			 * b_prev may be set to the fanout hint		\
 			 * hence can't use freemsg directly		\
 			 */						\
-			mac_pkt_drop(NULL, NULL, mp_chain, B_FALSE);	\
+			mac_drop_chain(mp_chain, "SRS Tx max queue");	\
 			DTRACE_PROBE1(tx_queued_hiwat,			\
 			    mac_soft_ring_set_t *, srs);		\
 			enqueue = 0;					\
@@ -1347,8 +1347,8 @@ int mac_srs_worker_wakeup_ticks = 0;
 	if (!(srs->srs_type & SRST_TX))					\
 		mutex_exit(&srs->srs_bw->mac_bw_lock);
 
-#define	MAC_TX_SRS_DROP_MESSAGE(srs, mp, cookie) {		\
-	mac_pkt_drop(NULL, NULL, mp, B_FALSE);			\
+#define	MAC_TX_SRS_DROP_MESSAGE(srs, chain, cookie, s) {	\
+	mac_drop_chain((chain), (s));				\
 	/* increment freed stats */				\
 	(srs)->srs_tx.st_stat.mts_sdrops++;			\
 	(cookie) = (mac_tx_cookie_t)(srs);			\
@@ -2894,7 +2894,7 @@ again:
 		mac_srs->srs_bw->mac_bw_sz -= sz;
 		mac_srs->srs_bw->mac_bw_drop_bytes += sz;
 		mutex_exit(&mac_srs->srs_bw->mac_bw_lock);
-		mac_pkt_drop(NULL, NULL, head, B_FALSE);
+		mac_drop_chain(head, "Rx no bandwidth");
 		goto leave_poll;
 	} else {
 		mutex_exit(&mac_srs->srs_bw->mac_bw_lock);
@@ -3339,7 +3339,7 @@ mac_rx_srs_process(void *arg, mac_resource_handle_t srs, mblk_t *mp_chain,
 			mac_bw->mac_bw_drop_bytes += sz;
 			mutex_exit(&mac_bw->mac_bw_lock);
 			mutex_exit(&mac_srs->srs_lock);
-			mac_pkt_drop(NULL, NULL, mp_chain, B_FALSE);
+			mac_drop_chain(mp_chain, "Rx no bandwidth");
 			return;
 		} else {
 			if ((mac_bw->mac_bw_sz + sz) <=
@@ -3461,7 +3461,8 @@ mac_tx_srs_no_desc(mac_soft_ring_set_t *mac_srs, mblk_t *mp_chain,
 
 	ASSERT(tx_mode == SRS_TX_DEFAULT || tx_mode == SRS_TX_BW);
 	if (flag & MAC_DROP_ON_NO_DESC) {
-		MAC_TX_SRS_DROP_MESSAGE(mac_srs, mp_chain, cookie);
+		MAC_TX_SRS_DROP_MESSAGE(mac_srs, mp_chain, cookie,
+		    "Tx no desc");
 	} else {
 		if (mac_srs->srs_first != NULL)
 			wakeup_worker = B_FALSE;
@@ -3524,7 +3525,8 @@ mac_tx_srs_enqueue(mac_soft_ring_set_t *mac_srs, mblk_t *mp_chain,
 	MAC_COUNT_CHAIN(mac_srs, mp_chain, tail, cnt, sz);
 	if (flag & MAC_DROP_ON_NO_DESC) {
 		if (mac_srs->srs_count > mac_srs->srs_tx.st_hiwat) {
-			MAC_TX_SRS_DROP_MESSAGE(mac_srs, mp_chain, cookie);
+			MAC_TX_SRS_DROP_MESSAGE(mac_srs, mp_chain, cookie,
+			    "Tx SRS hiwat");
 		} else {
 			MAC_TX_SRS_ENQUEUE_CHAIN(mac_srs,
 			    mp_chain, tail, cnt, sz);
@@ -3897,7 +3899,8 @@ mac_tx_bw_mode(mac_soft_ring_set_t *mac_srs, mblk_t *mp_chain,
 			cookie = (mac_tx_cookie_t)mac_srs;
 			*ret_mp = mp_chain;
 		} else {
-			MAC_TX_SRS_DROP_MESSAGE(mac_srs, mp_chain, cookie);
+			MAC_TX_SRS_DROP_MESSAGE(mac_srs, mp_chain, cookie,
+			    "Tx no bandwidth");
 		}
 		mutex_exit(&mac_srs->srs_lock);
 		return (cookie);
@@ -4440,9 +4443,9 @@ mac_tx_send(mac_client_handle_t mch, mac_ring_handle_t ring, mblk_t *mp_chain,
 				mac_hw_emul(&mp, NULL, NULL, MAC_ALL_EMULS);
 				if (mp != NULL) {
 					(dst_flow_ent->fe_cb_fn)(
-						dst_flow_ent->fe_cb_arg1,
-						dst_flow_ent->fe_cb_arg2,
-						mp, do_switch);
+					    dst_flow_ent->fe_cb_arg1,
+					    dst_flow_ent->fe_cb_arg2,
+					    mp, do_switch);
 				}
 
