14579 expose virtio 9P transport device

Reviewed by: Andy Fiddaman <andy@omnios.org>
Reviewed by: Dan McDonald <danmcd@mnx.io>
Reviewed by: Gordon Ross <Gordon.W.Ross@gmail.com>
Reviewed by: Robert Mustacchi <rm@fingolfin.org>
Approved by: Garrett D'Amore <garrett@damore.org>

18 files changed, 1334 insertions, 20 deletions

diff --git a/usr/src/cmd/devfsadm/misc_link.c b/usr/src/cmd/devfsadm/misc_link.c
index 9172238f7e..46ff016ab7 100644
--- a/usr/src/cmd/devfsadm/misc_link.c
+++ b/usr/src/cmd/devfsadm/misc_link.c
@@ -23,6 +23,7 @@
  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2015, Joyent, Inc. All rights reserved.
  * Copyright 2022 Garrett D'Amore <garrett@damore.org>
+ * Copyright 2022 Oxide Computer Company
  */
 
 #include <regex.h>
@@ -58,6 +59,7 @@ static int cpuid(di_minor_t minor, di_node_t node);
 static int glvc(di_minor_t minor, di_node_t node);
 static int ses_callback(di_minor_t minor, di_node_t node);
 static int kmdrv_create(di_minor_t minor, di_node_t node);
+static int vio9p_create(di_minor_t minor, di_node_t node);
 
 static devfsadm_create_t misc_cbt[] = {
 	{ "pseudo", "ddi_pseudo", "(^sad$)",
@@ -207,7 +209,10 @@ static devfsadm_create_t misc_cbt[] = {
 	},
 	{ "pseudo", "ddi_pseudo", "overlay",
 	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, minor_name
-	}
+	},
+	{ "9p", "ddi_pseudo", "vio9p",
+	    TYPE_EXACT | DRV_EXACT, ILEVEL_0, vio9p_create,
+	},
 };
 
 DEVFSADM_CREATE_INIT_V0(misc_cbt);
@@ -246,7 +251,10 @@ static devfsadm_remove_t misc_remove_cbt[] = {
 	},
 	{ "pseudo", "^sctp|sctp6$",
 	    RM_PRE | RM_ALWAYS, ILEVEL_0, devfsadm_rm_link
-	}
+	},
+	{ "9p", "^9p/[0-9]+$",
+	    RM_PRE | RM_HOT | RM_ALWAYS, ILEVEL_0, devfsadm_rm_all
+	},
 };
 
 /* Rules for gpio devices */
@@ -632,6 +640,26 @@ av_create(di_minor_t minor, di_node_t node)
 }
 
 /*
+ * Create device nodes for Virtio 9P channels:
+ *	/dev/9p/[0-9]+
+ */
+static int
+vio9p_create(di_minor_t minor, di_node_t node)
+{
+	char *minor_name = di_minor_name(minor);
+	char path[PATH_MAX + 1];
+
+	if (minor_name == NULL || strcmp(minor_name, "9p") != 0) {
+		return (DEVFSADM_CONTINUE);
+	}
+
+	(void) snprintf(path, sizeof (path), "9p/%d", di_instance(node));
+	(void) devfsadm_mklink(path, node, minor, 0);
+
+	return (DEVFSADM_CONTINUE);
+}
+
+/*
  * Creates /dev/lom and /dev/tsalarm:ctl for tsalarm node
  */
 static int
diff --git a/usr/src/man/man4d/Makefile b/usr/src/man/man4d/Makefile
index f60dc389b7..0eb6bab297 100644
--- a/usr/src/man/man4d/Makefile
+++ b/usr/src/man/man4d/Makefile
@@ -16,8 +16,8 @@
 # Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
 # Copyright 2018 Nexenta Systems, Inc.
 # Copyright 2020 Peter Tribble
-# Copyright 2021 Oxide Computer Company
 # Copyright 2022 RackTop Systems, Inc.
+# Copyright 2022 Oxide Computer Company
 #
 
 include		$(SRC)/Makefile.master
@@ -239,6 +239,7 @@ i386_MANFILES=	ahci.4d		\
 		ural.4d		\
 		urtw.4d		\
 		usmn.4d		\
+		vio9p.4d	\
 		vioblk.4d	\
 		vioif.4d	\
 		vioscsi.4d	\
diff --git a/usr/src/man/man4d/vio9p.4d b/usr/src/man/man4d/vio9p.4d
new file mode 100644
index 0000000000..80952da799
--- /dev/null
+++ b/usr/src/man/man4d/vio9p.4d
@@ -0,0 +1,141 @@
+.\"
+.\" This file and its contents are supplied under the terms of the
+.\" Common Development and Distribution License ("CDDL"), version 1.0.
+.\" You may only use this file in accordance with the terms of version
+.\" 1.0 of the CDDL.
+.\"
+.\" A full copy of the text of the CDDL should have accompanied this
+.\" source.  A copy of the CDDL is also available via the Internet at
+.\" http://www.illumos.org/license/CDDL.
+.\"
+.\"
+.\" Copyright 2022 Oxide Computer Company
+.\"
+.Dd August 1, 2022
+.Dt VIO9P 4D
+.Os
+.Sh NAME
+.Nm vio9p
+.Nd Virtio 9P Transport Driver
+.Sh SYNOPSIS
+.Pa /dev/9p/*
+.Sh DESCRIPTION
+The
+.Nm
+driver provides access to 9P transport devices commonly used by hypervisors
+and emulators to expose a shared file system.
+.Pp
+The
+.Nm
+driver is not a
+.Sy Committed
+interface, and may change at any time.
+.Sh APPLICATION PROGRAMMING INTERFACE
+Each device corresponds to a specific 9P channel, providing exclusive access to
+one consumer at a time.
+The device may be opened with an
+.Xr open 2
+call, which must include at least the
+.Dv O_EXCL
+and
+.Dv O_RDWR
+flags.
+The
+.Dv O_NONBLOCK
+or
+.Dv O_NDELAY
+flags may be used if non-blocking reads and writes are required.
+.Pp
+Once open,
+.Xr read 2
+and
+.Xr write 2
+calls may be made against the resulting file descriptor.
+Writes represent a 9P request message sent to the hypervisor, and reads
+represent responses to those requests.
+.Pp
+Unlike with other transports like TCP, the channel is not explicitly reset when
+the device is opened or closed.
+After a call to
+.Xr open 2 ,
+the application should use a
+.Sy version
+message to open a new session.
+This will explicitly discard any previous session, clunking any active fids in
+the process and negotiating an appropriate protocol version with the
+hypervisor.
+It is likely also appropriate to do this as part of closing the device, to
+allow the hypervisor to free any session tracking resources.
+.Pp
+Writes must be well-formed 9P messages, conforming to whichever 9P protocol
+specification is used by the hypervisor.
+In particular, each message must include a minimum of seven bytes, representing
+the message
+.Em size[4] ,
+.Em type[1] ,
+and
+.Em tag[2] .
+In most or all available protocol specifications, these fields are unsigned
+integers in little-endian order.
+The driver limits request and response size to 8192 bytes, and will fail larger
+writes with
+.Er EMSGSIZE .
+Applications should, in their initial
+.Sy version
+message,
+negotiate an
+.Em msize[4]
+value less than or equal to 8192 bytes.
+.Pp
+Reads are interruptible and will block waiting for a response to a request sent
+in a previous write.
+If insufficient buffer space is provided to the read call to receive the
+message, the call will fail with
+.Er EOVERFLOW
+and the message will remain available for a subsequent read.
+Messages are provided as-is to the application, including the
+.Em size[4] ,
+.Em type[1] ,
+and
+.Em tag[2] .
+.Pp
+Depending on the 9P server provided by the hypervisor, requests that are issued
+concurrently may result in responses that arrive out of order.
+Applications should develop a strategy for allocating unique
+.Em tag[2]
+values, so that request and response messages can be correlated.
+.Sh IOCTLS
+The driver provides an ioctl,
+.Dv VIO9P_IOC_MOUNT_TAG ,
+to expose the
+.Em Mount Tag
+string if one was provided by the hypervisor.
+The ioctl is defined in
+.In sys/vio9p.h .
+The argument must be a
+.Vt "char *" ,
+pointing to a buffer of
+.Dv VIO9P_MOUNT_TAG_SIZE
+bytes.
+On success, the buffer will contain the mount tag string as read from the
+hypervisor, followed by a null-terminating zero byte added by the driver to
+ensure the result can always be treated as a C string.
+While the hypervisor is expected to provide a human-readable C string,
+applications should take care to verify that the contents are valid for display
+or other purposes.
+Note that even if successfully read, the string may be empty.
+.Sh FILES
+.Bl -tag -width Pa
+.It Pa /dev/9p/*
+Character device for access to a 9P channel.
+.It Pa /kernel/drv/amd64/vio9p
+Device driver (x86)
+.El
+.Sh INTERFACE STABILITY
+.Sy Uncommitted
+.Sh SEE ALSO
+.Xr close 2 ,
+.Xr ioctl 2 ,
+.Xr open 2 ,
+.Xr read 2 ,
+.Xr write 2
diff --git a/usr/src/pkg/manifests/driver-storage-vio9p.p5m b/usr/src/pkg/manifests/driver-storage-vio9p.p5m
new file mode 100644
index 0000000000..f4ce42c1a6
--- /dev/null
+++ b/usr/src/pkg/manifests/driver-storage-vio9p.p5m
@@ -0,0 +1,40 @@
+#
+# CDDL HEADER START
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2022 Oxide Computer Company
+#
+
+#
+# The default for payload-bearing actions in this package is to appear in the
+# global zone only.  See the include file for greater detail, as well as
+# information about overriding the defaults.
+#
+<include global_zone_only_component>
+set name=pkg.fmri value=pkg:/driver/storage/vio9p@$(PKGVERS)
+set name=pkg.summary value="Virtio 9P transport driver"
+set name=pkg.description value="Virtio 9P transport driver"
+set name=info.classification value=org.opensolaris.category.2008:Drivers/Storage
+set name=variant.arch value=$(ARCH)
+dir  path=kernel group=sys
+dir  path=kernel/drv group=sys
+dir  path=kernel/drv/$(ARCH64) group=sys
+file path=kernel/drv/$(ARCH64)/vio9p group=sys
+file path=usr/include/sys/vio9p.h
+dir  path=usr/share/man
+dir  path=usr/share/man/man4d
+file path=usr/share/man/man4d/vio9p.4d
+driver name=vio9p perms="* 0600 root root" alias=pci1af4,9
+license lic_CDDL license=lic_CDDL
diff --git a/usr/src/uts/common/Makefile.files b/usr/src/uts/common/Makefile.files
index b8cad13069..506454f404 100644
--- a/usr/src/uts/common/Makefile.files
+++ b/usr/src/uts/common/Makefile.files
@@ -2104,6 +2104,9 @@ VIOIF_OBJS = vioif.o
 # Virtio SCSI driver
 VIOSCSI_OBJS = vioscsi.o
 