 			}
@@ -4801,7 +4804,7 @@ mac_tx_sring_enqueue(mac_soft_ring_t *ringp, mblk_t *mp_chain, uint16_t flag,
 	ASSERT(MUTEX_HELD(&ringp->s_ring_lock));
 	MAC_COUNT_CHAIN(mac_srs, mp_chain, tail, cnt, sz);
 	if (flag & MAC_DROP_ON_NO_DESC) {
-		mac_pkt_drop(NULL, NULL, mp_chain, B_FALSE);
+		mac_drop_chain(mp_chain, "Tx softring no desc");
 		/* increment freed stats */
 		ringp->s_ring_drops += cnt;
 		cookie = (mac_tx_cookie_t)ringp;
@@ -4845,8 +4848,8 @@ mac_tx_sring_enqueue(mac_soft_ring_t *ringp, mblk_t *mp_chain, uint16_t flag,
 					 * b_prev may be set to the fanout hint
 					 * hence can't use freemsg directly
 					 */
-					mac_pkt_drop(NULL, NULL,
-					    mp_chain, B_FALSE);
+					mac_drop_chain(mp_chain,
+					    "Tx softring max queue");
 					DTRACE_PROBE1(tx_queued_hiwat,
 					    mac_soft_ring_t *, ringp);
 					enqueue = B_FALSE;
diff --git a/usr/src/uts/common/io/mac/mac_soft_ring.c b/usr/src/uts/common/io/mac/mac_soft_ring.c
index f4d2a5ee81..c8a16e6fd3 100644
--- a/usr/src/uts/common/io/mac/mac_soft_ring.c
+++ b/usr/src/uts/common/io/mac/mac_soft_ring.c
@@ -242,7 +242,7 @@ mac_soft_ring_free(mac_soft_ring_t *softring)
 	ASSERT((softring->s_ring_state &
 	    (S_RING_CONDEMNED | S_RING_CONDEMNED_DONE | S_RING_PROC)) ==
 	    (S_RING_CONDEMNED | S_RING_CONDEMNED_DONE));
-	mac_pkt_drop(NULL, NULL, softring->s_ring_first, B_FALSE);
+	mac_drop_chain(softring->s_ring_first, "softring free");
 	softring->s_ring_tx_arg2 = NULL;
 	mac_soft_ring_stat_delete(softring);
 	mac_callback_free(softring->s_ring_notify_cb_list);
diff --git a/usr/src/uts/common/io/mac/mac_util.c b/usr/src/uts/common/io/mac/mac_util.c
index bee11377f8..03da3a3504 100644
--- a/usr/src/uts/common/io/mac/mac_util.c
+++ b/usr/src/uts/common/io/mac/mac_util.c
@@ -76,7 +76,7 @@
  */
 