+# Virtio 9P transport driver
+VIO9P_OBJS = vio9p.o
+
 #
 #	kiconv modules
 #
diff --git a/usr/src/uts/common/Makefile.rules b/usr/src/uts/common/Makefile.rules
index 8a7e11e34c..78bee80f0d 100644
--- a/usr/src/uts/common/Makefile.rules
+++ b/usr/src/uts/common/Makefile.rules
@@ -1533,6 +1533,10 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/vioscsi/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/vio9p/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(COMMONBASE)/idspace/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
diff --git a/usr/src/uts/common/io/vio9p/vio9p.c b/usr/src/uts/common/io/vio9p/vio9p.c
new file mode 100644
index 0000000000..5302043365
--- /dev/null
+++ b/usr/src/uts/common/io/vio9p/vio9p.c
@@ -0,0 +1,839 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2022 Oxide Computer Company
+ */
+
+/*
+ * VIRTIO 9P DRIVER
+ *
+ * This driver provides support for Virtio 9P devices.  Each driver instance
+ * attaches to a single underlying 9P channel.  A 9P file system will use LDI
+ * to open this device.
+ */
+
+#include <sys/modctl.h>
+#include <sys/types.h>
+#include <sys/file.h>
+#include <sys/errno.h>
+#include <sys/param.h>
+#include <sys/stropts.h>
+#include <sys/stream.h>
+#include <sys/strsubr.h>
+#include <sys/kmem.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/conf.h>
+#include <sys/devops.h>
+#include <sys/ksynch.h>
+#include <sys/stat.h>
+#include <sys/modctl.h>
+#include <sys/debug.h>
+#include <sys/pci.h>
+#include <sys/containerof.h>
+#include <sys/ctype.h>
+#include <sys/stdbool.h>
+#include <sys/sysmacros.h>
+#include <sys/list.h>
+
+#include "virtio.h"
+#include "vio9p_impl.h"
+
+static void *vio9p_state;
+
+uint_t vio9p_int_handler(caddr_t, caddr_t);
+static uint_t vio9p_poll(vio9p_t *);
+static int vio9p_quiesce(dev_info_t *);
+static int vio9p_attach(dev_info_t *, ddi_attach_cmd_t);
+static int vio9p_teardown(vio9p_t *, vio9p_teardown_style_t);
+static int vio9p_detach(dev_info_t *, ddi_detach_cmd_t);
+static int vio9p_open(dev_t *, int, int, cred_t *);
+static int vio9p_ioctl(dev_t, int, intptr_t, int, cred_t *, int *);
+static int vio9p_close(dev_t, int, int, cred_t *);
+static int vio9p_read(dev_t, uio_t *, cred_t *);
+static int vio9p_write(dev_t, uio_t *, cred_t *);
+static vio9p_req_t *vio9p_req_alloc_impl(vio9p_t *, int);
+static void vio9p_req_free_impl(vio9p_t *, vio9p_req_t *);
+
+static struct cb_ops vio9p_cb_ops = {
+	.cb_rev =			CB_REV,
+	.cb_flag =			D_NEW | D_MP,
+
+	.cb_open =			vio9p_open,
+	.cb_close =			vio9p_close,
+	.cb_read =			vio9p_read,
+	.cb_write =			vio9p_write,
+	.cb_ioctl =			vio9p_ioctl,
+
+	.cb_strategy =			nodev,
+	.cb_print =			nodev,
+	.cb_dump =			nodev,
+	.cb_devmap =			nodev,
+	.cb_mmap =			nodev,
+	.cb_segmap =			nodev,
+	.cb_chpoll =			nochpoll,
+	.cb_prop_op =			ddi_prop_op,
+	.cb_str =			NULL,
+	.cb_aread =			nodev,
+	.cb_awrite =			nodev,
+};
+
+static struct dev_ops vio9p_dev_ops = {
+	.devo_rev =			DEVO_REV,
+	.devo_refcnt =			0,
+
+	.devo_attach =			vio9p_attach,
+	.devo_detach =			vio9p_detach,
+	.devo_quiesce =			vio9p_quiesce,
+
+	.devo_cb_ops =			&vio9p_cb_ops,
+
+	.devo_getinfo =			ddi_no_info,
+	.devo_identify =		nulldev,
+	.devo_probe =			nulldev,
+	.devo_reset =			nodev,
+	.devo_bus_ops =			NULL,
+	.devo_power =			NULL,
+};
+
+static struct modldrv vio9p_modldrv = {
+	.drv_modops =			&mod_driverops,
+	.drv_linkinfo =			"VIRTIO 9P driver",
+	.drv_dev_ops =			&vio9p_dev_ops
+};
+
+static struct modlinkage vio9p_modlinkage = {
+	.ml_rev =			MODREV_1,
+	.ml_linkage =			{ &vio9p_modldrv, NULL }
+};
+
+/*
+ * DMA attribute template for header and status blocks.
+ */
+static const ddi_dma_attr_t vio9p_dma_attr = {
+	.dma_attr_version =		DMA_ATTR_V0,
+	.dma_attr_addr_lo =		0x0000000000000000,
+	.dma_attr_addr_hi =		0xFFFFFFFFFFFFFFFF,
+	.dma_attr_count_max =		0x00000000FFFFFFFF,
+	.dma_attr_align =		1,
+	.dma_attr_burstsizes =		1,
+	.dma_attr_minxfer =		1,
+	.dma_attr_maxxfer =		0x00000000FFFFFFFF,
+	.dma_attr_seg =			0x00000000FFFFFFFF,
+	.dma_attr_sgllen =		VIRTIO_9P_MAX_SGL,
+	.dma_attr_granular =		1,
+	.dma_attr_flags =		0
+};
+
+uint_t
+vio9p_int_handler(caddr_t arg0, caddr_t arg1)
+{
+	vio9p_t *vin = (vio9p_t *)arg0;
+
+	mutex_enter(&vin->vin_mutex);
+	uint_t count = vio9p_poll(vin);
+	mutex_exit(&vin->vin_mutex);
+
+	return (count > 0 ? DDI_INTR_CLAIMED : DDI_INTR_UNCLAIMED);
+}
+
+static void
+vio9p_req_freelist_put(vio9p_t *vin, vio9p_req_t *vnr)
+{
+	VERIFY(!list_link_active(&vnr->vnr_link_complete));
+	VERIFY(!list_link_active(&vnr->vnr_link_free));
+
+	vin->vin_generation = 0;
+	list_insert_head(&vin->vin_req_freelist, vnr);
+
+	if (vin->vin_open) {
+		/*
+		 * Wake any callers waiting in vio9p_req_alloc() for an entry:
+		 */
+		cv_broadcast(&vin->vin_cv);
+	}
+}
+
+static void
+vio9p_req_free(vio9p_t *vin, vio9p_req_t *vnr)
+{
+	VERIFY(MUTEX_HELD(&vin->vin_mutex));
+
+	if (list_link_active(&vnr->vnr_link_complete)) {
+		list_remove(&vin->vin_completes, vnr);
+	}
+
+	vio9p_req_freelist_put(vin, vnr);
+}
+
+static void
+vio9p_req_free_impl(vio9p_t *vin, vio9p_req_t *vnr)
+{
+	if (vnr->vnr_chain != NULL) {
+		virtio_chain_free(vnr->vnr_chain);
+		vnr->vnr_chain = NULL;
+	}
+	if (vnr->vnr_dma_in != NULL) {
+		virtio_dma_free(vnr->vnr_dma_in);
+		vnr->vnr_dma_in = NULL;
+	}
+	if (vnr->vnr_dma_out != NULL) {
+		virtio_dma_free(vnr->vnr_dma_out);
+		vnr->vnr_dma_out = NULL;
+	}
+
+	VERIFY(!list_link_active(&vnr->vnr_link_complete));
+	VERIFY(!list_link_active(&vnr->vnr_link_free));
+
+	list_remove(&vin->vin_reqs, vnr);
+	VERIFY3U(vin->vin_nreqs, >, 0);
+	vin->vin_nreqs--;
+
+	kmem_free(vnr, sizeof (*vnr));
+}
+
+/*
+ * Allocate a request for a transaction.  If one is not available and this is
+ * for a blocking request, wait for one to become available.
+ */
+static vio9p_req_t *
+vio9p_req_alloc(vio9p_t *vin, bool wait)
+{
+	vio9p_req_t *vnr;
+
+	VERIFY(MUTEX_HELD(&vin->vin_mutex));
+
+again:
+	/*
+	 * Try the free list first:
+	 */
+	if ((vnr = list_remove_head(&vin->vin_req_freelist)) != NULL) {
+		return (vnr);
+	}
+
+	/*
+	 * Failing that, try to allocate more memory if we are under our
+	 * request cap:
+	 */
+	if ((vnr = vio9p_req_alloc_impl(vin, KM_NOSLEEP_LAZY)) != NULL) {
+		return (vnr);
+	}
+
+	/*
+	 * If this is a blocking request, wait for an entry to become available
+	 * on the free list:
+	 */
+	if (wait) {
+		if (cv_wait_sig(&vin->vin_cv, &vin->vin_mutex) == 0) {
+			return (NULL);
+		}
+
+		goto again;
+	}
+
+	return (NULL);
+}
+
+static vio9p_req_t *
+vio9p_req_alloc_impl(vio9p_t *vin, int kmflag)
+{
+	dev_info_t *dip = vin->vin_dip;
+	vio9p_req_t *vnr;
+
+	if (vin->vin_nreqs >= VIRTIO_9P_MAX_REQS) {
+		/*
+		 * We have reached the limit of requests that we are willing to
+		 * allocate for the whole device.
+		 */
+		return (NULL);
+	}
+
+	/*
+	 * Note that the request object has various list link fields which are
+	 * initialised to zero here and which we check at various points later.
+	 */
+	if ((vnr = kmem_zalloc(sizeof (*vnr), kmflag)) == NULL) {
+		return (NULL);
+	}
+	list_insert_tail(&vin->vin_reqs, vnr);
+	vin->vin_nreqs++;
+
+	if ((vnr->vnr_chain = virtio_chain_alloc(vin->vin_vq, kmflag)) ==
+	    NULL) {
+		dev_err(vin->vin_dip, CE_WARN, "!chain alloc failure");
+		goto fail;
+	}
+	virtio_chain_data_set(vnr->vnr_chain, vnr);
+
+	/*
+	 * Allocate outbound request buffer:
+	 */
+	if ((vnr->vnr_dma_out = virtio_dma_alloc(vin->vin_virtio,
+	    VIRTIO_9P_REQ_SIZE, &vio9p_dma_attr,
+	    DDI_DMA_CONSISTENT | DDI_DMA_WRITE, kmflag)) == NULL) {
+		dev_err(dip, CE_WARN, "!DMA out alloc failure");
+		goto fail;
+	}
+	VERIFY3U(virtio_dma_ncookies(vnr->vnr_dma_out), <=, VIRTIO_9P_MAX_SGL);
+
+	for (uint_t n = 0; n < virtio_dma_ncookies(vnr->vnr_dma_out); n++) {
+		if (virtio_chain_append(vnr->vnr_chain,
+		    virtio_dma_cookie_pa(vnr->vnr_dma_out, n),
+		    virtio_dma_cookie_size(vnr->vnr_dma_out, n),
+		    VIRTIO_DIR_DEVICE_READS) != DDI_SUCCESS) {
+			dev_err(dip, CE_WARN, "!chain append out failure");
+			goto fail;
+		}
+	}
+
+	/*
+	 * Allocate inbound request buffer:
+	 */
+	if ((vnr->vnr_dma_in = virtio_dma_alloc(vin->vin_virtio,
+	    VIRTIO_9P_REQ_SIZE, &vio9p_dma_attr,
+	    DDI_DMA_CONSISTENT | DDI_DMA_READ, kmflag)) == NULL) {
+		dev_err(dip, CE_WARN, "!DMA in alloc failure");
+		goto fail;
+	}
+	VERIFY3U(virtio_dma_ncookies(vnr->vnr_dma_in), <=, VIRTIO_9P_MAX_SGL);
+
+	for (uint_t n = 0; n < virtio_dma_ncookies(vnr->vnr_dma_in); n++) {
+		if (virtio_chain_append(vnr->vnr_chain,
+		    virtio_dma_cookie_pa(vnr->vnr_dma_in, n),
+		    virtio_dma_cookie_size(vnr->vnr_dma_in, n),
+		    VIRTIO_DIR_DEVICE_WRITES) != DDI_SUCCESS) {
+			dev_err(dip, CE_WARN, "!chain append in failure");
+			goto fail;
+		}
+	}
+
+	return (vnr);
+
+fail:
+	vio9p_req_free_impl(vin, vnr);
+	return (NULL);
+}
+
+static uint_t
+vio9p_poll(vio9p_t *vin)
+{
+	virtio_chain_t *vic;
+	uint_t count = 0;
+	bool wakeup = false;
+
+	VERIFY(MUTEX_HELD(&vin->vin_mutex));
+
+	while ((vic = virtio_queue_poll(vin->vin_vq)) != NULL) {
+		vio9p_req_t *vnr = virtio_chain_data(vic);
+
+		count++;
+
+		virtio_dma_sync(vnr->vnr_dma_in, DDI_DMA_SYNC_FORCPU);
+
+		if (!vin->vin_open ||
+		    vnr->vnr_generation != vin->vin_generation) {
+			/*
+			 * Either the device is not open, or the device has
+			 * been closed and opened again since this request was
+			 * submitted.  Just free the memory and drive on.
+			 */
+			vio9p_req_free(vin, vnr);
+			continue;
+		}
+
+		list_insert_tail(&vin->vin_completes, vnr);
+		wakeup = true;
+	}
+
+	if (wakeup) {
+		cv_broadcast(&vin->vin_cv);
+	}
+
+	return (count);
+}
+
+static int
+vio9p_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	int instance = ddi_get_instance(dip);
+	virtio_t *vio;
+	vio9p_req_t *vnr;
+
+	if (cmd != DDI_ATTACH) {
+		return (DDI_FAILURE);
+	}
+
+	if (ddi_soft_state_zalloc(vio9p_state, instance) != DDI_SUCCESS) {
+		return (DDI_FAILURE);
+	}
+
+	if ((vio = virtio_init(dip, VIRTIO_9P_WANTED_FEATURES, B_TRUE)) ==
+	    NULL) {
+		ddi_soft_state_free(vio9p_state, instance);
+		dev_err(dip, CE_WARN, "failed to start Virtio init");
+		return (DDI_FAILURE);
+	}
+
+	vio9p_t *vin = ddi_get_soft_state(vio9p_state, instance);
+	vin->vin_dip = dip;
+	vin->vin_virtio = vio;
+	ddi_set_driver_private(dip, vin);
+	list_create(&vin->vin_reqs, sizeof (vio9p_req_t),
+	    offsetof(vio9p_req_t, vnr_link));
+	list_create(&vin->vin_completes, sizeof (vio9p_req_t),
+	    offsetof(vio9p_req_t, vnr_link_complete));
+	list_create(&vin->vin_req_freelist, sizeof (vio9p_req_t),
+	    offsetof(vio9p_req_t, vnr_link_free));
+
+	if (virtio_feature_present(vio, VIRTIO_9P_F_MOUNT_TAG)) {
+		uint16_t len = virtio_dev_get16(vio, VIRTIO_9P_CONFIG_TAG_SZ);
+		if (len > VIRTIO_9P_TAGLEN) {
+			len = VIRTIO_9P_TAGLEN;
+		}
+
+		/*
+		 * This array is one byte longer than VIRTIO_9P_TAGLEN, and is
+		 * thus always NUL-terminated by the use of
+		 * ddi_soft_state_zalloc() above.
+		 */
+		for (uint16_t n = 0; n < len; n++) {
+			vin->vin_tag[n] = virtio_dev_get8(vio,
+			    VIRTIO_9P_CONFIG_TAG + n);
+		}
+	}
+
+	/*
+	 * When allocating the request queue, we include enough slots for a
+	 * full set of cookies (based on our DMA attributes) in both the in and
+	 * the out direction.
+	 */
+	if ((vin->vin_vq = virtio_queue_alloc(vio, VIRTIO_9P_VIRTQ_REQUESTS,
+	    "requests", vio9p_int_handler, vin, B_FALSE,
+	    2 * VIRTIO_9P_MAX_SGL)) == NULL) {
+		return (vio9p_teardown(vin, VIRTIO_9P_TEARDOWN_PRE_MUTEX));
+	}
+
+	if (virtio_init_complete(vio, VIRTIO_ANY_INTR_TYPE) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "failed to complete Virtio init");
+		return (vio9p_teardown(vin, VIRTIO_9P_TEARDOWN_PRE_MUTEX));
+	}
+
+	cv_init(&vin->vin_cv, NULL, CV_DRIVER, NULL);
+	mutex_init(&vin->vin_mutex, NULL, MUTEX_DRIVER, virtio_intr_pri(vio));
+
+	/*
+	 * Make sure the free list contains at least one request at attach time
+	 * so that the device is always somewhat useable:
+	 */
+	if ((vnr = vio9p_req_alloc_impl(vin, KM_SLEEP)) == NULL) {
+		dev_err(dip, CE_WARN, "failed to allocate first request");
+		return (vio9p_teardown(vin, VIRTIO_9P_TEARDOWN_ATTACH));
+	}
+	vio9p_req_freelist_put(vin, vnr);