 /*PRINTFLIKE2*/
-static void
+void
 mac_drop_pkt(mblk_t *mp, const char *fmt, ...)
 {
 	va_list adx;
@@ -93,6 +93,31 @@ mac_drop_pkt(mblk_t *mp, const char *fmt, ...)
 	freemsg(mp);
 }
 
+/*PRINTFLIKE2*/
+void
+mac_drop_chain(mblk_t *chain, const char *fmt, ...)
+{
+	va_list adx;
+	char msg[128];
+	char *msgp = msg;
+
+	va_start(adx, fmt);
+	(void) vsnprintf(msgp, sizeof (msg), fmt, adx);
+	va_end(adx);
+
+	/*
+	 * We could use freemsgchain() for the actual freeing but
+	 * since we are already walking the chain to fire the dtrace
+	 * probe we might as well free the msg here too.
+	 */
+	for (mblk_t *mp = chain, *next; mp != NULL; ) {
+		next = mp->b_next;
+		DTRACE_PROBE2(mac__drop, mblk_t *, mp, char *, msgp);
+		freemsg(mp);
+		mp = next;
+	}
+}
+
 /*
  * Copy an mblk, preserving its hardware checksum flags.
  */
@@ -233,7 +258,7 @@ bail:
 static boolean_t
 mac_sw_cksum_ipv6(mblk_t *mp, uint32_t ip_hdr_offset, const char **err)
 {
-	ip6_t* ip6h = (ip6_t *)(mp->b_rptr + ip_hdr_offset);
+	ip6_t *ip6h = (ip6_t *)(mp->b_rptr + ip_hdr_offset);
 	const uint8_t proto = ip6h->ip6_nxt;
 	const uint16_t *iphs = (uint16_t *)ip6h;
 	/* ULP offset from start of L2. */
@@ -1543,17 +1568,10 @@ mac_strip_vlan_tag_chain(mblk_t *mp_chain)
  */
 /* ARGSUSED */
 void
-mac_pkt_drop(void *arg, mac_resource_handle_t resource, mblk_t *mp,
+mac_rx_def(void *arg, mac_resource_handle_t resource, mblk_t *mp_chain,
     boolean_t loopback)
 {
-	mblk_t  *mp1 = mp;
-
-	while (mp1 != NULL) {
-		mp1->b_prev = NULL;
-		mp1->b_queue = NULL;
-		mp1 = mp1->b_next;
-	}
-	freemsgchain(mp);
+	freemsgchain(mp_chain);
 }
 
 /*
diff --git a/usr/src/uts/common/io/simnet/simnet.c b/usr/src/uts/common/io/simnet/simnet.c
index efce703cb7..7fb48c90e4 100644
--- a/usr/src/uts/common/io/simnet/simnet.c
+++ b/usr/src/uts/common/io/simnet/simnet.c
@@ -693,7 +693,7 @@ simnet_rx(void *arg)
 
 	/* Check for valid packet header */
 	if (mac_header_info(sdev->sd_mh, mp, &hdr_info) != 0) {
-		freemsg(mp);
+		mac_drop_pkt(mp, "invalid L2 header");
 		sdev->sd_stats.recv_errors++;
 		goto rx_done;
 	}
@@ -754,7 +754,7 @@ simnet_m_tx(void *arg, mblk_t *mp_chain)
 	if ((sdev_rx = sdev->sd_peer_dev) == NULL) {
 		/* Discard packets when no peer exists */
 		rw_exit(&simnet_dev_lock);
-		freemsgchain(mp_chain);
+		mac_drop_chain(mp_chain, "no peer");
 		return (NULL);
 	}
 
@@ -771,14 +771,14 @@ simnet_m_tx(void *arg, mblk_t *mp_chain)
 	 */
 	if (!simnet_thread_ref(sdev_rx)) {
 		rw_exit(&simnet_dev_lock);
-		freemsgchain(mp_chain);
+		mac_drop_chain(mp_chain, "simnet peer dev not ready");
 		return (NULL);
 	}
 	rw_exit(&simnet_dev_lock);
 
 	if (!simnet_thread_ref(sdev)) {
 		simnet_thread_unref(sdev_rx);
-		freemsgchain(mp_chain);
+		mac_drop_chain(mp_chain, "simnet dev not ready");
 		return (NULL);
 	}
 