+
+	if (virtio_interrupts_enable(vio) != DDI_SUCCESS) {
+		return (vio9p_teardown(vin, VIRTIO_9P_TEARDOWN_ATTACH));
+	}
+
+	/*
+	 * Hang out a minor node so that we can be opened.
+	 */
+	int minor = ddi_get_instance(dip);
+	if (ddi_create_minor_node(dip, "9p", S_IFCHR, minor, DDI_PSEUDO,
+	    0) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not create minor node");
+		return (vio9p_teardown(vin, VIRTIO_9P_TEARDOWN_ATTACH));
+	}
+
+	ddi_report_dev(dip);
+
+	return (DDI_SUCCESS);
+}
+
+static int
+vio9p_teardown(vio9p_t *vin, vio9p_teardown_style_t style)
+{
+	dev_info_t *dip = vin->vin_dip;
+
+	if (style != VIRTIO_9P_TEARDOWN_PRE_MUTEX) {
+		/*
+		 * Make sure we do not hold the mutex across interrupt disable.
+		 */
+		VERIFY(MUTEX_NOT_HELD(&vin->vin_mutex));
+	}
+
+	ddi_remove_minor_node(dip, NULL);
+
+	if (vin->vin_virtio != NULL) {
+		/*
+		 * Disable interrupts so that we can be sure our handler does
+		 * not run again while we free things.
+		 */
+		virtio_interrupts_disable(vin->vin_virtio);
+	}
+
+	/*
+	 * Empty the free list:
+	 */
+	for (;;) {
+		vio9p_req_t *vnr = list_remove_head(&vin->vin_req_freelist);
+		if (vnr == NULL) {
+			break;
+		}
+		vio9p_req_free_impl(vin, vnr);
+	}
+	VERIFY(list_is_empty(&vin->vin_req_freelist));
+	list_destroy(&vin->vin_req_freelist);
+
+	/*
+	 * Any active requests should have been freed in vio9p_detach(), so
+	 * there should be no other requests left at this point.
+	 */
+	VERIFY0(vin->vin_nreqs);
+	VERIFY(list_is_empty(&vin->vin_reqs));
+	list_destroy(&vin->vin_reqs);
+
+	VERIFY(list_is_empty(&vin->vin_completes));
+	list_destroy(&vin->vin_completes);
+
+	/*
+	 * Tear down the Virtio framework.
+	 */
+	if (vin->vin_virtio != NULL) {
+		boolean_t failed = (style != VIRTIO_9P_TEARDOWN_DETACH);
+		virtio_fini(vin->vin_virtio, failed);
+	}
+
+	if (style != VIRTIO_9P_TEARDOWN_PRE_MUTEX) {
+		mutex_destroy(&vin->vin_mutex);
+		cv_destroy(&vin->vin_cv);
+	}
+
+	ddi_set_driver_private(dip, NULL);
+	ddi_soft_state_free(vio9p_state, ddi_get_instance(dip));
+
+	return (style == VIRTIO_9P_TEARDOWN_DETACH ? DDI_SUCCESS : DDI_FAILURE);
+}
+
+static int
+vio9p_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	vio9p_t *vin = ddi_get_driver_private(dip);
+
+	if (cmd != DDI_DETACH) {
+		return (DDI_FAILURE);
+	}
+
+	mutex_enter(&vin->vin_mutex);
+
+	/*
+	 * Detach will only be called once we are no longer held open.
+	 */
+	VERIFY(!vin->vin_open);
+
+	/*
+	 * If a request was submitted to the hypervisor but never completed, it
+	 * may still be active even though the device has been closed.
+	 */
+	bool shutdown = false;
+	for (vio9p_req_t *vnr = list_head(&vin->vin_reqs);
+	    vnr != NULL; vnr = list_next(&vin->vin_reqs, vnr)) {
+		if (!list_link_active(&vnr->vnr_link_free)) {
+			/*
+			 * There is at least one active request.  We need to
+			 * reset the device to claw back the DMA memory.
+			 */
+			shutdown = true;
+			break;
+		}
+	}
+
+	if (shutdown) {
+		virtio_chain_t *vic;
+
+		virtio_shutdown(vin->vin_virtio);
+		while ((vic = virtio_queue_evacuate(vin->vin_vq)) != NULL) {
+			vio9p_req_t *vnr = virtio_chain_data(vic);
+
+			virtio_dma_sync(vnr->vnr_dma_in, DDI_DMA_SYNC_FORCPU);
+
+			vio9p_req_free_impl(vin, vnr);
+		}
+	}
+
+	mutex_exit(&vin->vin_mutex);
+
+	return (vio9p_teardown(vin, VIRTIO_9P_TEARDOWN_DETACH));
+}
+
+static int
+vio9p_quiesce(dev_info_t *dip)
+{
+	vio9p_t *vin;
+
+	if ((vin = ddi_get_driver_private(dip)) == NULL) {
+		return (DDI_FAILURE);
+	}
+
+	return (virtio_quiesce(vin->vin_virtio));
+}
+
+static int
+vio9p_open(dev_t *dev, int flag, int otyp, cred_t *cred)
+{
+	if (otyp != OTYP_CHR) {
+		return (EINVAL);
+	}
+
+	/*
+	 * This device represents a request-response communication channel
+	 * between the host and the hypervisor; as such we insist that it be
+	 * opened exclusively, and for both read and write access.
+	 */
+	if (!(flag & FEXCL) || !(flag & FREAD) || !(flag & FWRITE)) {
+		return (EINVAL);
+	}
+
+	vio9p_t *vin = ddi_get_soft_state(vio9p_state, getminor(*dev));
+	if (vin == NULL) {
+		return (ENXIO);
+	}
+
+	mutex_enter(&vin->vin_mutex);
+	if (vin->vin_open) {
+		mutex_exit(&vin->vin_mutex);
+		return (EBUSY);
+	}
+	vin->vin_open = true;
+
+	vin->vin_generation++;
+	if (vin->vin_generation == 0) {
+		vin->vin_generation++;
+	}
+
+	mutex_exit(&vin->vin_mutex);
+	return (0);
+}
+
+static int
+vio9p_close(dev_t dev, int flag, int otyp, cred_t *cred)
+{
+	if (otyp != OTYP_CHR) {
+		return (EINVAL);
+	}
+
+	vio9p_t *vin = ddi_get_soft_state(vio9p_state, getminor(dev));
+	if (vin == NULL) {
+		return (ENXIO);
+	}
+
+	mutex_enter(&vin->vin_mutex);
+	if (!vin->vin_open) {
+		mutex_exit(&vin->vin_mutex);
+		return (EIO);
+	}
+
+	/*
+	 * Free all completed requests that have not yet been read:
+	 */
+	vio9p_req_t *vnr;
+	while ((vnr = list_remove_head(&vin->vin_completes)) != NULL) {
+		vio9p_req_free(vin, vnr);
+	}
+
+	vin->vin_open = false;
+	mutex_exit(&vin->vin_mutex);
+	return (0);
+}
+
+static int
+vio9p_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *cred,
+    int *rvalp)
+{
+	vio9p_t *vin = ddi_get_soft_state(vio9p_state, getminor(dev));
+	if (vin == NULL) {
+		return (ENXIO);
+	}
+
+	switch (cmd) {
+	case VIO9P_IOC_MOUNT_TAG:
+		if (ddi_copyout(vin->vin_tag, (void *)arg,
+		    sizeof (vin->vin_tag), mode) != 0) {
+			return (EFAULT);
+		}
+		return (0);
+
+	default:
+		return (ENOTTY);
+	}
+}
+
+static int
+vio9p_read(dev_t dev, struct uio *uio, cred_t *cred)
+{
+	bool blocking = (uio->uio_fmode & (FNDELAY | FNONBLOCK)) == 0;
+	vio9p_req_t *vnr;
+	vio9p_t *vin;
+
+	if ((vin = ddi_get_soft_state(vio9p_state, getminor(dev))) == NULL) {
+		return (ENXIO);
+	}
+
+	mutex_enter(&vin->vin_mutex);
+again:
+	if ((vnr = list_remove_head(&vin->vin_completes)) == NULL) {
+		if (!blocking) {
+			mutex_exit(&vin->vin_mutex);
+			return (EAGAIN);
+		}
+
+		/*
+		 * There is nothing to read right now.  Wait for something:
+		 */
+		if (cv_wait_sig(&vin->vin_cv, &vin->vin_mutex) == 0) {
+			mutex_exit(&vin->vin_mutex);
+			return (EINTR);
+		}
+		goto again;
+	}
+
+	/*
+	 * Determine the size of the response message using the initial size[4]
+	 * field of the response.  The various specifying documents that exist
+	 * suggest this is an unsigned integer in little-endian order.
+	 */
+	uint32_t msz;
+	bcopy(virtio_dma_va(vnr->vnr_dma_in, 0), &msz, sizeof (msz));
+	msz = LE_32(msz);
+	if (msz > virtio_dma_size(vnr->vnr_dma_in)) {
+		msz = virtio_dma_size(vnr->vnr_dma_in);
+	}
+
+	if (msz > uio->uio_resid) {
+		/*
+		 * Tell the consumer they are going to need a bigger
+		 * buffer.
+		 */
+		list_insert_head(&vin->vin_completes, vnr);
+		mutex_exit(&vin->vin_mutex);
+		return (EOVERFLOW);
+	}
+
+	mutex_exit(&vin->vin_mutex);
+	int e = uiomove(virtio_dma_va(vnr->vnr_dma_in, 0), msz, UIO_READ, uio);
+	mutex_enter(&vin->vin_mutex);
+
+	if (e == 0) {
+		vio9p_req_free(vin, vnr);
+	} else {
+		/*
+		 * Put the response back in the list for another try, so that
+		 * we do not drop any messages:
+		 */
+		list_insert_head(&vin->vin_completes, vnr);
+	}
+
+	mutex_exit(&vin->vin_mutex);
+	return (e);
+}
+
+static int
+vio9p_write(dev_t dev, struct uio *uio, cred_t *cred)
+{
+	bool blocking = (uio->uio_fmode & (FNDELAY | FNONBLOCK)) == 0;
+
+	size_t wsz = uio->uio_resid;
+	if (wsz < 7) {
+		/*
+		 * Requests should be well-formed 9P messages.  They must
+		 * contain at least 7 bytes: msize[4] + type[1] + tag[2].
+		 */
+		return (EINVAL);
+	} else if (wsz > VIRTIO_9P_REQ_SIZE) {
+		return (EMSGSIZE);
+	}
+
+	vio9p_t *vin = ddi_get_soft_state(vio9p_state, getminor(dev));
+	if (vin == NULL) {
+		return (ENXIO);
+	}
+
+	mutex_enter(&vin->vin_mutex);
+	vio9p_req_t *vnr = vio9p_req_alloc(vin, blocking);
+	if (vnr == NULL) {
+		mutex_exit(&vin->vin_mutex);
+		return (blocking ? ENOMEM : EAGAIN);
+	}
+	vnr->vnr_generation = vin->vin_generation;
+	VERIFY3U(wsz, <=, virtio_dma_size(vnr->vnr_dma_out));
+
+	mutex_exit(&vin->vin_mutex);
+	int e = uiomove(virtio_dma_va(vnr->vnr_dma_out, 0), wsz, UIO_WRITE,
+	    uio);
+	mutex_enter(&vin->vin_mutex);
+
+	if (e == 0) {
+		virtio_dma_sync(vnr->vnr_dma_out, DDI_DMA_SYNC_FORDEV);
+		virtio_chain_submit(vnr->vnr_chain, B_TRUE);
+	} else {
+		vio9p_req_free(vin, vnr);
+	}
+
+	mutex_exit(&vin->vin_mutex);
+	return (e);
+}
+
+int
+_init(void)
+{
+	int r;
+
+	if ((r = ddi_soft_state_init(&vio9p_state, sizeof (vio9p_t), 0)) != 0) {
+		return (r);
+	}
+
+	if ((r = mod_install(&vio9p_modlinkage)) != 0) {
+		ddi_soft_state_fini(&vio9p_state);
+	}
+
+	return (r);
+}
+
+int
+_fini(void)
+{
+	int r;
+
+	if ((r = mod_remove(&vio9p_modlinkage)) != 0) {
+		return (r);
+	}
+
+	ddi_soft_state_fini(&vio9p_state);
+
+	return (r);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&vio9p_modlinkage, modinfop));
+}
diff --git a/usr/src/uts/common/io/vio9p/vio9p_impl.h b/usr/src/uts/common/io/vio9p/vio9p_impl.h
new file mode 100644
index 0000000000..f8718c1ed2
--- /dev/null
+++ b/usr/src/uts/common/io/vio9p/vio9p_impl.h
@@ -0,0 +1,126 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2022 Oxide Computer Company
+ */
+
+/*
+ * VIRTIO 9P DRIVER
+ */
+
+#ifndef _VIO9P_IMPL_H
+#define	_VIO9P_IMPL_H
+
+#include "virtio.h"
+#include <sys/vio9p.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * VIRTIO 9P CONFIGURATION REGISTERS
+ *
+ * These are offsets into the device-specific configuration space available
+ * through the virtio_dev_*() family of functions.
+ */
+#define	VIRTIO_9P_CONFIG_TAG_SZ			0x00	/* 16 R   */
+#define	VIRTIO_9P_CONFIG_TAG			0x02	/* SZ R   */
+
+/*
+ * VIRTIO 9P VIRTQUEUES
+ *
+ * Virtio 9P devices have just one queue which is used to make 9P requests.
+ * Each submitted chain should include appropriately sized inbound and outbound
+ * descriptors for the request and response messages.  The maximum size is
+ * negotiated via the "msize" member of the 9P TVERSION request and RVERSION
+ * response.  Some hypervisors may require the first 7 bytes (size, type, tag)
+ * to be contiguous in the first descriptor.
+ */
+#define	VIRTIO_9P_VIRTQ_REQUESTS	0
+
+/*
+ * VIRTIO 9P FEATURE BITS
+ */
+#define	VIRTIO_9P_F_MOUNT_TAG		(1ULL << 0)
+
+/*
+ * These features are supported by the driver and we will request them from the
+ * device.
+ */
+#define	VIRTIO_9P_WANTED_FEATURES	(VIRTIO_9P_F_MOUNT_TAG)
+
+/*
+ * DRIVER PARAMETERS
+ */
+#define	VIRTIO_9P_MAX_REQS		16
+#define	VIRTIO_9P_REQ_SIZE		8192
+
+/*
+ * It is not clear that there is a well-defined number of cookies for this
+ * interface; QEMU may support as many as there are direct descriptors in the
+ * ring, and bhyve may support something like 128.  We'll use a conservative
+ * number that's large enough to ensure we'll be able to allocate without
+ * requiring contiguous pages.
+ */
+#define	VIRTIO_9P_MAX_SGL		8
+
+/*
+ * TYPE DEFINITIONS
+ */
+
+typedef enum vio9p_teardown_style {
+	VIRTIO_9P_TEARDOWN_PRE_MUTEX,
+	VIRTIO_9P_TEARDOWN_ATTACH,
+	VIRTIO_9P_TEARDOWN_DETACH,
+} vio9p_teardown_style_t;
+
+typedef struct vio9p_req {
+	virtio_dma_t			*vnr_dma_in;
+	virtio_dma_t			*vnr_dma_out;
+	virtio_chain_t			*vnr_chain;
+	list_node_t			vnr_link;
+	list_node_t			vnr_link_complete;
+	list_node_t			vnr_link_free;
+	uint64_t			vnr_generation;
+} vio9p_req_t;
+
+typedef struct vio9p {
+	dev_info_t			*vin_dip;
+	virtio_t			*vin_virtio;
+	virtio_queue_t			*vin_vq;
+
+	kmutex_t			vin_mutex;
+	kcondvar_t			vin_cv;
+
+	/*
+	 * When the device is opened, select a generation number.  This will be
+	 * used to discard completed responses that arrive after the device was
+	 * closed and reopened.
+	 */
+	uint64_t			vin_generation;
+	bool				vin_open;
+
+	uint_t				vin_nreqs;
+	list_t				vin_reqs;
+	list_t				vin_completes;
+
+	list_t				vin_req_freelist;
+
+	char				vin_tag[VIO9P_MOUNT_TAG_SIZE];
+} vio9p_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _VIO9P_IMPL_H */
diff --git a/usr/src/uts/common/io/vioblk/vioblk.c b/usr/src/uts/common/io/vioblk/vioblk.c
index f6649bdd12..1c00d67184 100644
--- a/usr/src/uts/common/io/vioblk/vioblk.c
+++ b/usr/src/uts/common/io/vioblk/vioblk.c
@@ -981,7 +981,7 @@ vioblk_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
 