@@ -798,7 +798,7 @@ simnet_m_tx(void *arg, mblk_t *mp_chain)
 			mp_new = allocb(size, BPRI_HI);
 			if (mp_new == NULL) {
 				sdev->sd_stats.xmit_errors++;
-				freemsg(mp);
+				mac_drop_pkt(mp, "allocb failed");
 				continue;
 			}
 			bzero(mp_new->b_wptr, size);
@@ -814,7 +814,7 @@ simnet_m_tx(void *arg, mblk_t *mp_chain)
 		/* Pullup packet into a single mblk */
 		if ((nmp = msgpullup(mp, -1)) == NULL) {
 			sdev->sd_stats.xmit_errors++;
-			freemsg(mp);
+			mac_drop_pkt(mp, "msgpullup failed");
 			continue;
 		} else {
 			mac_hcksum_clone(mp, nmp);
@@ -824,8 +824,8 @@ simnet_m_tx(void *arg, mblk_t *mp_chain)
 
 		/* Hold reference for taskq receive processing per-pkt */
 		if (!simnet_thread_ref(sdev_rx)) {
-			freemsg(mp);
-			freemsgchain(mpnext);
+			mac_drop_pkt(mp, "failed to get thread ref");
+			mac_drop_chain(mpnext, "failed to get thread ref");
 			break;
 		}
 
diff --git a/usr/src/uts/common/io/stream.c b/usr/src/uts/common/io/stream.c
index 55fd87db45..288f77ae47 100644
--- a/usr/src/uts/common/io/stream.c
+++ b/usr/src/uts/common/io/stream.c
@@ -839,7 +839,7 @@ frnop_func(void *arg)
  */
 static mblk_t *
 gesballoc(unsigned char *base, size_t size, uint32_t db_rtfu, frtn_t *frp,
-	void (*lastfree)(mblk_t *, dblk_t *), int kmflags)
+    void (*lastfree)(mblk_t *, dblk_t *), int kmflags)
 {
 	dblk_t *dbp;
 	mblk_t *mp;
diff --git a/usr/src/uts/common/sys/mac_impl.h b/usr/src/uts/common/sys/mac_impl.h
index f1b119653f..21f2c10a8e 100644
--- a/usr/src/uts/common/sys/mac_impl.h
+++ b/usr/src/uts/common/sys/mac_impl.h
@@ -290,54 +290,6 @@ struct mac_group_s {
 #define	GROUP_INTR_ENABLE_FUNC(g)	(g)->mrg_info.mgi_intr.mi_enable
 #define	GROUP_INTR_DISABLE_FUNC(g)	(g)->mrg_info.mgi_intr.mi_disable
 