 	virtio_register_cfgchange_handler(vio, vioblk_cfgchange, vib);
 
-	if (virtio_init_complete(vio, 0) != DDI_SUCCESS) {
+	if (virtio_init_complete(vio, VIRTIO_ANY_INTR_TYPE) != DDI_SUCCESS) {
 		dev_err(dip, CE_WARN, "failed to complete Virtio init");
 		goto fail;
 	}
diff --git a/usr/src/uts/common/io/vioif/vioif.c b/usr/src/uts/common/io/vioif/vioif.c
index ae1e2d4ee2..74f1d46a69 100644
--- a/usr/src/uts/common/io/vioif/vioif.c
+++ b/usr/src/uts/common/io/vioif/vioif.c
@@ -1916,7 +1916,7 @@ vioif_select_interrupt_types(void)
 		 * The system may not have valid SMBIOS data, so ignore a
 		 * failure here.
 		 */
-		return (0);
+		return (VIRTIO_ANY_INTR_TYPE);
 	}
 
 	if (strcmp(info.smbi_manufacturer, "Google") == 0 &&
@@ -1931,7 +1931,7 @@ vioif_select_interrupt_types(void)
 		return (DDI_INTR_TYPE_FIXED);
 	}
 
-	return (0);
+	return (VIRTIO_ANY_INTR_TYPE);
 }
 
 static int
diff --git a/usr/src/uts/common/io/vioscsi/vioscsi.c b/usr/src/uts/common/io/vioscsi/vioscsi.c
index 0c83b33489..6d3d1e374a 100644
--- a/usr/src/uts/common/io/vioscsi/vioscsi.c
+++ b/usr/src/uts/common/io/vioscsi/vioscsi.c
@@ -1263,7 +1263,7 @@ vioscsi_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
 		return (DDI_FAILURE);
 	}
 
-	if (virtio_init_complete(vio, 0) != DDI_SUCCESS) {
+	if (virtio_init_complete(vio, VIRTIO_ANY_INTR_TYPE) != DDI_SUCCESS) {
 		dev_err(dip, CE_WARN, "virtio_init_complete failed");
 		vioscsi_teardown(sc, B_TRUE);
 		return (DDI_FAILURE);
diff --git a/usr/src/uts/common/io/virtio/virtio.h b/usr/src/uts/common/io/virtio/virtio.h
index 48e15b28f2..820bc3b811 100644
--- a/usr/src/uts/common/io/virtio/virtio.h
+++ b/usr/src/uts/common/io/virtio/virtio.h
@@ -350,6 +350,12 @@ uint_t virtio_dma_ncookies(virtio_dma_t *);
 uint64_t virtio_dma_cookie_pa(virtio_dma_t *, uint_t);
 size_t virtio_dma_cookie_size(virtio_dma_t *, uint_t);
 
+/*
+ * virtio_init_complete() accepts a mask of allowed interrupt types using the
+ * DDI_INTR_TYPE_* family of constants.  If no specific interrupt type is
+ * required, pass VIRTIO_ANY_INTR_TYPE instead:
+ */
+#define	VIRTIO_ANY_INTR_TYPE	0
 
 #ifdef __cplusplus
 }
diff --git a/usr/src/uts/common/io/virtio/virtio_dma.c b/usr/src/uts/common/io/virtio/virtio_dma.c
index 81972b5402..b2cbbb2acf 100644
--- a/usr/src/uts/common/io/virtio/virtio_dma.c
+++ b/usr/src/uts/common/io/virtio/virtio_dma.c
@@ -11,6 +11,7 @@
 
 /*
  * Copyright 2019 Joyent, Inc.
+ * Copyright 2022 Oxide Computer Company
  */
 
 /*
@@ -40,7 +41,21 @@
 #include "virtio.h"
 #include "virtio_impl.h"
 
+typedef int (dma_wait_t)(caddr_t);
 
+static dma_wait_t *
+virtio_dma_wait_from_kmflags(int kmflags)
+{
+	switch (kmflags) {
+	case KM_SLEEP:
+		return (DDI_DMA_SLEEP);
+	case KM_NOSLEEP:
+	case KM_NOSLEEP_LAZY:
+		return (DDI_DMA_DONTWAIT);
+	default:
+		panic("unexpected kmflags value 0x%x", kmflags);
+	}
+}
 
 void
 virtio_dma_sync(virtio_dma_t *vidma, int flag)
@@ -90,10 +105,7 @@ virtio_dma_init_handle(virtio_t *vio, virtio_dma_t *vidma,
 {
 	int r;
 	dev_info_t *dip = vio->vio_dip;
-
-	VERIFY(kmflags == KM_SLEEP || kmflags == KM_NOSLEEP);
-	int (*dma_wait)(caddr_t) = (kmflags == KM_SLEEP) ? DDI_DMA_SLEEP :
-	    DDI_DMA_DONTWAIT;
+	int (*dma_wait)(caddr_t) = virtio_dma_wait_from_kmflags(kmflags);
 
 	vidma->vidma_virtio = vio;
 
@@ -124,10 +136,7 @@ virtio_dma_init(virtio_t *vio, virtio_dma_t *vidma, size_t sz,
 	int r;
 	dev_info_t *dip = vio->vio_dip;
 	caddr_t va = NULL;
-
-	VERIFY(kmflags == KM_SLEEP || kmflags == KM_NOSLEEP);
-	int (*dma_wait)(caddr_t) = (kmflags == KM_SLEEP) ? DDI_DMA_SLEEP :
-	    DDI_DMA_DONTWAIT;
+	int (*dma_wait)(caddr_t) = virtio_dma_wait_from_kmflags(kmflags);
 
 	if (virtio_dma_init_handle(vio, vidma, attr, kmflags) !=
 	    DDI_SUCCESS) {
@@ -168,10 +177,7 @@ virtio_dma_bind(virtio_dma_t *vidma, void *va, size_t sz, int dmaflags,
 	int r;
 	dev_info_t *dip = vidma->vidma_virtio->vio_dip;
 	ddi_dma_cookie_t dmac;
-
-	VERIFY(kmflags == KM_SLEEP || kmflags == KM_NOSLEEP);
-	int (*dma_wait)(caddr_t) = (kmflags == KM_SLEEP) ? DDI_DMA_SLEEP :
-	    DDI_DMA_DONTWAIT;
+	int (*dma_wait)(caddr_t) = virtio_dma_wait_from_kmflags(kmflags);
 
 	VERIFY(vidma->vidma_level & VIRTIO_DMALEVEL_HANDLE_ALLOC);
 	VERIFY(!(vidma->vidma_level & VIRTIO_DMALEVEL_HANDLE_BOUND));
diff --git a/usr/src/uts/common/io/virtio/virtio_main.c b/usr/src/uts/common/io/virtio/virtio_main.c
index 28dce6dc92..ec8bcd9f22 100644
--- a/usr/src/uts/common/io/virtio/virtio_main.c
+++ b/usr/src/uts/common/io/virtio/virtio_main.c
@@ -1440,7 +1440,7 @@ virtio_interrupts_setup(virtio_t *vio, int allow_types)
 		return (DDI_FAILURE);
 	}
 
-	if (allow_types != 0) {
+	if (allow_types != VIRTIO_ANY_INTR_TYPE) {
 		/*
 		 * Restrict the possible interrupt types at the request of the
 		 * driver.
diff --git a/usr/src/uts/common/sys/Makefile b/usr/src/uts/common/sys/Makefile
index 2dddfad820..d506f26802 100644
--- a/usr/src/uts/common/sys/Makefile
+++ b/usr/src/uts/common/sys/Makefile
@@ -657,6 +657,7 @@ CHKHDRS=			\
 	vfstab.h		\
 	vgareg.h		\
 	videodev2.h		\
+	vio9p.h			\
 	visual_io.h		\
 	vlan.h			\
 	vm.h			\
diff --git a/usr/src/uts/common/sys/vio9p.h b/usr/src/uts/common/sys/vio9p.h
new file mode 100644
index 0000000000..359862e797
--- /dev/null
+++ b/usr/src/uts/common/sys/vio9p.h
@@ -0,0 +1,49 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2022 Oxide Computer Company
+ */
+
+#ifndef _SYS_VIO9P_H
+#define	_SYS_VIO9P_H
+
+/*
+ * VIRTIO 9P DRIVER
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * If the hypervisor supports mount tags through the VIRTIO_9P_F_MOUNT_TAG
+ * feature, they will have at most this many bytes:
+ */
+#define	VIRTIO_9P_TAGLEN		32
+
+/*
+ * ioctl(2) support for 9P channel devices:
+ */
+#define	VIO9P_IOC_BASE			(('9' << 16) | ('P' << 8))
+#define	VIO9P_IOC_MOUNT_TAG		(VIO9P_IOC_BASE | 0x01)
+
+/*
+ * Buffer size for the VIO9P_IOC_MOUNT_TAG ioctl, which includes one byte
+ * beyond the maximum tag length for NUL termination:
+ */
+#define	VIO9P_MOUNT_TAG_SIZE		(VIRTIO_9P_TAGLEN + 1)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SYS_VIO9P_H */
diff --git a/usr/src/uts/intel/Makefile.intel b/usr/src/uts/intel/Makefile.intel
index 3c0bce4e3e..fe06a58334 100644
--- a/usr/src/uts/intel/Makefile.intel
+++ b/usr/src/uts/intel/Makefile.intel
@@ -411,6 +411,9 @@ DRV_KMODS	+= vioblk
 DRV_KMODS	+= vioif
 DRV_KMODS	+= vioscsi
 
+# Virtio 9P transport driver
+DRV_KMODS	+= vio9p
+
 #
 #	DTrace and DTrace Providers
 #
diff --git a/usr/src/uts/intel/vio9p/Makefile b/usr/src/uts/intel/vio9p/Makefile
new file mode 100644
index 0000000000..0774962e52
--- /dev/null
+++ b/usr/src/uts/intel/vio9p/Makefile
@@ -0,0 +1,67 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2022 Oxide Computer Company
+#
+
+#
+# Path to the base of the uts directory tree (usually /usr/src/uts).
+#
+UTSBASE =		../..
+
+#
+# Define the module and object file sets.
+#
+MODULE =		vio9p
+OBJECTS =		$(VIO9P_OBJS:%=$(OBJS_DIR)/%)
+ROOTMODULE =		$(ROOT_DRV_DIR)/$(MODULE)
+
+#
+# Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+# Define targets
+#
+ALL_TARGET =		$(BINARY)
+INSTALL_TARGET =	$(BINARY) $(ROOTMODULE)
+
+#
+# Overrides
+#
+INC_PATH +=		-I$(UTSBASE)/common/io/virtio
+
+#
+# Driver depends on virtio
+#
+LDFLAGS +=		-N misc/virtio
+
+#
+# Default build targets.
+#
+.KEEP_STATE:
+
+def: $(DEF_DEPS)
+
+all: $(ALL_DEPS)
+
+clean: $(CLEAN_DEPS)
+
+clobber: $(CLOBBER_DEPS)
+
+install: $(INSTALL_DEPS)
+
+#
+# Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