-#define	MAC_RING_TX(mhp, rh, mp, rest) {				\
-	mac_ring_handle_t mrh = rh;					\
-	mac_impl_t *mimpl = (mac_impl_t *)mhp;				\
-	/*								\
-	 * Send packets through a selected tx ring, or through the	\
-	 * default handler if there is no selected ring.		\
-	 */								\
-	if (mrh == NULL)						\
-		mrh = mimpl->mi_default_tx_ring;			\
-	if (mrh == NULL) {						\
-		rest = mimpl->mi_tx(mimpl->mi_driver, mp);		\
-	} else {							\
-		rest = mac_hwring_tx(mrh, mp);				\
-	}								\
-}
-
-/*
- * This is the final stop before reaching the underlying driver
- * or aggregation, so this is where the bridging hook is implemented.
- * Packets that are bridged will return through mac_bridge_tx(), with
- * rh nulled out if the bridge chooses to send output on a different
- * link due to forwarding.
- */
-#define	MAC_TX(mip, rh, mp, src_mcip) {					\
-	mac_ring_handle_t	rhandle = (rh);				\
-	/*								\
-	 * If there is a bound Hybrid I/O share, send packets through	\
-	 * the default tx ring. (When there's a bound Hybrid I/O share,	\
-	 * the tx rings of this client are mapped in the guest domain	\
-	 * and not accessible from here.)				\
-	 */								\
-	_NOTE(CONSTANTCONDITION)					\
-	if ((src_mcip)->mci_state_flags & MCIS_SHARE_BOUND)		\
-		rhandle = (mip)->mi_default_tx_ring;			\
-	if (mip->mi_promisc_list != NULL)				\
-		mac_promisc_dispatch(mip, mp, src_mcip);		\
-	/*								\
-	 * Grab the proper transmit pointer and handle. Special		\
-	 * optimization: we can test mi_bridge_link itself atomically,	\
-	 * and if that indicates no bridge send packets through tx ring.\
-	 */								\
-	if (mip->mi_bridge_link == NULL) {				\
-		MAC_RING_TX(mip, rhandle, mp, mp);			\
-	} else {							\
-		mp = mac_bridge_tx(mip, rhandle, mp);			\
-	}								\
-}
-
 /* mci_tx_flag */
 #define	MCI_TX_QUIESCE	0x1
 
@@ -726,6 +678,18 @@ typedef struct mac_client_impl_s mac_client_impl_t;
 extern void	mac_init(void);
 extern int	mac_fini(void);
 
+/*
+ * MAC packet/chain drop functions to aggregate all dropped-packet
+ * debugging to a single surface.
+ */
+/*PRINTFLIKE2*/
+extern void	mac_drop_pkt(mblk_t *, const char *, ...)
+    __KPRINTFLIKE(2);
+
+/*PRINTFLIKE2*/
+extern void	mac_drop_chain(mblk_t *, const char *, ...)
+    __KPRINTFLIKE(2);
+
 extern void	mac_ndd_ioctl(mac_impl_t *, queue_t *, mblk_t *);
 extern boolean_t mac_ip_hdr_length_v6(ip6_t *, uint8_t *, uint16_t *,
     uint8_t *, ip6_frag_t **);
@@ -839,7 +803,7 @@ extern void mac_flow_set_name(flow_entry_t *, const char *);
 extern mblk_t *mac_add_vlan_tag(mblk_t *, uint_t, uint16_t);
 extern mblk_t *mac_add_vlan_tag_chain(mblk_t *, uint_t, uint16_t);
 extern mblk_t *mac_strip_vlan_tag_chain(mblk_t *);
-extern void mac_pkt_drop(void *, mac_resource_handle_t, mblk_t *, boolean_t);
+extern void mac_rx_def(void *, mac_resource_handle_t, mblk_t *, boolean_t);
 extern mblk_t *mac_rx_flow(mac_handle_t, mac_resource_handle_t, mblk_t *);
 
 extern void i_mac_share_alloc(mac_client_impl_t *);
diff --git a/usr/src/uts/i86pc/io/gfx_private/gfxp_bitmap.c b/usr/src/uts/i86pc/io/gfx_private/gfxp_bitmap.c
index 2fed9f162c..1a11d7ff0f 100644
--- a/usr/src/uts/i86pc/io/gfx_private/gfxp_bitmap.c
+++ b/usr/src/uts/i86pc/io/gfx_private/gfxp_bitmap.c
@@ -450,10 +450,10 @@ bitmap_cons_clear(struct gfxp_fb_softc *softc, struct vis_consclear *ca)
 		for (i = 0; i < console->fb.screen.y; i++) {
 			if (softc->mode == KD_TEXT) {
 				fb = console->fb.fb + i * pitch;
-				(void) memset(fb, ca->bg_color, pitch);
+				(void) memset(fb, data, pitch);
 			}
 			fb = console->fb.shadow_fb + i * pitch;
-			(void) memset(fb, ca->bg_color, pitch);
+			(void) memset(fb, data, pitch);
 		}
 		break;
 	case 15: